Guernsey’s new AML regime explained
Guernsey’s new AML/CFT Regime will come into force on 31 March 2019; and while the transitional provisions appear generous, “don’t delay, act now”, is the message from Advocate Andrew Laws, Managing Partner of Babbé LLP.
The Criminal Justice (Proceeds of Crime) (Bailiwick of Guernsey) (Amendment) Ordinance, 2018 was approved by the States of Guernsey in December 2018 and Guernsey’s new AML/CFT regime, comprising a new Schedule three to the Proceeds of Crime Law and a revised Handbook on Countering Financial Crime and Terrorist Financing will come into force on 31 March 2019. The final version of the revised Handbook was issued by the Guernsey Financial Services Commission on 12 March 2019 and is a key document for all “Specified Businesses” meaning both financial services businesses (such as banks, investment firms, fiduciaries and insurers) and lawyers, accountants and estate agents.
Still awaited is Guernsey’s National Risk Assessment which will set out a summary of the threats, vulnerabilities and consequences of money laundering, terrorist financing and other forms of financial crime, including the proliferation of weapons of mass destruction, to Guernsey as a jurisdiction. The latest indication on timing is that this will be issued by the Guernsey authorities in late June/early July 2019. The delay in the release of the National Risk Assessment has impacted the transitional provisions for compliance with the new AML/CFT regime but there is plenty that firms can, and should, be focusing on in the interim.
Firms will need to look to the National Risk Assessment for guidance when revising their own Business Risk Assessments. Notably, firms will now be required to prepare separate assessments in respect of money laundering and terrorist financing. While the assessments can be included in the same document, they should be clearly distinct from one another.
The timescale for concluding the revisions to firms’ business risk assessments is four months from the date of publication of the National Risk Assessment so anticipated timing is likely to be the end of October 2019. However, it should be emphasised that this is the date by which the Business Risk Assessments must be fully completed AND reviewed and approved by the firm’s Board or Partners, so it is important not to let this exercise “drift” over the summer months especially if there are specific set dates for Board or Partners’ meetings that have to be taken into consideration.
The new Handbook also requires Directors and Partners to “take ownership” of their firm’s Business Risk Assessments it is important that ALL Directors or Partners are fully engaged in this process; it is not an exercise that is the sole responsibility of “Compliance”, or the Money Laundering Reporting Officer, for example.
Firms will also need to determine and document their Risk Appetite and this should be clearly communicated to staff. It is imperative that employees understand the implications of their firm’s Risk Appetite in respect of their day-to-day activities, particularly those employees involved in customer-facing or business development roles; employees should be able to articulate what risks the firm is prepared to accept to achieve its business objectives and, perhaps more importantly, what risks it is NOT willing to accept.
The new Handbook also creates the position of “the MLCO” — the Money Laundering Compliance Officer. While most financial services businesses are highly likely to have an appointed “Compliance Officer” already, there has been no requirement until now for lawyers, accountants and estate agents to have a named Compliance Officer and this will pose a challenge for smaller firms.
It should be noted that the role of the MLCO is a crucial one. According to the new Handbook released in November 2018, the MLCO will “have responsibility” for a firm’s compliance with its policies, procedures and controls to forestall, prevent and detect money laundering and terrorist financing. The MLCO must also be a “natural person” so a corporate MLCO cannot be appointed. They must be of at least management level, have the appropriate knowledge, skill and experience and be fully aware of their own obligations and those of the firm.
While the Guernsey Financial Services Commission has emphasised that it is the Board or the Partners who remain ultimately responsible for the firm’s compliance with the Handbook and indicated that they see the MLCO as a “monitoring role”, there is no doubt that the MLCO will be subject to scrutiny by the regulator if there are failings in firms’ AML/CFT policies, procedures and controls.
The same individual can be appointed to the positions of MLCO and the Money Laundering Reporting Officer provided that the firm has considered that this is appropriate. The MLCO can also hold other roles within a firm but any potential conflicts must be identified, documented and managed. The MLCO role can be outsourced subject to appropriate policies and procedures being in place and firms that are members of a wider group may be able to leverage expertise outside of Guernsey as the MLCO does not have to be resident in Guernsey but “in the British Islands” — meaning Guernsey, Jersey, the UK and the Isle of Man.
As this is a new position, firms are required to appoint their MLCO by 31 March 2019 and to notify the Guernsey Financial Services Commission of the appointment by 14 April 2019.
It is crucial that, if they have not done so already, firms identify and appoint the right person to the MLCO role. Firms need to think carefully about the level of support and training provided to the MLCO and must also ensure that The MLCO has meaningful access to the Board or the Partners to enable them to fulfil their role effectively.
Another major change is in respect of the identification and verification of identity of “beneficial owners” of companies. Whilst firms in Guernsey will be familiar with the revised requirements in respect of Guernsey companies, the new Handbook extends those requirements to apply to companies incorporated in jurisdictions other than Guernsey.
The new requirements involve a three stage process: in step one, firms must identify and verify the natural person(s) who control a company “through ownership” — meaning the holding, directly or indirectly, of more than 25% of the shares in that company, or more than 25% of the voting rights, or holding the right to appoint or remove directors holding a majority of the voting rights on all or substantially all matters at meetings of the board. Where no such person(s) can be identified, firms should move to step two: this requires firms to identify and verify any natural person(s) who exercise control over the company “by other means” — this could include, for example, the situation where the natural person with the controlling interest is dominated by another individual because of a familial, employment, historical or contractual association and, in practice, the natural person with the controlling interest will be influenced in their decision-making by that individual. If no natural person(s) can be identified under either step one or step two, the firm should move to step three which requires them to identify and verify any person who is a “senior managing official” of the company.
However, in situations where a natural person has been identified under step one but where there is reason to believe that another natural person is also ultimately exercising control over the company by other means, (step two) then firms must identify and verify the natural person(s) under both step one and step two.
While the deadline for the revision of firms’ policies and procedures to ensure they comply with Schedule three and the new Handbook is not until seven months from the publication of the National Risk Assessment (so likely to be January 2020), the changes to the beneficial ownerships provisions are not directly impacted by this timing. Firms should therefore start to amend their policies, procedures and checklists now to reflect the revised requirements. They should also ensure that staff receive training in the new requirements as a failure to identify and verify the correct beneficial owners of the company, constitutes a breach of Schedule three and the new Handbook.
The new Handbook continues to embrace the risk-based approach so that firms can focus their efforts where those are most needed. While the [current] [previous] Handbook refers [referred] to three levels of CDD — Simplified CDD for Low Risk Customers, CDD for Normal or Standard Risk Customers and Enhanced CDD for High Risk Customers — the new Handbook introduces the fresh concept of “Enhanced Measures”:
Enhanced Measures apply to certain designated categories of customer irrespective of their risk rating so it is possible to have a customer assessed as Low Risk for the purposes of money laundering and terrorist financing but who qualifies for Enhanced Measures. The categories of customer to which Enhanced Measures apply effectively mean that, for many firms in Guernsey, the majority of their client-base will meet the criteria for Enhanced Measures.
Those categories are: a customer who is not resident in Guernsey, the provision of private banking services, a customer which is a legal person or legal arrangement used for personal asset holding purposes and a customer which is a legal person with nominee shareholders or owned by a legal person with nominee shareholders.
For each of the four categories, the new Handbook provides guidance as to what Enhanced Measures could include and it is likely that firms will have already carried out some of the due diligence measures that amount to the relevant Enhanced Measure — for example, ensuring that they have established, understand and have documented the customer’s source of funds and source of wealth. However, what will be required is for firms to review their client base and, where necessary, re-document and “re-badge” the CDD they already hold as an Enhanced Measure. Firms must also ensure that the Enhanced Measures they have adopted are relevant to the identified risks posed by the customer.
Again, these changes are not impacted by the date of the release of Guernsey’s National Risk Assessment so firms should start to take action now, particularly in situations where Enhanced Measures will apply to all, or a majority of, their client base. All existing High Risk customers must be reviewed and brought into compliance with the new Handbook by 31 December 2020; for Standard Risk and Low Risk customers the deadline is 31 December 2021.
Firms will also need to consider the interplay between Enhanced Measures and Enhanced CDD for High Risk customers where there have also been major changes. The new Handbook establishes three situations where a business relationship must compulsorily be assessed as High Risk: business relationships involving Foreign Politically Exposed Persons, business relationships where the customer has a relevant connection with a country or territory which has been identified by “credible sources” as providing funding or support for terrorist activities and business relationships where the customer, beneficial owner, or any other legal person in the ownership and control structure of the customer, is a legal person that has bearer shares or bearer warrants.
The new Handbook does not include a definitive list of what might be considered “credible sources” for the purposes of determining whether a country or territory provides funding or support for terrorist activities; firms should therefore undertake their own investigations to establish a documented record of relevant countries and territories.
The new Handbook also introduces three different “strains” of PEP: Foreign PEPs, Domestic PEPs — these are individuals who hold a relevant public function within the Bailiwick of Guernsey (meaning Guernsey, Alderney and Sark) – and International Organisation PEP. “IOPEPs” are individuals who hold senior positions — director, board member, councillor or equivalent — in organisations such as the World Bank, the UN and NATO.
Not all Guernsey, Alderney and Sark politicians are considered to be Domestic PEPs. Firms will need to look at Appendix E of the new Handbook which sets out a list of the roles and positions which give the holder Domestic PEP status.
Only Foreign PEPs will need to be classified mandatorily as High Risk. Enhanced CDD will need to be undertaken in relation to them and, if the Foreign PEP is the firm’s customer, they will also qualify for Enhanced Measures as they are not resident in Guernsey. For Domestic PEPs and IOPEPs, firms must consider their role and PEP status as factors when undertaking the relevant relationship risk assessment but they need not be classified as High Risk. Where a Domestic PEP is the firm’s customer, they will not qualify for Enhanced Measures (because they are resident in Guernsey); IOPEPs are however likely to qualify for Enhanced Measures.
The new Handbook also allows for the de-classification of PEPs albeit with some exceptions. Foreign PEPs and IOPEPs can be “de-PEP’d” after seven years from ceasing to hold relevant office (although this does not apply to Heads of State or IOPEPs in certain very senior roles). Domestic PEPs can be “de-PEP’d” after five years from ceasing to hold relevant office.
These changes are to be welcomed although they will mean additional work for firms in the short term: for example, firms will need to review their policies, procedures and controls to reflect the new requirements and the new categorisations of PEPs. PEP Registers will also need to be reviewed and restructured to capture the different types of PEP and firms will need to consider whether any of their existing PEP clients can be de-classified and, if so, when.
While this seems to involve a lot of hard work, it will be important to get it right: a breach of Schedule three of the Proceeds of Crime Law is a criminal offence for which the penalty is an unlimited fine and up to five years in prison. Breach of the Rules in the new Handbook can result in regulatory action including the imposition of conditions on a firm’s licence to do business, the revocation of a firm’s licence, public statements and financial penalties. Failings can also lead to action being taken against key individuals of a firm such as Directors, Partners, Senior Managers, the MLRO and the MLCO. In addition to being fined and referenced in a public statement, individuals can be prohibited by the Guernsey Financial Services Commission from working in regulated firms within the sector.
The hard work starts now!