Financial Crime Supervision and Policy Division Training Thematic Review Report of Findings

Financial Crime Supervision and Policy Division Training Thematic Review Report of Findings 8 June 2016

Executive Summary
Executive Summary
During 2015 the Financial Crime Supervision and Policy Division conducted a thematic review of financial crime training and the policies, procedures and controls utilised by firms across the financial services and prescribed business sectors. This review covered 62 firms employing a total of 2,238 people. The Commission concluded from the findings that firms broadly had good awareness of the requirements in respect of money laundering and terrorist financing training and had enacted appropriate policies, procedures and controls to ensure compliance with their regulatory obligations. One particularly positive observation was the level of professionally qualified staff members and directors across industry, with 58% of all Board members and 54% of employees holding professional qualifications. This figure increases to 65% and 64% of fiduciary and banking Boards respectively, the two sectors considered to be at a higher risk of money laundering and terrorist financing by the Financial Action Task Force. Notwithstanding the above, a number of areas were identified where controls could be strengthened to better protect businesses and more widely the reputation of the Bailiwick against financial crime risks. The main finding identified from this review was a disconnect between those AML/CFT and financial crime risks which firms identified as the greatest threat to their business and the content of the AML/CFT and more general financial crime training provided to staff and Board members. Nearly three quarters of firms surveyed identified fraud as one of the top three financial crime risks to their business, but only six of those firms specifically covered fraud in the regular training provided to staff. A similar picture emerged in relation to other risks. Given the critical role played by employees in protecting firms from their abuse by financial criminals, the Commission would expect the risks identified by firms in their business risk assessments to flow through into training. In addition a significant difference was identified in the approach to training taken by firms which were
part of international business groups compared to those firms with Bailiwick-resident owners. In this
respect, firms in international business groups spent on average almost two and a half times more than locally owned firms on financial crime training, resulting in more frequent training for all staff employed by firms which were part of international groups. Whilst the review spanned all sectors of the industry there were few discernible trends on a sector specific basis with the exception of two areas: spend on financial crime training per sector and the form of periodic training. Finally, I should like to take this opportunity to thank each of the 62 firms which responded to the thematic questionnaire, and in particular those seven firms who met with representatives of the Financial Crime Supervision and Policy Division to discuss their policies, procedures and controls in more detail. This report reflects the findings from the thematic review and I hope its content will be useful to all regulated firms within the Bailiwick when assessing their training needs and policies, procedures and controls. Fiona Crocker 8 June 2016

Contents
Contents

1. Background.........................................................................................................................................1
2. Scope...................................................................................................................................................1
   2.1. Regulatory Requirements............................................................................................................1
   2.1.1. Financial Services Businesses..............................................................................................1
   2.1.2. Prescribed Businesses ..........................................................................................................2
   2.1.3. Minimum Criteria for Licensing ..........................................................................................2
   2.2. Approach .....................................................................................................................................3
   2.3. Sample .........................................................................................................................................4
   2.3.1. Licensed and Registered Businesses....................................................................................4
   2.3.2. Employees............................................................................................................................5
   2.3.3. Professional Qualifications ..................................................................................................7
3. Provision of Training ..........................................................................................................................9
   3.1. Induction Training .....................................................................................................................10
   3.1.1. Form of Induction Training................................................................................................10
   3.1.2. Timing of Induction Training.............................................................................................10
   3.1.3. Exceptions to Induction Training Policy............................................................................11
   3.2. Periodic Training .......................................................................................................................12
   3.2.1. Form of Periodic Training..................................................................................................12
   3.2.2. Frequency of Periodic Training..........................................................................................13
   3.3. Enhanced Training.....................................................................................................................14
   3.3.1. Board or Senior Management ............................................................................................14
   3.3.2. Money Laundering Reporting Officer and Nominated Officer..........................................15
   3.3.3. Outsourcing of the Money Laundering Reporting Officer Function..................................16
4. Content and Relevance of Training ..................................................................................................17
   4.1. Training Content........................................................................................................................17
   4.2. Financial Crime Risks ...............................................................................................................18
5. Control and Oversight of Training....................................................................................................19
   5.1. Board and Senior Management Oversight.................................................................................19
   5.1.1. Board Reporting .................................................................................................................19
   5.1.2. Compliance Review ...........................................................................................................20
   5.2. Effectiveness of Training...........................................................................................................20
   5.2.1. Methods of Establishing Effectiveness ..............................................................................20
   5.2.2. Employee Self-Certification...............................................................................................21
   5.3. Training Budget and Spending ..................................................................................................22
   5.3.1. Training Budget..................................................................................................................22
   5.3.2. Spending on Financial Crime Training ..............................................................................22

Contents
6. Conclusion ........................................................................................................................................24
6.1. Board Oversight.........................................................................................................................24
6.2. Subject Matter of Training.........................................................................................................24
6.3. Third-Party MLROs/Compliance Officers................................................................................24
6.4. Non-Executive Directors...........................................................................................................25
6.5. Compliance Monitoring and Measuring Effectiveness .............................................................25
7. Next Steps.........................................................................................................................................26
Appendix 1 - Glossary of Terms...........................................................................................................27

1. Background
   One of the most important tools available to firms to assist in the prevention and detection of money laundering, terrorist financing and other financial crime is to have staff who are alert to the potential risks and identifiers of suspicious activity. For this reason, the provision of appropriate and effective training for staff members is a crucial control in mitigating the potential exposure of a firm to its products or services being abused for illicit purposes. Under the Disclosure (Bailiwick of Guernsey) Law, 2007 as amended and the Terrorism and Crime (Bailiwick of Guernsey) Law, 2002 as amended it is a defence for an individual failing to report suspicion of money laundering or terrorist financing if they did not know or suspect that another person was engaged in money laundering or terrorist financing and that they had not been provided with training as required under the Regulations. The Regulations, which carry criminal sanction if breached by firms, and in turn the Handbooks therefore impose a number of requirements on firms in connection with the nature, relevance and frequency of training for directors and staff members to which firms must adhere. If a firm allows its employees to conduct their activities while not fully appraised of the risks it can lead to serious consequences, both for the firm and the individuals in question. In addition to the adverse publicity of a firm being connected with financial crime, it can also have a detrimental impact on the reputation of the Bailiwick as a well-regulated international finance centre.
2. Scope
   The provision of financial crime training was selected as the topic for this review on the basis of the importance of having suitably trained and experienced staff members who are cognisant of both the risks posed to the business and the controls established by the firm to counter the threat of financial crime. Additionally, weaknesses related to the quality and effectiveness of AML/CFT training, together with associated matters such as record keeping, are periodically identified by the Commission during its supervisory engagement with firms. The thematic review sought to gather information from a cross section of industry in respect of how training responsibilities under the Regulations and the Handbooks are fulfilled.
   2.1. Regulatory Requirements
   For ease of reference, the specific regulations and rules applicable to training have been included below.
   2.1.1. Financial Services Businesses
   Regulation 13(2) and (3) – ‘Employee Screening and Training’ Regulation 14(3)(b) – ‘Record-Keeping’ Regulation 15 – ‘Ensuring Compliance, Corporate Responsibility and Related Requirements’
   Chapter 2 – ‘Corporate Governance’
   Section 2.3 – ‘Board Responsibility for Oversight of Compliance’
   Section 2.4 – ‘The Money Laundering Reporting Officer’
   Chapter 3 – ‘A Risk Based Approach’
   Rule 71 – ‘Monitoring the Effectiveness of Policies, Procedures and Controls’
   Chapter 11 – ‘Employee Screening and Training’
   Chapter 12 – ‘Record Keeping’
   Chapter 13 – ‘Bribery and Corruption’
   Section 13.7 – ‘Training’

2.1.2. Prescribed Businesses
Regulation 13(2) and (3) – ‘Employee Screening and Training’ Regulation 14(3)(b) – ‘Record-Keeping’ Regulation 15 – ‘Ensuring Compliance, Corporate Responsibility and Related Requirements’
Chapter 2 – ‘Corporate Governance’
Section 2.3 – ‘Board Responsibility for Oversight of Compliance’
Section 2.4 – ‘The Money Laundering Reporting Officer’
Chapter 3 – ‘A Risk Based Approach’
Rule 85 – ‘Monitoring the Effectiveness of Policies, Procedures and Controls’
Chapter 9 – ‘Employee Screening and Training’
Chapter 10 ‘Record Keeping’
Chapter 11 – ‘Bribery and Corruption’
Section 11.7 – ‘Training’
2.1.3. Minimum Criteria for Licensing
The regulatory laws1 each set the minimum criteria which the Commission expects firms and the persons acting as directors, partners and/or managers within those businesses to meet. In assessing whether a person is a fit and proper person to a hold a licence or a particular position within a licensed or registered business, the Commission will have regard to, amongst other aspects:
‘his educational and professional qualifications, his membership of professional or other relevant bodies and any evidence of his continuing professional education or development’; and ‘his knowledge and understanding of the legal and professional obligations to be assumed or undertaken’. In making this assessment the Commission does consider if an individual has the requisite skills and understanding of the Bailiwick’s AML/CFT requirements and financial crime risks generally to which businesses are exposed.

1 The Protection of Investors (Bailiwick of Guernsey) Law, 1987 as amended – Schedule 4 The Regulation of Fiduciaries, Administration Businesses and Company Directors, etc. (Bailiwick of Guernsey) Law, 2000 as amended–
Schedule 1
The Banking Supervision (Bailiwick of Guernsey) Law, 1994 as amended – Schedule 3 The Insurance Business (Bailiwick of Guernsey) Law, 2002 as amended – Schedule 7 The Insurance Managers and Insurance Intermediaries (Bailiwick of Guernsey) Law, 2002 as amended – Schedule 4 The Registration of Non-Regulated Financial Services Businesses (Bailiwick of Guernsey) Law, 2008 as amended – Schedule 2

2.2. Approach
The thematic review consisted of two stages:
 Firstly a questionnaire was sent to 62 firms seeking responses to various questions related to the policies, procedures and controls in respect of AML/CFT and financial crime training, together with basic background information on the firms sampled.  Secondly, based on the responses given to the questionnaire, on-site visits were conducted to seven firms to gain a more detailed and practical understanding of their training arrangements. The questionnaire was broken-down into the following sections, which collectively covered the requirements of the Regulations and the Handbook connected with training and its associated controls:
Questionnaire Section Content
Background  Firm Ownership
 Risk Assessment and Key Risks
 Profile of Client Base
Resourcing  Number of Employees
 Recent Recruitment
 Professional Qualifications
Induction Training  Manner of Induction Training Provision  Timeframe for Providing Induction Training  Content of Induction Training Periodic Training  Manner of Periodic Training Provision  Timeframe for Providing Regular Training  Content of Periodic Training Board or Senior Management  Manner of Board or Senior Management Training Provision  Content of Additional Training MLRO, Deputies and Nominated Officers  Relevant Qualifications  Content of Additional Training Financial Crime Training  Content of Wider Financial Crime Training  Triggers/Prompts for Training Content and Relevance of Training  Setting of Training Content  Establishing Specificity to Guernsey  Tailoring of Training to Employee Needs  Frequency of Review of Training Content Control and Oversight of Training  Training Budget  Training Costs  Responsibility for Training Monitoring Effectiveness of Training  Methods of Assessment of Understanding  Use of Employee Self Declarations  Compliance Monitoring Programme Record Keeping  Manner of Record Storage

2.3. Sample
2.3.1. Licensed and Registered Businesses
The questionnaire surveyed 62 firms holding licences and registrations covering the complete spectrum of those sectors covered under the Bailiwick’s AML/CFT regime. All graphs contained within this report are based on the information and statistical data contained within the 62 questionnaire responses received. Some firms which participated held multiple licences. Sample of 62 Firms Broken-down by Licence(s) Held In selecting the firms for this review the Commission sought a sample within which every sector was represented but which was weighted towards fiduciaries and private banks where the risks of money laundering and terrorist financing are generally considered to be higher by the Financial Action Task Force. The sample included:
 31% of all licensed banks;
 23% of all licensed fiduciaries;
 14% of investment licensees with staff and premises in the Bailiwick;  11% of firms licensed by the Commission as authorised managers, insurance intermediaries and domestic insurers with staff and premises in the Bailiwick;  13% of non-regulated financial services businesses; and  6% of prescribed businesses (specifically 10% of legal professionals, 4% of accountants and 9% of estate agents). In addition to sector, the Commission also sought to establish if there were any discernible trends between firms which were part of international groups and those which were privately owned within the Bailiwick. As can be seen by the following chart, just over half of the firms sampled were those with Bailiwick ownership, with the remaining 48% consisting of firms which were part of international groups. Those international firms sampled were largely branches or subsidiaries of listed parent entities, with a small number of those international firms privately owned or part of larger privately owned groups. Banking 11% Investment 26% Insurance 8% Fiduciary 42% Prescribed Business 7% NRFSB 6%

Breakdown of Firms Sampled by Ownership Type
Breakdown of Firms Sampled by Ownership Type
2.3.2. Employees
At the time of the questionnaire being completed, the 62 firms participating in the survey employed a total of 2,238 people, of which 1,847 were employed within financial services businesses. This equates to 27% of the total number of people employed within the finance sector according to the States of Guernsey’s December 2015 Labour Market Bulletin. These were split as follows:
Sector (Primary Licence/Registration) Firms Employees Average* Banking 9 519 58 Non-Regulated Financial Services Businesses 3 26 9 Prescribed Businesses 6 391 65 Fiduciary 27 703 26 Investment 14 490 35 Insurance 3 109 36 Total: 62 2238 36

• Reflects the average number of employees per firm in that sector
  Private - Local
  52%
  Private -
  Overseas
  11%
  International
  37%
  Ownership Structure
  Banking Investment Insurance Fiduciary Prescribed Business NRFSB Private - Local 0 7 1 24 5 2 Private - Overseas 1 3 1 2 0 0 International 8 13 4 9 1 3 0 5 10 15 20 25 30 Number of Firms

Average Size of Firm (by Employees) by Sector
The 2,238 employees covered by the firms participating in the review represented the following categories of employee. It should be noted that one employee may be included in multiple categories where they hold more than one prescribed position within a firm, i.e. director and MLRO. Role Ins. Inv. Ban. Fid. NRFSB PB Total Executive Director / Senior Management 24 83 41 149 7 46 350 Non-Executive Director 7 14 23 22 1 1 68 MLRO / Nominated Officer 7 28 21 58 5 15 134 Relevant Employees 78 338 451 440 8 325 1640 Other Employees 5 54 9 94 9 28 199 Employees of Firm Sample by Role Banking, 58 Non-Regulated Financial Services Businesses, 9 Prescribed Businesses, 65 Fiduciary, 26 Insurance, 36 Investment, 35 Executive Director / Senior Management 15% Non-Executive Director 3% MLRO, Deputy MLRO & Nominated Officer 6% Relevant Employee 68% Other Employee 8%

Employees of Firm Sample by Contract Type
2.3.3. Professional Qualifications
The review encompassed 418 Board members (executive and non-executive) and/or members of a firm’s senior management team, together with 1,774 ‘relevant employees’ (including MLROs and nominated officers). The responses received identified that more than half of those persons within the scope of the review held a relevant professional qualification, which was either a financial crime specific qualification or a professional qualification which covers one or more aspect or module related to AML/CFT and financial crime. Board Members and Employees Holding Professional Qualifications Good Practice Two firms explained that staff are empowered to identify professional qualifications relevant to their function which they felt would increase their knowledge and/or skills and thereby benefit both the employee and the firm in their day to day work. The Commission noted that both firms had structured AML/CFT training programmes in place for all staff, supplemented with almost half of employees within each firm undertaking, or having completed, a professional qualification. Of the 418 individuals constituting Board members (both executive and non-executive) and/or members of senior management teams, 244 (58%) held a professional qualification. Full-Time Contract 78%
Part-Time
Contract
17%
Temporary
Contract
5%
418 244 1774 959
0
200
400
600
800
1000
1200
1400
1600
1800
2000
Board Staff
Number of Individuals
Total Qualified

Board Members Holding Professional Qualifications by Sector Breaking this figure down by sector, fiduciary licensees had the highest percentage of professionally qualified Board members, with 65% of directors holding a relevant professional qualification. In this regard the most common qualifications held within the sector were those run by the Society of Trust and Estate Practitioners. The Banking sector had the second highest level of professionally qualified Board members/senior management with 64%, followed by the Investment and Prescribed Business sectors at 54%, the Insurance sector with 42% and the NRFSB sector with 25%. Percentage of Board Members Holding Professional Qualifications by Sector With regard to firm ownership, the highest percentage of professionally qualified Board members were amongst those firms privately owned from overseas, with 70% of directors holding a professional qualification. Bailiwick owned firms were second with 57% of professionally qualified Board members and finally firms which were part of international groups with 49%. With regard to the size of firms surveyed, the Commission noted no discernible difference in the percentage of professionally qualified Board members, with the exception of the largest firms surveyed which had the lowest average number of qualified directors. 0 20 40 60 80 100 120 140 160 180 Banking NRFSB Prescribed Business Fiduciary Investment Insurance Number of Employees Total Qualified 0 10 20 30 40 50 60 70 80 90 100 Banking NRFSB Prescribed Business Fiduciary Investment Insurance Percentage of Board Members

Percentage of Professionally Qualified Board Members by Size of Firms’ Employment Base Amongst the wider employee base of firms, 959 of the 1,774 relevant employees covered by the survey had achieved or were studying for a professional qualification, equating to 54% of the sample. Good Practice One firm explained that as part of its investment in its staff and in order to incentivise employees to undertake professional qualifications, it provided rewards for the successful completion of any such study, as well as supporting employees financially and through the provision of study leave. With regard to MLROs, 55 of the 62 firms surveyed (89%) confirmed that their MLRO holds or is in the process of completing a professional qualification. The most popular professional qualification amongst MLROs was the International Compliance Association’s Diploma in Compliance, with a third having attained the diploma. Two other relevant qualifications popular amongst those sampled were the International Compliance Association’s Diplomas in Anti-Money Laundering and Financial Crime Prevention. Outside the financial crime specific qualifications achieved, nine firms sampled confirmed that their MLROs were qualified accountants and six stated that their MLROs were qualified lawyers. The Institute of Directors’ Diploma in Company Direction had also been completed by the MLROs of nine firms sampled.
3. Provision of Training
The provision of comprehensive and appropriate AML/CFT training is not only a requirement of the Regulations and the Handbooks, it also serves as a vital control to businesses in mitigating the risks of a firm’s products and services being used successfully in the commission of financial crime. While the Handbooks stipulate the timeframe within which training must be provided and the areas and subjects that training should cover, the manner in which training is delivered is open to firms to determine. The approach adopted by firms will depend upon the size, nature and complexity of the business; however classroom training, videos and technology-based training programmes can all be used to good effect depending on the environment and the number of people to be trained. The following chapter is broken down into three main areas and covers: the initial training provided to staff members at the commencement of their employment; the training provided to employees on a recurring basis; and the enhanced training provided to Board members, senior management and MLROs. 0 10 20 30 40 50 60 70 80 90 100 0-20 21-40 41-60 61-80 81-100 101+ % of Qualified Board Members Size of Firm by Number of Employees

3.1. Induction Training
3.1.1. Form of Induction Training
Various methods are utilised by firms to provide induction training to new employees, ranging from one-to-one sessions with the MLRO, through to group based presentations and discussions lead by external consultants. Manner of Induction Training Provision
3.1.2. Timing of Induction Training
The timeframe within which new employees must receive introductory AML/CFT training is not stipulated within the Regulations or the Handbooks. The Regulations instead provide flexibility to firms, provided that such training is delivered prior to an employee becoming involved in the day-to￾day operations of the firm. In this regard, 65% of firms surveyed indicated that they provide induction training within a fortnight of an individual commencing employment, with 34% providing said training within the first week. Conversely, 14% of the firms sampled provide induction training within three months of an employee starting. Timeframe for Induction Training Provision 0 5 10 15 20 25 30 35 40 45 Computer Based Internal - Group Pres. Internal - Group Disc. Internal - One-to-one External Consultant Self-Taught/ Reading Number of Firms Permanent Relevant Employees Temporary Relevant Employees Contract Staff Week 34% Fortnight 31% Month 21% Quarter 14%

Poor Practice
One firm indicated that new starters receive their induction training ‘upon satisfactory completion of their probation period’. The Commission would anticipate that initial training is provided as part of any induction process, with successful completion of training and an understanding of an employee’s AML/CFT obligations forming part of the firm’s consideration of whether that individual has successfully completed their probation. Good Practice One firm provides new employees with introductory AML/CFT training on their first morning with the Firm. In this respect a one-to-one session is held with the MLRO providing an overview of Guernsey’s AML/CFT regulatory regime, together with details of an employee’s personal obligations and the consequences for failing to comply with these obligations. A ‘Day 1’ pack is also provided, including an AML/CFT training document, a reporting suspicion summary and details of the MLRO and compliance team. This training is supported by a more in-depth on-line AML/CFT training course which is completed by employees as part of their wider induction programme with the Firm.
3.1.3. Exceptions to Induction Training Policy
Of the 62 firms surveyed, 10 (16%) confirmed that they allow exceptions to their AML/CFT induction training requirements. Half of these firms confirmed that such exceptions related to individuals holding specific functions within a firm, including ‘facilities staff’ and ‘non-relevant support staff’, none of which undertake regulated business and would therefore not constitute ‘relevant persons’ for the purposes of the Handbooks. Other examples of exceptions include:
 ‘If a new employee has joined from another regulated entity in Guernsey and has confirmed that AML/CFT training has been given, timescale for induction training may be longer’;  ‘If an employee leaves the permanent employ of the Company and is subsequently re-employed under contract within the same year’; and  ‘Exceptions are only allowed for NEDs who have recently received appropriate local AML/CFT training elsewhere’. In certain circumstances exceptions to a firm’s training requirements may be made where a firm has established that an individual: has received training on Guernsey’s AML/CFT legal and regulatory framework; understands their obligations under this framework and the implications for non￾compliance; and is well versed in the Firm’s arrangements. However, the Commission would reinforce that firms need to ensure that all staff, including any non-executive directors, are cognisant of the policies, procedures and controls enacted by the Firm to counter the risks specific to that business and the methods by which an employee complies with his/her statutory obligations within the Firm. In addition to the above, the Commission would reinforce the need for firms to ensure that all persons considered to be undertaking regulated business, regardless of whether they hold client-facing roles, receive training as they may be in positions whereby they see or review information which could lead to them forming a suspicion about activity within the business.

3.2. Periodic Training
3.2.1. Form of Periodic Training
As with induction training, various methods are utilised by industry to provide periodic training to employees. It is noted that the use of external consultants is far greater for periodic training than induction training, with internal one-to-one sessions far less common, particularly amongst firms with a larger number of employees. 48% of firms responding to the questionnaire indicated that they utilise self-taught methods of training and/or reading; however in all cases this training was complemented by other learning methods. With regard to the methods of training utilised by the various sectors in respect of their permanent relevant employees, computer-based training was the favoured method of training amongst the Banking sector, with 77% of firms using such products. Conversely, within the prescribed business sector, 83% stated that they utilise internal one-to-one training, whilst within the Fiduciary sector 74% of firms preferred to use external consultants to provide periodic training. Manner of Periodic Training Provision Good Practice In addition to the routine training provided to employees, one firm explained that the MLRO will periodically circulate relevant case studies to staff members highlighting particular features or risks which the firm considers staff should be aware of. Good Practice In order to incentivise staff and make the training process more engaging, one firm awards prizes to (non-director) members of staff who score the highest in the mandatory on-line AML/CFT training. Board members are also required to complete the training, though no rewards are offered. 0 5 10 15 20 25 30 35 40 45 Computer Based Internal - Group Pres. Internal - Group Disc. Internal - One-to-one External Consultant Self-Taught/ Reading Number of Firms Permanent Relevant Employees Temporary Relevant Employees Contract Staff

3.2.2. Frequency of Periodic Training
Unlike induction training, the obligation to provide regular training on at least a biennial basis is required by rule in the Handbooks. It was noted however that 71% of firms surveyed provide training on a more regular basis. Frequency of Periodic Training Provision When comparing the responses of firms which are part of International groups or have overseas owners with those firms which are Bailiwick owned, there is a noticeable difference in the frequency with which training is provided. In this respect, 81% of international firms provide AML/CFT training on an annual basis, in comparison to 55% of Bailiwick owned firms. With regard to the 3% of firms providing quarterly training, two Bailiwick owned firms explained that formal periodic training was provided on an annual basis; however informal quarterly training was provided, either through quarterly compliance newsletters or internal compliance training where this was considered necessary. Frequency of Periodic Training Provision by Ownership A number of firms commented that while training is scheduled on an annual or biennial basis, this is subject to there being no ‘trigger-events’ requiring ad-hoc training to be provided sooner, for example developments to local regulatory requirements. Quarterly 3% Annually 68% Biennially 29% 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% Quarterly Biannual Annual Biennial Percentage of Firms Local International

Poor Practice
One firm stated that training was provided ‘on the job’, giving no further detail as to the structure or content of the periodic training given to staff. This may be considered sufficient to cover training of a firm’s policies and procedures but it is unlikely to adequately cover the AML/CFT legal and regulatory framework or an individual’s obligations thereunder. Furthermore there is no discernible record of what training the firm has provided.
3.3. Enhanced Training
3.3.1. Board or Senior Management
In addition to the mandatory AML/CFT training which should be provided to all relevant employees, the Regulations and Handbook stipulate those employees who, in view of their particular responsibilities, should receive additional and ongoing training. In light of their responsibility for the effectiveness and appropriateness of firms’ policies, procedures and controls related to countering money laundering and terrorist financing, the Board and senior management of firms are specifically identified within the Handbooks as requiring additional training. The provision of training to the Board and senior management largely mirrors those methods used for other members of staff, with internal one-to-one training the most popular manner in which induction training is provided. Methods of Induction Training Provision for Board Members and Senior Management With regard to ongoing periodic AML/CFT training, the use of external consultants remains the most popular method, with 47 of the 62 firms using external consultants to train Board members and senior management. Of the 62 firms surveyed, 33 confirmed that their Board or senior management includes non-executive members. In this respect, Banking and Insurance licensees were the most likely to have non-executive directors with 30 individuals appointed to Boards of eight firms. With regard to the training of non-executive Board members, the Commission noted a number of firms placed reliance upon the training received by the non-executive director(s) from other employment/appointments. Additionally in some cases no formal confirmation had been requested or received in respect of this training and no evidence held to meet the relevant record keeping requirements. 0 5 10 15 20 25 30 35 40 Computer Based Internal - Group Pres. Internal - Group Disc. Internal - One-to-one External Consultant Self-Taught/ Reading Number of Firms Board or Senior Management Non-Executive Board Members

Poor Practice
A Firm with a Non-Executive Director on the Board of Directors maintained no records of training undertaken by that individual, nor did it have sight of the training the individual had completed. The firm was therefore not in a position to ascertain if the training the individual received was updated and relevant for a non-executive role on its Board. Methods of Periodic Training Provision for Board Members and Senior Management
3.3.2. Money Laundering Reporting Officer and Nominated Officer
In response to the Questionnaire firms provided a list of training received by MLROs and Nominated Officers covering the period from 1 January 2014 up to the completion of the survey. In addition to the high number of professionally qualified MLROs, it was evident that both MLROs and Nominated Officers also attended or completed various other forms of CPD during the period. The manner in which enhanced training is provided to MLROs varied greatly across the firms surveyed, from in-house computer based training modules through to attendance at external conferences or seminars. Good Practice Where firms form part of a wider, often global group of companies, the Commission noted instances of information sharing between group MLROs or other group level forums. Such arrangements provide for the sharing of best practice between group entities and the identification of trends or threats specific to the business of a firm or the sector within which it operates. 0 5 10 15 20 25 30 35 40 45 50 Computer Based Internal - Group Pres. Internal - Group Disc. Internal - One-to-one External Consultant Self-Taught/ Reading Number of Firms Executive Board Member Non-Executive Board Member

In addition to specific training received by the MLRO, firms also identified ways in which MLROs maintain an on-going awareness of AML/CFT issues and changes in relevant legislation. Examples of responses provided included:
 Review of the Commission’s website, the FIS’ Themis system and/or the States of Guernsey Policy Council website on a regular, generally daily or weekly basis;  Membership of, and attendance at, seminars or other events hosted by professional associations or local industry bodies;  Subscriptions to various e-mail alerts, website updates or relevant electronic or published newsletters or magazines; and  Participation in regulatory or other working groups focussing on AML/CFT or financial crime related matters. Good Practice At one firm a member of the compliance department produced a bi-weekly round-up of current news stories and developments in relation to AML/CFT and anti-bribery and corruption, keeping its MLRO, Board and senior management appraised on relevant current matters.
3.3.3. Outsourcing of the Money Laundering Reporting Officer Function
Regulation 12 requires that firms appoint an individual of at least management level to fulfil the position of Money Laundering Reporting Officer. Rules 37 and 51 of the FSB and PB Handbooks respectively provide further information on this appointment and clarify that the appointment must be of a natural person who is employed by the business. The Commission notes that a number of firms have outsourced the MLRO function, employing a third￾party individual to hold this position. Of the 62 firms surveyed as part of the review, eleven (18%) confirmed that they have appointed a third party in this regard. Poor Practice Three firms sampled as part of the review confirmed that they had outsourced the function of MLRO to a third party. All three firms confirmed that no formal assessment had been conducted of the training that individual had received, either prior to them being appointed or on an ongoing basis. Instead, reliance was placed on the fact that the individual was employed by a firm offering compliance services and the three firms therefore took the individual’s knowledge and understanding at face value. The Commission would reiterate that a firm cannot contract out its statutory and regulatory responsibilities and that the Board of a firm remains responsible for complying with the relevant regulatory requirements. Firms should therefore ensure that appropriate checks are undertaken at the point of establishing a relationship with a third party, including an assessment of the training undertaken by the nominated individual to be appointed as Money Laundering Reporting Officer. On an on-going basis Boards should ensure that they are comfortable that the MLRO has undertaken a sufficient level of training to maintain an appropriate understanding of their roles and responsibilities, together with the risks to which the firm is subject. Where this training is not provided internally or in the course of the MLRO’s employment with the firm, evidence should be requested and maintained in order that the Board can satisfy itself that its staff remain suitably trained.

4. Content and Relevance of Training
   The guiding principle of all financial crime training should be to encourage employees, irrespective of their level of seniority, to understand their responsibility to contribute to the protection of the business against the risk of money laundering and terrorist financing. In this regard, training should highlight to employees the importance of the contribution that they can individually make to the prevention and detection of financial crime. There is a tendency, in particular on the part of more junior employees, to mistakenly believe that the role they play is less pivotal than that of more senior colleagues. Such an attitude may lead to failures to disseminate important information because of mistaken assumptions that the information will have already been identified and dealt with by more senior colleagues. In order to empower staff members, it is vital that any training provided both at the commencement of employment and on an on-going basis is relevant both to the business of the firm and the wider environment in which the firm operates. In this respect, where a firm utilises the services of a third party to provide training to employees, the firm should consider the content of the training and its suitability to the business of the firm. Training provided should not be generic in nature and any ‘off￾the-shelf’ style products should be tailored or supported by content specific to the type of business the firm undertakes and the policies, procedures and controls of the firm.
   4.1. Training Content
   The Handbooks stipulate the topics which training must cover as a minimum. These topics include: the CDD requirements; the requirements for the internal and external reporting of suspicion; the criminal and regulatory sanctions in place for failing to report information in accordance with policies, procedures and controls; and the principal vulnerabilities of the Firm’s products and services. In reviewing the questionnaires completed by firms and the training materials provided by those firms visited, the Commission noted that training covered most of these factors. With regard to the subject matter of training, using terrorist financing as an example, the majority of firms responding to the questionnaire stated specifically that training covered this area, including employees’ legal obligations and recent developments in the methods and techniques utilised by terrorist organisations. Good Practice A number of firms utilising group or third party training resources detailed the input they have in determining the content of the training provided, tailoring this to include specific references to the environment within which the firm operates, as well as business specific policies and procedures and local MLROs or other relevant parties. Good Practice In addition to covering the mandatory subjects, one firm tailored its AML/CFT training on an annual basis to ensure variety as well as coverage of emerging threats and current topics.

4.2. Financial Crime Risks
Notwithstanding the comments made in section 4.1. a common theme to emerge from this thematic was a disconnect between the principal financial crime risks which firms identified and the subsequent focus on these areas within the training provided to staff. As part of the survey firms were requested to provide details of the top three financial crime risks specific to their organisations. The overwhelming risk identified by 74% of firms was fraud in its various forms. Three examples noted by firms were: identity fraud, invoice fraud and employee fraud. Top 5 Risks Identified by Firms Sampled While three quarters of firms surveyed identified fraud as a primary risk to their business, only six of these forty-six firms specifically covered the subject of fraud within the periodic training provided to all relevant employees. A further fourteen firms stated that an additional fraud-specific training course had been provided to at least a sub-set of employees. Twenty-six of the forty-six firms referencing fraud as a top-three risk to the business therefore made no reference to fraud within any of the regular or ad-hoc training provided to employees. A similar picture emerged in relation to the other risks identified by firms as part of the survey. Good Practice One firm had identified a particular vulnerability in relation to cyber-security in light of an increase in the number of fraudulent attempts to misappropriate or gain control over client funds. As a result the Firm commissioned an external party to provide training to staff covering the primary weaknesses in this area and the methods by which the Firm and its employees could mitigate the risks of similar issues arising. Poor Practice One firm identified fraud and market manipulation in their top three risks; however when visited and questioned on the content of staff training, the firm indicated that neither were specifically covered in the training provided to employees. 0 5 10 15 20 25 30 35 40 45 50 Fraud Tax Evasion Money Laundering Cybercrime Bribery and Corruption Number of Firms

5. Control and Oversight of Training
   5.1. Board and Senior Management Oversight
   The Board or senior management of a firm has ultimate effective responsibility for ensuring that the firm’s business is conducted in compliance with the requirements of the Regulations, the Handbooks and any other relevant legislation. This includes ensuring that employees of the firm receive an appropriate level of AML/CFT training relevant to the role they undertake within the firm and establishing whether the training received allows individuals to effectively fulfil their responsibilities. Good Practice One firm explained that all training, including AML/CFT training, was managed through a centralised web-based training system designed to automatically capture mandatory training. The system has additional built-in controls to ensure that training is completed in a timely manner, with e-mail alerts to the relevant staff members, and ultimately their line managers, should specific deadlines for the completion of training not be met. Poor Practice One firm had no formal policy for the drafting of Board meeting minutes. The firm explained that action points of meetings were noted; however structured minutes of Board discussions were not maintained. The Firm was thereby unable to evidence to the Commission or any other third party the level of consideration given to various subjects, including its assessment of the provision and effectiveness of AML/CFT and financial crime training.
   5.1.1. Board Reporting
   The provision of relevant information to the Board or senior management of a firm is crucial in allowing for decisions to be made cognisant of their responsibilities and the effectiveness of the controls implemented by a firm to meet those responsibilities. The Commission noted that the Board or senior management of the majority of firms visited as part of the thematic review were provided with adequate periodic information on the provision of AML/CFT training to their staff. Good Practice A number of the firms surveyed confirmed that financial crime training is a standing item on the MLRO’s reports to the Board, through which they provide details on the training provided to staff, together with any employees with outstanding training items and an assessment of the quality of training received. Similarly, a number of firms visited demonstrated that financial crime training was a standing agenda item on Board and/or management committee meetings, thus ensuring regular discussion on the provision and effectiveness of AML/CFT training. Poor Practice One firm had only recently introduced formal written reporting to the Board, with one MLRO report having been filed as at the date of the visit. In addition, the Commission noted that the Board had taken seven months to reply to the MLRO on the action points arising from the report.

5.1.2. Compliance Review
Related to the above obligations, it is the responsibility of the Board to ensure that a policy is in place for the review of a firm’s compliance with its obligations under the Regulations and Handbooks. Amongst other factors such a compliance review must include the provision of training. Such a review should ensure that appropriate AML/CFT training is being provided to allow staff members to fulfil their duties and responsibilities effectively. 57 of the 62 firms surveyed confirmed that the provision and effectiveness of AML/CFT training is included within the firm’s compliance monitoring programme and/or internal/external audit reviews. 18 firms responded to the questionnaire confirming that their compliance monitoring programmes had identified matters requiring that specific attention be given to aspects of policies, procedures or controls related to AML/CFT training. Examples of the matters identified as part of firms’ compliance reviews included:
 ‘An amendment to the Staff Induction process to ensure that the Compliance department confirm relevant training has been provided to all new employees’;  ‘Staff members were previously required to maintain their own training logs, therefore information detailed in the staff training logs differed between members of staff’. In response the Firm ‘set-up a centralised database of staff training to be populated by one or two individuals only, therefore maintaining consistency of record keeping’;  ‘Internal audit found that in one instance an employee appeared to have failed the online AML/CFT test but there was no further information as to whether they had subsequently passed following a retake’. Poor Practice Upon review of the compliance monitoring programme of one firm, the Commission noted that two specific checks in relation to Board and MLRO training had not been completed for the previous year. The firm was therefore unable to demonstrate that it had sufficient oversight of the training undertaken by these persons to ensure that their regulatory obligations in this regard had been met. As demonstrated by the above issues, an effective policy for the review of compliance is not only a requirement of the Handbook, it also serves as a vital control to ensure that weaknesses in the policies, procedures and controls of a firm, including those related to financial crime training, can be quickly identified and adequately mitigated.
5.2. Effectiveness of Training
5.2.1. Methods of Establishing Effectiveness
Whilst the Handbook requires that firms put in place mechanisms to measure the effectiveness of AML/CFT training provided to employees, the manner in which this assessment should be undertaken is left to the discretion of businesses. This has resulted in a range of measures being adopted across industry to assess whether staff members are suitably trained. From the survey the Commission established that the most popular method of assessing training effectiveness was through the use of an exam/test. 40 respondents confirmed the use of such an approach, managed either internally or through a third party training provider.

Methods of Assessing the Effectiveness of AML/CFT Training Poor Practice Eleven firms surveyed confirmed that they had no formal method of assessing the effectiveness of any training provided to employees at the commencement of their employment. These firms were therefore allowing newly employed individuals to become actively involved in the business of the firm, including the potential for exposure to suspicious activity or circumstances, without knowing if those employees had the requisite knowledge and understanding. Good Practice In addition to the use of tests as part of a firm’s on-line training tool to measure the effectiveness of training provided, one firm issued a questionnaire to monitor staff knowledge about AML/CFT related matters as a further compliance monitoring control. The questionnaire highlighted a small number of deficiencies which were subsequently addressed by the firm.
5.2.2. Employee Self-Certification
51 of the 62 firms responding to the survey (82%) confirmed that they require employees to certify on an on-going basis that they have read and understand the financial crime policies, procedures and controls of the firm. The other 11 (18%) advised that no such policy exists. Of the 51 firms responding in the affirmative, 43 stated that confirmation is sought annually and 5 required such confirmation on a biennial basis. The 3 remaining firms advised that no specific time-frame is set, instead copies of the policies, procedures and controls are circulated whenever there has been an update to them with staff required to confirm that they have read them by return. Good Practice One firm explained that it requires employees to confirm on an annual basis that they had read and understood the Handbook, in addition to the AML/CFT policies, procedures and controls of the Firm. 0 5 10 15 20 25 3rd. Party Test/Exam Internal Test/Exam Self-Assessment Group Discussion Senior Man. Assessment Other No Formal Assessment Number of Firms AML/CFT Induction Training Periodic AML/CFT Training Board or Senior Management AML/CFT Training

5.3. Training Budget and Spending
Skilled and knowledgeable employees are an invaluable control in mitigating the exposure of businesses to the threat of financial crime. In order to achieve this it is vital that firms make sufficient investment in the provision of beneficial and effective training.
5.3.1. Training Budget
The vast majority of firms sampled as part of the thematic survey provided detailed information of their overall training budgets, as well as the figures spent specifically on AML/CFT and financial crime training. 53 of the 62 firms surveyed which were licensed or registered during 2014 provided details of their training budget for that year, with 7 confirming that they had no specific training budget or limit set on the amount of money spent on training. The total training budget for the remaining 46 firms stood at £1,445,471, equating to an average of £31,423 per entity.
5.3.2. Spending on Financial Crime Training
Of the £1,445,471 overall amount budgeted for training during 2014, £335,935 was directly attributed to the provision of financial crime training, including the costs associated with individuals undertaking relevant professional qualifications. This equates to 23% of the overall training budget. Training Budget vs. Spending on Financial Crime Training During 2014 A small number of respondents confirmed that there was no direct cost to the business for financial crime training on the basis that such training was provided internally by the MLRO or other qualified in-house individual. The 53 firms which provided details of their financial crime training costs employed a total of 2,035 employees, of which 1,840 were classified as ‘relevant employees’ for the purposes of requiring AML/CFT and financial crime training. This equates to an average spend across all sectors of circa. £183 per relevant employee on AML/CFT and financial crime training. Breaking these figures down further, there was evidence of distinct differences between industry sectors with regard to the average amount spent per employee on AML/CFT and financial crime training. As reflected in the table below, the average spend per employee in the banking sector was considerably higher than in other sectors. £1,445,471 £335,935 £0 £200,000 £400,000 £600,000 £800,000 £1,000,000 £1,200,000 £1,400,000 £1,600,000 Training Budget Financial Crime Training

Sector Total Spent on
Financial Crime
Training
Average No. of
Relevant
Employees*
Average Spend
Per Employee
Banking £179,548.00 62 £412.75
Prescribed Business £27,700.00 72 £76.73
Non-Regulated Financial Services Businesses £2,200.00 5 £244.44 Fiduciary £58,050.20 22 £113.16 Investment £63,236.40 32 £151.28 Insurance £3,100.00 35 £29.81

• Average number of relevant employees reflects the average of those firms sampled which provided information on their
  financial crime training spend.
  Average Spend per Employee vs. Average Number of Employees per Firm With regard to the above graph, a large proportion of the firms surveyed in the prescribed business and insurance sectors reported that training was provided in-house, either through group discussions and one-to-one training sessions, or through the use of computer-based training software. The costs associated with these methods were therefore reported as being minimal in comparison to the number of employees covered. If the average spend on AML/CFT and financial crime training is analysed on the basis of firm ownership, there is a marked difference in the amount spent by firms which were part of international business groups compared to those firms with Bailiwick-resident owners. In this respect, firms in international business groups spent on average almost two and a half times more than locally owned firms on financial crime training. Average Spend on Financial Crime Training per Firm by Ownership 0 10 20 30 40 50 60 70 80 £0 £50 £100 £150 £200 £250 £300 £350 £400 £450 Number of Employees Average Spend per Employees Average Spend per Relevant Employee Average Number of Relevant Employees £3,810 £9,170 £0 £1,000 £2,000 £3,000 £4,000 £5,000 £6,000 £7,000 £8,000 £9,000 £10,000 Average Spend per Firm Local International

6. Conclusion
   On the whole the thematic review demonstrated that firms have a good understanding of their regulatory obligations in respect of financial crime training and have enacted policies, procedures and controls to enable compliance with these obligations. Notwithstanding the good practice demonstrated, a number of areas were identified where some firms would benefit from improving their procedures in line with wider industry best practice. These areas are highlighted below.
   6.1. Board Oversight
   The Board (or equivalent) of a firm has effective responsibility for ensuring that the dealings of the firm are conducted in compliance with the requirements of the Regulations, the Handbook and any other relevant legislation. In this regard, Boards should ensure that they receive adequate information on a sufficiently regular basis to allow them to satisfy themselves that their employees are suitably trained to fulfil their responsibilities, both personal and commercial. Boards should formally consider staff training on a regular basis and document their discussions and any conclusions drawn, be that as to the suitability of the training received or any actions arising which require further attention.
   6.2. Subject Matter of Training
   Firms should consider the content of training provided to employees and ensure that the subject matter covered is relevant to the business of the firm and the specific activities undertaken by those employees. As a primary pre-requisite, the training provided should equip employees with sufficient knowledge to allow them to identify suspicious activity in the dealings of the firm, together with their personal obligations in this regard. The Commission would reiterate the requirements of the Regulations and the Handbook with regard to the content of training, in particular that it should include details of the principal vulnerabilities of the products and services offered by the firm and those areas deemed to pose the greatest risk to the business. In this respect the content of any training provided should be driven by the risks identified by the firm in its Business Risk Assessment and cover those areas deemed by the Board of the firm to pose the greatest risk.
   6.3. Third-Party MLROs/Compliance Officers
   Firms outsourcing their Money Laundering Reporting Officer function to a third party service provider must ensure that they undertake appropriate checks to ascertain whether the representative nominated by that service provider is appropriately qualified to hold such a function. As with any outsourcing relationship, the Board of the firm remains ultimately responsible for compliance with the requirements of the Regulations and the Handbook. This includes any activity undertaken by an outsourced provider in meeting the firm’s statutory obligations in respect of its AML/CFT controls. In assessing whether an individual is sufficiently trained to conduct their duties effectively, firms should not place sole reliance on the fact that the outsource provider offers such services and should ensure that appropriate checks are undertaken on the training received by the third party provider and its nominated representative(s).

6.4. Non-Executive Directors
Where firms utilise the services of one or more NED, it is important that the training received by the NED(s) is considered and its suitability for the business of the firm assessed. Where firms consider it necessary, additional training should be provided to ensure that all Board members are suitably trained and sufficiently knowledgeable to fulfil their duties. In all cases firms should hold details of training undertaken by NEDs to provide assurance to the Board of the suitability of its directors, as well as complying with the relevant record keeping requirements of the Regulations and the rules in the Handbooks.
6.5. Compliance Monitoring and Measuring Effectiveness
Firms must have in place a compliance review policy which makes provision for the review of a number of elements to ensure their appropriateness and effectiveness. This includes, amongst other aspects, an evaluation of the financial crime training provided to staff. This review should comprise a periodic check to ensure that all staff members have received their required induction and ongoing training within a suitable and regular timeframe in accordance with the timetable set by the Regulations and the rules in the Handbooks, together with an evaluation of the appropriateness and effectiveness of any training received. There are a number of methods by which the effectiveness of training can be established and a decision as to the most suitable approach is for the Board of the firm based upon the type of training and the manner in which it is provided.

7. Next Steps
   This review is relevant to all firms licensed by, or registered with, the Commission for the purposes of anti-money laundering, countering the financing of terrorism and financial crime regulation. All firms should consider whether their own arrangements are fit for purpose and meet the standards required by the Regulations and the Handbooks. Where firms consider that their policies, procedures and/or controls in respect of financial crime training are not effectively managing the risks associated with employees, then they should make the necessary changes and implement more robust controls. All firms should have arrangements in place to provide suitable and sufficient training to employees, as well as being able to effectively assess the success with which the employees of the firm acknowledged and understood the training received. These arrangements should include the ability to readily identify those persons requiring training and controls to ensure that employees receive regular training within the appropriate timeframe. Firms should regularly review their training procedures to ensure that they remain fit for purpose, including regularly reviewing the content of training provided to ensure that it remains relevant to both the business of the firm and the environment within which the firm operates. The Commission has separately contacted the firms which participated in the on-site portion of this review to provide individual feedback. This feedback has largely consisted of housekeeping matters which the Boards of those firms should give consideration to implementing. Where it has been felt necessary the Commission has implemented Risk Mitigation Programmes requiring firms to rectify particular risks by a given timeframe and will follow-up with those firms to ensure that the issues identified have been suitably addressed.

Appendix 1 - Glossary of Terms
AML/CFT
Anti-Money Laundering and Countering the Financing of Terrorism Firm A financial services business or prescribed business which conducts business in, or from within, the Bailiwick of Guernsey and is subject to the requirements of the Regulations and Handbooks. MLRO Money Laundering Reporting Officer NED Non-Executive Director NRFSB Non-Regulated Financial Services Business Relevant Employee (See ‘Glossary’, Chapter 17 or 15 of the Handbooks) Any person who falls within one or more of the following categories:
(a) member of the board;
(b) member of the management of a firm;
(c) employees whose duties relate to the regulated business of a firm; or (d) other employees who are exposed to the risk of money laundering and terrorist financing. The Commission The Guernsey Financial Services Commission The Financial Crime Division The Commission’s Financial Crime Supervision and Policy Division The Handbooks Together the Handbook for Financial Services Businesses on Countering Financial Crime and Terrorist Financing and the Handbook for Legal Professionals, Accountants and Estate Agents on Countering Financial Crime and Terrorist Financing. The Regulations Together the Criminal Justice (Proceeds of Crime) (Financial Services Businesses) (Bailiwick of Guernsey) Regulations, 2007 as amended and the Criminal Justice (Proceeds of Crime) (Legal Professionals, Accountants and Estate Agents) Regulations, 2008 as amended.