(1)The protections set out in subsection (2) apply in relation to a disclosure made by a person (“A”) to another person (“B”) if—
(a)A is carrying on business in circumstances where subsection (3) applies,
(b)B is also carrying on business in circumstances where that subsection applies,
(c)the information relates to a person who is a customer or former customer of A (“the customer”),
(d)either the request condition or the warning condition is met,
(e)A is satisfied that the disclosure of the information will or may assist B in carrying out relevant actions of B, and
(f)the disclosure is not a privileged disclosure.
(2)The protections are that, subject to subsection (11), the disclosure does not—
(a)give rise to a breach of any obligation of confidence owed by A, or
(b)give rise to any civil liability, on the part of A, to the person to whom the disclosed information relates.
(3)This subsection applies—
(a)where the business carried on is business in the regulated sector, and
(b)in circumstances prescribed, in relation to the business or the person carrying it on, by regulations made by the Secretary of State for the purposes of this paragraph.
(4)The request condition is that—
(a)the disclosure is made in response to a request made by B, and
(b)at the time the request is made, B has reason to believe that A holds information relating to the customer the disclosure of which will or may assist B in carrying out relevant actions of B.
(5)The warning condition is that A, due to concerns about risks of economic crime, has decided to take safeguarding action (or would have decided to take such action but for the customer having ceased to be a customer of A).
(6)For the purposes of subsection (5), “safeguarding action” means—
(a)terminating a business relationship with the customer,
(b)refusing the customer a product or service, or
(c)restricting the customer’s access to elements of a product or service available to other customers of A.
(7)Where a disclosure is made to which subsection (1) applies, B’s use of the disclosed information, for the purposes of any of B’s relevant actions, does not breach any obligation of confidence owed by B.
(8)The protections set out in subsection (9) apply in relation to a disclosure made by a person (“R”) who is carrying on business in circumstances where subsection (3) applies to another person for the purpose of making a disclosure request if R has reason to believe that other person—
(a)is carrying on business in circumstances where subsection (3) applies, and
(b)has in their possession information about a customer or former customer of theirs that will or may assist R to carry out any of R’s relevant actions.
(9)The protections are that, subject to subsection (11), the disclosure does not—
(a)give rise to a breach of any obligation of confidence owed by R, or
(b)give rise to any civil liability, on the part of R, to the person to whom the disclosed information relates.
(10)Where a disclosure is made to which subsection (8) applies, the use by that other person of the disclosed information, for the purposes of enabling a disclosure to be made by them to which subsection (1) applies, does not—
(a)give rise to a breach of any obligation of confidence owed by them, or
(b)give rise to any civil liability, on the part of R, to the person to whom the disclosed information relates.
This is subject to subsection (11).
(11)Nothing in this section requires or authorises a disclosure of information that would contravene, or prevents any civil liability arising under, the data protection legislation.
(1)The protections set out in subsection (2) apply in relation to a disclosure made by a person (“A”) to another person (“B”) if—
(a)A is carrying on business in circumstances where subsection (3) applies,
(b)the information relates to a person who is a customer or former customer of A (“the customer”),
(c)due to concerns about the risk of economic crime, A has decided to—
(i)terminate a business relationship with the customer,
(ii)refuse the customer a product or service, or
(iii)restrict the customer’s access to elements of a product or service which are available to other customers,
(d)A is satisfied that the information disclosed to B, if it is disclosed by B to one or more persons carrying on business in circumstances where subsection (3) applies, will or may assist those persons in carrying out their relevant actions,
(e)to the extent that the information is personal data, the UK GDPR applies to the disclosure of the information by A,
(f)A and B are parties to an agreement the terms of which provide that, to the extent that the information is personal data, B will only disclose or otherwise process it in circumstances where the UK GDPR applies to the disclosure or other processing, and
(g)the disclosure is not a privileged disclosure.
(2)The protections are that, subject to subsection (10), the disclosure does not—
(a)give rise to a breach of any obligation of confidence owed by A, or
(b)give rise to any civil liability, on the part of A, to the person to whom the disclosed information relates.
(3)This subsection applies—
(a)where the business carried on is business in the regulated sector as—
(i)a deposit-taking body,
(ii)an electronic money institution,
(iii)a payment institution,
(iv)a cryptoasset exchange provider, or
(v)a custodian wallet provider,
(b)where—
(i)the business carried on is business in the regulated sector within paragraph 1(1)(j) to (n) of Schedule 9 to the Proceeds of Crime Act 2002 (audit, insolvency, accountancy, tax or legal services), and
(ii)the UK revenue of the person carrying on the business is large or very large for the relevant financial year (see subsection (11)), and
(c)in circumstances prescribed, in relation to the business or the person carrying it on, by regulations made by the Secretary of State for the purposes of this paragraph.
(4)Where subsection (1) applies to a disclosure of information made by A to B, the protections set out in subsection (5) apply in relation to a further disclosure of that information made by B to another person (“C”) if—
(a)C is carrying on business in circumstances where subsection (3) applies, and
(b)to the extent that the information is personal data, the UK GDPR applies to all processing of the information by B, up to and including the disclosure of the information to C.
(5)The protections are that, subject to subsection (10), the disclosure does not—
(a)give rise to a breach of any obligation of confidence owed by B, or
(b)give rise to any civil liability, on the part of B, to the person to whom the disclosed information relates.
(6)Where a disclosure is made to which subsection (4) applies, C’s use of the disclosed information, for the purposes of any of C’s relevant actions, does not breach any obligation of confidence owed by C.
(7)The protections set out in subsection (8) apply in relation to a disclosure made by a person (“R”), who is carrying on business in circumstances where subsection (3) applies, to another person, for the purposes of making a request for a disclosure of information to be made to R by that other person if, at the time the request is made, R has reason to believe that the disclosure of information to which the request relates would be one to which subsection (4) applies.
(8)The protections are that, subject to subsection (10), the disclosure does not—
(a)give rise to a breach of any obligation of confidence owed by R, or
(b)give rise to any civil liability, on the part of R, to the person to whom the disclosed information relates.
(9)Where a disclosure is made to which subsection (7) applies, the use by that other person, of the disclosed information, for the purposes of enabling a disclosure to be made by them to which subsection (4) applies, does not—
(a)give rise to a breach of any obligation of confidence owed by them, or
(b)give rise to any civil liability, on their part, to the person to whom the disclosed information relates.
This is subject to subsection (10).
(10)Nothing in this section authorises a disclosure of information that would contravene, or prevents any civil liability arising under, the data protection legislation.
(11)In subsection (3)(b) “relevant financial year”—
(a)for the purposes of subsection (1)(a), means the financial year immediately preceding that in which the disclosure by A is made;
(b)for the purposes of subsection (4)(a), means the financial year immediately preceding that in which the disclosure to C is made.
And, for the purposes of subsection (3)(b), the question of whether a person’s UK revenue is large or very large for a particular financial year is to be determined in accordance with sections 55 to 57 of the Finance Act 2022 (calculation of UK revenue for the economic crime (anti-money laundering) levy).
(1)For the purposes of sections 188 and 189, “privileged disclosure” means a disclosure of information made by a professional legal adviser or relevant professional adviser in circumstances where the information disclosed came to the adviser in privileged circumstances.
(2)Information comes to a professional legal adviser or relevant professional adviser in privileged circumstances if it is communicated or given to the adviser—
(a)by (or by a representative of) a client of the adviser in connection with the giving by that person of legal advice to the client,
(b)by (or by a representative of) a person seeking legal advice from the adviser, or
(c)by a person in connection with legal proceedings or contemplated legal proceedings.
(3)For the purposes of this section a “relevant professional adviser” means an accountant, auditor or tax adviser who is a member of a professional body which is established for accountants, auditors or tax advisers (as the case may be) and which makes provision for—
(a)testing the competence of those seeking admission to membership of such a body as a condition for such admission, and
(b)imposing and maintaining professional and ethical standards for its members, as well as imposing sanctions for non-compliance with those standards.
In sections 188 and 189, “relevant actions”, of a person, means the actions of—
(a)determining, for the purposes of preventing, detecting or investigating economic crime—
(i)whether it is appropriate to apply any customer due diligence measures, or any similar measures, in respect of a customer or proposed customer of the person;
(ii)the nature or extent of the measures;
(b)carrying out, for such purposes—
(i)effective measures for identifying or verifying the identity of, or
(ii)any other customer due diligence measures in respect of,
a customer or proposed customer of the person;
(c)determining, for such purposes, whether it is appropriate to—
(i)terminate an existing business relationship with a customer or proposed customer of the person;
(ii)decline to establish a new business relationship with such a customer;
(iii)decline to provide a product or service to such a customer;
(iv)restrict the access of such a customer to an existing product or service which is normally available to other customers;
(v)decline to carry out a transaction for such a customer.
(1)In sections 188 to 191, “business relationship” means a business, professional or commercial relationship between a person carrying on relevant business and a customer or client which—
(a)arises out of the business of the person, and
(b)has, or is expected by the person (at the time when contact is established) to have, an element of duration.
(2)In subsection (1) “relevant business” means—
(a)in the case of section 188 (and section 191 as it applies for the purposes of that section), business within section 188(3);
(b)in the case of section 189 (and section 191 as it applies for the purposes of that section), business within section 189(3).
(1)In sections 188 to 191—
“cryptoasset exchange provider” has the meaning given by paragraph 1(12)(a) of Schedule 9 to the Proceeds of Crime Act 2002;
“custodial wallet provider” has the meaning given by paragraph 1(12)(b) of Schedule 9 to the Proceeds of Crime Act 2002;
“customer due diligence measures” has the meaning given by regulation 3(1) of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (S.I. 2017/692);
“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
“deposit-taking body” means—
a business which engages in the activity of accepting deposits, or
the National Savings Bank;
“economic crime” means an act which—
constitutes an offence listed in Schedule 11 (“a listed offence”),
constitutes an attempt or conspiracy to commit a listed offence,
constitutes an offence—
under Part 2 of the Serious Crime Act 2007 (England and Wales and Northern Ireland: encouraging or assisting crime) in relation to a listed offence, or
under the law of Scotland of inciting the commission of a listed offence,
would constitute a listed offence or an offence specified in paragraph (b), (c) or (d) if done in the United Kingdom;
“electronic money institution” has the same meaning as in the Electronic Money Regulations 2011 (S.I. 2011/99) (see regulation 2 of those Regulations);
“enactment” includes—
an enactment contained in subordinate legislation (as defined in section 21 of the Interpretation Act 1978);
an enactment contained in, or in an instrument made under, a Measure or Act of Senedd Cymru;
an enactment contained in, or in an instrument made under, an Act of the Scottish Parliament;
an enactment contained in, or in an instrument made under, Northern Ireland legislation;
any retained direct EU legislation;
“financial year” means a period of 12 months ending with 31 March;
“payment institution” means an authorised payment institution or small payment institution (each as defined in regulation 2 of the Payment Services Regulations 2017 (S.I. 2017/752));
“personal data” and “processing” have the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
“regulated sector”: see subsection (2);
“the UK GDPR” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).
(2)Part 1 of Schedule 9 to the Proceeds of Crime Act 2002 has effect for the purpose of determining what is a business in the regulated sector.
(3)The Secretary of State may, by regulations, add an offence to or remove an offence from the list in Schedule 11.