AML/CFT

Enhancing Compliance: Navigating the GFSC Handbook and High Risk Requirements

Sara Barclay AML/CTF, Compliance, Corporate Governance, Due diligence, Guernsey , , , , , , , ,

In today’s fast-paced regulatory environment, Guernsey financial institutions must ensure they are not only compliant but also adaptive to ever-evolving domestic and international standards. The Guernsey Financial Services Commission (GFSC)Handbook provides a critical framework for ensuring Guernsey financial institutions uphold the highest standards of governance when countering financial crime, countering the financing of terrorism, and countering the Financing of Proliferation (CFC,CTF,CPF or Financial Crime) when undertaking their business activities. One of the most crucial sections, Chapter 8, delves into enhanced customer due diligence (ECDD) measures required for high-risk business relationships and situations. This blog will explore these ECDD measures and how organisations can align their operations and compliance frameworks with the Guernsey regulatory expectations set out in Chapter 8 of the GFSC Handbook.

Understanding the GFSC Handbook: A Regulatory Pillar

The GFSC Handbook is a guiding document that helps regulated entities in Guernsey comply with legislative and regulatory requirements, specifically around CFC, CTF, CPF and operational soundness to prevent and detect financial crime. By addressing both international and local standards, the Handbook covers areas such as:

  • Corporate governance
  • Risk management
  • Due diligence
  • Customer relationships
  • Transaction monitoring

However, when dealing with high-risk scenarios, standard measures are often insufficient. Chapter 8 is designed to mitigate risk in such situations through ECDD, enhanced monitoring, and enhanced reporting requirements to provide for effective corporate governance.

The Importance of Chapter 8: Enhanced Measures for High-Risk Situations

Chapter 8 of the GFSC Handbook specifically addresses scenarios where standard due diligence may not suffice to adequately mitigate risks of high risk business relationships. In such situations, Guernsey financial institutions and their directors and controllers are expected to employ ECDD measures to ensure robust risk management. These high-risk situations may arise from the following:

  • High-risk customers: Individuals or entities from jurisdictions with weaker CFC, CTF, CPF frameworks or with susceptibility to financing of terrorism or proliferation activities, politically exposed persons (PEPs), or clients involved in industries with higher susceptibility to financial crime.
  • Complex or unusual transactions: Large transactions that are inconsistent with the customer’s known profile or operations, or where the source of funds or rationale for the transaction is unclear.
  • Higher-risk products and services: Financial services that pose higher risks, such as correspondent banking, nominee services, and some services involving virtual assets.

Enhanced Customer Due Diligence (ECDD)

One of the critical components of Chapter 8 is ECDD, which goes beyond standard customer identification and verification processes. ECDD measures may include:

  • Additional documentation: Guernsey Financial institutions must collect more extensive documentation to verify the customer’s identity, business activities and rationale, and the source of their funds and wealth of their beneficial owners .
  • More in-depth investigations: Guernsey Financial institutions are required to dig deeper into a client’s background, including reviewing ownership structures, past transactions, and financial history (source of wealth and source of funds).
  • Regular updates: Ongoing due diligence must be performed more frequently, ensuring that any changes to the customer’s profile are promptly captured, investigated, and where required that documentation is obtained to confirm the continued legitimacy of the business relationship.

Key Requirements under Chapter 8 of the GFSC Handbook

To successfully implement Chapter 8, Guernsey Financial institutions need to address several critical areas:

  • Customer Due Diligence (CDD) and understanding and documenting the rationale of the business relationship and its components. 

Under Chapter 8, financial institutions must enhance their CDD and while documenting and clearing demonstration the rationale and purpose of the business relationship. This includes verifying the identity of beneficial owners, understanding the nature and purpose of business relationships, and ensuring continuous monitoring. For high-risk customers, ECDD measures require more rigorous background checks, additional verification, a deeper understanding of the client’s source of wealth and funds, and ensuring that it the take on and continuation of the business relationship is signed off by a higher level of authority and oversight.

  • Transaction Monitoring and Risk Profiling

Guernsey Financial institutions must implement more extensive and frequent transaction monitoring for high-risk clients. Chapter 8 mandates continuous monitoring of business relationships to detect suspicious activities promptly. This includes having lower thresholds for transaction monitoring, greater scrutiny and documentation of transactions, activity undertaken,  and their rationale, to flag unusual patterns or irregular transactions that might indicate money laundering, terrorist financing or proliferation activity.

  • Source of Funds and Wealth Verification, Documentation and Monitoring

Enhanced measures under Chapter 8 place significant emphasis on identifying and verifying the source of funds and wealth and holding up to date documentation on this area. This goes beyond just knowing where the money comes from; Guernsey Financial institutions need to understand how the funds were acquired, the activities that generated them, and ensure they are legitimate. For example, funds coming from high-risk jurisdictions for terrorism or industries require additional scrutiny to prevent bribery and corruption, or activities that may be linked to proliferation activities.

  • Enhanced Monitoring and Reporting

Monitoring business relationships is a continuous process of both day-to-day review of the transactions and verification subjects and more frequent periodic reviews of the business relationship, especially for high-risk clients. Chapter 8 requires Guernsey financial institutions to apply more scrutiny to transactions for high risk business relationships and escalate suspicious activities to the Money Laundering Reporting Officer and where necessary to the authorities, such as the Financial Intelligence Unit, or for sanctions to the Guernsey Policy Council . Guernsey Financial Institutions must ensure they have robust internal mechanisms to report suspicious transactions regardless of monetary value, or sanctions while maintaining comprehensive documentation to support their findings.

  • Risk-Based Approach

Chapter 8 promotes a risk-based approach, where enhanced measures are applied based on the level of risk posed by the customer, transaction, service or product provider and any higher risk area identified. Institutions must create internal policies and procedures that reflect this principle, ensuring flexibility in responding to varying levels and types of risk.

Implementing ECDD Measures: Best Practices

To successfully align with Chapter 8 and the broader GFSC Handbook requirements, organizations should consider the following best practices:

  • Comprehensive Risk Assessment: Conduct regular risk assessments to identify customers, products, and services that pose higher risks. This will help prioritize where ECDD measures are necessary.
  • Training and Awareness: Ensure that staff at all levels are trained to recognize high-risk scenarios and know when to apply ECDD measures and what ECDD measures are required.
  • Technological Integration: Utilize advanced technology such as automated sanction screening and transaction monitoring, to flag suspicious activity, and conduct more thorough and continuaous due diligence.
  • Documentation and Record-Keeping: Hold and maintain detailed records of all due diligence processes, transactions, and enhanced measures taken. This is crucial for regulatory reporting and audits.
  • Regular Reviews and Updates: Chapter 8 requires ongoing monitoring and re-assessment of business relationships inclusive of the verification subjects, so Guernsey financial institutions should regularly review their procedures, especially when regulatory changes occur or there are changes to the business plan and sphere of operation.

Conclusion: Staying Ahead of Compliance Obligations

Complying with Chapter 8 of the GFSC Handbook requires a proactive and well-structured approach by the Directors and relevant senior employees in managing high-risk scenarios. Guernsey financial institutions must be vigilant in applying enhanced customer due diligence, monitoring, and reporting, ensuring that all procedures meet the stringent regulatory requirements of the GFSC. By adopting best practices, leveraging technology, and promoting a culture of compliance, Guernsey financial institutions can better manage higher risks and maintain a strong relationship with regulators and stake holders in the Guernsey regualtory framework.

Staying compliant isn’t just about ticking boxes—it’s about detailing the approach to risk, applying the measures and documenting their effectiveness in protecting the local and international financial system from abuse in order to safeguard the reputation of your business and third-parties that provide services to you and your clients.

By carefully and proactively integrating the ECDD measures detailed in Chapter 8 of the Handbook, Guernsey financial institutions can navigate the financial crime risks posed successfully, maintain compliance with GFSC rules and regulations, reporting requirements, and better protect themselves from investigations, enforcement actions and financial crime while providing products and services to those business relationships and persons who are high risk.

Stay ahead of the curve—ensure your compliance regarding Enhanced Due Diligence and high risk business relationships are up to date!

Join us at Technical Specialist Partners in fostering a culture of integrity and accountability by contacting us at hello@technicalspecialistpartners.com to discuss your requirements and the services that we can provide. Together we can build a compliant and ethical work place.

GFSC Handbook Requirements for Source of Wealth and Source of Funds

Sara Barclay AML/CTF, Compliance, Compliance Monitoring, Corporate Governance, Due diligence, Guernsey , , , , , , , , ,

The Guernsey Financial Services Handbook for Countering Financial Crime, Countering Terrorist Financing and Countering Proliferation Financing (GFSC Handbook or Handbook)  sets forth comprehensive guidelines on how Guernsey financial institutions should address Source of wealth (SoW) and (SoF) as part of their customer due diligence (CDD) and enhanced due diligence (EDD) processes. These requirements are particularly stringent when dealing with high or higher-risk customers or complex transactions. Some of the key aspects include:

Collection of Information

Guernsey financial institutions must collect sufficient information about the client’s SoW and SoF  to properly assess the legitimacy of their customers financial activities and rationale for the use of the Bailiwick. As detailed in the GFSC Handbook this may involve:

  • Verifying employment income through pay slips, tax returns, or employer references confirming salary.
  • Confirming inheritance via probate or legal documentation.
  • Assessing investment income by reviewing dividend statements, property sales records, or portfolio valuations.

The Handbook stresses that for high-risk customers, Guernsey financial institutions must obtain more granular detail to fully understand the journey to and/or origin of wealth and funds of the person and/or business relationship.

Verification of Information

It is not enough to simply collect SoW and SoF information—institutions must also verify and document it! Verification can include independent checks through public databases, third-party documentation, and government records and the generation of a SoW and SoF memo or document comprising these information sources. 

The GFSC Handbook and the Thematic Review provide a clear roadmap for Guernsey Financial institutions to manage risks related to SoW and SoF effectively. By following these guidelines, institutions can enhance their Countering Financial Crime, Countering Terrorist Financing and Countering Proliferation Financing (CFC,CTF,CPF) frameworks, protect their reputations, their third party suppliers and ensure good corporate governance while meeting domestic and internal regulatory obligations and requirements.

For higher and high-risk business relationships and scenarios, additional layers of verification are required, often involving more detailed documentation, such as bank statements, legal contracts, or public filings.

Ongoing Monitoring

SoW and SoF checks are not a one-off exercise. Institutions are required to monitor the source of wealth and funds on an ongoing basis, particularly when dealing with politically exposed persons (PEPs), high-net-worth individuals, or clients from jurisdictions with weaker CFC,CTF,CPF frameworks. If any red flags arise, institutions must investigate further and escalate the matter internally to their Money Laundering Reporting Officer (MLRO) who may externalise a report to the relevant authorities if necessary.

Record Keeping

Maintaining thorough records of all SoW and SoF inquiries, documentation, and verification processes is mandatory. These records are essential for audit trails and for satisfying GFSC’s requirements during compliance reviews or in the event of an on-site regulatory visit, thematic reviews, request for information from a regulatory or law enforcement authority and when making disclosures to the Guernsey FIU.

Insights from the Thematic Review: A Focus on Private Wealth Management

The Thematic Review conducted by the GFSC on Source of Funds and Source of Wealth in the private wealth management sector highlights several critical findings and areas for improvement within the Guernsey financial industry. This review provides deeper insight into how Guernsey financial institutions can bolster their compliance with SoW and SoF requirements.

Key Findings:

  • Insufficient Depth in SoW/SoF Information: The Thematic Review found that many institutions were not gathering enough detailed information on SoW and SoF, particularly for high-risk clients. A common issue was reliance on customer declarations without independent verification. The GFSC expects institutions to dig deeper, especially when there are signs of complexity or higher risk within a business relationship or transaction.
  • Lack of Independent Verification: While most institutions collected some form of SoW and SoF data, verification was often lacking. The GFSC stresses that for high-net-worth individuals, high-risk clients or clients with complex wealth structures, institutions must take extra steps to verify the authenticity of their SoW and SoF.
  • Inconsistent Risk-Based Approach: Many institutions had policies in place but did not apply them appropriately or consistently, particularly in identifying and managing higher and high-risk scenarios. The GFSC noted that this inconsistency poses a significant risk to effective of a Guernsey financial institutions CFC, CTF, CPF controls and the wider compliance with the Handbook’s corporate governance requirements.

Best Practices for Strengthening SoW and SoF Compliance

To better align with the GFSC’s expectations and the findings of the Thematic Review, Guernsey financial institutions should adopt the following best practices:

  •  Implement a Robust Risk-Based Approach

A risk-based approach to SoW and SoF inquiries ensures that the level of investigation and verification matches the customer’s risk profile. High-risk clients, such as PEPs, those in or conducting transactions with high risk jurisdictions,  or those involved in complex financial arrangements, should undergo enhanced due diligence (EDD), which includes more thorough SoW and SoF checks.

  •  Increase Depth of Information Collection

Institutions must ensure that they gather comprehensive information about the client’s SoW and SoF. This includes not only basic facts but also deeper context, such as the history of wealth accumulation and the specific details behind large transactions. 

  •  Utilize Independent Sources for Verification

To avoid over-reliance on customer-provided information, institutions should use independent and reliable sources to verify SoW and SoF. This may involve using public records, financial databases, or independent experts.

  •  Enhance Staff Training and Awareness

Staff at all levels should be trained to understand the importance of SoW and SoF checks, and how to conduct these inquiries effectively. Training should also cover the red flags to watch for potentially risky transactions or clients that may trigger a suspicion to the MLRO.

  •  Ongoing Monitoring and Review

Regular reviews and continuous monitoring of client profiles and their transactions are vital. Institutions must be prepared to escalate any concerns about SoW or SoF to their MLRO , ensuring that these concerns are investigated and, if necessary, reported to the Guernsey FIU.

Conclusion: Ensuring Compliance and Mitigating Risk

Ensuring compliance with SoW and SoF requirements not only helps in meeting regulatory expectations but also plays a key role in maintaining the integrity of the Bailiwick and the global financial system.

For Guernsey financial institutions and those international firms wishing to set up in the Bailiwick, the message is clear: robust, well-documented, and verified SoW and SoF processes are critical for reducing exposure to financial crime risks and ensuring long-term success in the Guernsey Financial Sector for your business.

You can access the GFSC’s full Thematic Review on Source of Funds and Source of Wealth in the Private Wealth Management sector here .

Stay ahead of the curve—ensure your compliance is up to date! Join us at Technical Specialist Partners in fostering a culture of integrity and accountability by contacting us at hello@technicalspecialistpartners.com  to discuss your requirements and the services that we can provide. Together we can build a compliant and ethical work place. website link

The Sum of All the Parts

Sara Barclay AML/CTF, Compliance, Due diligence, Guernsey , , , , , ,

Compliance monkeyThe Guernsey Anti-Money Laundering and Countering Terrorist Financing (“AML/CTF”) framework has continually developed to take in to account good practice, external pressures, requests and recommendations of onshore governments, quangos and international organisations  to ensure that financial crime in all its guises is effectively tackled. The Commission have sought to and I would say that they have largely achieved a cohesive framework that effectively mitigates against the use by criminals of Guernsey as an international finance centre while not over burdening the Financial Service Business operating here.

This cohesive framework has been achieved over the course of the years by open dialogue with local industry bodies, licensees and working effectively and productively with those outside of Guernsey to achieve a proportionate approach for  the products and services that are provided to clients wishing to utilise the jurisdiction. Most notably in 2013 the AML/CTF framework in Guernsey changed extensively and this resulted in general insurance products being removed, but did it remove all the products and services that can classified as General Insurance?

With regard to the Insurance sector in Guernsey, a legal entity can be licensed for general business or for long-term business. Long term business is defined in the Insurance Business (Bailiwick of Guernsey) Law, 2002 as contracts on human life, human longevity, marriage and birth, linked long-term, permanent health, capital redemption, pension fund management and credit life assurance. Due to the nature and the requirements of some clients, an insurance licensee with a general business categorisation may want to offer some of these products to their clients to supplement the range of products and services they currently or can offer their clients, but without the need to be licensed for long-term business.  Section 2(4) of the Insurance Business (Bailiwick of Guernsey) Law, 2002 does allow for an Insurance licensee to elect that a contract for a term of not more than 18 months that may be regarded as a long-term business contract and can be deemed to be general business.

This would appear to allow a general insurer to fit such products into their licence requirements e.g. general insurance, without the requirements to adhere to the Guernsey AML/CTF framework as per the changes that were made to the Commission’s AML/CTF Handbook (” Commission’s Handbook”), in 2013.  It should be noted that the treatment of these products, though allowed to be done in certain circumstances by an Insurance licensee does not change the definition of those products in the Insurance Business (Bailiwick of Guernsey) Law, 2002.

In the Criminal Justice (Proceeds of Crime) (Bailiwick of Guernsey) Regulations, 2007 at schedule 1 it states that a Financial Services Businesses for the purposes of the Regulations are detailed in part 1 of the schedule, except where they are incidental or are other activities as listed at Part 2 of the Schedule. Part 1 of the schedule includes the carrying on of “Long Term Business as defined by the Insurance Business (Bailiwick of Guernsey) Law, 2002 as being a Financial Services Business for the purposes of the Regulation and the Commission’s Handbook, it does not include any change in the treatment of an Insurance product by an Insurance Licensee. The Commission’s Handbook at section 4.8 specifically deals with the treatment of life or other investment linked insurance policies and as such these appear to directly fall in to the Guernsey AML/CTF regime. Effectively this is saying that if a product falls under the long-term definition stated in the Insurance Business (Bailiwick of Guernsey) Law, 2002 though a Licensee it may regard it as being General business they remain subject to the AML/CTF Regulations. Thus a licensee must adhere to the requirements of the Commission’s Handbook and AML/CTF framework when dealing with such products.

The sum of all these parts would indicate that an Insurance licensee effecting or carrying out life or other long-term products regardless of how a Licensee may be able to classify these products as general business under the Insurance Business (Bailiwick of Guernsey) Law, 2002, they would still fall under the AML/CTF regulations and Commission’s Handbook by way of the requirements of the Criminal Justice (Proceeds of Crime) (Bailiwick of Guernsey) Regulations, 2007 held at schedule 1. An Insurance Licensee regardless of how it treats such products under its licence would be required to have in place an effective AML/CTF framework.  A licensee must be able to evidence the suitability of its AML/CTF framework and compliance with the AML/CTF requirements pertaining to its business to the Commission.

An Insurance licensee must ensure that at all times they meet the requirements for the minimum criteria for licensing, schedule 4 of the Insurance Business (Bailiwick of Guernsey) Law, 2002. This includes a requirement to meet and adhere to any rules, codes, guidance, principles and instructions issued from time to time under any other enactment as may be applicable to the business, and this would also be inclusive of the Guernsey AML/CTF framework.

Missing the Elephant in the room.

Sara Barclay AML/CTF, Due diligence , ,

These last few weeks I have been thinking back to myCompliance monkey time in Law Enforcement. Those of you who can remember back that far probably have an image of a young surfer dude who turned up in the most scruffiest uniform, collar half in half out, requiring either a haircut or beard trim, usually both and never mind the lack of tie!

Those who worked with me will probably remember a person who worked manically yet methodically, questioning everything, discussing and testing theories before providing a list of potential targets for Officers to stop and check out. I am very proud to have been one of the highest seizing drugs Officers during my time, but all this could not have been done without the above, the support of my senior officers (and at times I pushed them to the limits) and the Law Enforcement Officers and teams I worked with, who looked at the whole.

In recent weeks there has been a lot of international interest in the offshore world regarding tax avoidance and tax evasion as well as financial crime, which has included revelations of HSBC in Switzerland. This post is not about HSBC, what is or isn’t tax evasion or even the ethics behind tax avoidance or financial crime, but I hope to try to provide some advice where the due diligence process fails. I have previously written about how due diligence is only part of the solution. As a past Customs and Immigration Officer and now as a compliance manager and consultant these documents are essential in identifying and verifying the target/ client but this is by no means the be all or end all.

It is all about the analysis of information in front of us, checking these details and asking the questions not our pre-conceived ideas or prejudices. Do we ask the question of why our clients invest offshore or set up dynastic structures or entrepreneurial structures offshore, do we understand and test and document, this rationale and reason and do the transactions make sense and fit the profile?

As a Law Enforcement Officer I would start by building a picture of travellers, and ask myself if the analysis I had in front of me made sense. Were there any comparisons to known smuggling and people trafficking profiles? Then I would seek out the experience of my peers, asking questions and gaining in-sights, understanding and clarifying what I had in front of me. This is no different from a Financial Services Business, where you are obtaining identification details, verifying these with documentation, researching through the various open-source intelligence databases for known facts, asking questions regarding the rationale. Seeking supporting evidence e.g. tax/ legal rationale and advice for the creation of a structure, its suitability and comparing the client and business relationship to known criminal profiles.

Having assisted licensees when they have been subjected to on-site visits by the Commission the main observation is, to a greater or lesser extent, that the requirements of the Regulations and the Handbook have been met. Some licensees have gone for just meeting the required standards others are far in excess of what is required by the regulations, but all generally pass with only the criticism of lack of former names or certification not meeting the expectations of the Commission. The real bug bear for the Commission is the lack of or insufficient periodic review. Yes we screen for sanctions, yes we check the appropriateness of our due diligence and we risk assess to what we see in our verification documents and from our refreshed our database checks but is this enough? Well unfortunately no it’s not and we are missing the Elephant in the room.

We spend alot of time getting the tax/ legal advice, the rationale of the relationship and the expected transactions at the start of the on-boarding process but we seldom question these areas again in the course of the business relationship. Tax advice is valid when it is given and after that it is outdated and what was legal tax mitigation can become tax evasion, transactions vary due to life circumstances including financial crime, entrepreneurial relationships change due to economic reasons and taking advantage of situations, some which can be financial crime. The information is in front of our eyes yet we fail to look at it, react to it, analysis it and document these changes or question the rationale.

Being miles above and beyond regulation may serve little purpose apart from to annoy clients and make the offshore world difficult to invest in and access for those with legitimate reasons and rationales. You may think it looks good to a Regulator to be gold platted but that is not the case as they are only looking at compliance with the regulatory requirements. The information to detect financial crime in all its guises is in front of us, the transactions, the file notes of meetings and the tax advice or legal advice. All this allows us to analyse the client to ensure that what we have fits in to our knowledge and understanding of the them and that what we have is legal and remains legal. This though is the Elephant in the room we seldom look at and where Regulators will not look kindly on when they find it lacking, regardless of how high above the required due diligence standards you are!

In all these Financial crime and Tax evasion cases if the advice had been looked at, the transactions and rationale been reviewed in detail would things have been different? It is not OK to say things were different back in the day, it does not absolve you or anyone from financial crime or being complicit in it.

If the only thing you take from this is to look at the whole picture, analyse all the information and rationale of a client, ask any questions you can’t fathom out, and obtain answers and document your full review, this post will have been worth it.

Don’t change for the sake of change!

Sara Barclay AML/CTF, Compliance Monitoring, Corporate Governance , ,

It has been an interesting few weeks with lots of nervous Directors concerned with their compliance functions and wondering what to do in light of the recent Commission’s findings and fines that have been publically issued. What must be remembered is that the Directors are responsible for the compliance function and framework (Chapter 2 of the Commission’s Handbook’s) of their business and not the consultants they may employ.  So what needs to be done?

Don’t Panic! There really is little point in panicking and it will only tend to make things worse. Panicking only creates more fears, which may not be justified in some cases, fear then leads to aggression and that only leads to breakdown in communication. The key in gaining an understanding of what has happened and where your business may sit in the regulatory framework will be down to communication with your compliance provider.

Review your compliance framework. Are you satisfied that you have all the evidence to support the previous findings of your compliance function provided by your consultants? Does their review go far enough and look at all the areas of the regulation that pertains to your business? Are they evidencing their findings suitably to back up their conclusions? At the end of the day your compliance framework is your responsibility and you need to evidence that you are satisfied with it, those that undertake the review role and that you have oversight to control it.

I have previously had licensees who would sit down with me during the year and go through my monitoring programme and how they correlated to the reports I was providing them. The positive was that it gave them comfort and evidenced to the Commission that they had true oversight and control of their compliance framework.

Communicate clearly and calmly. This is important, the oversight review you have done will provide you with questions that you need to have satisfied.  In light of the recent Commission actions and public statement released, you will also need to know the facts of what happened and why it happened as you need to assess if you could find yourself in the same situation of being incorrectly reported to on the regulatory requirements.

Even if your provider was not concerned in the recent Commission’s action you need to ensure that they would not put your business in jeopardy. It is important that from your review you can put any queries or concerns across in a calm manner. Your consultants may be defensive but the discussion needs to be open and honest so you can establish the facts. It is vital that your consultants and/or their management have the ability to constructively deal and satisfy any questions or concerns you may have.

Potential areas to discuss and obtain evidence on. Are you satisfied with the work that has been and continues being undertaken? Do you need to increase the time that the consultants provide to your business? Is the compliance monitoring utilised to assess your business suitable? Do the reports provided to you evidence the review that has been undertaken and do they cover the requirements of the regulatory framework? Are you getting the service that you require and want, remember you are the customer here!

Are the consultants suitably qualified or knowledgeable in the areas pertaining to your business, and have you got the evidence? It is always best to assume that you need enough information to satisfy yourself as you would for any of your employees. Your compliance consultants will be able to provide you with evidence of the consultant’s qualifications and suitability.  I was always more than happy to provide my certificates to licensees as I am very proud of what I have achieved!

Review, assess, conclude and evidence. Once you have the responses to your queries and concerns, you will be in a situation where you can review and assess where your current framework is and where it is going. You may be satisfied that everything is suitable or your compliance consultants are making changes to bring their game up for you and are able to service your requirements appropriately going forward. You may find that it’s time to bring your compliance function in-house wholly or partially, or if you remain unsatisfied you have the option to move to another provider, but do your due diligence.

What is vitally important in your conclusion is that you evidence all of the findings. The Commission will be asking you the questions about your compliance framework, how you monitor and mitigate the risks and are able to ensure oversight. You will be held accountable by the Commission so you need to have the answers and evidence. It’s just good Corporate Governance at the end of the day.

I was approached earlier this week by a Licensee who had just been visited by the Commission. The Commission was impressed that AML/CTF was discussed and documented at their meetings and how this evidenced the oversight and responsibility the Licensee took. One happy Licensee always means one happy Compliance monkey. This shows the power of good minutes and how the Commission view the importance of them in the evidencing of the oversight of the compliance function taken by Licensees.

At the end of the day you do not want to be jumping from the frying pan into the fire. People make mistakes it is whether they can learn from them.  Whatever conclusion you come to will allow you to make the best decision for your business, just make sure that it is clearly evidenced. Don’t change just for change sake!

Briefing note 002- Trust Company Business On-Site Examination Findings from Jersey

Sara Barclay AML/CTF, Business Risk Assessment, Compliance Monitoring, Corporate Governance , , , , , ,

Image

The Jersey Financial Services Commission (“JFSC”) has recently published its 2013 on-site regulatory examination findings in respect of Fiduciary business conducted in Jersey. These findings are pertinent to any financial service business, Compliance Officer and Money Laundering Reporting Officer (“MLRO”) in ensuring that they are adhering to the Guernsey regulatory framework. I believe that key points from the examination findings are as follows:

Evaluation of Suspicious Activity Report’s (“SAR’s”) and reporting to the Financial Intelligence Unit (“FIU”):

  • Delays in the acknowledgement of receipt of an internal SAR to the person disclosing.
  • Lack of detailed investigation by the MLRO to support the decision made.
  • Follow-up action resulting from internal reports not being undertaken or no evidence of follow-up action were noted.
  • Lack of autonomy by an MLRO and the decision to report to the FIU being made by Board rather than the MLRO.
  • Internal reports not being recorded accurately and being overlooked by the MLRO leading to late reporting to the FIU.

Corporate Governance:

  • Board discussions not being fully documented in some instances.
  • Concerns were identified in respect of the Board interaction, reporting lines and the functions of delegated risk committees of cross-divisional functions of a business.
  • Term’s of reference for delegated functions of the Board not being in place.

Business Risk Assessment (”BRA”) and Strategy:

  • Lacking details of the consideration of the following areas;
    • Organisational factors;
    • Jurisdiction of customers;
    • Underlying activities of Customers, including Politically Exposed Person risk;
    • Products and services specific to the business (third parties);
    • Delivery of those products and services;
    • Outsourcing risk to other branches or third parties and;
    • Not separating its BRA assessment from that of the Manager.

Conflicts of Interest:

  • No documented consideration of potential Conflicts of Interest where multiple licences are held and products are provided to customers who are common to both licenses.
  • Consideration and documentation of wider Conflicts of Interests, such as the investment in to customer structures by a Director.
  • Consideration of the risk where a significant shareholder of the business introduces customers.
  • Non-Executive Directors maintaining a direct relationship with a customer.
  • Conflicting roles of Compliance Officers the anti-money laundering function where the individuals also held a primary customer facing role.
  • Consideration of the impact of close staff relationships particularly at a senior level e.g. husband and wife.
  • Policies and procedures for declaring and monitoring were identified.

Compliance Function:

  • Inconsistent attendance at Board meetings by the Compliance Officer.
  • No separate reports in respect of Compliance and the anti-money laundering and combatting terrorist financing (“AML/CTF”) function.
  • Reports not containing the following;
    • Regulatory updates;
    • Progress of compliance monitoring;
    • Updated position on compliance registers, and;
    • Information on periodic reviews and accounting records.
  • In some cases there was a lack of documenting of matters brought to the attention of the Board.

Compliance Resourcing:

  • Back logs in periodic review cycle.
  • Delays in compliance monitoring
  • Not undertaking action in respect of regulatory updates.
  • Out of date policies and procedures
  • Ongoing projects and remedial work not completed.
  • Concerns in respect of the investigation and determination of SAR’s.
  • Meeting the day-to-day requirements of the compliance role, where the Compliance Officer or MLRO held other roles within the business.

Compliance Monitoring:

  • Compliance Monitoring Programme’s (“CMP’s”) task orientated rather than a schedule of testing of the operational procedures.
  • CMP’s not being seen or approved by the Board.
  • Ineffective reporting of the progress or completion of the CMP and of the remediation of compliance findings.
  • Compliance testing of the areas of the business lacking in detail.
  • Ineffective mapping of the business to the regulatory framework.

Business Acceptance Systems and Controls:

  • Procedures not being specific regarding the prescribed due diligence required for higher risk customers and business relationships.
  • Undertaking transactions prior to the acceptance of the customer by the Business.
  • The delay of obtaining verification documents and undertaking risk rating prior to the undertaking of customer transactions.

Customer Risk Management Systems and Controls:

  • Customer risk assessments not capturing fully the risks associated with customers or as detailed by the regulatory framework.
  • Customer risk assessment not capturing the risks identified by the business in the BRA.
  • Customer risk assessments not taking into account adverse information identified on the customer.
  • Weighting scores for risks not being appropriate to elevate overall the risk to high where required.
  • Lack of guidance to assist staff in the completion of the customer risk profile.

Customer Profile

  • Vague customer profiles not capturing the expected pattern and frequency of expected transactions.
  • Customer information held in various places rather than centrally.
  • Where the rationale for the business relationship was recorded as tax planning or mitigation, Licensee’s did not hold the relevant tax advice.

Politically Exposed Persons:

  • PEP’s being declassified contrary to the regulatory framework.
  • Immediate family members and close associates not being designated as PEP’s

In conclusion Licensees and the Boards must ensure that they have up to date compliance procedures, their functions are staffed and resourced appropriately and ensuring that they have suitable and sufficient management information for their compliance status being provided in a timely manner to them.  The role of the MLRO is coming more into focus with Regulators especially its assessment by the Board.  The MLRO function needs to be adequately resourced with a suitable and autonomous person, it is my opinion that this role will become more of a focus of regulatory visits and evidence of its review and suitability will required to be documented.  I would always advise that a separate compliance report and MLRO report is provided to the Board to ensure that matters are easily identifiable to the Board.  Conflicts of interest must be recorded and the risks assessed appropriately.   The BRA must take into account the risks that customers pose to the business and also the AML/CTF risks detailed by the regulatory framework and where they are not applicable they should be noted as such. What I believe is the most important finding to come out is, ensuring customer risk assessments and profiles are detailed and maintained ensuring that all risks are covered in the BRA.  I would advise that you assess your business to these findings and if any matters are found a remedial programme is put in place and signed off by the Board ensuring appropriate timescales and reporting is in place.

.

Briefing Note: Jersey Financial Services Commission Onsite Examination Findings.

Sara Barclay AML/CTF, Compliance Monitoring, Corporate Governance , , ,

Compliance monkey

The Jersey Financial Services Commission (“JFSC”) conducted an onsite examination of one of its fiduciary licensee’s which has resulted in a public statement being issued. The findings provide an insight in to the areas that our sister Island regulator is focusing on and the regulatory action they are taking in respect of their findings. I believe that the key points of the onsite examination are as follows;

Anti-Money Laundering and Combatting Financing of Terrorism (“AML/CTF”)

The key points made in respect of the examination of the area of AML/CFT noted the following areas as failure to comply with the AML/CFT regulatory requirements:

  • Out of date CDD.
  • Lack of sufficient evidencing of source of funds and source of wealth.
  • Lack of evidence to demonstrate that CDD had been sufficiently evaluated.
  • Inadequate evidence of EDD having been undertaken on High Risk customers
  • Inadequate evidence of the review of risk assessments.
  • Providing registered office only business and the issuance of Powers of Attorney with little control of the risks and oversight expected to be applied to these products.

 

An investigation was also undertaken into a customer entity that had received funds that may have been connected to a fraud. The investigation found the following matters of concern:

  • Mind and management not with the Jersey appointed Directors but with the beneficial owners.
  • Lack of questioning and properly understanding the activities of the customer entity.
  • Allowing payments to be made by the Customer entity without knowing or assessing whether adequate funds would be available to complete transactions.
  • Over reliance on the ultimate beneficial owners instructions and did not challenge the rationale for acquiring assets.
  • Receiving loans which did not have formal loan agreements and were from entities that had the same beneficial owners.
  • Failing to understand the source of funds through the customer entity.
  • Failing to consider adverse information made available to it regarding the source of funds received by the customer’s entity.
  • Receiving funds without knowledge of the remitter and paying them out the next day.
  • Failing to keep adequate books and records for the customer entity
  • Being re-active instead of pro-active in the management of the customer entity.

 

Breaches of the Code of Conduct of Trust Company Business

The key points that led to breaches of the Jersey regulatory framework and principles for the conduct of Trust Company Business were as follows:

  • Failing to act with skill, care and diligence.
  • Failing to evidence in writing decisions made.
  • Failing to identify conflicts of interests.
  • Failing to ensure adequate review procedures were implemented to monitor Trust Company Business.
  • Failing to maintain adequate internal systems and controls.
  • Failing to exercise an adequate level of Corporate Governance.

These failures led to remedial action having to be implemented as follows:

  • Directors stepping down and the appointment of new local Directors and a new Non-Executive Chairperson.
  • Review in conjunction with an external resource of the processes and procedures of the business to effect changes to strengthen its systems and controls.
  • Initiation of a review process of customer files to remedy customer due diligence deficiencies.
  • Remediation programme has been put in place to rectify issues identified by the investigation.

In conclusion I believe that a robust compliance function and a compliance monitoring programme encompassing the regulatory framework would have alerted the business to its deficiencies and assisted in the evidencing of areas of concern that required remedial action that were subsequently identified by the JFSC .  I recommend that the points raised are taken in to account in any Financial Regulated or Registered Business and assessed against its current compliance framework. If you do find that you have issues of concern or that you cannot adequately evidence compliance to the regulatory framework my advice is to form a remediation plan and inform the Commission as soon as practical. A problem shared is a problem halved, I cannot give any guarantees that you will not face regulatory sanction but being open and honest has the potential to reduce or negate the use of regulatory sanctions, as William Mason Director General, mentioned in his December 2013 address to the Industry.  If the regulator in our sister Island is looking at these areas I believe that the Guernsey Commission will also be.

Is Client Due Diligence there to stop Criminals and Criminality?

Sara Barclay AML/CTF , , , , ,

ImageOver the last few years of training people in the weird and wonderful world of AML/CTF I have noticed that people have become despondent with the subject.  I will be the first to admit that it can be a pretty dry subject if not put across well.  One of the areas of despondency that Licensees and their employees have with AML/CTF comes from the task of collecting Client Due Diligence (“CDD”).  Will the collation of CDD actually stop criminals utilising the Bailiwick?  Does this process have any effect on stopping criminality? With some Licensees believing that this burdensome exercise acts as a detriment to business, is this really the case or a misunderstanding?

Stopping criminality and criminals using the Bailiwick by obtaining a passport and utility bill is improbable. It is very unlikely that on production of these documents that they will inform you that they are a criminal and will be using your services and products for their criminality (I have only ever had one unsuccessful drug importer inform me what he was up to when stopped, but that’s another story). These documents are provided to criminals by Government agencies and Utility firms, legitimately, as it is the criminal’s human right after all to be able to live and travel and many do have legitimate incomes.  Criminals will sometimes use fraudulent documents which I’m afraid are prevalent in today’s society.  Fraudulent documents are cheap and easy to obtain and in today’s world of computer technology easy to produce to a very good standard, just look at the print quality of documents that you produce in your office on a day-to-day basis!  Criminals have access to the same if not better technology. Criminals in my experience are only different from ourselves through their moral and ethical values. Ethical and moral values change throughout a person’s life due to the situations they find themselves in and therefore a legitimate customer at a start of a business relationship may change in to a criminal. Unfortunately a passport or utility bill will not tell you if your customer will become a criminal at a later stage.

We are an International Finance Centre respected worldwide for our professionalism and the quality of our products and services and this will naturally be attractive to our customers and potential customers as well as criminals.  Our regulatory framework requires us to identify and verify our customers by obtaining CDD and in my opinion this is not only for us to know our clients and undertake checks to identify any adverse information on them but it also assists Regulators and Law Enforcement Agencies in preventing and detecting criminality and identifying the perpetrators.  By obtaining the required level of CDD when international requests for assistance in investigations are received by either our Regulator or Law Enforcement Agency, it will allow a licensee to react effectively and efficiently, searching their client database to establish if there is any connection or potential connection.

Our Law Enforcement Agency and the Regulator receive requests for assistance from overseas agencies and from my experience the requests are not always the most detailed or extensive and sometimes not totally accurate, this is not the fault of the overseas agency as they are only as good as the intelligence they receive from their sources.  From my time in the Financial Intelligence Service it has never ceased to amaze me that with a little information provided to our Licensees they are able to quickly identify if there is a connection or a potential connection to an enquiry, this is a credit to the professionalism of their employees and commitment in not allowing criminals to prosper.

In one case I dealt with the request for assistance was received from an overseas Law Enforcement Agency who could only provide the suspected person’s name which was very common and a potential address. Not expecting a lot I was surprised to get a phone call from a local financial institution that had a possible match on the suspected person. Relaying this information back to the overseas Law Enforcement Agency their amazement was evident. With a bit more investigative work and liaising between the parties involved it transpired that the local financial institution did have the person the overseas Law Enforcement Agency believed to be involved in criminality, an exercise made easier due to the financial institution having obtained the required CDD which also led to further details being discovered.

I have also been told on occasions by overseas agencies that they always like dealing with the Bailiwick as they are able to establish quickly if there is a connection to their suspect.   This greatly assists them in directing and managing their case and also any potential prosecution. Something positive for all stakeholders in our financial industry to take away with them!

We can safely say that the CDD documents we obtain will not stop criminals utilising the Bailiwick but as you can see they do act as a deterrent.  These documents won’t stop criminality but they will assist in the fight to detect and identify effectively and efficiently suspected criminals when we receive requests from our Law Enforcement Agency or Regulators. The assistance we give to the international community allows the Bailiwick to hold its head up high while discrediting the view held by some out there that we are a safe haven for criminals and their ill-gotten gains, and we do have our supporters out there.

Explaining my view on the necessity to collate these documents, Licensee’s and their employees are able understand the vital importance that they and these documents play in deterring criminals and assisting the international community in the prevention and detection of crime. I hope I have removed the perception that the CDD collation exercise is worthless and burdensome to a business, while demonstrating that it is a worthwhile and a necessary part of doing business in a moral and ethical way. It is interesting to note the recent developments in the on-shore world to pass regulations in respect of identifying ultimate beneficial owners, something we have had in or regulatory framework and have been undertaking for a very long time!

Are we guilty of stopping investment in the developing world?

Sara Barclay AML/CTF , , ,

Compliance monkeyOne of the questions that I am asked when undertaking Anti-Money Laundering and Combating Terrorist Financing (“AML/CTF”) training is “should we just stop dealing with areas and customers that have a higher risk of money laundering and terrorist financing”? Why is it that people believe that Licensee’s and Guernsey must stop any business that may have a higher risk of money laundering terrorist financing? Has this led to a paranoia within our financial industry and could this be leading our industry to be potential uncompetitive and lacking the entrepreneurial spirit that directors, management and compliance officers should aspire to? Most importantly is our paranoia stopping us from providing investment into the developing world and allowing these people to remain in poverty?

The laws, regulations, codes, rules and guidance (“the Framework”) as published by the Guernsey Financial Services Commission (“Commission”) require that licensees have suitable and sufficient policies procedures and controls for the products and services provided to customers in order to protect the Licensee and the Bailiwick of Guernsey from being susceptible to money launderers and terrorist financiers. Licensee’s must not avoid their responsibilities or manipulate the framework, but ensure that at all times they conduct their business within the Framework. The Commission does not prohibit engagement with higher risk clients or Licensees and their customers being engaged in sensitive activities that are of a higher risk of money laundering or terrorist financing, only that licensees mitigate the risks suitably and demonstrably.

The policies, procedures and controls of a Licensee must meet the minimum requirements of the Framework, though there is nothing stopping a licensee from exceeding these requirements. The Framework is merely requiring Licensees and their employees to be able to identify and verify their customers, understand the reason and rationale of their customer in order that they can assess whether the use of the product or service is reasonable. The Framework also ensures that the minimum required information on a customer is obtained and can be provided by the licensee expediently to Regulators or Law Enforcement if required.

The Licensee must assess its customer’s not on prejudice or paranoia but on a risk based approach at the start and during the business relationship ensuring that they have sufficient knowledge and information on their client as required by their risk based approach and the Framework. Just because a customer is a higher risk of money laundering and terrorist financing does not necessarily mean that they are a criminal, just that the activities or the jurisdiction amongst other things may make the customer or their activities more susceptible to money laundering and terrorist financing and that more frequent monitoring is required to be undertaken.

 There are many opportunities in the developing world that will not only allow our customers to prosper but also the people of these jurisdictions to also prosper and be able to move themselves out of poverty.Telecommunications, mining, agriculture and cash machines are some of the business propositions that I have seen being presented to licensees by their customers only to be met by the paranoia that these may expose the licensee to money laundering or terrorist financing and must be avoided or declined.

Should the question that licensees ask when they take on customers or provided products or services to a client relate to the Licensee’s knowledge and experience of the customers activity, and if the policies, procedures and controls of the licensee are suitable and sufficient for this type of activity? If the answer is no can the Licensee enhance their knowledge or policies, procedures and controls or oversight of the customers activity to become comfortable in undertaking the engagement.

By acting in paranoia it is the Licensee and their employees not the Commission or the Framework that is letting customers down and the people of these developing countries. In some ways it could be argued that we are allowing money laundering and terrorist financing to prosper by not engaging with the development of legitimate business and opportunities in these developing countries.

We can never eradicate money laundering and terrorist financing, but by ensuring that a Licensee’s policies procedures and controls meet the requirements of the Framework I believe that they can engage with customers and activities that will provide a benefit to people in developing countries and enhance the living conditions and education for all. Would it not benefit these countries and people if by applying our high standards that money laundering and terrorist financing in all guises could be reduced?