Guernsey’s new anti-money-laundering regime will come into force on 31 March. Although the transitional provisions appear generous, the advice of this article is 'don’t delay, act now.'

The Criminal Justice (Proceeds of Crime) (Bailiwick of Guernsey) (Amendment) Ordinance 2018 was approved by the States of Guernsey in December and Guernsey’s new anti-money-laundering and anti-terrorist-finance AML/ATF regime, comprising a new Schedule 3 to the Proceeds of Crime Law and a revised "Handbook on Countering Financial Crime and Terrorist Financing" (actually a rulebook) will come into force on 31 March. The final version of this revised rulebook was issued by the Guernsey Financial Services Commission on 12 March and is a vital document for all 'specified businesses' - a term that covers both financial service businesses (such as banks, investment firms, fiduciaries and insurers) and lawyers, accountants and estate agents.

Still awaited is Guernsey’s National Risk Assessment, which will set out a summary of the threats, weaknesses and consequences of money laundering, terrorist finance and other forms of financial crime, including the funding of the proliferation of weapons of mass destruction, to Guernsey as a jurisdiction. The latest indication about timing is that the Guernsey authorities will issue this in late June or early July. This is later than expected and its tardiness, in turn, is affecting the transitional provisions for compliance with the new AML/ATF regime. However, there is plenty that firms can, and should, be concentrating on in the meantime.

Firms ought to look to the National Risk Assessment for guidance when revising their own Business Risk Assessments. They will soon be required to prepare separate assessments in respect of money laundering and terrorist finance. Each firm can include those assessments in the same document, but it should keep them distinct from one another.

The need to involve directors and partners

Firms ought to finish revising their Business Risk Assessments four months after the date on which the authorities publish the National Risk Assessment, which ought to be at the end of October. However, it should be emphasised that this is the date by which the Business Risk Assessments must be fully completed AND reviewed AND approved by every firm’s board or partners, so it is important not to let things drift over the summer months, especially if there are specific set dates for board or partners’ meetings that have to be taken into consideration.

The new rulebook also requires directors and partners to 'take ownership' of their firms' Business Risk Assessments. It is important that ALL directors or partners are fully involved in this process; it is not the sole responsibility of 'Compliance' or the Money Laundering Reporting Officer, for example.

Firms also ought to determine and write down their 'risk appetites' and tell their staff about them with the utmost clarity. It is imperative for employees to understand the implications of their firms' risk appetites in respect of their day-to-day activities - particularly those employees who are involved in customer-facing or business-development jobs. Employees should know (and be able to tell others) about the risks that their firms are prepared to run and, perhaps more importantly, the risks that they are NOT willing to run.

Enter the MLCO

The new rulebook also creates the position of the MLCO – the Money Laundering Compliance Officer. Although most financial firms are highly likely to have appointed a compliance officer already, there has been no requirement until now for lawyers, accountants and estate agents to have a named compliance officer and this will pose a challenge for smaller firms.

It should be noted that the job of the MLCO is a crucial one. According to the new rulebook, released in November, the MLCO will “have responsibility” for a firm’s compliance with its policies, procedures and controls to forestall, prevent and detect money laundering and terrorist finance. The MLCO must also be a “natural person,” so the firm in question cannot appoint a company to do the job. He must be of at least management rank, have the appropriate knowledge, skill and experience and be fully aware of his own obligations and those of the firm.

Although the Guernsey Financial Services Commission has said that it is the board or the partners at each firm who remain ultimately responsible for its compliance with the rulebook and has added that it sees the MLCO as a “monitoring role,” there is no doubt that it will scrutinise the MLCO if it finds firms AML/ATF policies, procedures and controls wanting.

The same individual can be appointed to the positions of MLCO and Money Laundering Reporting Officer if the firm sees fit. The MLCO can also do other jobs at the firm but any potential conflicts must be identified, written down and managed. The firm can outsource the MLCO's job, subject to appropriate policies and procedures being in place, and if the firm is part of a wider group it might be able to use expertise outside Guernsey; the MLCO, after all, does not have to be resident in Guernsey but “in the British Islands” – meaning Guernsey, Jersey, the UK and the Isle of Man.

As this is a new position, every firm is required to appoint its MLCO by 31 March and to notify the Guernsey Financial Services Commission of the appointment by 14 April.

It is crucial that, if they have not done so already, firms should identify and appoint the right people to be their MLCOs. Firms need to think carefully about the level of support and training with which they are going to provided their MLCOs and will also have to afford them meaningful access to their boards or partners if they are going to do their jobs effectively.

The long reach of beneficial ownership checks

Another major change will come in respect of the identification and verification of the identities of “beneficial owners” of companies. Firms in Guernsey are familiar with the revised requirements in respect of Guernsey companies, but the new rulebook extends those requirements to apply to companies incorporated in jurisdictions other than Guernsey.

The new requirements involve a three-stage process. In step one, each firm must identify and verify the natural person(s) who control it “through ownership” – meaning the holding, directly or indirectly, of more than 25% of the shares in that company, or more than 25% of the voting rights, or the holding of the right to appoint or remove directors by the holding of a majority of the voting rights on all (or substantially all) matters at meetings of the board.

If no such person(s) can be identified, the firm should move to step two. This requires it to identify and verify any people who exercise control over the company “by other means.” This could include, for example, a situation in which the natural person with the controlling interest is dominated by another individual because of a familial, employment, historical or contractual association and, in practice, the natural person with the controlling interest is bound to be influenced in his decisions by that individual. If no natural person(s) can be identified by either step one or step two, the firm should move to step three, which requires it to identify and verify any person who is a “senior managing official.”

However, in situations where a natural person has been identified under step one but there is reason to believe that another natural person is also ultimately exercising control over the company by other means (step two), the firm must identify and verify the natural person(s) under both step one and step two.

Dates for the diary

Although the deadline for the revision of firms’ policies and procedures to ensure that they comply with Schedule 3 and the new rulebook is not until seven months after the publication of the National Risk Assessment (and therefore likely to be January 2020), the changes to the beneficial ownerships provisions are not affected by this timing directly. Firms should therefore start to change their policies, procedures and checklists now to meet the revised requirements. They should also ensure that staff receive training in the new requirements. This is because a failure to identify and verify the correct beneficial owners of the company constitutes a breach of Schedule 3 and the new rulebook.

When a measure can be enhanced

The new rulebook continues to call on firms to take a risk-based approach to compliance, the better to concentrate their efforts where they are most needed. Although the current rulebook refers to three levels of 'customer due diligence,' otherwise known as 'know your customer' measures – 'simplified' CDD for customers who pose a low risk, normal CDD for normal or standard-risk customers and 'enhanced' CDD for highly risky customers – the new rulebook introduces the fresh concept of 'enhanced measures.'

This term applies to certain categories of customer, irrespective of their risk ratings. It is possible for a firm to decide that a customer poses a low risk for the purposes of money laundering and terrorist finance, but he might still qualify for enhanced measures. The majority of many Guernsey firms' clients will fall into the right categories for enhanced measures.

Those categories are:

• a customer who is not resident in Guernsey;
• the provision of private banking services;
• a customer which is a legal person or legal arrangement (perhaps a trust) used for personal asset holding purposes; and
• a customer which is a legal person with nominee shareholders or owned by a legal person with nominee shareholders.

The new rulebook describes the enhanced measures that might apply to each of the four categories. It is likely that firms will have already taken some of these – for example, by ensuring that they have established customers’ sources of funds and of wealth. However, they are going to have to review their client bases and, where necessary, 're-badge' the CDD they are already undertaking as 'enhanced measures.' They must also see to it that the enhanced measures they take are relevant to the risks that pertain to the customers against whom they are taking them.
 
Again, these changes are not affected by the date on which Guernsey is releasing its National Risk Assessment. Firms should therefore start to take action now, especially in situations where enhanced measures will apply to all, or most of, their clients. They must review all existing highly risky customers and bring them into compliance with the new rulebook by 31 December 2020; for standard-risk and low-risk customers the deadline is 31 December 2021.

Enhanced measures, enhanced CDD

Firms also ought to consider the interplay between enhanced measures and enhanced CDD for highly risky customers, because major changes are occurring here as well. The new rulebook establishes three situations in which a business relationship absolutely must be assessed as highly risky: business relationships involving foreign "politically-exposed persons" or PEPs, business relationships in which the customer has a relevant connection which “credible sources” say provide funding or support for terrorist activities and business relationships in which the customer, beneficial owner, or any other legal person in the ownership and control structure of the customer, is a legal person in possession of bearer shares or bearer warrants.

The new rulebook does not include a definitive list of the “credible sources” on which firms might rely when determining whether a country or territory provides funding or support for terrorist activities. Firms should therefore undertake their own investigations to establish a written record of relevant countries and territories.  

The joy of PEPs

The new rulebook also introduces three different “strains” of PEP: foreign PEPs, domestic PEPs (who preform relevant public functions in the Bailiwick of Guernsey, meaning Guernsey, Alderney and Sark) and "International Organisation PEPs" or IOPEPs. These last people occupy senior positions – director, board member, councillor or equivalent – in organisations such as the World Bank, the United Nations and the North Atlantic Treaty Organisation.

Not all Guernsey, Alderney and Sark politicians are considered to be domestic PEPs. Firms ought to look at Appendix E of the new rulebook, which sets out a list of the jobs and positions that qualify.

Only foreign PEPs will absolutely have to be classified as highly risky. Each firm will have to embark on enhanced CDD in relation to them. If a foreign PEP is the firm’s customer, he will also qualify for 'enhanced measures' because he is not resident in Guernsey. Domestic PEPs and IOPEPs are more of a grey area; firms must consider their jobs when assessing the risks that they pose, but they need not classify them as highly risky. When a domestic PEP is a customer at a financial firm, he will not qualify for enhanced measures because he is not resident in Guernsey. IOPEPs, however, are likely to qualify.

The new rulebook also allows for the de-classification of PEPs, albeit with some exceptions. Foreign PEPs and IOPEPs can be 'de-PEPped' seven years after they cease to hold relevant office, although this does not apply to heads of state or IOPEPs in certain very senior jobs. Domestic PEPs can be 'de-PEPped' five years after they cease to hold relevant office.   

Firms will obviously have to review their policies, procedures and controls to obey the new rules and the new categorisations of PEPs. Firms will also have to review their PEP registers and restructure them to capture the different types of PEP. They will also have to decide whether they might be able to declassify any of their existing PEP clients and, if so, when.

Dire consequences for the unwary

This is going to entail a lot of hard work. It will be important to get it right; a breach of Schedule 3 Proceeds of Crime Law is a criminal offence for which the penalty is an unlimited fine and up to five years in prison. Any firm that contravenes the new rulebook might suffer from regulatory action, which might include the imposition of conditions on its licence to do business, the revocation of its licence, adverse public statements and financial penalties. Failures might also lead the regulators to take action against important people at firms such as directors, partners, senior managers, MLROs and, for the first time, MLCOs. In addition to being fined and mentioned in withering public statements, people can be prohibited by the Guernsey Financial Services Commission from working at regulated financial firms ever again.

The hard work starts now!

* Andrew Laws can be reached on +44 1481 746107 or at a.laws@babbelegal.com