Author: Sara Barclay – Technical Compliance Consultant. Contact: sara@tspgsy.com. 

Strengthening Financial Crime Frameworks 

This article looks at the key learning points in respect of the Guernsey Financial Services Commission’s latest enforcement action. The focus is on how Boards, senior management and operational teams can ensure that financial crime risks are properly understood, managed and resourced throughout the client lifecycle, while demonstrate strong governance, effective controls and meaningful oversight. 

Source of Wealth and Source of Funds 

A robust understanding of a client’s Source of Wealth (SoW) and Source of Funds (SoF) remains a cornerstone of an effective financial crime framework and understanding of a client relationship. 

Good practice requires that SoW and SoF: 

• Are clearly established at onboarding, proportionate to the risk posed by the client, product, jurisdiction and delivery channel 

• Are reasonable and plausible, taking into account the client’s background, occupation, business activities and geographic exposure 

• Are supported by appropriate documentary evidence, particularly where higher-risk factors are present. Where the key person or business relationship is High risk this must be corroborated.  

Importantly, SoW and SoF are not oneoff exercises. Firms should ensure that: 

• SoW and SoF are kept under review, are assessed and refreshed at periodic reviews and when trigger events occur 

• New or additional funds entering a relationship are assessed for consistency with the known SoW profile and the validity of these funds are assessed and documented 

• Any inconsistencies, gaps or changes over time and during trigger events or periodic reviews are identified, investigated and documented 

Boards and senior management should receive management information that enables them to understand: 

• The quality and completeness of SoW/SoF information across the client base 

• Where higher-risk, high risk or more complex profiles exist  

• Whether remediation activity is timely and adequately resourced 

Customer Due Diligence (CDD) 

Effective Customer Due Diligence (CDD) underpins a firm’s ability to understand who its clients are and the risks they pose while reducing the potential for impersonation and fraud. 

Industry best practice includes ensuring that CDD: 

• Meets current regulatory standards, including certification requirements 

• Is legible, complete and understandable to staff relying on it 

• Accurately reflects the client’s current circumstances, including residence, domicile, nationality and tax position 

Over time, clients may experience life events such as relocation, changes in personal circumstances or changes in business activities. While due diligence may not be subject to formal expiry, firms are expected to ensure that: 

• CDD remains fit for purpose throughout the relationship 

• Material changes trigger refresh or enhancement of documentation 

• Tax information is assessed for accuracy and consistency, particularly where higher-risk jurisdictions are involved 

From a governance perspective, firms should be able to demonstrate that: 

• CDD quality is reviewed, challenged and outcome documented  as part of periodic reviews or trigger events 

• Deficiencies are identified, remediated and tracked 

• The Board is aware of any systemic issues affecting CDD quality and the level of compliance with regulatory requirements.  

Though there are no specific requirements for CDD when Introducers or intermediaries fall outside of the controller aspect of the Handbook, there are requirements to understand and document the appropriateness, suitability and background/regulatory history as well as understanding their jurisdiction risk. This information coupled with the CDD information for the business relationship and Key Principals allows for a fuller understanding of the financial crime risks posed. 

Customer Risk Assessment 

A well-designed Customer Risk Assessment (CRA) is essential to understanding and managing financial crime risk at both an individual client and portfolio level. 

Good practice requires that CRAs: 

• Reflect jurisdictional, product, delivery channel and client-specific risks 

• Are informed by the firm’s Business Risk Assessment (BRA) and relevant national or sector risk assessments 

• Are applied consistently across the client base 

• Take into account any risks identified in respect of introducers or intemediaries of the business relationship  

CRAs should enable firms to: 

• Identify high and higher-risk relationships and Key Principals  

• Understand risk concentration across jurisdictions, products or intermediaries 

• Apply appropriate mitigation where allowed, controls and monitoring in line with assessed risk 

Boards and senior management should be provided with MI that: 

• Clearly shows the distribution of risk across their business relationships 

• Highlights any areas of concentration or emerging risk 

• Allowing them to demonstrate how risk assessments translate into operational controls and resourcing  

Ongoing Monitoring and Maintenance of Business Relationships 

Ongoing monitoring is a fundamental regulatory expectation and should be both proactive and reactive.  

Effective monitoring frameworks include: 

• Trigger event reviews due to unexpected activity of a client or regulation change 

• Periodic reviews conducted in line with the client’s risk rating 

• Screening for sanctions, PEP exposure and adverse media 

• Review of the of SoW, SoF, CDD and CRA where relevant reassessment and authorisation of the continuance of the business relationship 

Where adverse information is identified, good practice requires firms to: 

• Assess relevance and materiality rather than dismissing information without analysis 

• Obtain further information or documentation where appropriate 

• Contact clients or their representatives to establish facts 

• Clearly document conclusions and rationale for the resulting action to taken  

The existence of adverse information does not automatically indicate suspicion; however, failure to investigate and record decisions can expose the firm to regulatory risk. 

Red Flags and Escalation – Practical Lessons from GFSC Enforcement 

The recent GFSC enforcement action demonstrates that red flags were present, identifiable and documented, but were not escalated, challenged or acted upon with sufficient rigour. The Commission made clear that this failure materially contributed to the seriousness of the outcome and the potential for the business and the jurisdiction being susceptible to financial crime. 

Red flags must be assessed individually and cumulatively across the client base to identify trends, with decisions supported by evidence and clearly recorded. 

Key Red Flags Highlighted by the GFSC 

The enforcement action identified recurring red flag scenarios that firms should treat as requiring prompt escalation and investigation: 

• Large, unsolicited or unexpected payments inconsistent with the client’s known Source of Wealth or Source of Funds, including sudden increases in premium payments. 

• Failure or refusal to provide information, including noncompletion of updated SoF questionnaires following unusual activity. 

• Requests to return funds to a different bank account from which they originated, raising potential layering or misdirection concerns. 

• Delayed identification of PEP status or adverse media, resulting in clients remaining incorrectly riskrated for extended periods. 

• Inconsistencies in client data, including multiple variations of names, addresses or jurisdictions without adequate investigation. 

• Highrisk jurisdictions combined with weak corroboration, including highvalue transactions supported by outdated or poorly evidenced SoW/SoF. 

The Commission was critical of instances where such indicators were dismissed as administrative issues or poor client communication, rather than treated as potential financial crime risk. 

Escalation and Decision-Making Expectations 

The GFSC reiterated that: 

• The presence of red flags does not automatically require a disclosure, but 

• Failure to investigate, escalate and document decisions exposes firms and individuals to an increase in potential financial crime and enforcement action. 

Firms are expected to ensure that: 

• Red flags are escalated promptly to suitably experienced personnel. 

• Investigations are proportionate and evidencebased, taking account of cumulative risk. 

• Decisions—whether to continue, restrict, enhance monitoring or exit a relationship—are clearly documented, including the rationale. 

• Where risks cannot be mitigated, firms consider enhanced controls, relationship exit and disclosure obligations. 

Wider Control and Governance Implications 

The GFSC made clear that repeated failures to act on red flags often indicate: 

• Overreliance on triggerevent reviews 

• Weak screening or data quality 

• Insufficient challenge within MLRO or Compliance functions 

• Inadequate escalation to senior management and Boards 

• Failure to implement remediation and appropriate controls and regulatory requirements 

Where red flag handling weaknesses are systemic or material, firms are expected to notify the GFSC promptly, supported by a credible remediation plan and delivery timeline. 

Board and Senior Management Oversight 

Across all areas, effective governance is critical. Boards and senior management are expected to: 

• Set a clear risk appetite in respect of their business objectives in relation to the potential for financial crime 

• Ensure that frameworks, policies and controls are adequately designed and resourced to meet the needs of the business undertaken and the regulatory requirements 

• Challenge management where weaknesses or delays in remediation are identified 

Management information provided to Boards should be: 

• Relevant, accurate and timely 

• Focused not only on risk ratings but also on control effectiveness and trends 

• Sufficient to enable informed decisionmaking 

A strong tone from the top, combined with effective oversight and accountability, is central to maintaining a resilient and compliant business. 

Call to Action for Boards, Senior Management and MLRO Functions 

Recent GFSC enforcement action demonstrates that financial crime frameworks fail not because firms lack policies, but because controls are do not take account of the National Risk Assessment and industry findings, are poorly implemented, insufficiently resourced, or not embedded into daytoday operations.  

The consequences of failing are no longer theoretical—regulators are willing to impose significant financial penalties, public censure and individual sanctions where firms cannot evidence effective compliance to local regulatory frameworks, oversight, challenge and remediation. 

Boards and senior management should therefore: 

• Move beyond assurance on paper and obtain evidence that financial crime controls are operating effectively in practice. 

• Challenge the quality, timeliness and regulatory and business relevance of Customer Due Diligence, Source of Wealth/Source of Funds and risk assessments—not simply their existence. 

• Ensure that known issues are remediated promptly, rather than deferred to future trigger events or periodic reviews, and appropriate controlls can identify areas requiring remediation 

• Confirm that the MLRO and Compliance functions are sufficiently supported with technical expertise, data capability and capacity to discharge their responsibilities. 

• Act early where gaps are identified—waiting for regulatory intervention materially increases cost, disruption and reputational damage. 

The GFSC has been clear: good intentions and historic controls are not enough. Firms must be able to demonstrate that financial crime risks are understood, monitored and acted upon in real time, with clear accountability and evidence of challenge, while maintaining an up to date and regulatory compliant financial crime framework. 

Engaging experienced technical specialists at an early stage allows firms to: 

• Address weaknesses before they become systemic 

• Strengthen governance and confidence at Board level 

• Reduce the likelihood of enforcement, financial penalties and reputational harm 

• Ensure that a firm complies with regulatory requirements and guidance 

Technical Specialist Partners Limited offers pragmatic, hands-on support to help firms move from policy compliance to  effective, defensible financial crime frameworks that are regulatory compliant. We also offer health checks, reviews and assistance for proactive remediation. For more information, see: https://technicalspecialistpartners.com