Financial Crime Governance, Risk and Compliance – Fund Managers & Fund Administrators

Financial Crime Governance, Risk and
Compliance – Fund Managers & Fund
Administrators
Thematic Review – 2017

Foreword
During late 2016 a thematic review of fund managers and fund administrators’ governance, risk and compliance frameworks was undertaken in conjunction with the Investment Supervision and Policy Division. This topic was chosen because a key theme to emerge from supervision has been a weakness in the application of effective compliance monitoring arrangements. This review covered 34 firms which were predominantly the smaller firms operating in the sector. These firms manage/administer approximately £44.2 billion in funds which hold circa 24,000 investor relationships. Our objective in selecting this theme was:
“To understand how fund managers and fund administrators had structured their governance, risk and compliance frameworks to mitigate financial crime risk.” The Commission concluded from the findings that generally there is a culture of compliance amongst firms together with an understanding of the importance of good governance and of implementing effective but proportionate compliance arrangements to mitigate financial crime risks. The body of this report sets out in detail both good practice and areas with scope for improvement. It was positive to note that overall firms had identified in their risk assessments the exposure of their schemes to financial crime risks, in particular, fraud, tax evasion, bribery and corruption, however these risks were not always sufficiently mitigated. The 2015 Financial Crime Thematic on Financial Crime Training highlighted a disconnect between the risks identified by the Board and the subsequent provision of relevant training to staff. It was disappointing to note from this review that with some firms there is also a disconnect in their risk and compliance framework between the risks identified in their business risk assessments on one hand and mitigation of those risks in their compliance arrangements on the other. It is crucial for firms to not only consider the regulations and rules, but also the risks pertinent to the business in the development of effective but proportionate compliance controls which are applied sensibly to the business rather than with a heavy hand. A good risk based documented compliance monitoring programme, supported by investment in training, will provide for a more resilient management of risk. A purely ‘tick box’ approach to regulatory compliance is not considered wise. I should like to take this opportunity to thank each of the firms which responded to the thematic questionnaire, and in particular those ten firms who met with the Commission to discuss their policies, procedures and controls in more detail. This report reflects the findings from the thematic review of predominantly low impact firms and we hope its content will be useful to all regulated firms within the Bailiwick when considering the effectiveness and relevance to their business of their policies, procedures and controls. Fiona Crocker 14 November 2017

Contents
Glossary of Terms...................................................................................................................................1
Scope.......................................................................................................................................................2
Approach.................................................................................................................................................2
Compliance Resources............................................................................................................................2
Part A. Business Risk Management Framework ...............................................................................3
1. Identifying and Assessing Financial Crime Risks to the Firm.......................................................3
2. Risk Appetite..................................................................................................................................3
3. Risk Mitigation - Compliance Monitoring Programme .................................................................4
Part B. Financial Crime Governance..................................................................................................6
1. Board Oversight of Financial Crime Compliance..........................................................................6
2. Financial Crime Management Information ....................................................................................7
2.1 Risk Reviews and Action Points.......................................................................................................7
2.2 Time Taken to Disclose SARS .........................................................................................................8
Part C. Customer Risk Management Framework.............................................................................8
1. Scheme Take-on Arrangements.....................................................................................................8
2. Investor Take-On............................................................................................................................9
3. Ongoing Monitoring of Schemes and Investors.............................................................................9
3.1 Transaction Monitoring ..................................................................................................................10
3.2 Customer Screening........................................................................................................................10
3.3 Frequency of Risk Reviews............................................................................................................10
3.3.1 Scheme Periodic Risk Reviews....................................................................................................10
3.3.2 Investor Periodic Risk Reviews...................................................................................................11
3.4 Risk Review Action Points.............................................................................................................11
3.4.1 Outstanding Scheme Action Points..............................................................................................11
3.4.2 Outstanding Investor Action Points.............................................................................................12
3.5 Risk Review Triggers .....................................................................................................................13
3.5.1 Scheme Risk Review Triggers.....................................................................................................13
3.5.2 Investor Risk Review Triggers ....................................................................................................14

Glossary of Terms
AML/CFT - Anti-Money Laundering and Countering the Financing of Terrorism Board - The Board of Directors or equivalent or the senior management, where it is not a body corporate. Customer - A person or legal arrangement who is seeking to establish or has established, a business relationship with a financial services business, or to carry out or has carried out, an occasional transaction with a financial services business. Firm - A financial services business which conducts business in, or from within, the Bailiwick of Guernsey and is subject to the requirements of the Regulations and Handbooks. Fund Administrator - A firm designated by the Commission to be the designated manager of a scheme for the purposes of the POI Law. Fund Manager - A firm licensed under the POI Law which fulfils the management function to a scheme. ML - Money Laundering MLRO - Money Laundering Reporting Officer PEP - Politically Exposed Person SAR - Suspicious Activity Report Scheme - Collective Investment Scheme TF - Terrorist Financing The Commission - The Guernsey Financial Services Commission The POI Law - The Protection of Investors (Bailiwick of Guernsey) Law, 1987, as amended The Handbook - The Handbook for Financial Services Businesses on Countering Financial Crime and Terrorist Financing The Regulations - The Criminal Justice (Proceeds of Crime) (Financial Services Businesses) (Bailiwick of Guernsey) Regulations, 2007 as amended

Scope
The thematic review consisted of two stages:
 A questionnaire was sent to 34 firms asking about their compliance arrangements, oversight by their Boards and the review of the policies, procedures and controls together with basic background information on the firms sampled.  On-site visits were then conducted to 10 firms to gain a more detailed and practical understanding of their governance, risk and compliance frameworks. The visit component consisted of: i) a review of firms’ business risk assessments, Board packs and Board minutes, and policies regarding compliance monitoring arrangements; and ii) discussion with representatives of the Board, the MLRO and/or Compliance Officers and, where applicable, operational staff to gain an overview of the effectiveness of the systems and processes in place relating to the firm’s compliance arrangements. Approach The Commission deliberately selected smaller firms as larger firms are subject to structured engagement plans in accordance with the Commission’s risk based system of supervision. All graphs contained within this report are based on the information and statistical data contained within the 34 responses to the questionnaire and the practice examples are based upon a combination of those responses and the findings from the on-site visits. Compliance Resources The 34 firms participating in the thematic employed approximately 500 people, of which 80 employees occupied compliance roles. The 16 larger firms participating in the exercise employing 20 or more individuals employed an in-house compliance officer responsible for financial crime compliance. Of the remaining firms, 8 outsourced the compliance function to a group unit in Guernsey and 10, mainly the smallest in terms of employment numbers (8 staff or less), used a third party compliance consultant. Of the firms surveyed 3 had an internal audit function, 9 employed on a periodic basis an external audit service provider to specifically review AML/CFT controls and 6 were subject to both internal and external audits. Most of these 18 firms with an audit function were part of international financial groups although some independently owned firms periodically sought external review of their AML/CFT controls.

Part A. Business Risk Management Framework

1. Identifying and Assessing Financial Crime Risks to the Firm
   Firms were asked to provide the top three financial crime risks specific to their business. Most firms reflected that handling proceeds of crime was one of their top 3 risks but it was also apparent that firms were cognisant that their schemes could be exposed to fraud, tax evasion and bribery and corruption risks. A firm’s business risk assessment which identifies and assesses the risks to its business should form the foundation upon which its risk management framework is built. It was therefore surprising to find information provided by two firms in response to the questionnaire about the key risks they faced, differed to that contained within their business risk assessments. This indicates either ambiguity or differing views on risk held by its senior management, or that the assessment had not been sufficiently tailored to the business of the firm, or required up-dating to reflect changes to the risks faced by the firm.

2. Risk Appetite
   Just over a fifth of firms surveyed had set no risk appetite statement indicating the level of money laundering and terrorist financing risk they were prepared to manage beyond which business would not be accepted. These firms said that the main reason for this was that they evaluated the risk of each new piece of business on a case by case basis. However, there is danger that without a clear overarching view on how much risk a firm is willing to take and consequently be able to manage and mitigate, business may be taken on which is beyond the capacity of a firm’s established controls and resources to effectively manage. In the absence of clarity over the amount of risk a firm is prepared to accept it would be difficult for staff responsible for new business to be aware of what type of new business would be accepted by the firm. Some level of flexibility and receptivity to new business lines is to be expected however the Board should have a view on which areas and product sectors it wishes the firm to target and which it wishes to stay away from, and this should be communicated to staff accordingly. However, most firms had an established risk appetite which had been communicated to staff predominantly through training and circulation of the business risk assessment. A firm had not articulated within its Business Risk Assessment the type of funds/assets it was willing to administer. There is a risk that the firm may take on a fund whose assets it has no experience of administering, which may impact its ability to identify and assess specific financial crime risks a fund presents for the purposes of determining an effective compliance monitoring programme to manage and mitigate those risks. AREA FOR IMPROVEMENT:

3. Risk Mitigation - Compliance Monitoring Programme
   Having identified its risk exposure, a firm must establish a compliance review policy which takes into account the size, nature and complexity of the business and which must include a requirement of sample testing on an ongoing basis to assess whether the policies, procedures and controls remain appropriate and effective to minimise the risk of a firm being used to launder criminal funds or fund terrorism. Consequently, encouraging a culture of compliance among staff to comply with policies and procedures is key. All 34 firms which responded to the questionnaire had compliance monitoring programmes in place and there were high levels of sample testing across a range of functions. Given the significant number of changes to UN and EU sanctions lists and in view that a risk based approach cannot be taken in respect of screening the customers and beneficial owners of customers, it was encouraging to note that 100% of firms sampled are monitoring their compliance with sanctions. However, the bar chart below indicates that there are areas where firms remain vulnerable in the absence of testing. Breakdown of firms who are not testing specific policies and procedures The above bar chart details the percentage rather than the number of firms as intermediary and introducer relationships were not applicable to all 34 firms surveyed. Furthermore, this bar chart does not include the two firms who confirmed in their survey response that testing of intermediary relationships would commence in 2017. Just over a quarter of firms surveyed did not have a compliance test to ensure that their intermediary relationships complied with the provisions set out in Section 6.5 of the AML/CFT Handbook. The Commission would encourage firms’ compliance monitoring programmes to include testing to ensure that the Firm has reasonably concluded that the intermediary relationship is 1) low risk, 2) that it has undertaken CDD procedures in respect of the intermediary and 3) that the relationship relates solely to the provision of financial products or services which meet the requirements of the AML/CFT Handbook. 27% 18% 10% 9% 9% 7% 7% 6% 3% 3% 0% 5% 10% 15% 20% 25% 30% Percentage of Firms POINT OF NOTE:

Although information received from the 34 firms indicated that compliance procedures were being reviewed and aligned to the risks identified in their Business Risk Assessment, gaps were evident when the Commission reviewed Business Risk Assessments in conjunction with compliance monitoring programmes of the 10 firms it visited. Most of these firms had identified in their risk assessments the exposure of their schemes to financial crime risks, in particular, fraud, tax evasion, bribery and corruption (including through politically exposed relationships), however these risks were not always sufficiently mitigated through the compliance monitoring programme. Of the 10 firms visited, 6 had compliance monitoring programmes which were predominantly rules￾based, but did not fully take into account the risks identified by the Board in the Business Risk Assessment. Of these 6 firms, 5 had outsourced their compliance function to a third party consultant, implying that a generic version of the compliance monitoring programme had been provided without any subsequent revision to reflect the specific nature of the firm’s business model and the financial crime risks associated with that business model. Whilst a generic programme can be a starting point for a firm without the resources to develop bespoke programmes it is important that the Board ensure that the programme is tailored to fit the specific needs of the firm. For example, one of the 4 firms with a tailored programme took into consideration the risks identified in the Business Risk Assessment and the risk assigned to a scheme determined the frequency of the reviews within the annual compliance monitoring programme. The 2015 Financial Crime Thematic on Financial Crime Training highlighted a disconnect between the risks identified by the Board and the provision of relevant training to staff. There is also a disconnect in some firms’ compliance frameworks between the identification of risk through the business risk assessment on one hand and its risk mitigation on the other. It is crucial for firms to not only consider regulations and rules in establishing their compliance and operational frameworks, but also the risks pertinent to their business. A good risk based documented compliance monitoring programme, supported by investment in training, will provide more resilient management of risks. A purely ‘tick box’ approach to compliance is not considered wise. A firm’s Business Risk Assessment identified bribery and corruption as an inherently high risk to its business and staff had received training on mitigating such risks. Bribes can be disguised as commission or consulting fees, but the compliance monitoring programme included no monitoring over the controls applied to payments out of the scheme property. Whilst 100% of firms stated that their compliance monitoring programme monitor sanctions, a number of firms rely on automated sanctions screening systems of which one firm did not undertake any tests
to assess if the automated screening processes (in this instance a group system) was operating correctly. Automated systems will not be effective if the IT programmes supporting them have been incorrectly configured. The Commission would encourage all firms who use automated systems to ensure that testing of those systems is included in their compliance monitoring programmes and it would also be prudent to run tests following system upgrades which are likely to affect functionality. AREA FOR IMPROVEMENT:
POINT OF NOTE:

“ ”
Part B. Financial Crime Governance

1. Board Oversight of Financial Crime Compliance
   The Board of a firm should be reviewing compliance with its regulatory obligations at regular intervals appropriate to the size, nature and complexity of its business, as it is ultimately responsible for risk management and for ensuring that the firm’s business is conducted in compliance with the requirements of the POI Law, the Regulations, the Handbook and any other relevant legislation. This exercise identified that two thirds of firms surveyed were reviewing compliance with their obligations on a quarterly basis, and three of these firms were also reviewing compliance on a specific issue when triggered by regulatory updates. Just under a third of firms were reviewing their levels of compliance on an annual basis only. These firms should consider if an annual review of compliance is sufficient taking into account the size, nature, and complexity of their business, including its client (fund and investor) base.

The Board must have controls in place to ensure that compliance tests are being conducted effectively and carried out within the specified timeframes to mitigate the risk. The Board must also be satisfied that the firm has appropriate and sufficient compliance resource. From the information provided from the survey, Boards are reviewing the suitability and appropriateness of their compliance arrangements and assessing resources against the size, nature and complexity of the firm’s business. This issue was discussed during the visits and, with the exception of one firm, the Commission found that Boards were assessing whether the compliance resource was equal or greater to the demands placed upon it by the business. 22 11 1 0 2 4 6 8 10 12 14 16 18 20 22 24 Quartely Annually Ad-hoc Number of Firms How often does the Board review and approve the firm’s financial crime compliance arrangements?

The Board minutes for one firm did not include the Board’s consideration of AML/CFT issues. In this regard, the Board minutes recorded only that compliance matters such as AML training, the conflicts of interest log, gifts register and the contents of the compliance report had been discussed with no record of what those discussions were. Noting only that there had been a discussion on a tabled compliance report without any reflection on what those discussions were could indicate that the Board is taking little responsibility for ensuring the business is being run in accordance with applicable legislation.
2. Financial Crime Management Information
A firm should have appropriate reporting methods and reporting channels in order for the Board to be fully apprised of issues arising within its business and to allow it to take necessary actions to remedy identified deficiencies. The Commission observed that in most cases Boards consider information regarding a firm’s compliance through a periodic report from the Compliance Officer or MLRO, which is usually tabled and discussed at each Board meeting. Such reports include information on the compliance monitoring programme and the results, trends and themes arising from those tests, emerging risks to the business, updates on the progress of risk reviews and outstanding action points, amongst other matters. As part of the visits, the Commission reviewed the Compliance and/or MLRO reports and the Board meeting minutes to understand whether the Boards were i) being provided with sufficient information in order to fulfil their corporate governance duties, ii) whether the Boards challenged that information and iii) if evidence could be seen of Boards discussing AML/CFT matters. Some Boards had not reviewed the scope and content of the Compliance and/or MLRO reports. Other Boards were not provided with adequate or regular information on instances of non-compliance with their policies and procedures. The following examples indicate where good quality management information is critical.
2.1 Risk Reviews and Action Points
Generally, the status of financial crime risk reviews and outstanding action points arising were being considered at appropriate intervals and to a level which would indicate that the Board would understand and respond to the reasons behind any delays in completing the reviews or addressing the action points. The most popular methods utilised by the Boards to ensure that action points are resolved is to include this information in the Compliance/MLRO reports, incorporating it as a standard item in Board or Committee meetings’ agenda, through regular ongoing monitoring at senior manager level and through the compliance monitoring programme. The Boards of some of the firms are also involved in the risk review process and therefore would be aware of any issues outstanding. AREA FOR IMPROVEMENT:

A firm’s compliance reports did not provide sufficient details on the compliance monitoring tests that were carried out and their results. In addition, the reports contained insufficient management information on the number of outstanding risk reviews and action points which the firm had. The Board, which is ultimately responsible for the effectiveness of its compliance arrangements, should consider how it obtains sufficient assurance that key controls such as risk reviews are being appropriately and effectively applied to its business.
2.2 Time Taken to Disclose SARS
Half of the firms visited did not include in the report to the Board information on the time taken between internal disclosure of a suspicion of ML or TF to the MLRO and the decision by the MLRO as to whether to report the suspicion to the FIS. Suspicions of ML and TF must be disclosed as soon as possible to the FIS in order not to delay or hinder an investigation into potential criminality by the law enforcement authorities. Information on how long decisions are taken on internal disclosures by the MLRO assist a Board in determining whether its procedures and controls on reporting suspicions are effective.
Part C. Customer Risk Management Framework

1. Scheme Take-on Arrangements
   Firms were asked to describe their arrangements for assessing ML and TF risk when considering taking on a new scheme. Firms indicated that they considered factors such as jurisdiction and standing of the promoter, scheme type, structure and rationale for the type of scheme proposed, including its complexity, type of assets to be held and the profile of intended investors. Responses indicated that a scheme would not be taken on until the tax rationale was fully understood. Measures taken to understand this included obtaining a copy of the tax advice for the scheme and considering its contents and/or working with legal advisors on the scheme’s structure in the planning stages. Additionally changes such as the domicile of the scheme, or the impact of changes to legislation on the scheme’s strategy would prompt a firm to review the scheme’s tax arrangements. Firms were also taking into account whether there was an exposure to bribery and corruption risks through the activities of a proposed scheme and the nature of the investments to be held. The Commission sought to understand the criteria which firms apply when considering the initial risk assessment of a new scheme and the basis upon which a scheme proposal might be rejected or a relationship with an existing scheme terminated. Overall firms were considering factors such as geographical sphere of operation, customer type, nature, size, complexity and activity of the scheme structure, in addition to the regulatory status of promoters, their probity, integrity and solvency. Nearly a quarter of firms surveyed had declined potential schemes within the last two years, which indicates that potential new business will be declined where unacceptable higher risks appear to be AREA FOR IMPROVEMENT:
   POINT OF NOTE:

“ present or where scheme purposes are not understood. Among the firms who had not rejected a new scheme proposal, a number of these firms manage or administer self-promoted or own-house schemes rather than third party schemes which would therefore be unlikely to be rejected. Reasons for rejecting or terminating a scheme included having suspicion over the activities or the individuals involved with the scheme, high risk profile characteristics of customers and key individuals and commercial reasons. Nevertheless, overall the principal reason referred to by half of the firms surveyed relate to it not being within the firm’s risk appetite. In this regard, the firm would not accept the relationship if the risks were perceived to be too high to manage.
2. Investor Take-On
The Commission sought to understand the criteria used to assess the risks posed by a potential investor. Factors firms considered as part of the take-on and risk assessment of investors included customer type, geographical origin, adverse media associations, type of structure (where the investor is not an individual) and beneficial owners and whether there were any links to a sensitive industry. Please note that respondents could provide more than one category when completing the questionnaire. Following the assessment of the risks associated with the proposed investor, a firm should hold sufficient information in order to decide whether or not to accept it. In this regard, the most common reasons for rejection appear to be adverse media associations and lack of rationale or customer due diligence.
3. Ongoing Monitoring of Schemes and Investors
All firms must ensure that there are sufficient controls in place to monitor their customers, both schemes and their investors, on an ongoing basis for the timely detection of i) any suspicions about their activity, ii) whether a customer or its beneficial owner/s is subject to international sanction(s) or iii) if there have been changes to the profile of the customer or beneficial owner requiring the firm to re-assess the risk posed – for example a change in beneficial ownership, detection of a political connection or adverse media about the party/ies. 18 14 9 7 6 6 0 2 4 6 8 10 12 14 16 18 20 Number of Firms ” Where would the Firm find it appropriate, based on an assessment of financial crime risk, to reject or terminate a business relationship with an Investor?

3.1 Transaction Monitoring
Firms taking part in the thematic appear to have good quality fraud and bribery and corruption controls over payments from accounts of collective investment schemes whereby fee invoices have to be internally approved prior to payment and checks and enquiries carried out prior to paying fees not subject to a formal agreement to ensure the validity of the payment in the account details of the recipient. The majority of payments are in relation to pre-determined fees to other financial and professional services businesses providing a service to a collective investment scheme. Firms were also cognisant that bribes could be disguised as “consultancy fees” and therefore the aforementioned payment controls would also alleviate the risk of firms facilitating corrupt practices.
3.2 Customer Screening
Increasing use is being made of automated screening systems to monitor customers, beneficial owners and underlying customers against sanctions lists, for PEP associations and for adverse media, particularly within larger firms. This thematic involving smaller firms showed that just over two thirds of them are using automated screening as part of their monitoring controls whilst the remaining third of firms continue to manually screen their client bases. Manual screening is usually undertaken upon notice of an update to the sanction lists, but in the absence of other checks a firm may not be aware of other changes to a customer’s (or beneficial owner’s) profile. It was therefore encouraging to see that among the ten firms visited, two whom relied on manual screening had other controls to identify changes in customer profile such as creating Google alerts to highlight adverse media or undertaking screening checks prior to payments being made.
3.3 Frequency of Risk Reviews
3.3.1 Scheme Periodic Risk Reviews
Two thirds of firms surveyed reviewed the financial crime risk of their schemes on a periodic basis depending on the risk assigned to that scheme. Some of these firms also perform reviews on a trigger event basis as standard practice. A few firms did not rate schemes in these risk categories hence the not applicable response. 24 5 5 25 6 3 24 6 4 0 2 4 6 8 10 12 14 16 18 20 22 24 26 28 30 Periodic Trigger Only Not Applicable Number of Firms High Risk Standard Risk Low Risk “ ” What is the frequency of scheme financial crime risk reviews based on risk rating?

3.3.2 Investor Periodic Risk Reviews
The responses from the survey indicate that the use of trigger based reviews was more prevalent for investors than schemes, however just over half of the firms surveyed undertake periodic rather than trigger based reviews. Three of the firms surveyed were not responsible for investor CDD which was the responsibility of another financial services business in Guernsey servicing the scheme. Furthermore, a few firms did not rate investors in these risk categories hence the not applicable response. Six of the firms surveyed had established a financial crime risk review process based on trigger events only without any additional safeguards, such as an automated screening system, in order to identify PEP and/or adverse media associations in between triggers. Firms which review schemes and investors solely on the basis of a trigger event and not risk can be vulnerable to changes in the scheme/investor profile which raise the ML and TF risks posed because a trigger event can occur far too infrequently. The Commission encourages firms to review their risk review processes for both schemes and investors together with their screening procedures to ensure they are not vulnerable to lengthy delays in identifying changes to the scheme or investor’s profile.
3.4 Risk Review Action Points
3.4.1 Outstanding Scheme Action Points
It was encouraging to find that just over half of firms surveyed (18) had completed all the scheduled financial crime risk reviews for schemes for 2016 by the end of quarter 3 2016 when the thematic commenced. The Commission questioned how many action points had been raised during reviews in 2014 and 2015 and how many of those action points remained outstanding in 2016. It was positive to note that very few action points identified in 2014 and 2015 remained outstanding by the second half of 2016. 20 10 4 17 13 4 15 11 8 0 2 4 6 8 10 12 14 16 18 20 22 Periodic Trigger Only Not Applicable Number of Firms High Risk Standard Risk Low Risk What is the frequency of Investors’ financial crime risk reviews “ based on risk rating? ” POINT OF NOTE:

3.4.2 Outstanding Investor Action Points
From the responses within the questionnaire, 13 out of the 34 firms reviewed had outstanding investor reviews for the prior calendar year with an average number of 72 reviews outstanding for each firm which were likely to be cleared by year end. The Commission queried the number of outstanding action points arising for the preceding two calendar years investor risk reviews. It was discouraging to find that 7 firms had yet to address action points which had been raised in the two years preceding. A total of 786 action points were raised by those firms in 2014 and 2015, however 366 still remained to be addressed at quarter 4 2016. The Commission looked at the most common issues that arose from compliance monitoring tests carried out on investor financial crime risk reviews in order to identify specific trends. Amongst the 34 firms surveyed, it was noted that the greatest issue encountered related to incomplete investor information and missing documentation. Other reasons included outstanding risk reviews and action points which were still to be addressed and risk classifications which require changes to be made. 233 185 27 207 34 2 55 201 85 14 106 3 0 50 100 150 200 250 High Risk Standard Risk Low Risk High Risk Standard Risk Low Risk Action points Outstanding Number of Action Points 2014 2015 How many action points arose from the investor financial crime risk reviews for 2014 and 2015, and how many of those remain outstanding? ” “

3.5 Risk Review Triggers
3.5.1 Scheme Risk Review Triggers
For schemes where the financial crime risk reviews are trigger based, the Commission sought to understand what triggers would prompt the reviews. The responses within the questionnaires indicated that in addition to sanctions or adverse media hits, changes to the scheme’s investment policy and objectives and counterparties would prompt a review. Whether the review is trigger based or periodic, a scheme’s due diligence documentation is mainly reviewed at the time of the financial crime risk review to ensure it is up to date and relevant. It was noted that all but 3 firms would review the adequacy of the scheme’s due diligence at the time of the risk review. One of these firm stated that the due diligence documentation would be considered by the administrator during the establishment process as the scheme is in-house and would only be reviewed more deeply if there was a fundamental change. 15 7 6 6 5 5 1 0 2 4 6 8 10 12 14 16 18 Investor Info/Docs Missing Outstanding Action Points Outstanding Risk Reviews No Material Issues Risk Classification Issues CDD No Clear Documented Rationale Number of Firms Sanctions or Adverse Media Screening, 33, Change in Investment 45% Policy and Objectives, 26, 36% Change in Party, 12, 17% Regulatory Developments, 1, 1% Investment performance, 1, 1% Where the financial crime risk reviews are trigger based, what are these “ triggers? ” What are the most common issues arising from compliance monitoring tests carried out on investor financial crime periodic “ reviews? ”

It was noted that 71% of the firms would also consider the commercial rationale for the business relationship with the scheme and the rationale for administering, managing and, where relevant, domiciling the scheme in Guernsey during the review. Of those firms which did not consider this, this was largely due to the scheme being an in-house product of the firm in Guernsey and therefore its natural domicile was with that firm.
3.5.2 Investor Risk Review Triggers
With regard to the triggers that prompt a review of the risk assigned to an investor, the responses indicated that the principal triggers are updates to sanctions lists or adverse media matches, changes in a customer’s circumstances and drawdowns/distributions. However, where a regular screening system is not employed it would be unlikely for a firm to conduct a trigger review on this basis. Other triggers included identification of the investor as a PEP and unusual patterns of share dealing. Most firms reviewed an investor’s due diligence documentation at the time of the risk review to ensure it is up to date and relevant. It was noted that all but 4 firms would review the adequacy of the investor’s due diligence at the time of the risk review. The Commission encourages firms to consider incorporating within the review an assessment of the due diligence held for the investor, bearing in mind that as the business relationship develops, the risk of money laundering and terrorist financing may change. In this regard, it is a requirement for firms to assess whether the identification documentation held remains adequate for the assessed risk. The Commission takes this opportunity to remind firms that it is not necessary to re-verify or obtain current documents where previous verification documents have expired unless the firm has assessed that the documentation held is not adequate for the assessed risk or there are doubts about the accuracy of the data. Sanctions or Adverse Media Screening, 31, 36% Change in a Customer's Circumstances, 30, 35% Drawdowns and Distributions, 12, 14% Identification of a PEP, 3, 3% Other, 10, 12% Where the financial crime risk reviews are trigger based, what are these triggers? “ ” POINT OF NOTE: