The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017

CHAPTER 2 U.K. Risk assessment and controls

Risk assessment by the Treasury and Home Office U.K.

16.—(1) The Treasury and the Home Office must make arrangements before 26th June 2018 for a risk assessment to be undertaken to identify, assess, understand and mitigate the risks of money laundering and terrorist financing affecting the United Kingdom (“the risk assessment”).

(2) The risk assessment must, among other things—

(a) identify any areas where relevant persons should apply enhanced customer due diligence measures, and where appropriate, specify the measures to be taken;

(b) identify, where appropriate, the sectors or areas of lower and greater risk of money laundering and terrorist financing;

(c) consider whether any rules on money laundering and terrorist financing made by a supervisory authority applying in relation to the sector it supervises are appropriate in the light of the risks of money laundering and terrorist financing applying to that sector;

(d) provide the information and analysis necessary to enable it to be used for the purposes set out in paragraph (3).

(3) The Treasury and the Home Office must ensure that the risk assessment is used to—

(a) consider the appropriate allocation and prioritisation of resources to counter money laundering and terrorist financing;

(b) consider whether the exclusions provided for in regulation 15 are being abused;

(c) consider whether providers of gambling services other than casinos should continue to be excluded from the requirements of these Regulations.

(4) For the purpose of paragraph (3)(c), a “provider of gambling services” means a person who by way of business provides facilities for gambling within the meaning of section 5 of the Gambling Act 2005 (facilities for gambling) M1 .

F1 (5) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(6) The Treasury and the Home Office must prepare a joint report setting out, as appropriate, the findings of the risk assessment as soon as reasonably practicable after the risk assessment is completed.

[F2 (6A) The report must also set out—

(a) the institutional structure and broad procedures of the United Kingdom’s anti-money laundering and counter-terrorist financing regime, including the role of the financial intelligence unit, tax agencies and prosecutors;

(b) the nature of measures taken and resources allocated to counter money laundering and terrorist financing.]

(7) A copy of that report must be laid before Parliament, and sent to—

(a) the PRA;

(b) the supervisory authorities;

F3 (c) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F4 (d) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F5 (e) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(8) If information from the risk assessment would assist the supervisory authorities in carrying out their own money laundering and terrorist financing risk assessment, the Treasury and the Home Office must, where appropriate, make that information available to those supervisory authorities, unless to do so would not be compatible with restrictions on sharing information imposed by or under [F6 —

(a) the Data Protection Act 2018 or any other enactment, or

(b) the [F7 UK GDPR].]

(9) The Treasury and the Home Office must take appropriate steps to ensure that the risk assessment is kept up-to-date.

Textual Amendments

F1 Reg. 16(5) omitted (31.12.2020) by virtue of The Money Laundering and Transfer of Funds (Information) (Amendment) (EU Exit) Regulations 2019 (S.I. 2019/253), regs. 1(2), 5(1)(a) (with savings in S.I. 2019/680, reg. 11); 2020 c. 1, Sch. 5 para. 1(1)

F2 Reg. 16(6A) inserted (10.1.2020) by The Money Laundering and Terrorist Financing (Amendment) Regulations 2019 (S.I. 2019/1511), regs. 1(2), 4(8)

F3 Reg. 16(7)(c) omitted (31.12.2020) by virtue of The Money Laundering and Transfer of Funds (Information) (Amendment) (EU Exit) Regulations 2019 (S.I. 2019/253), regs. 1(2), 5(1)(b) (with savings in S.I. 2019/680, reg. 11); 2020 c. 1, Sch. 5 para. 1(1)

F4 Reg. 16(7)(d) omitted (31.12.2020) by virtue of The Money Laundering and Transfer of Funds (Information) (Amendment) (EU Exit) Regulations 2019 (S.I. 2019/253), regs. 1(2), 5(1)(b) (with savings in S.I. 2019/680, reg. 11); 2020 c. 1, Sch. 5 para. 1(1)

F5 Reg. 16(7)(e) omitted (31.12.2020) by virtue of The Money Laundering and Transfer of Funds (Information) (Amendment) (EU Exit) Regulations 2019 (S.I. 2019/253), regs. 1(2), 5(1)(b) (with savings in S.I. 2019/680, reg. 11); 2020 c. 1, Sch. 5 para. 1(1)

F6 Words in reg. 16(8) substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 412 (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)

F7 Words in reg. 16(8)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 3 para. 108 (with Sch. 3 para. 112); 2020 c. 1, Sch. 5 para. 1(1)

Marginal Citations

M1 2005 c.19.

[F8 Risk assessment by the Treasury U.K.

16A.— (1) The Treasury must make arrangements for a risk assessment to be undertaken to identify, assess, understand and mitigate the risks of proliferation financing affecting the United Kingdom (“the proliferation financing risk assessment”).

(2) The proliferation financing risk assessment must, among other things—

(a) identify, where appropriate, the sectors or areas of lower and greater risk of proliferation financing;

(b) provide the information and analysis necessary to enable it to be used for the purposes set out in paragraph (3).

(3) The Treasury must ensure that the proliferation financing risk assessment is used to—

(a) consider the appropriate allocation and prioritisation of resources to counter proliferation financing;

(b) consider whether the exclusions provided for in regulation 15 (exclusions) are being abused.

(4) The Treasury must prepare a report setting out, as appropriate, the findings of the proliferation financing risk assessment as soon as reasonably practicable after the proliferation financing risk assessment is completed.

(5) A copy of that report must be laid before Parliament and sent to the supervisory authorities.

(6) The Treasury must take appropriate steps to ensure that the proliferation financing risk assessment is kept up-to-date.

(7) The proliferation financing risk assessment may be included in the risk assessment made under regulation 16 (risk assessment by the Treasury and Home Office).

(8) The report referred to in paragraph (4) may be included within the joint report of the Treasury and Home Office referred to in regulation 16(6).

(9) In this regulation, “proliferation financing” means the act of providing funds or financial services for use, in whole or in part, in the manufacture, acquisition, development, export, trans-shipment, brokering, transport, transfer, stockpiling of, or otherwise in connection with the possession or use of, chemical, biological, radiological or nuclear weapons, including the provision of funds or financial services in connection with the means of delivery of such weapons and other CBRN-related goods and technology, in contravention of a relevant financial sanctions obligation.

(10) In this regulation—

“biological weapon” means a biological agent or toxin (within the meaning of section 1(1)(a) of the Biological Weapons Act 1974F9 ) in a form capable of use for hostile purposes or anything to which section 1(1)(b) of that Act applies;

“chemical weapon” has the meaning given by section 1 of the Chemical Weapons Act 1996F10 ;

“CBRN-related goods and technology” means technology (including dual-use technology) and dual-use goods used for non-legitimate purposes in connection with the matters referred to in paragraph (9);

“dual-use goods” means (a) any thing for the time being specified in Annex I of the Dual-Use Regulation, other than any thing which is dual-use technology, and (b) any tangible storage medium on which dual use technology is recorded or from which it can be derived;

“Dual-Use Regulation” means Council Regulation (EC) No 428/2009 of 5 May 2009F11 setting up a Community regime for the control of exports, transfer, brokering and transit of dual-use items;

“dual-use technology” means any thing for the time being specified in Annex I of the Dual-Use Regulation which is described as software or technology;

“nuclear weapon” includes a nuclear explosive device that is not intended for use as a weapon;

“radiological weapon” means a device designed to cause destruction, damage or injury by means of the radiation produced by the decay of radioactive material;

“relevant financial sanctions obligation” means a prohibition or requirement in regulations made under section 1 of the Sanctions and Anti-Money Laundering Act 2018F12 and imposed for one or more of the purposes in section 3(1) or (2) of that Act so far as it relates to compliance with a relevant UN obligation;

“relevant UN obligation” means an obligation that the UK has by virtue of a resolution adopted by the Security Council of the United Nations which relates to the prevention, suppression and disruption of the proliferation of weapons of mass destruction and the financing of such;

“technology” has the meaning given by paragraph 37 of Schedule 1 to the Sanctions and Anti-Money Laundering Act 2018.]

Textual Amendments

F8 Reg. 16A inserted (1.9.2022) by The Money Laundering and Terrorist Financing (Amendment) (No. 2) Regulations 2022 (S.I. 2022/860), regs. 1(5), 6(2)

F9 1974 c. 6; section 1 was amended by section 43 of the Anti-terrorism, Crime and Security Act 2001 (c. 24).

F10 1996 c. 6.

F11 EUR 2009/428. Annexes I and IV were amended by S.I. 2019/771 and 2022/410.

F12 2018 c. 13.

Risk assessment by supervisory authorities U.K.

17.—(1) Each supervisory authority must identify and assess the international and domestic risks of money laundering and terrorist financing to which those relevant persons for which it is the supervisory authority (“its own sector”) are subject.

(2) In carrying out the risk assessment required under paragraph (1), the supervisory authority must take into account—

F13 (a) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F14 (b) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(c) the report prepared by the Treasury and the Home Office under regulation 16(6); and

(d) information made available by the Treasury and the Home Office under regulation 16(8).

(3) A supervisory authority must keep an up-to-date record in writing of all the steps it has taken under paragraph (1).

(4) Each supervisory authority must develop and record in writing risk profiles for each relevant person in its own sector.

(5) A supervisory authority may prepare a single risk profile under paragraph (4) in relation to two or more relevant persons in its sector, if—

(a) the relevant persons share similar characteristics; and

(b) the risks of money laundering and terrorist financing affecting those relevant persons do not differ significantly.

(6) Where a supervisory authority has prepared a single risk profile for two or more relevant persons in its sector (a “cluster”), the supervisory authority must keep under review whether an individual risk profile should be prepared in relation to any relevant person in the cluster because sub-paragraph (a) or (b) (or both sub-paragraphs) of paragraph (5) are no longer satisfied in relation to that person.

(7) In developing the risk profiles referred to in paragraph (4), the supervisory authority must take full account of the risks that relevant persons in its own sector will not take appropriate action to identify, understand and mitigate money laundering and terrorist financing risks.

(8) Each supervisory authority must review the risk profiles developed under paragraph (4) at regular intervals and following any significant event or developments which might affect the risks to which its own sector is subject, such as—

(a) significant external events that change the nature of the money laundering or terrorist financing risks;

(b) emerging money laundering or terrorist financing risks;

(c) any findings resulting from measures taken by other supervisory authorities;

(d) any changes in the way in which its own sector is operated;

(e) significant changes in regulation.

(9) If information from the risk assessment carried out under paragraph (1), or from information provided to the supervisory authority under regulation 16(8), would assist relevant persons in carrying out their own money laundering and terrorist financing risk assessment, the supervisory authority must, where appropriate, make that information available to those persons, unless to do so would not be compatible with restrictions on sharing information imposed by or under [F15 —

(a) the Data Protection Act 2018 or any other enactment, or

(b) the [F16 UK GDPR].]

Textual Amendments

F13 Reg. 17(2)(a) omitted (31.12.2020) by virtue of The Money Laundering and Transfer of Funds (Information) (Amendment) (EU Exit) Regulations 2019 (S.I. 2019/253), regs. 1(2), 5(2) (with savings in S.I. 2019/680, reg. 11); 2020 c. 1, Sch. 5 para. 1(1)

F14 Reg. 17(2)(b) omitted (31.12.2020) by virtue of The Money Laundering and Transfer of Funds (Information) (Amendment) (EU Exit) Regulations 2019 (S.I. 2019/253), regs. 1(2), 5(2) (with savings in S.I. 2019/680, reg. 11); 2020 c. 1, Sch. 5 para. 1(1)

F15 Words in reg. 17(9) substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 413 (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)

F16 Words in reg. 17(9)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 3 para. 109 (with Sch. 3 para. 112); 2020 c. 1, Sch. 5 para. 1(1)

Risk assessment by relevant persons U.K.

18.—(1) A relevant person must take appropriate steps to identify and assess the risks of money laundering and terrorist financing to which its business is subject.

(2) In carrying out the risk assessment required under paragraph (1), a relevant person must take into account—

(a) information made available to them by the supervisory authority under regulations 17(9) and 47, and

(b) risk factors including factors relating to—

(i) its customers;

(ii) the countries or geographic areas in which it operates;

(iii) its products or services;

(iv) its transactions; and

(v) its delivery channels.

(3) In deciding what steps are appropriate under paragraph (1), the relevant person must take into account the size and nature of its business.

(4) A relevant person must keep an up-to-date record in writing of all the steps it has taken under paragraph (1), unless its supervisory authority notifies it in writing that such a record is not required.

(5) A supervisory authority may not give the notification referred to in paragraph (4) unless it considers that the risks of money laundering and terrorist financing applicable to the sector in which the relevant person operates are clear and understood.

(6) A relevant person must provide the risk assessment it has prepared under paragraph (1), the information on which that risk assessment was based and any record required to be kept under paragraph (4), to its supervisory authority on request.

[F17 Risk assessment by relevant persons in relation to proliferation financing U.K.

18A.— (1) A relevant person must take appropriate steps to identify and assess the risks of proliferation financing to which its business is subject.

(2) In carrying out the risk assessment required under paragraph (1), a relevant person must take into account—

(a) information in the report referred to in regulation 16A (risk assessment by the Treasury); and

(b) risk factors including factors relating to—

(i) its customers;

(ii) the countries or geographic areas in which it operates;

(iii) its products or services;

(iv) its transactions; and

(v) its delivery channels.

(3) In deciding what steps are appropriate under paragraph (1), the relevant person must take into account the size and nature of its business.

(4) A relevant person must keep an up-to-date record in writing of all the steps it has taken under paragraph (1), unless its supervisory authority notifies it in writing that such a record is not required.

(5) A relevant person must provide the risk assessment it has prepared under paragraph (1), the information on which that risk assessment was based and any record required to be kept under paragraph (4), to its supervisory authority on request.]

Textual Amendments

F17 Reg. 18A inserted (1.9.2022) by The Money Laundering and Terrorist Financing (Amendment) (No. 2) Regulations 2022 (S.I. 2022/860), regs. 1(5), 6(3)

Policies, controls and procedures U.K.

19.—(1) A relevant person must—

(a) establish and maintain policies, controls and procedures to mitigate and manage effectively the risks of money laundering and terrorist financing identified in any risk assessment undertaken by the relevant person under regulation 18(1);

(b) regularly review and update the policies, controls and procedures established under sub-paragraph (a);

(c) maintain a record in writing of—

(i) the policies, controls and procedures established under sub-paragraph (a);

(ii) any changes to those policies, controls and procedures made as a result of the review and update required by sub-paragraph (b); and

(iii) the steps taken to communicate those policies, controls and procedures, or any changes to them, within the relevant person's business.

(2) The policies, controls and procedures adopted by a relevant person under paragraph (1) must be—

(a) proportionate with regard to the size and nature of the relevant person's business, and

(b) approved by its senior management.

(3) The policies, controls and procedures referred to in paragraph (1) must include—

(a) risk management practices;

(b) internal controls (see regulations 21 to 24);

(c) customer due diligence (see regulations 27 to 38);

(d) reliance and record keeping (see regulations 39 to 40);

(e) the monitoring and management of compliance with, and the internal communication of, such policies, controls and procedures.

(4) The policies, controls and procedures referred to in paragraph (1) must include policies, controls and procedures—

(a) which provide for the identification and scrutiny of—

(i) any case where—

(aa) a transaction is complex [F18 or] unusually large, or there is an unusual pattern of transactions, [F19 or]

(bb) the transaction or transactions have no apparent economic or legal purpose, and

(ii) any other activity or situation which the relevant person regards as particularly likely by its nature to be related to money laundering or terrorist financing;

(b) which specify the taking of additional measures, where appropriate, to prevent the use for money laundering or terrorist financing of products and transactions which might favour anonymity;

(c) which ensure that when [F20 new products, new business practices (including new delivery mechanisms) or new technology are] adopted by the relevant person, appropriate measures are taken in preparation for, and during, the adoption of such [F21 products, practices or] technology to assess and if necessary mitigate any money laundering or terrorist financing risks this new [F22 product, practice or] technology may cause;

(d) under which anyone in the relevant person's organisation who knows or suspects (or has reasonable grounds for knowing or suspecting) that a person is engaged in money laundering or terrorist financing as a result of information received in the course of the business or otherwise through carrying on that business is required to comply with—

(i) Part 3 of the Terrorism Act 2000 M2 ; or

(ii) Part 7 of the Proceeds of Crime Act 2002 M3 ;

(e) which, in the case of a money service business that uses agents for the purpose of its business, ensure that appropriate measures are taken by the business to assess—

(i) whether an agent used by the business would satisfy the fit and proper test provided for in regulation 58; and

(ii) the extent of the risk that the agent may be used for money laundering or terrorist financing.

(5) In determining what is appropriate or proportionate with regard to the size and nature of its business, a relevant person may take into account any guidance which has been—

(a) issued by the FCA; or

(b) issued by any other supervisory authority or appropriate body and approved by the Treasury.

(6) A relevant person must, where relevant, communicate the policies, controls and procedures which it establishes and maintains in accordance with this regulation to its branches and subsidiary undertakings which are located outside the United Kingdom.

Textual Amendments

F18 Word in reg. 19(4)(a)(i)(aa) substituted (10.1.2020) by The Money Laundering and Terrorist Financing (Amendment) Regulations 2019 (S.I. 2019/1511), regs. 1(2), 4(9)(a)

F19 Word in reg. 19(4)(a)(i) substituted (10.1.2020) by The Money Laundering and Terrorist Financing (Amendment) Regulations 2019 (S.I. 2019/1511), regs. 1(2), 4(9)(a)

F20 Words in reg. 19(4)(c) substituted (10.1.2020) by virtue of The Money Laundering and Terrorist Financing (Amendment) Regulations 2019 (S.I. 2019/1511), regs. 1(2), 4(9)(b)(i)

F21 Words in reg. 19(4)(c) inserted (10.1.2020) by The Money Laundering and Terrorist Financing (Amendment) Regulations 2019 (S.I. 2019/1511), regs. 1(2), 4(9)(b)(ii)

F22 Words in reg. 19(4)(c) inserted (10.1.2020) by The Money Laundering and Terrorist Financing (Amendment) Regulations 2019 (S.I. 2019/1511), regs. 1(2), 4(9)(b)(iii)

Marginal Citations

M2 2000 c.11.

M3 2002 c. 29.

[F23 Policies, controls and procedures in relation to proliferation financing U.K.

19A.— (1) A relevant person must—

(a) establish and maintain policies, controls and procedures to mitigate and manage effectively the risks of proliferation financing identified in any risk assessment undertaken by the relevant person under regulation 18A(1);

(b) regularly review and update the policies, controls and procedures established under sub-paragraph (a);

(c) maintain a record in writing of—

(i) the policies, controls and procedures established under sub-paragraph (a);

(ii) any changes to those policies, controls and procedures made as a result of the review and update required by sub-paragraph (b); and

(iii) the steps taken to communicate those policies, controls and procedures, or any changes to them, within the relevant person’s business.

(2) The policies, controls and procedures adopted by a relevant person under paragraph (1) must be—

(a) proportionate with regard to the size and nature of the relevant person’s business; and

(b) approved by its senior management.

(3) The policies, controls and procedures referred to in paragraph (1) must include—

(a) risk management practices;

(b) internal controls (see regulations 21 to 24)F24 ;

(c) the monitoring and management of compliance with, and the internal communication of, such policies, controls and procedures.

(4) The policies, controls and procedures referred to in paragraph (1) must include policies, controls and procedures—

(a) which provide for the identification and scrutiny of—

(i) any case where—

(aa) a transaction is complex or unusually large, or there is an unusual pattern of transactions; or

(bb) the transaction or transactions have no apparent economic or legal purpose, and

(ii) any other activity or situation which the relevant person regards as particularly likely by its nature to be related to proliferation financing;

(b) which specify the taking of additional measures, where appropriate, to prevent the use for proliferation financing of products and transactions which might favour anonymity;

(c) which ensure that when new products, new business practices (including new delivery mechanisms) or new technology are adopted by the relevant person, appropriate measures are taken in preparation for, and during, the adoption of such products, practices or technology to assess and if necessary mitigate any proliferation financing risks this new product, practice or technology may cause;

(d) which, in the case of a money service business that uses agents for the purpose of its business, ensure that appropriate measures are taken by the business to assess—

(i) whether an agent used by the business would satisfy the fit and proper test provided for in regulation 58F25 ; and

(ii) the extent of the risk that the agent may be used for proliferation financing.

(5) A relevant person must, where relevant, communicate the policies, controls and procedures which it establishes and maintains in accordance with this regulation to its branches and subsidiary undertakings which are located outside the United Kingdom.]

Textual Amendments

F23 Reg. 19A inserted (1.9.2022) by The Money Laundering and Terrorist Financing (Amendment) (No. 2) Regulations 2022 (S.I. 2022/860), regs. 1(5), 6(4)

F24 Regulation 22 was revoked by S.I. 2019/253. Regulation 24 was amended by S.I. 2019/1511.

F25 Regulation 58 was amended by S.I. 2019/1511.

Policies, controls and procedures: group level U.K.

20.—(1) A relevant parent undertaking must—

(a) ensure that the policies, controls and procedures referred to in [F26 regulations 19(1) and 19A(1)] apply—

(i) to all its subsidiary undertakings, including subsidiary undertakings located outside the United Kingdom; and

(ii) to any branches it has established outside the United Kingdom;

which is carrying out any activity in respect of which the relevant person is subject to these Regulations;

(b) establish and maintain throughout its group the policies, controls and procedures for data protection and sharing information for the purposes of preventing [F27 money laundering, terrorist financing and proliferation financing] with other members of the group [F28 , including policies on the sharing of information about customers, customer accounts and transactions;]

(c) regularly review and update the policies, controls and procedures applied and established under sub-paragraphs (a) and (b);

(d) maintain a record in writing of—

(i) the policies, controls and procedures established under sub-paragraphs (a) and (b);

(ii) any changes to those policies, controls and procedures made as a result of the review and update required by sub-paragraph (c); and

(iii) the steps taken to communicate those policies, controls and procedures, or any changes to them, to its subsidiary undertakings and branches.

F29 (2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(3) If any of the subsidiary undertakings or branches of a relevant parent undertaking are established in a third country which does not impose requirements to counter [F30 money laundering, terrorist financing and proliferation financing] as strict as those of the United Kingdom, the relevant parent undertaking must ensure that those subsidiary undertakings and branches apply measures equivalent to those required by these Regulations, as far as permitted under the law of the third country.

(4) Where the law of a third country does not permit the application of such equivalent measures by the subsidiary undertaking or branch established in that country, the relevant parent undertaking must—

(a) inform its supervisory authority accordingly; and

(b) take additional measures to handle the risk of [F31 money laundering, terrorist financing and proliferation financing].

(5) A relevant parent undertaking must ensure that information relevant to the prevention of [F32 money laundering, terrorist financing and proliferation financing] is shared as appropriate between members of its group, subject to any restrictions on sharing information imposed by or under any enactment or otherwise.

[F33 (6) The FCA may make technical standards specifying—

(a) what additional measures are required from credit institutions and financial institutions under paragraph (4); and

(b) the minimum action to be taken by credit institutions and financial institutions where paragraph (4) applies.]

Textual Amendments

F26 Words in reg. 20(1)(a) substituted (1.9.2022) by The Money Laundering and Terrorist Financing (Amendment) (No. 2) Regulations 2022 (S.I. 2022/860), regs. 1(5), 6(5)

F27 Words in reg. 20(1)(b) substituted (1.9.2022) by The Money Laundering and Terrorist Financing (Amendment) (No. 2) Regulations 2022 (S.I. 2022/860), regs. 1(5), 6(7)(b)

F28 Words in reg. 20(1)(b) added (10.1.2020) by The Money Laundering and Terrorist Financing (Amendment) Regulations 2019 (S.I. 2019/1511), regs. 1(2), 4(10)

F29 Reg. 20(2) omitted (31.12.2020) by virtue of The Money Laundering and Transfer of Funds (Information) (Amendment) (EU Exit) Regulations 2019 (S.I. 2019/253), regs. 1(2), 5(3)(a) (with savings in S.I. 2019/680, reg. 11); 2020 c. 1, Sch. 5 para. 1(1)

F30 Words in reg. 20(3) substituted (1.9.2022) by The Money Laundering and Terrorist Financing (Amendment) (No. 2) Regulations 2022 (S.I. 2022/860), regs. 1(5), 6(7)(b)

F31 Words in reg. 20(4)(b) substituted (1.9.2022) by The Money Laundering and Terrorist Financing (Amendment) (No. 2) Regulations 2022 (S.I. 2022/860), regs. 1(5), 6(7)(b)

F32 Words in reg. 20(5) substituted (1.9.2022) by The Money Laundering and Terrorist Financing (Amendment) (No. 2) Regulations 2022 (S.I. 2022/860), regs. 1(5), 6(7)(b)

F33 Reg. 20(6) inserted (31.12.2020) by The Money Laundering and Transfer of Funds (Information) (Amendment) (EU Exit) Regulations 2019 (S.I. 2019/253), regs. 1(2), 5(3)(b) (with savings in S.I. 2019/680, reg. 11); 2020 c. 1, Sch. 5 para. 1(1)

Internal controls U.K.

21.—(1) Where appropriate with regard to the size and nature of its business, a relevant person must—

(a) appoint one individual who is a member of the board of directors (or if there is no board, of its equivalent management body) or of its senior management as the officer responsible for the relevant person's compliance with these Regulations;

(b) carry out screening of relevant employees appointed by the relevant person, both before the appointment is made and during the course of the appointment;

(c) establish an independent audit function with the responsibility—

(i) to examine and evaluate the adequacy and effectiveness of the policies, controls and procedures adopted by the relevant person to comply with the requirements of these Regulations;

(ii) to make recommendations in relation to those policies, controls and procedures; and

(iii) to monitor the relevant person's compliance with those recommendations.

(2) For the purposes of paragraph (1)(b)—

(a) “screening” means an assessment of—

(i) the skills, knowledge and expertise of the individual to carry out their functions effectively;

(ii) the conduct and integrity of the individual;

(b) a relevant employee is an employee whose work is—

(i) relevant to the relevant person's compliance with any requirement in these Regulations, or

(ii) otherwise capable of contributing to the—

(aa) identification or mitigation of the risks of [F34 money laundering, terrorist financing and proliferation financing] to which the relevant person's business is subject, or

(bb) prevention or detection of [F35 money laundering, terrorist financing and proliferation financing] in relation to the relevant person's business.

(3) An individual in the relevant person's firm must be appointed as a nominated officer.

(4) A relevant person must, within 14 days of the appointment, inform its supervisory authority of—

(a) the identity of the individual first appointed under paragraph (1)(a);

(b) the identity of the individual first appointed under paragraph (3); and

(c) of any subsequent appointment to either of those positions.

(5) Where a disclosure is made to the nominated officer, that officer must consider it in the light of any relevant information which is available to the relevant person and determine whether it gives rise to knowledge or suspicion or reasonable grounds for knowledge or suspicion that a person is engaged in money laundering or terrorist financing.

(6) Paragraphs (1) and (3) do not apply where the relevant person is an individual who neither employs nor acts in association with any other person.

(7) A relevant person who is an electronic money issuer or a payment service provider must appoint an individual to monitor and manage compliance with, and the internal communication of, the policies, controls and procedures adopted by the relevant person under regulation 19(1) [F36 or 19A(1)], and in particular to—

(a) identify any situations of higher risk of [F37 money laundering, terrorist financing or proliferation financing];

(b) maintain a record of its policies, controls and procedures, risk assessment and risk management including the application of such policies and procedures;

(c) apply measures to ensure that its policies, controls and procedures are taken into account in all relevant functions including in the development of new products, dealing with new customers and in changes to business activities; and

(d) provide information to senior management about the operation and effectiveness of its policies, controls and procedures whenever appropriate and at least annually.

(8) A relevant person must establish and maintain systems which enable it to respond fully and rapidly to enquiries from any person specified in paragraph (9) as to—

(a) whether it maintains, or has maintained during the previous five years, a business relationship with any person; and

(b) the nature of that relationship.

(9) The persons specified in this paragraph are—

(a) financial investigators accredited under section 3 of the Proceeds of Crime Act 2002 (accreditation and training) M4 ;

(b) persons acting on behalf of the Scottish Ministers in their capacity as an enforcement authority under that Act; and

(c) constables or equivalent officers of any law enforcement authority.

(10) In determining what is appropriate with regard to the size and nature of its business, a relevant person—

(a) must take into account its risk assessment under regulation 18(1) [F38 and 18A(1)]; and

(b) may take into account any guidance which has been—

(i) issued by the FCA; or

(ii) issued by any other supervisory authority or appropriate body and approved by the Treasury.

Textual Amendments

F34 Words in reg. 21(2)(b)(ii)(aa) substituted (1.9.2022) by The Money Laundering and Terrorist Financing (Amendment) (No. 2) Regulations 2022 (S.I. 2022/860), regs. 1(5), 6(7)(c)

F35 Words in reg. 21(2)(b)(ii)(bb) substituted (1.9.2022) by The Money Laundering and Terrorist Financing (Amendment) (No. 2) Regulations 2022 (S.I. 2022/860), regs. 1(5), 6(7)(c)

F36 Words in reg. 21(7) inserted (1.9.2022) by The Money Laundering and Terrorist Financing (Amendment) (No. 2) Regulations 2022 (S.I. 2022/860), regs. 1(5), 6(6)(a)

F37 Words in reg. 21(7)(a) substituted (1.9.2022) by The Money Laundering and Terrorist Financing (Amendment) (No. 2) Regulations 2022 (S.I. 2022/860), regs. 1(5), 6(8)(a)

F38 Words in reg. 21(10)(a) inserted (1.9.2022) by The Money Laundering and Terrorist Financing (Amendment) (No. 2) Regulations 2022 (S.I. 2022/860), regs. 1(5), 6(6)(b)

Marginal Citations

M4 2002 c. 29. Section 3 was amended by paragraph 111 of Schedule 8 to the Crime and Courts Act 2013 (c.22), and by paragraph 120 of Schedule 8 and paragraph 1 of Schedule 14 to the Serious Crime Act 2007 (c.27).

Central contact points: electronic money issuers and payment service providers U.K.

F39 22.  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

F39 Reg. 22 omitted (31.12.2020) by virtue of The Money Laundering and Transfer of Funds (Information) (Amendment) (EU Exit) Regulations 2019 (S.I. 2019/253), regs. 1(2), 5(4) (with savings in S.I. 2019/680, reg. 11); 2020 c. 1, Sch. 5 para. 1(1)

Requirement on authorised person to inform the FCA U.K.

23.—(1) An authorised person whose supervisory authority is the FCA must, before acting as a money service business or a trust or company service provider or within 28 days of so doing, inform the FCA that it intends, or has begun, to act as such.

(2) Paragraph (1) does not apply to an authorised person which—

(a) immediately before the day on which these Regulations come into force (“the relevant date”) was acting as a money service business or a trust or company service provider and continues to act as such after that date; and

(b) informs the FCA that it is acting as such within 30 days of the relevant date.

(3) Where an authorised person whose supervisory authority is the FCA ceases to act as a money service business or a trust or company service provider, it must within 28 days inform the FCA.

(4) Any requirement imposed by this regulation is to be treated as if it were a requirement imposed by or under FSMA.

(5) Any information to be provided to the FCA under this regulation must be in such form or verified in such manner as it may specify.

Training U.K.

24.—(1) A relevant person must—

(a) take appropriate measures to ensure that its relevant employees [F40 , and any agents it uses for the purposes of its business whose work is of a kind mentioned in paragraph (2),] are—

(i) made aware of the law relating to [F41 money laundering, terrorist financing and proliferation financing], and to the requirements of data protection, which are relevant to the implementation of these Regulations; and

(ii) regularly given training in how to recognise and deal with transactions and other activities or situations which may be related to [F42 money laundering, terrorist financing or proliferation financing];

(b) maintain a record in writing of the measures taken under sub-paragraph (a), and in particular, of the training given to its relevant employees [F43 and to any agents it uses for the purposes of its business whose work is of a kind mentioned in paragraph (2)].

(2) For the purposes of paragraph (1), a relevant employee is an employee whose work is—

(a) relevant to the relevant person's compliance with any requirement in these Regulations, or

(b) otherwise capable of contributing to the—

(i) identification or mitigation of the risk of [F44 money laundering, terrorist financing and proliferation financing] to which the relevant person's business is subject; or

(ii) prevention or detection of [F45 money laundering, terrorist financing and proliferation financing] in relation to the relevant person's business.

(3) In determining what measures are appropriate under paragraph (1), a relevant person—

(a) must take account of—

(i) the nature of its business;

(ii) its size;

(iii) the nature and extent of the risks of [F46 money laundering, terrorist financing and proliferation financing] to which its business is subject; and

(b) may take into account any guidance which has been—

(i) issued by the FCA; or

(ii) issued by any other supervisory authority or appropriate body and approved by the Treasury.

Textual Amendments

F40 Words in reg. 24(1)(a) inserted (10.1.2020) by The Money Laundering and Terrorist Financing (Amendment) Regulations 2019 (S.I. 2019/1511), regs. 1(2), 4(11)(a)

F41 Words in reg. 24(1)(a)(i) substituted (1.9.2022) by The Money Laundering and Terrorist Financing (Amendment) (No. 2) Regulations 2022 (S.I. 2022/860), regs. 1(5), 6(7)(d)

F42 Words in reg. 24(1)(a)(ii) substituted (1.9.2022) by The Money Laundering and Terrorist Financing (Amendment) (No. 2) Regulations 2022 (S.I. 2022/860), regs. 1(5), 6(8)(b)

F43 Words in reg. 24(1)(b) inserted (10.1.2020) by The Money Laundering and Terrorist Financing (Amendment) Regulations 2019 (S.I. 2019/1511), regs. 1(2), 4(11)(b)

F44 Words in reg. 24(2)(b)(i) substituted (1.9.2022) by The Money Laundering and Terrorist Financing (Amendment) (No. 2) Regulations 2022 (S.I. 2022/860), regs. 1(5), 6(7)(d)

F45 Words in reg. 24(2)(b)(ii) substituted (1.9.2022) by The Money Laundering and Terrorist Financing (Amendment) (No. 2) Regulations 2022 (S.I. 2022/860), regs. 1(5), 6(7)(d)

F46 Words in reg. 24(3)(a)(iii) substituted (1.9.2022) by The Money Laundering and Terrorist Financing (Amendment) (No. 2) Regulations 2022 (S.I. 2022/860), regs. 1(5), 6(7)(d)

Supervisory action U.K.

25.—(1) The supervisory authority must determine whether the additional measures taken under regulation 20(4) by a relevant parent undertaking which is an authorised person [F47 , a qualifying parent undertaking (as defined by section 192B of FSMA) or a non-authorised parent undertaking (as defined by section 143B of FSMA)] are sufficient to handle the risk of money laundering and terrorist financing effectively.

(2) If the supervisory authority does not consider the measures referred to in paragraph (1) to be sufficient, it must consider whether to direct the relevant parent undertaking—

(a) not to enter into a business relationship with a specified person;

(b) not to undertake transactions of a specified description with a specified person;

(c) to terminate an existing business relationship with a specified person;

(d) to cease any operations in the third country.

(e) to ensure that its subsidiary undertaking—

(i) does not enter into a business relationship with a specified person;

(ii) terminates an existing business relationship with a specified person; or

(iii) does not undertake transactions of a specified description with a specified person, or ceases any operations in the third country.

(3) A direction issued under paragraph (2) takes effect—

(a) immediately, if the notice given under paragraph (6) states that that is the case;

(b) on such date as may be specified in the notice; or

(c) if no such date is specified in the notice, when the matter to which the notice relates is no longer open to review.

(4) For the purposes of paragraph (3), a matter to which a notice relates is still open to review if—

(a) the period during which any person may refer the matter to the appropriate tribunal is still running;

(b) the matter has been referred to the appropriate tribunal but has not been dealt with;

(c) the matter has been referred to the appropriate tribunal and dealt with but the period during which an appeal may be brought against the appropriate tribunal's decision is still running; or

(d) such an appeal has been brought but has not been determined.

(5) Where the FCA proposes to issue a direction under paragraph (2) to a PRA-authorised person or to a person who has a qualifying relationship with a PRA-authorised person, it must consult the PRA.

(6) If the supervisory authority issues a direction under paragraph (2) it must give the relevant parent undertaking (“A”) a notice in writing.

(7) The notice must—

(a) give details of the direction;

(b) state the supervisory authority's reasons for issuing the direction;

(c) inform A that A may make representations to the supervisory authority within such period as may be specified in the notice (whether or not A has referred the matter to the appropriate tribunal);

(d) inform A of when the direction takes effect; and

(e) inform A of A's right to refer the matter to the appropriate tribunal.

(8) The supervisory authority may extend the period allowed under the notice for making representations.

(9) If, having considered any representations made by A, the supervisory authority decides—

(a) to issue the direction, or

(b) if the direction has been issued, not to rescind the direction,

it must give A notice in writing.

(10) If, having considered any representations made by A, the supervisory authority decides—

(a) not to issue the direction,

(b) to issue a different direction, or

(c) to rescind a direction which has effect,

it must give A notice in writing.

(11) A notice under paragraph (9) must inform A of A's right to refer the matter to the appropriate tribunal.

(12) A notice under paragraph (10)(b) must comply with paragraph (7).

(13) If a notice informs A of A's right to refer a matter to the appropriate tribunal, it must give an indication of the procedure on such a reference.

[F48 (13A) The supervisory authority may, if it considers it proportionate to do so, publish such information about a direction given under paragraph (2) as the authority considers appropriate.

(13B) Where the supervisory authority publishes such information and the supervisory authority decides to rescind the direction to which the notice relates, the supervisory authority must, without delay, publish that fact in the same manner as that in which the information was published under paragraph (13A).

(13C) Where the supervisory authority publishes information under paragraph (13A) and the person to whom the notice is given refers the matter to the Upper Tribunal, the supervisory authority must, without delay, publish information about the status of the appeal and its outcome in the same manner as that in which the information was published under paragraph (13A).]

(14) For the purpose of this regulation—

(a) “appropriate tribunal” means—

(i) the Upper Tribunal, in the case of a direction issued by the FCA;

(ii) the First-tier or Upper Tribunal, as provided for in regulation 99, in the case of a direction issued by the Commissioners;

(b) “specified” means specified in the direction.

Textual Amendments

F47 Words in reg. 25(1) substituted (1.1.2022) by The Financial Services Act 2021 (Prudential Regulation of Credit Institutions and Investment Firms) (Consequential Amendments and Miscellaneous Provisions) Regulations 2021 (S.I. 2021/1376), regs. 1(3), 21(3)

F48 Reg. 25(13A)-(13C) inserted (10.1.2020) by The Money Laundering and Terrorist Financing (Amendment) Regulations 2019 (S.I. 2019/1511), regs. 1(2), 4(12)