6. The credit institution or financial institution, referred to in this Part as the “relevant institution,” maintains appropriate procedures to ensure that—
(a)an independent person can investigate and audit the measures maintained by the relevant institution for the purpose of ensuring the security of any information disclosed to that institution; and
(b)it complies with its obligations under the Data Protection Act 1998, or, where the relevant institution carries on business in an EEA State other than the United Kingdom, with its obligations under legislation implementing Directive 95/46/EC(1) of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data.
7. The relevant institution has delivered to the registrar a statement confirming that it is a credit institution or a financial institution, as the case may be, and that it meets the conditions in paragraph 6.
8. The relevant institution has delivered to the registrar a statement that it intends to use information only for the purpose of applying customer due diligence measures to the eligible Scottish partnership to which the secured information relates, in compliance with the institution’s obligations under Part 3 (customer due diligence) of the 2017 Money Laundering Regulations.
9. The relevant institution has delivered to the registrar a statement that confirms the name and registered number of the eligible Scottish partnership in respect of which it is required to apply customer due diligence measures under the 2017 Money Laundering Regulations.
10. The relevant institution has delivered to the registrar a statement that it intends to take delivery of and to use the information only in the United Kingdom or another EEA State.
11. The relevant institution has delivered to the registrar a statement that it will, where it supplies a copy of the information to a processor for the purpose of processing the information for use in respect of the purpose referred to in paragraph 8—
(a)ensure that the processor is one who carries on business in the European Economic Area;
(b)require that the processor does not transmit the information outside the European Economic Area; and
(c)require that the processor does not disclose the information except to that institution.
12. The relevant institution has delivered any information or evidence required by the registrar for the purpose of enabling the registrar to determine in accordance with these Regulations whether to disclose the information.
13. The relevant institution has complied with any requirement by the registrar to confirm the accuracy of the statements, information or evidence delivered to the registrar pursuant to this Part of this Schedule.
OJ L 281, 23.11.1995, p.31.