Financial Crime Governance, Risk and
Compliance – Smaller Firms in the
Trust and Corporate Service Provider
Sector
Thematic Review – 2017

Executive Summary
During mid-2017, a thematic review was undertaken on the financial crime governance, risk and compliance frameworks of a selection of smaller firms in the trust and corporate service provider sector (“TCSP”). The Commission undertook a similar review of fund administrators in 2016 and wished to assess the differences and similarities in approach to governance, risk and compliance frameworks. This review covered 35 firms collectively managing just over 13% of total fiduciary assets under management, with circa 5,200 business relationships. It predominantly focussed on smaller, privately owned firms with a low impact rating. Our objective in selecting this theme was:
“To understand how smaller firms in the TCSP sector had structured their governance, risk and compliance frameworks to mitigate financial crime risk.” It was concluded that most firms understood the importance of governance, risk and compliance, which is essential in the mitigation of financial crime, being the focus of this Thematic. However, we identified deficiencies in the compliance monitoring programmes in a fifth of the firms taking part in this thematic, which warranted the imposition of risk mitigation programmes by the Commission. The body of this report sets out in detail both good practice and areas with scope for improvement. All firms surveyed had a compliance monitoring programme in place; however it was disappointing to note that for a significant number of firms this was not appropriately tailored to the risks specific to their business. This area of concern was also raised in the thematic on fund administrators. A good risk based documented compliance monitoring programme, supported by investment in training, will positively affect the firm’s control framework, mitigating risks and justifying the decisions made by the Board, resulting in a more resilient business. A ‘tick box’ approach to regulatory compliance is not considered wise. However, it was positive to note that overall firms had identified in their Business Risk Assessments their exposure to specific financial crime risks, in particular, fraud, tax evasion and bribery and corruption, which from aggregated data the Commission holds on Suspicious Activity Reports made to Guernsey’s Financial Intelligence Unit, are the main underlying predicate offences the sector is identifying. Furthermore, an encouraging number of TCSPs were actively meeting with their clients on at least an annual basis in order to forge direct relationships. Consequently, there was little use of Reliable Introducer Relationships in the firms surveyed when compared to those surveyed in the Funds sector thematic. This reflects that TCSPs have to obtain verification documents on the clients, beneficial owners and underlying principals in order to open trust and corporate accounts with other Bailiwick financial services business. I should like to take this opportunity to thank each of the firms, which responded to the thematic questionnaire, and in particular, those fifteen firms who met with representatives of the Financial Crime Supervision and Policy Division to discuss their policies, procedures and controls in more detail. This report reflects the findings from the thematic review of predominantly low impact firms and we hope its content will be useful to all regulated firms within the Bailiwick when they are seeking to assure themselves that their own controls are and remain effective and relevant to their business. Fiona Crocker 14 May 2018

Glossary of Terms
AML/CFT - Anti-Money Laundering and Countering the Financing of Terrorism Beneficial Owner - The natural person who has full or partial control of the structure / assets under administration through ownership. Board - The Board of Directors or equivalent or the senior management, where it is not a body corporate. B.R.A. – Business Risk Assessment Client - A person or legal arrangement who is seeking to establish or has established, a business relationship with a financial services business, or to carry out or has carried out, an occasional transaction with a financial services business. CMP – Compliance Monitoring Programme. C.O. – Compliance Officer. EDD – Enhanced Due Diligence FCSPD – The Commission’s Financial Crime Supervision and Policy Division Firm - A financial services business which conducts business in, or from within, the Bailiwick of Guernsey and is subject to the requirements of the Regulations and Handbooks. FIU - Financial Intelligence Unit ML - Money Laundering MLRO - Money Laundering Reporting Officer PEP - Politically Exposed Person RORA – Registered Office / Registered Agent SAR - Suspicious Activity Report TF - Terrorist Financing TCSP – Trust and Corporate Service Provider The Commission - The Guernsey Financial Services Commission The Handbook - The Handbook for Financial Services Businesses on Countering Financial Crime and Terrorist Financing The Regulations - The Criminal Justice (Proceeds of Crime) (Financial Services Businesses) (Bailiwick of Guernsey) Regulations, 2007 as amended

Contents
Foreword & Executive Summary ............................................................................................................ ii Glossary of Terms................................................................................................................................... iii
Scope.......................................................................................................................................................1
Approach.................................................................................................................................................1
Compliance Resources............................................................................................................................2
Part A. Business Risk Management Framework .....................................................................................4
1. Identifying and Assessing Financial Crime Risks to the Firm..........................................................4
2. Risk Appetite ..................................................................................................................................6
3. Risk Mitigation - Compliance Monitoring Programme (“CMP”) ....................................................8
Part B. Financial Crime Governance......................................................................................................11
1. Board Oversight of Financial Crime Compliance..........................................................................11
2. Financial Crime Management Information ..................................................................................12
Part C. Customer Risk Management Framework..................................................................................14
1. Customer Take-on Arrangements................................................................................................14
2. Ongoing Monitoring of Customers...............................................................................................17
2.1 Transaction Monitoring .....................................................................................................17
2.2 Customer Screening ...........................................................................................................17
2.3 Client Periodic Risk Reviews...............................................................................................19
2.4 Risk Review Action Points...................................................................................................19

Scope
The thematic review consisted of two stages:
 A questionnaire was sent to 35 firms asking about their compliance arrangements, oversight by their Boards and the review of the policies, procedures and controls together with basic background information on the firms sampled.  On-site visits were then conducted to 15 firms to gain a more detailed and practical understanding of their governance, risk and compliance frameworks. The visit component consisted of: i) a review of firms’ business risk assessments, Board packs (including compliance and MLRO reports) and Board minutes, and policies regarding compliance monitoring arrangements; and ii) discussion with representatives of the Board, the MLRO and/or Compliance Officers and, where applicable, operational staff to gain an overview of the effectiveness of the systems and processes in place relating to the firm’s compliance arrangements. Approach The Commission uses thematic reviews as a tool to gather information on industry trends on specific subjects or controls. It also uses these reviews as a means to engage with smaller firms which have a Low PRISM Impact rating, as firms with a higher Impact Rating are subject to more frequent structured engagement plans in accordance with the Commission’s risk based system of supervision. The focus was on firms which classify themselves as privately owned, as a significant proportion of firms to which risk mitigation programmes have had to be applied have come from this population of licensees. A selection of firms self-identified as International Finance Groups (“I.F.G.”) were also included to provide not only some comparative data, but also as firms with this ownership profile have also been subject to risk mitigation programmes. A breakdown of the ownership of those firms surveyed is as follows:

4
31
0
5
10
15
20
25
30
35
International Financial
Group
Privately Owned
Ownership of firms surveyed
3
12
0
2
4
6
8
10
12
14
International Financial
Group
Privately Owned
Ownership of firms visited

All graphs contained within this report are based on the information and statistical data contained within the 35 responses to the thematic questionnaire, in combination with data obtained from the annual Financial Crime Risk and Fiduciary Returns. The examples of good and poor practices within this report are based upon a combination of those responses and the findings from the onsite visits. Compliance Resources The 35 firms participating in the thematic employ 400 people, of which 69 employees occupy compliance roles. Of the firms surveyed 20 employ an in-house compliance officer specifically responsible for financial crime compliance, with 11 of these firms bolstering their in-house resource through the use of an outsourced compliance service provider. Of the 11 firms who do not employ an in-house compliance officer specifically for financial crime compliance, 10 of these firms outsource aspects of their compliance arrangements. Overall, 60% of firms surveyed (i.e. 21 out of 35) outsourced some aspect of their compliance arrangements. A breakdown of the compliance resourcing for privately owned firms highlights that the majority of the small firms, i.e. those employing 10 or less employees (representing 22 of the 31 privately owned firms surveyed), augment their in-house compliance resources with the use of outsourced compliance service providers.

Those smaller firms surveyed that did not employ an in-house compliance officer specifically for financial crime compliance, nor used an outsourced compliance service provider, explained that individuals who had other responsibilities covered this function. This is not surprising as staff at many small firms often wear more than “one hat”; interviews from the onsite visits indicate that the employees of smaller firms often cover multiple roles which (given the relative size of the firm) may not necessarily require a dedicated full time resource. However, firms should consider if this is appropriate taking into account the risk profile of their clients. 11 11 0 2 4 6 8 10 12 No Yes Number of firms with <=10 ppl Do you employ a C.O. specifically for AML/CFT compliance? 6 16 0 2 4 6 8 10 12 14 16 18 No Yes Number of firms with <=10 ppl Do you outsource aspects of your compliance arrangements?

Of the firms surveyed, five had an internal audit function to specifically review AML/CFT controls, seven employed on a periodic basis an external audit service provider to specifically review AML/CFT controls and five were subject to both internal and external audits. It is encouraging to note that, whilst it is not a regulatory requirement, these firms are utilising external assistance to audit their AML/CFT frameworks. Of those firms who had no internal or external audit function, all explained that they considered that the size of the firm was not sufficient to warrant a separate audit function. The products and services provided by the TCSP sector are generally perceived by international bodies such as the Financial Action Taskforce to present higher ML and TF risks. The Commission would urge firms without a separate audit function, after taking into account the risk profile of their clients, to consider if a periodic audit of the firm’s AML/CFT controls would assist the firm in ensuring these controls remain adequate and effective. 2 1 1 3 4 6 18 0 2 4 6 8 10 12 14 16 18 20 Yes - Internal Function Yes - Internal and External Function Yes - External Function No

Firms

International Financial Group
Privately Owned
Does the Firm maintain a separate audit function to assess / monitor the adequacy and effectiveness of “ financial crime compliance? ”

Part A. Business Risk Management Framework

1. Identifying and Assessing Financial Crime Risks to the Firm
   Firms were asked to articulate the top three financial crime risks specific to their business. Most firms (i.e. 24 out of 35) reflected that handling proceeds of crime (i.e. Money Laundering) was one of their top 3 risks. It was apparent however that many of these firms were cognisant that their clients could expose their firms to fraud, tax evasion and bribery and corruption risks. The recently implemented UK corporate offence of the failure to prevent tax evasion has only heightened the need for firms to give greater consideration to the risks of tax evasion posed by their clients. Also, it was encouraging to note that some of the firms surveyed identified risk factors which were pertinent to their business, such as providing Registered Office / Registered Agent only services to a client, PEP clients, high risk jurisdictions and complex client structures, which could increase their ML and TF exposure. It was interesting to note that the privately owned firms had identified a greater breadth of potential ML/TF risks than the other group types surveyed. For example, none of the international financial group firms surveyed had identified Bribery & Corruption as one of their top ML/TF risks. This is somewhat concerning, as most of these firms have not inconsiderable numbers of relationships with PEPs and clients from jurisdictions on the Business from Sensitive Sources notices issued by the Commission; clients who might generally pose a greater risk of bribery and corruption. This raises the question of why this risk was not identified as a key ML/TF risk by these firms, as a firm’s business risk assessment, which identifies and assesses the money laundering and terrorist financing risks to its business, should form the foundation upon which its AML/CFT risk management framework is built.

An example of good practice in this regard was noted where one firm set out in its B.R.A. that it had a medium risk appetite, but the geographical regions it targets for clients introduce their own inherent risks. This firm acknowledged that there was a danger that the firm could consider high risk jurisdictions to be low risk because the firm had directors who knew those markets well. The firm recognised that there was also a danger that it could rely too heavily on its knowledge of certain jurisdictions and would incorrectly extrapolate that knowledge to encompass jurisdictions where its directors have less knowledge and experience. In order to counter this, the firm explained that directors knew the limitations of their knowledge and would not seek to expand into countries where they had no knowledge or trusted introductions. This was supported by the information it provided on the geographical breakdown of its client base. This firm understood its business model and its strengths and weaknesses (with respect to financial crime) and was alive to the risks inherent in that model. The Commission would encourage firms to be candid about what their strengths and weaknesses are and consider how these risks could be applicable to their business. Whilst the majority of the B.R.A.s reviewed (9 out of 15) identified specific ML/TF risks well and would assist the firm in establishing effective defences against ML and TF, there were examples of poor B.R.A.s. In these cases the assessment was overly extensive and focussed on the minutiae, making it difficult to determine which identified ML and TF risks were the most pertinent to the business, or were overly generic and did not effectively document the ways in which these risks affected the Firm. For example, one firm’s B.R.A., in addition to considering ML risks such as bribery and corruption, PEP’s, etc., covered risk considerations such as liquidity, market and business continuity risks. Yet the focus of the B.R.A. appeared to be on the operational risks of not following the policies, procedures and controls, instead of also analysing the financial crime risks faced from its products, services and customers and the systems and controls employed to mitigate these risks. It was unclear how useful this document would be to staff to understand what the key ML/TF risks facing the firm were. In addition, it was disappointing to note that three of the 15 firms visited had no assessment of, nor consideration of mitigants for, detecting and combatting the risks of terrorist financing within their B.R.A.s. AREA FOR IMPROVEMENT:
CASE STUDY:

2. Risk Appetite
   The Board is responsible for setting a firm’s financial crime risk appetite and this should be set out in the B.R.A. Its risk appetite should define the amount of financial crime risk that the firm is willing to accept in the pursuit of its objectives, as well as outlining the boundaries of its risk taking, beyond which the firm is not prepared to accept risk. Encouragingly, only one firm surveyed stated that it did not include a risk appetite statement within its B.R.A. This was markedly different to those firms surveyed in the 2016 Funds thematic, where just over a fifth of firms surveyed had no documented risk appetite. A firm that did not include a risk appetite statement in its B.R.A. explained that staff were made aware of the firm's risk appetite through the Board holding regular discussions with the senior management team, who then share this information to the wider team through day-to-day business to make them aware of the firm’s risk appetite. However with no clear documented reference setting out the firm’s appetite for risk, it raises the risk that new business is acquired without the appropriate and sufficiently resourced systems and controls in place to mitigate relevant risks. It is the Commission’s expectation that a firm‘s ML/TF risk appetite is documented and is readily accessible to all relevant staff, in particular those staff who deal with new business proposals, to ensure that they understand the firm’s risk appetite and its effect on the strategic objectives of the firm. The majority of the firms surveyed (i.e. 30 out of 35) conveyed their risk appetite to their staff by circulating the B.R.A., via internal systems or via training. However, five of the firms surveyed did not. They explained that either the firm’s policies, procedures or controls were sufficient to convey the firm’s risk appetite, or the size of the business meant that all employees were part of the Board and as such were aware of the firm’s risk appetite. This approach may be reasonable for a small firm where all relevant staff are on the Board. For larger firms relevant staff will need to be familiar with the firm’s policies and procedures. However the Commission does not consider it appropriate that the only means through which staff can understand a firm’s risk appetite is through a detailed review of the firm’s policies and procedures, unless those policies and procedures are very clear on what risks the firm will not accept. The Commission believes it is vitally important that all relevant staff clearly understand the firm’s financial crime risk appetite. AREA FOR IMPROVEMENT:

A firm had identified Registered Office / Registered Agent (“RORA”) services as increasing its exposure to its top 3 ML/TF risks. The risks associated with this type of business, particularly where there are non-Bailiwick resident beneficial owners, is that if a Firm does not provide directors or nominee shareholders and administrative services to the company, its ability to know what the company is doing is significantly weaker than where it has mind and management control over the company and its activities. The firm identified that additional controls would be required to mitigate this risk which would include periodically obtaining accounts and Board minutes from the external directors and administrators so that it could keep abreast the of the company’s activities. Consequently, the firm had decided that this made these structures uneconomic, i.e. the risk of providing these services ultimately outweighed the reward. They subsequently stopped offering this service and are actively exiting RORA structures. During its onsite visits the Commission reviewed firms’ risk appetite statements and noted that a number of statements were not clearly articulating the risk appetite of the Firm. For example, a number of risk appetite statements simply stated the percentage of high risk business the firm was prepared to take on. Whilst this qualitative measure may assist the firm in not overstretching its administrative, operational and resourcing constraints, it does not set out the type of risks it is willing to accept because they are within its ability to mitigate. For example, the monitoring requirements over a business relationship with a UK PEP will be different to that for a relationship involving a sensitive industry such as mining in a high risk jurisdiction. The risk appetite statement should consider other factors, such as:

• What are the strategic objectives of the firm? Are they clear?
• Is the Board clear about the nature and extent of the significant risks it is willing to take in
  achieving its strategic objectives?
• What are the significant risks the board is not willing to take?
  AREA FOR IMPROVEMENT:
  CASE STUDY:

3. Risk Mitigation - Compliance Monitoring Programme (“CMP”)
   Having identified its risk exposure, a firm must establish a policy for the review of its compliance with the requirements of the Regulations, which takes into account the size, nature and complexity of the business. This must also include a requirement of sample testing on an ongoing basis to assess whether the policies, procedures and controls remain appropriate and effective to minimise the risk of a firm being used to launder the proceeds of crime or fund terrorism. Consequently encouraging a culture of compliance amongst staff to comply with policies and procedures is key. All 35 firms surveyed had a CMP in place to carry out sample testing on the effectiveness of their controls, however the frequency within which they were reviewed by senior management varied considerably. Given the pivotal role that the CMP plays in ensuring the effectiveness of the mitigants put in place by the firm to detect and prevent ML/TF risks, it was encouraging that the majority of firms review this on at least an annual basis. However, it is disappointing to note that three firms only reviewed their CMP’s effectiveness on a trigger event basis. One of these firms commented during the onsite visit that it recognised that its review of the CMP had been ad hoc and too informal to date, covering only certain parts of the compliance monitoring programme rather than a full, organised review of each
   section. It committed to conducting a complete refresh of its CMP.
   The firms surveyed have identified issues in a number of controls as a result of the testing undertaken in their compliance monitoring programmes, principally surrounding CDD, client take-on procedures, transaction and activity monitoring and regular risk reviews. The Commission would encourage all firms to regularly test these controls. Early detection and remediation of a deficiency in its controls can reduce a firm’s exposure to ML and TF risks and potentially the costs of remediating a greater problem. 21 1 10 3 0 5 10 15 20 25 Annually Half Yearly Quarterly Trigger Based Number of Firms Frequency of review How often does the Firm consider if changes are necessary to the Compliance Monitoring Programme to “ ensure it remains effective? ”

Policies and procedures where issues were identified through compliance monitoring Whilst it is encouraging that firms’ compliance monitoring programmes are detecting issues, it is concerning that over half of the firms surveyed (i.e. 18 out of 35) had detected issues in their CDD controls. This was explored with firms during the onsite visits and it was determined that this did not relate to a failure to identify and verify the beneficial owners and principals, but rather it was highlighting ongoing requirements to keep CDD up to date on the basis of the assessed risk of the relationship. The Commission takes this opportunity to remind firms that it is not necessary to re-verify or obtain current documents where previous verification documents have expired, unless the firm has assessed that the documentation held is not adequate for the assessed risk, or there are doubts about the accuracy of the data. It was also concerning that, over a third of firms surveyed had detected issues in their policies and procedures relating to client take-on, regular risk assessments, transactions and activity monitoring and the effectiveness of their B.R.A. The Commission would encourage firms to continue to review their policies and procedures in these areas to ensure they are effective in detecting and mitigating ML and TF risks to the firm’s business. The Commission was encouraged to note that the CMPs for the firms’ surveyed contained high levels of sample testing across a range of functions. However a few firms stated they were not testing controls in a number of key areas. These included testing controls for:- i) reporting suspicion promptly, ii) record retention, iii) identification of unusual activity/transactions and iv) screening for sanctioned individual and entities. 18 13 12 12 10 6 5 2 1 0 2 4 6 8 10 12 14 16 18 20 Number of Firms

Breakdown of # firms who are not testing specific policies and procedures The Commission is concerned with this, particularly around the failure to test processes for the detection of unusual activity and for the reporting of suspicion, as these have been key issues to emerge in cases where enhanced supervisory measures have been necessary. Financial services businesses must perform ongoing and effective monitoring of all existing business relationships, including scrutinising transactions or other activities to ensure that they are consistent with the firm’s knowledge of the customer and their business. By not testing these key controls the Commission is unsure how these firms can be sure that they remain efficient and effective in preventing ML and TF. Another area of potential weakness is in not testing the effectiveness of the processes for assessing risk at take-on and on an ongoing regular basis. These processes are key controls in determining the extent of a firm’s due diligence on new and existing customers and beneficial owners to ensure that the reasons for the relationship and for establishing what type, volume and value of activity to expect are sufficiently clear and understood by the firm to enable it to determine the appropriate level of monitoring. By not testing the effectiveness of its take-on risk assessment process, this potentially opens the firm up to accepting business which subsequently turns out to be outside of its risk appetite, resources and its ability to manage. 6 4 3 3 2 0 1 2 3 4 5 6 7 Number of Firms

“ ”
The CMPs for two of the firms visited were word for word the same and contained tests, which were not applicable to the risks identified by these firms in their B.R.A. These are strong indicators to the Commission of an ‘off the shelf’ CMP, particularly as both firms used the same outsourced compliance service provider. Whilst a generic programme provided by a compliance consultant can be a starting point for a firm without the resources to develop a bespoke programme, it is important that the Board ensure that it is tailored to fit the specific needs of the firm. The depth and frequency of compliance monitoring tests should be based on a thorough assessment of the pertinent risks to the business.
Part B. Financial Crime Governance

1. Board Oversight of Financial Crime Compliance
   The Board of a firm should be reviewing compliance with its regulatory obligations at regular intervals appropriate to the size, nature and complexity of its business, as it is ultimately responsible for risk management and for ensuring that the firm’s business is conducted in compliance with the requirements of the Regulations, the rules in the Handbook and any other relevant legislation. From the information provided from the survey and from discussions during the subsequent visits, all Boards were formally reviewing the suitability and appropriateness of their compliance arrangements and assessing their resources against the size, nature and complexity of the firm’s business on at least an annual basis. The survey identified that 100% of firms were reviewing their level of compliance on at least an annual basis. Of this, 40% of firms (i.e. 14 firms) Boards were reviewing compliance with their obligations on at least a quarterly basis, with Boards of two of these firms reviewing compliance on a monthly basis.

2
12
21
0
5
10
15
20
25
Monthly Quarterly Annually
Number of Firms
How often does the Board review and approve the Firm’s financial crime compliance arrangements? AREA FOR IMPROVEMENT:

The Board must have controls in place to ensure that compliance tests are being conducted effectively and are being carried out within the specified timeframes to mitigate the risk. The Board must also be satisfied that the firm has appropriate and sufficient compliance resources.
2. Financial Crime Management Information
A firm should have appropriate reporting methods and reporting channels in order for the Board to be fully apprised of issues arising within its business and to allow it to take necessary actions to remedy identified deficiencies. The Commission observed that in most cases Boards consider information regarding a firm’s compliance through a periodic report from the Compliance Officer or MLRO, which is typically tabled and discussed at each Board meeting. Such reports include information on the compliance monitoring programme and the results, trends and themes arising from those tests, emerging risks to the business, updates on the progress of risk reviews and outstanding action points, amongst other matters. As part of the onsite visits the Commission reviewed the Compliance and/or MLRO reports and the Board meeting minutes to understand whether the Boards were i) being provided with sufficient information in order to fulfil their corporate governance duties, ii) whether the Boards challenged that information and iii) if evidence could be seen of Boards discussing AML/CFT matters. As previously noted, some Boards had not formally recorded their discussion and consideration of the information provided in the Compliance and/or MLRO reports. The following sub-paragraphs indicate why good quality management information is critical. A firm’s Executive Committee minutes regarding the Compliance report consistently stated, “Report as tabled was reviewed and duly noted”. When queried about this the firm explained that as any issues arising were discussed on an ongoing basis, there was not always a discussion of them in the Executive Committee meetings, however it did accept that the minutes “could be expanded upon”. Noting only that there had been discussion on a tabled compliance report does not necessarily provide compelling evidence that the Board is taking responsibility for ensuring the business is being run in accordance with applicable legislation.
2.1 Risk Reviews and Action Points
Generally, the status of financial crime risk reviews and outstanding action points arising was being considered at appropriate intervals by the Boards of the firms taking part in the Thematic survey. This appeared to be at a level which would indicate that the Board would understand and respond to the reasons behind any delays in completing the reviews or addressing the action points. AREA FOR IMPROVEMENT:

The main ways in which the Firms surveyed ensure that action points are resolved is by:

• including this information in the Compliance/MLRO reports,
• incorporating it as a standard item in the Board meetings’ agenda,
• using flags on the firm’s database system indicating outstanding action points,
• monthly reporting of overdue action points to staff and through the compliance monitoring
  programme.
  The Boards of some of the smaller firms commented that they are directly involved in the risk review process and explained that this is how they maintain awareness of any outstanding action point issues. One firm was unable to separately identify between significant financial crime related (or indeed prudential and/or conduct issues) from administrative client review action points. Consequently, the firm’s board would not be able to distinguish between material financial crime action points requiring immediate action and those that were not, nor the extent to which the firm’s exposure to the ML and TF risks had increased as a result. With responsibility upon the Board for ensuring the firm’s compliance with the Regulations, clear and unambiguous management information on the extent and significance of deficiencies in documentation and/or information on client files is key in determining how to target resources more effectively to ensure that file deficiencies are remediated.
  2.2 Time Taken to Disclose SARS
  It was encouraging to note that a number of the Firms are now including data on the time taken to consider internal SARs and make onward reports to the FIS within the MLRO reports to the Board. Most MLRO’s explained that they attempted to determine if a disclosure of an internal report was warranted within a few days. The Commission wishes to remind Firms that the timely reporting of suspicious activity, both internally to the MLRO and where appropriate, from the MLRO to the FIU, is one of the key components in the Bailiwick’s efforts to prevent both money laundering and terrorist financing. It is the responsibility of the Board to ensure that the Firm’s reporting process does not cause a delay to the timely reporting of suspicion in order not to delay or hinder an investigation into potential criminality by the law enforcement authorities. Information on how long decisions are taken on internal disclosures by the MLRO assist a Board in determining whether its procedures and controls on timely reporting of suspicions are effective. AREA FOR IMPROVEMENT:
  POINT OF NOTE:

Part C. Customer Risk Management Framework

1. Customer Take-on Arrangements
   Firms were asked to describe their arrangements for assessing ML and TF risk when they were considering taking on a new client. Firms indicated that they considered factors such as rationale of the structure, its elements, its proposed activities and the firm’s role in the structure. Determining why the potential client wishes to establish a structure in Guernsey was one of the first questions asked by some firms. Most firms indicated that a client would not be taken on until the tax rationale for the proposed structure was fully understood. It was particularly encouraging to find that it was common among firms taking part in the thematic for the firm to be party to correspondence with the client’s tax and/or legal advisors in order to understand the tax rationale. Some firms noted that it was now a general requirement from their bankers to provide them with this information in order to open an account. It was also encouraging that a large proportion of firms stated that where possible they would physically meet with the client / beneficial owner before deciding whether to take them on. When this was not possible, communication was by telephone and email. Nearly half of firms surveyed (17 out of 35) had declined potential clients within the last two years, which indicates that potential new business will be declined where unacceptable higher risks appear to be present or where the purpose of the proposed structure is not understood. The Commission sees this as positive indication that firms have a robust understanding of their risk appetite and impose a limit on how much risk they will take on. Reasons given for rejecting or terminating a potential client / business relationship included the client requirements being outside of the firm’s service offering (such as registered office / registered agent only services), deficiencies in requested due diligence, involvement in a high risk jurisdiction, adverse media and unclear rationale for the structure. Nevertheless, overall the principal reason referred to by the firms surveyed relate to it not being within the firm’s risk appetite. In this regard, the firm would not accept the relationship if the risks were perceived to be too high to manage. 18 6 4 3 1 1 2 0 2 4 6 8 10 12 14 16 18 20 0 1 2 3 5 6 10 Number of Firms Number of prospective clients declined “ I n t In the last two years, how many prospective clients has the Firm declined due either to suspicion or the prospect falling outside of the Firm’s Risk Appetite following consideration of the initial client risk rating? ”

This was the case for one of the firms that indicated that they had rejected 10 potential client relationships over the past 2 years. It stated that the main reason for declining potential business was either that the high risk factors were outside of its risk appetite, or the EDD measures that would be required to bring the risk back within its risk appetite would make the offering uneconomical. Please note: respondents could provide more than one category when completing the questionnaire. A proportion of firms have rejected prospective business over the past two years. Many of those firms explained that often it was identified that potential business was clearly outside of their risk appetite or unsuitable to their business at an early stage. One firm explained that there had been a number of instances where prospective clients had been too vague on the intended activities of the entities and when pressed they ceased to correspond, before an application the firm really developed; as such they were never formally declined. This suggests to the Commission that the majority of firms have robust client take-on controls to ensure that they have sufficient information to understand the intended nature and rationale for the relationship. 21 13 10 9 5 4 2 0 5 10 15 20 25 Number of Firms ” Where would the Firm find it appropriate, based on an assessment of financial crime risk, to reject or terminate a business relationship with a client? “

1.1 SAR reporting trends
The 2017 Financial Crime Risk Return (“FCRR”) data shows that 22 of the 35 firms surveyed (63%) had received an internal suspicion report in the previous 12 months, with 13 of these raising more than one.1 Firms were asked to classify the nature of any SARs raised from exited business over the past 3 years. Classifying the nature of the SARs can provide an insight into the ML and TF risks that the firm faces. By looking at the past 3 years of data it is possible to identify certain trends.

1 The one obvious outlier in the number of SAR’s graph explained that a number of their clients participated in a tax amnesty. 13 9 5 2 4 1 1 0 2 4 6 8 10 12 14 None 1 2 3 4 6 38 Number of Firms Number of Internal SARs 5 4 2 0 2 4 4 3 2 3 1 1 4 2 0 0 1 2 3 4 5 6 Fraud Tax Evasion Unusual Activity Bribery & Corruption Adverse Due Diligence Number of Firms Nature of Suspicion 1/7/14 - 30/6/15 1/7/15-30/6/16 1/7/16 to 28/4/17 How many internal SARs were received in the past year? “ I n t h e l ” In relation to rejected or terminated business where SAR was raised, what “ was the nature of the suspicion? I n t ”

Whilst the figures are small, the Commission was interested to observe a relative decrease in SARs raised due to Fraud and Tax Evasion. In the case of the former this may reflect heightened awareness of the importance of robust fraud controls in the wake of increased cyber-attacks. In respect of tax evasion, the reduction may arise from the increased reporting requirements that have come about through FATCA, CRS and the expiration of tax amnesties. It is also encouraging to note a relative increase in the reporting of SARs due to Unusual Activity, which suggests that the ongoing monitoring of clients is becoming more effective in detecting client activity outside of what was expected at take on (i.e. “the norm”).
2. Ongoing Monitoring of Customers
All firms must ensure that there are sufficient controls in place to monitor their customers on an ongoing basis for the timely detection of i) any suspicions about their activity, ii) whether a customer or its beneficial owner/s or connected parties are subject to international sanction(s) or iii) if there have been changes to the profile of the customer or beneficial owner requiring the firm to re-assess the risk posed – for example a change in beneficial ownership, detection of a political connection or adverse media about the party/ies.
2.1 Transaction Monitoring
Firms taking part in the thematic appear to have well established payment approval processes in place, with various degrees of senior management signoff which takes into account the risk ratings for individual files, i.e. the higher the risk rating the more senior the approval level before the transaction can proceed. These processes are typically tested via a formal CMP, or as a part of the periodic review process, although as noted earlier in the report, four of the firms surveyed did not test this aspect of their controls. Firms are also evidently aware of the risks of fraudulent transaction requests, received directly or via compromised client email accounts. It was encouraging to note that all firms visited implement controls to verify payment requests, mainly in the form of client call-backs, to confirm that the payment request did indeed come from the true client.
2.2 Customer Screening
Whilst nearly half of the firms’ surveyed use automated screening tools to monitor business relationships, there was a lower prevalence of automated screening tools in use amongst firms in this survey compared to those firms surveyed in the Funds sector thematic2 .

2 Over two-thirds of firms surveyed in the 2016 Funds sector Thematic use automated screening tools.

Of those firms relying on manual screening, it was encouraging to see that the majority had controls in place to assist in the timely identification of key changes in a customer profile. Examples of these controls included:
 manually screening their client databases on a weekly basis;  creating Google alerts to highlight adverse media on a customer undertaking manual screening checks prior to payments being made;  subscribing to HMRC, UN, and OFAC sanctions lists in order to conduct a manual screen whenever a sanctions notice is released; and  end to end testing of a process, such as making a payment, to ensure that all component parts were working effectively. Interestingly, there appears to be a lower number of SARs raised by those firms with only manual screening as opposed to those firms which have an automated screening system in place. Half of the firms with manual screening had not raised a SAR in the previous 12 months as opposed to only a fifth of those with automated screening. These statistics could suggest that instances of adverse media about a client are detected earlier when firms have automated screening systems in place. Firms may wish to consider the use of automated screening systems or similar technology as a way of mitigating the risk of not identifying a key change in the client / beneficial owners’ profile over a significant period. The Commission noted that most firms surveyed were screening their client base on a regular basis. However, some firms only screened their clients at take on and at the time of the respective periodic review. In the absence of other checks a firm may not be aware of changes to the client / beneficial owner’s profile. In the case of standard or low risk rated clients this could mean a two to five year gap in screening between scheduled reviews. AREA FOR IMPROVEMENT:
POINT OF NOTE:

2.3 Client Periodic Risk Reviews
All firms surveyed review the financial crime risk of their business relationships on a periodic basis, with the frequency of the review depending on the risk assigned to that relationship. Please note, the N/A relates to firms which do not recognise the indicated risk rating in their rating scheme. In regards to the two firms who do not recognise high-risk ratings, one is a firm who provides corporate services solely to Bailiwick clients, and the other is a firm with a very small client base none of whom were assessed as high risk. It was encouraging to note a greater use of periodic reviews by the surveyed firms in the TCSP sector. As previously mentioned, this sector is generally perceived to have a higher ML/TF risk in comparison to other sectors of the Bailiwick’s financial services industry. As such, the Commission sees the very low prevalence of trigger-based reviews as a positive indicator that firms are taking their responsibilities for regularly reviewing their client base seriously.
2.4 Risk Review Action Points
The survey requested data on how many action points had been raised during reviews in 2015 and 2016 and how many of those action points remained outstanding in 2017. Whilst a large number of action points had been raised by the firms in this survey, encouragingly there was a positive focus on promptly clearing any action points arising from these reviews when compared to the results of the Funds sector survey in 2016. 2 4 27 0 2 0 1 8 3 20 2 0 0 1 0 0 6 0 3 16 1 1 8 0 5 10 15 20 25 30 Quarterly Half Yearly Annually 18 Months Biennially Triennially 5 Yearly Trigger Based N/A Number of Firms High Risk Standard Risk Low Risk ” What is the frequency of client financial crime risk reviews based on risk “ rating?

In detail, the firms in this survey had raised 4,326 action points from periodic reviews in 2015 and 2016, with 840 (or 19%) of these action points outstanding by Q3 of 2017. In contrast, a total of 786 action points were raised by those firms in the Funds thematic in 2014 and 2015, with 366 (or 46%) remaining to be addressed at the time of the survey in quarter 4 2016.

• Please note: the Thematic questionnaire was distributed in the first half of 2017, the timing of this will have had some
  bearing on the number of outstanding action points for 2016.
  Amongst the 35 firms surveyed, common issues arising from risk reviews included outstanding action points, outstanding risk reviews, no clear documented rationale for the structures under administration and incorrect assignment of risk ratings. It was disappointing to note that greatest issue encountered related to incomplete client information and missing documentation, identified by 21 out of 35 firms surveyed (60%). When this was explored during the onsite visits, firms explained that their verification documents on clients and beneficial owners were incomplete in respect of an item of CDD documentation missing or having expired. 969 621 40 49 56 6 1451 1164 87 369 333 27 0 200 400 600 800 1000 1200 1400 1600 High Risk Standard Risk Low Risk High Risk Standard Risk Low Risk Action Points Raised Outstanding Action Points Number of Action Points 2015 2016 How many action points arose from the financial crime risk reviews for 2015 and 2016, and how many of those remain outstanding? ” “

Holding appropriate levels of client information constitutes an essential part of a firm’s risk management controls. However as previously stated, it is not necessary to re-verify or obtain current documents where previous verification documents have expired unless the firm has assessed that the documentation held is not adequate for the assessed risk, or there are doubts about the accuracy of the data. __________________________________________________________________________________ 21 8 8 6 3 3 1 0 5 10 15 20 25 Client Info/Docs Insufficient / Missing Outstanding Action Points No Material Issues Outstanding Risk Reviews No Clear Documented Rationale Risk Classification Issues Unknown Change in Client Activity Number of Firms What are the most common issues arising from compliance monitoring tests carried out on “ financial crime periodic reviews? ”