Guernsey Financial Services Commission Handbook on Countering Financial Crime and Terrorist Financing

Guernsey Financial Services Commission
Handbook on Countering Financial
Crime and Terrorist Financing
22 March21 July 2022

Contents
Chapters of this Handbook
Page
Table of Acronyms 5
Table of Figures 7
Chapter 1 Introduction 9
Chapter 2 Corporate Governance 17
Chapter 3 Risk-Based Approach 31
Chapter 4 Customer Due Diligence 53
Chapter 5 Natural Persons 65
Chapter 6 Certification 73
Chapter 7 Legal Persons and Legal Arrangements 81
Chapter 8 Enhanced Customer Due Diligence 107
Chapter 9 Simplified Customer Due Diligence 129
Chapter 10 Introduced Business 143
Chapter 11 Monitoring Transactions and Activity 149
Chapter 12 UN, UK and Other Sanctions 157
Chapter 13 Reporting Suspicion 165
Chapter 14 Wire Transfers 181
Chapter 15 Employee Screening and Training 193
Chapter 16 Record Keeping 201
Chapter 17 Transitional Provisions 207
Appendix A Glossary of Terms 213
Appendix B References 227
Appendix C Equivalent Jurisdictions 235
Appendix D Sector-Specific Guidance 237
Appendix E List of Domestic PEPs 257
Appendix F Introducer Certificate 261
Appendix G Schedule 3 to the Law 267
Appendix H High Risk Jurisdictions Subject to a Call for Action by the
FATF
315
Appendix I Countries and territories that are identified by relevant external
sources as presenting a higher risk of ML and/or FT 317 Index 325

Table of Acronyms
The following acronyms are used within this Handbook. Where necessary definitions of these terms can be found in Appendix A. AML Anti-Money Laundering App Application BACS Bankers’ Automated Clearing System CDD Customer Due Diligence CECIS Closed-Ended Collective Investment Scheme CFT Countering the Financing of Terrorism CIS Collective Investment Scheme DT Drug Trafficking ECDD Enhanced Customer Due Diligence ESAs European Supervisory Authorities EU European Union FATF Financial Action Task Force FIS Financial Intelligence Service FIU Financial Investigation Unit FSB Financial Services Business FT Financing of Terrorism GP General Partner IBAN International Bank Account Number IC Incorporated Cell ICC Incorporated Cell Company IFSWF International Forum of Sovereign Wealth Funds IMF International Monetary Fund IOSCO International Organization of Securities Commissions IT Information Technology LLP Limited Liability Partnership LP Limited Partnership LPP Legal Professional Privilege MI Management Information ML Money Laundering MLCO Money Laundering Compliance Officer MLRO Money Laundering Reporting Officer MONEYVAL The Committee of Experts on the Evaluation of Anti-Money Laundering and the Financing of Terrorism MSP Money Service Provider MVTS Money or Value Transfer Service NATO North Atlantic Treaty Organization NGCIS Non-Guernsey Collective Investment Scheme NPO Non-Profit Organisation NRA National Risk Assessment NRFSB Non-Regulated Financial Services Business OECD Organisation for Economic Co-operation and Development OECIS Open-Ended Collective Investment Scheme

OFAC Office of Foreign Assets Control
PB Prescribed Business
PC Protected Cell
PCC Protected Cell Company
PEP Politically Exposed Person
PQ Personal Questionnaire
PSP Payment Service Provider
RFID Radio-Frequency Identification
SCDD Simplified Customer Due Diligence
SDN Specially Designated National
SIO Senior Investigating Officer
SWF Sovereign Wealth Fund
SWIFT Society for Worldwide Interbank Financial Telecommunication THEMIS The FIS Online Reporting Facility for a Disclosure of Suspicion UK United Kingdom UN United Nations UNSCR United Nations Security Council Resolutions US United States of America

Table of Figures
The following tables and diagrams are used within this Handbook:
Page
Fig. 1 CDD Measures for Key Principals 56
Fig. 2 Process of Certification 74
Fig. 3 Chains of Certification 79
Fig. 4 Flow of Copy Certified Documentation 79 Fig. 5 Three Step Test of Beneficial Ownership 87 Fig. 6 Control Through Other Means 89 Fig. 7 Direct Holding vs. Indirect Holding 90 Fig. 8 Beneficial Ownership of PCCs 92 Fig. 9 Limited Partnership 94 Fig. 10 Enhanced Measures Flowchart 109 Fig. 11 Application of Due Diligence and Enhanced Measures Depending on Risk 110 Fig. 12 Timescales for Declassification of PEPs 119

Chapter 1
Introduction
Contents of this Chapter
1.1. Introduction...............................................................................................................................10
1.2. Background and Scope..............................................................................................................10
1.3. The Bailiwick’s AML and CFT Framework.............................................................................11
1.4. Handbook Purpose ....................................................................................................................12
1.5. Requirements of Schedule 3 .....................................................................................................13
1.6. Structure and Content of the Handbook....................................................................................13
1.7. Significant Failure to Meet the Required Standards.................................................................14
1.8. Data Protection..........................................................................................................................14
1.9. The Financial Action Task Force..............................................................................................14
1.10. The National Risk Assessment .................................................................................................15
1.11 MONEYVAL............................................................................................................................16

Chapter 1 - Page 10
1.1. Introduction

The laundering of criminal proceeds, the financing of terrorism and the financing of the
proliferation of weapons of mass destruction (henceforth referred to collectively as “ML and FT”) through the financial and business systems of the world is vital to the success of criminal and terrorist operations. To this end, criminals and terrorists seek to exploit the facilities of the world’s businesses in order to benefit from such proceeds or financing.
Increased integration of the world’s financial systems and the removal of barriers to the free
movement of capital have enhanced the ease with which criminal proceeds can be laundered or terrorist funds transferred and have added to the complexity of audit trails. The future of the Bailiwick of Guernsey (“the Bailiwick”) as a well-respected international financial centre depends on its ability to prevent the abuse of its financial services business (“FSB”) and prescribed business (“PB”) sectors by criminals and terrorists.
1.2. Background and Scope
The Bailiwick authorities are committed to ensuring that criminals, including money launderers,
terrorists and those financing terrorism or the proliferation of weapons of mass destruction, cannot launder the proceeds of crime through the Bailiwick or otherwise use the Bailiwick’s finance and business sectors. The Guernsey Financial Services Commission (“the Commission”) endorses the International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation issued by the Financial Action Task Force (“FATF” and “the FATF Recommendations”). This Handbook is a statement of the standards expected by the Commission of all specified businesses in the Bailiwick to ensure the Bailiwick’s compliance with the FATF Recommendations.
Should a specified business assist in laundering the proceeds of crime or in the financing of a
terrorist act or organisation, it could face regulatory investigation, the loss of its reputation, and law enforcement investigation. The involvement of a specified business with criminal proceeds or terrorist funds would also damage the reputation and integrity of the Bailiwick as an international finance centre.
Under Section 1(1) of the Criminal Justice (Proceeds of Crime) (Bailiwick of Guernsey) Law,
1999 as amended (“the Law”) all offences that are indictable under the laws of the Bailiwick are considered to be predicate offences and therefore funds or any type of property, regardless of value, acquired either directly or indirectly as the result of committing a predicate offence, are considered to be the proceeds of crime. Under Bailiwick law all offences are indictable, with the exception of some minor offences which mainly concern public order and road traffic. The range of predicate offences is therefore extremely wide and includes, but is not limited to, the following:
(a) participation in an organised criminal group and racketeering; (b) terrorism, including FT; (c) financing of proliferation of weapons of mass destruction; (d) human trafficking and migrant smuggling; (e) sexual exploitation, including sexual exploitation of children; (f) illicit trafficking in narcotic drugs and psychotropic substances; (g) illicit arms trafficking; (h) illicit trafficking in stolen and other goods; (i) corruption and bribery; (j) fraud and tax evasion; (k) counterfeiting and piracy of products; (l) environmental crime; (m) murder, manslaughter and grievous bodily injury;

Chapter 1 - Page 11
(n) kidnapping, illegal restraint and hostage taking; (o) robbery and theft; (p) smuggling; (q) extortion; (r) forgery; (s) piracy; and (t) insider trading and market manipulation.
6. The Bailiwick’s anti-money laundering (“AML”) and countering the financing of terrorism
(“CFT”) legislation (and by extension this Handbook) applies to all specified businesses conducting business in the Bailiwick. This includes Bailiwick-based branches and offices of companies incorporated outside of the Bailiwick conducting financial services and/or prescribed business within the Bailiwick. In this Handbook all references to ‘the firm’ shall have the same meaning as specified business in Paragraph 21(1) of Schedule 3, and includes all such businesses whether natural persons, legal persons or legal arrangements, including but not limited to, companies, partnerships and sole traders.
7. Schedule 3 to the Law (referred to henceforth as “Schedule 3”) and this Handbook have been
drafted to take into account the fact that not all of the requirements of the FATF Recommendations are relevant to all businesses. In this regard, while certain provisions (for example, the application of a risk-based approach, corporate governance, customer due diligence (“CDD”), suspicion reporting, employee training and record keeping) apply equally to all firms, there are other requirements set out in this Handbook which may not be as relevant to some particular areas of industry (for example, wire transfers). Taking such an approach to the drafting of Schedule 3 and this Handbook is intended to prevent the application of unnecessary and bureaucratic standards.
1.3. The Bailiwick’s AML and CFT Framework
8. The Bailiwick’s AML and CFT framework includes the following legislation (henceforth referred
to as “the Relevant Enactments”):
(a) The Criminal Justice (Proceeds of Crime) (Bailiwick of Guernsey) Law, 1999; (b) The Drug Trafficking (Bailiwick of Guernsey) Law, 2000; (c) The Terrorist Asset-Freezing (Bailiwick of Guernsey) Law, 2011; (d) The Sanctions (Bailiwick of Guernsey) Law, 2018; (e) The Terrorism and Crime (Bailiwick of Guernsey) Law, 2002; (f) The Disclosure (Bailiwick of Guernsey) Law, 2007; (g) The Transfer of Funds (Guernsey) Ordinance, 2017; (h) The Transfer of Funds (Alderney) Ordinance, 2017; (i) The Transfer of Funds (Sark) Ordinance, 2017; (j) The Disclosure (Bailiwick of Guernsey) Regulations, 2007; (k) The Terrorism and Crime (Bailiwick of Guernsey) Regulations, 2007; (l) The Registration of Non-Regulated Financial Services Businesses (Bailiwick of Guernsey) Law, 2008; (m) The Prescribed Businesses (Bailiwick of Guernsey) Law, 2008; (n) The Beneficial Ownership of Legal Persons (Guernsey) Law, 2017; (o) The Beneficial Ownership of Legal Persons (Alderney) Law, 2017; (p) The Beneficial Ownership (Definition) Regulations, 2017; (q) The Beneficial Ownership (Alderney) (Definitions) Regulations, 2017; (r) The Beneficial Ownership of Legal Persons (Provision of Information) (Transitional Provisions) Regulations, 2017; (s) The Beneficial Ownership of Legal Persons (Provision of Information) (Transitional Provisions) (Alderney) Regulations, 2017; (t) The Beneficial Ownership of Legal Persons (Nominee Relationships) Regulations, 2017;

Chapter 1 - Page 12
(u) The Beneficial Ownership of Legal Persons (Nominee Relationships) (Alderney) Ordinance, 2017; and (v) The Beneficial Ownership of Legal Persons (Provision of Information) (Limited Partnerships) Regulations, 2017; and such other enactments relating to ML and FT as may be enacted from time to time in the Bailiwick.
9. Sanctions legislation is published by the States of Guernsey’s Policy & Resources Committee
and can be accessed via the below website:
www.gov.gg/sanctions
1.4. Handbook Purpose
10. This Handbook has been issued by the Commission and, together with statements and instructions
issued by the Commission, contains the rules and guidance referred to in: Section 49AA(7) of the Law; Paragraph 3(7) of Schedule 3 to the Law; Section 15(8) of the Terrorism and Crime (Bailiwick of Guernsey) Law, 2002 as amended (“the Terrorism Law”); Section 15 of the Disclosure (Bailiwick of Guernsey) Law, 2007 as amended (“the Disclosure Law”); and Section 11 of the Transfer of Funds (Guernsey) Ordinance, 2017, the Transfer of Funds (Alderney) Ordinance, 2017 and the Transfer of Funds (Sark) Ordinance, 2017 (“the Transfer of Funds Ordinance”).
11. This Handbook is issued to assist the firm in complying with the requirements of the relevant
legislation concerning ML and FT, financial crime and related offences to prevent the Bailiwick’s financial system and operations from being abused for ML and FT. The Law and the Terrorism Law as amended state that the Bailiwick courts shall take account of rules made and instructions and guidance given by the Commission in determining whether or not the firm has complied with the requirements of Schedule 3.
12. This Handbook has the following additional purposes:
(a) to outline the legal and regulatory framework for AML and CFT requirements and systems; (b) to interpret the requirements of the Relevant Enactments and provide guidance on how they may be implemented in practice; (c) to indicate good industry practice in AML and CFT procedures through a proportionate, risk-based approach; and (d) to assist in the design and implementation of systems and controls necessary to mitigate the risks of the firm being used in connection with ML and FT and other financial crime.
13. The Commission acknowledges the differing approaches adopted by specified businesses to
achieve compliance with the requirements of the Relevant Enactments and Commission Rules. This Handbook therefore seeks to adopt a technology neutral stance, allowing the firm to embrace whichever technological solution(s) it deems appropriate to meet its obligations. Further information about the use of technology can be found in Chapter 3 of this Handbook.

Chapter 1 - Page 13
1.5. Requirements of Schedule 3
14. Schedule 3 includes requirements relating to:
(a) risk assessment and mitigation;
(b) applying CDD measures;
(c) monitoring customer activity and ongoing CDD; (d) reporting suspected ML and FT activity; (e) employee screening and training; (f) record keeping; and (g) ensuring compliance, corporate responsibility and related requirements.
15. Any paraphrasing of Schedule 3 within parts of this Handbook represents the Commission’s own
explanation of that schedule and is for the purposes of information and assistance only. Schedule 3 remains the definitive text for the firm’s AML and CFT obligations. The Commission’s paraphrasing does not detract from the legal effect of Schedule 3 or from its enforceability by the courts. In case of doubt, you are advised to consult a Bailiwick Advocate.
1.6. Structure and Content of the Handbook
16. This Handbook takes a two-level approach:
(a) Level one (“Commission Rules”) sets out how the Commission requires the firm to meet the requirements of Schedule 3. Compliance with the Commission Rules will be taken into account by the courts when considering compliance with Schedule 3 (which is legally enforceable and a contravention of which can result in prosecution); and (b) Level two (“guidance”) presents ways of complying with Schedule 3 and the Commission Rules. The firm may adopt other appropriate and effective measures to those set out in guidance, including policies, procedures and controls established by the group Head Office of the firm, so long as it can demonstrate that such measures also achieve compliance with
Schedule 3 and the Commission Rules.
17. When the requirements of Schedule 3 are explained or paraphrased in this Handbook, the term
‘shall’ is used and the text is presented in blue shaded boxes for ease of reference. Reference is also made to the relevant paragraph(s) of Schedule 3.
18. When the requirements of the Transfer of Funds Ordinance and the EU Regulation are explained
or paraphrased in Chapter 14 of this Handbook, the term ‘shall’ is used and the text is presented in clear boxes for ease of reference. Reference is also made to the relevant paragraph(s) of the Ordinance.
19. Where the Commission Rules are set out, the term ‘must’ is used and the text is presented in red
shaded boxes to denote that these are rules.
20. In all cases the terms ‘shall’ and ‘must’ indicate that these provisions are mandatory and subject
to the possibility of prosecution (in the case of a contravention of Schedule 3 or the Transfer of Funds Ordinance) as well as regulatory sanction and any other applicable sanctions.
21. In respect of guidance, this Handbook uses the terms ‘should’ or ‘may’ to indicate ways in which
the requirements of Schedule 3, the Transfer of Funds Ordinance and the Commission Rules can be satisfied, but allowing for alternative means of meeting the requirements as deemed appropriate by the firm.

Chapter 1 - Page 14
22. The Commission will from time to time update this Handbook to reflect new legislation,
developments in the financial services and PB sectors, changes to international standards, good practice and amendments to Schedule 3 or the Relevant Enactments.
23. This Handbook is not intended to provide an exhaustive list of appropriate and effective policies,
procedures and controls to counter ML and FT. The structure of this Handbook is such that it permits the firm to adopt a risk-based approach appropriate to its particular circumstances. The firm should give consideration to additional measures which may be necessary to prevent any exploitation of it and of its products, services and/or delivery channels by persons seeking to carry out ML and/or FT.
1.7. Significant Failure to Meet the Required Standards
24. For any firm, whether regulated by or registered with the Commission, the primary consequences
of any significant failure to meet the standards required by Schedule 3, the Commission Rules and the Relevant Enactments will be legal ones. In this respect the Commission will have regard to the firm’s compliance with the provisions of Schedule 3, the Commission Rules and the Relevant Enactments when considering whether to take enforcement action against it in respect of a breach of any requirements of the aforementioned. In such cases, the Commission has powers to impose a range of disciplinary and financial sanctions, including the power to withdraw, restrict or suspend the licence of the firm where applicable.
25. Where the firm is regulated by the Commission, the Commission is entitled to take such failure
into consideration in the exercise of its judgement as to whether the firm and its directors and managers have satisfied the minimum criteria for licensing. In particular, in determining whether the firm is carrying out its business with integrity and skill and whether a natural person is fit and proper, the Commission must have regard to compliance with Schedule 3, the Commission Rules and the Relevant Enactments.
26. In addition, the Commission can take enforcement action under the Regulatory Laws and/or the
Financial Services Commission Law for any contravention of the Commission Rules where the firm is licensed under one or more of the Regulatory Laws.
27. Where the firm is not regulated by, but is registered with the Commission, the Commission is
entitled to consider compliance with Schedule 3, the Commission Rules and the Relevant Enactments when exercising its judgement in considering the continued registration of the firm. In this respect the Commission can also take enforcement action under the NRFSB Law and the PB Law where the firm is registered with the Commission under those laws.
1.8. Data Protection
28. The Bailiwick’s AML and CFT legislation requires the firm to collate and retain records and
documentation. Where such records and documentation contain personal data, the firm will need to comply with the Data Protection (Bailiwick of Guernsey) Law, 2017 (“the Data Protection Law”) which brings the Bailiwick into line with the European Union’s (“EU”) General Data Protection Regulation (“GDPR”). https://www.guernseylegalresources.gg/laws/guernsey-bailiwick/d/data-protection/dataprotection-bailiwick-of-guernsey-law-2017-consolidated-text/ https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32016R0679
1.9. The Financial Action Task Force

Chapter 1 - Page 15
29. The FATF is an inter-governmental body that was established in 1989 by the ministers of its
member jurisdictions. The mandate of the FATF is to set standards and to promote effective implementation of legal, regulatory and operational measures for combating ML, FT, the financing of the proliferation of weapons of mass destruction and other related threats to the integrity of the international financial system.
30. The FATF Recommendations are recognised as the global AML and CFT standard. The FATF
Recommendations therefore set an international standard which countries should implement through measures adapted to their particular circumstances. The FATF Recommendations set out the essential measures that countries should have in place to:
(a) identify risks and develop policies and domestic co-ordination; (b) pursue ML, FT and the financing of proliferation of weapons of mass destruction; (c) apply preventive measures for the financial sector and other designated sectors; (d) establish powers and responsibilities for the competent authorities (for example, investigative, law enforcement and supervisory authorities) and other institutional measures; (e) enhance the transparency and availability of beneficial ownership information of legal persons and legal arrangements; and (f) facilitate international co-operation.
1.10. The National Risk Assessment
31. In accordance with the FATF Recommendations, the Bailiwick, led by the States of Guernsey’s
Policy & Resources Committee, has conducted a National Risk Assessment (“NRA”). The NRA was based on the methodology developed by the International Monetary Fund (“IMF”) supplemented by additional information provided by the relevant agencies within the Bailiwick and industry to ensure a thorough assessment of the ML and FT risks presented by the individual sectors within the finance industry and products and services from within the Bailiwick.
32. The key finding of the NRA with regard to ML risk is that as an international finance centre with
a low domestic crime rate, the Bailiwick’s greatest ML risk comes from the laundering of the proceeds of foreign criminality. The underlying offences most likely to be involved are bribery and corruption and fraud (including tax evasion). The key finding of the NRA with regard to FT risks is that the greatest risks come from its cross-border business being used to support foreign terrorism, by funds being passed through or administered from the Bailiwick. However, this risk is much lower than the ML risks from cross-border business. FT from cross-border business is most likely to arise in the context of secondary terrorist financing, i.e. where criminal proceeds are used to fund terrorism.
33. The assessment of risks and vulnerabilities detailed within the NRA will naturally cascade
through to specified businesses within the Bailiwick. In this respect, references are made throughout Schedule 3 and this Handbook requiring the firm to have regard to the content of the NRA when undertaking certain activities, for example, the formulation of its business risk assessments and risk appetite.
34. The Bailiwick will continue to review the NRA on an on-going and trigger-event basis, making
changes as necessary taking into account market changes, the advancement of technology and data collected from industry, for example, through various surveys and regulatory returns.
35. A copy of the Bailiwick’s NRA can be found on the website of the States of Guernsey’s Policy &
Resources Committee:
National Risk Assessment

Chapter 1 - Page 16
1.11 MONEYVAL
36. The Committee of Experts on the Evaluation of Anti-Money Laundering and the Financing of
Terrorism (“MONEYVAL”) is a monitoring body of the Council of Europe. The aim of MONEYVAL is to ensure that its member states have in place effective systems to counter ML and FT and comply with the relevant international standards in these fields.
37. On 10 October 2012 the Committee of Ministers of the Council of Europe, following a request
by the United Kingdom (“UK”), adopted a resolution to allow the Bailiwick, the Bailiwick of Jersey and the Isle of Man (the “Crown Dependencies”) to participate fully in the evaluation process of MONEYVAL and to become subject to its procedures.
38. MONEYVAL’s most recent evaluation of the Bailiwick was conducted during October 2014 and
assessed the Bailiwick’s compliance with the FATF 2003 Recommendations. In its report, published on 15 January 2016, MONEYVAL concluded that the Bailiwick has ‘a mature legal and regulatory system’ and surpassed the equivalent review by the IMF in 2010. www.coe.int/en/web/moneyval/jurisdictions/guernesey

Chapter 2
Corporate Governance
Contents of this Chapter
2.1. Introduction...............................................................................................................................18
2.2. GFSC Code of Corporate Governance......................................................................................18
2.3. Board Responsibility for Compliance.......................................................................................19
2.4. Board Oversight of Compliance ...............................................................................................20
2.5. Outsourcing...............................................................................................................................22
2.6. Foreign Branches and Subsidiaries...........................................................................................23
2.7. Liaison with the Commission ...................................................................................................25
2.8. Key Persons ..............................................................................................................................26
2.8.1. Money Laundering Compliance Officer...........................................................................26
2.8.2. Money Laundering Reporting Officer..............................................................................27
2.8.3. Nominated Officer............................................................................................................28

Chapter 2 - Page 18
2.1. Introduction

Good corporate governance should provide proper incentives for the board or senior management
to pursue objectives that are in the interests of the firm and its shareholders and should facilitate effective monitoring of the firm for compliance with its AML and CFT obligations.
The Organisation for Economic Co-operation and Development (“OECD”) describes the
corporate governance structure of a firm as the distribution of rights and responsibilities among different participants, such as the board, managers and other stakeholders, and the defining of the rules and procedures for making decisions on corporate affairs.
The presence of an effective corporate governance system, within an individual company and
across an economy as a whole, is key to building an environment of trust, transparency and accountability necessary for fostering long-term investment, financial stability and business integrity and helps to provide a degree of confidence that is necessary for the proper functioning of a market economy.
This Chapter, together with Schedule 3, provide a framework for the oversight of the policies,
procedures and controls of the firm to counter ML and FT.
In accordance with Paragraph 21(2) of Schedule 3, references in this Chapter and in the wider
Handbook to the “board” shall mean the board of directors of the firm where it is a body corporate, or the senior management of the firm where it is not a body corporate (but is, for example, a partnership or a branch).
With reference to Paragraph 21(3) of Schedule 3, where the firm is a sole trader (for example, a
personal fiduciary licence holder or a natural person registered as a prescribed business operating alone), references to the “board” are references to the natural person named in the licence or registration issued by the Commission, unless specified otherwise within this Handbook.
2.2. GFSC Code of Corporate Governance
The firm is expected to maintain good standards of corporate governance. In order to provide
locally regulated FSBs and individual directors with a framework for sound systems of corporate governance and to help them discharge their duties efficiently and effectively, the Commission has issued the Finance Sector Code of Corporate Governance (“the Code”). https://www.gfsc.gg/sites/default/files/20160218%20- %20Finance%20Sector%20Code%20of%20Corp%20%20Gov.pdf
The Code is a formal expression of good governance practice against which the Commission can
assess the degree of governance exercised over regulated persons. In this regard, the Commission is focussed on outcomes based regulation, i.e. the Code focuses on high-level principles which allow each firm to meet the requirements in a manner suitable to the specific FSB’s business without having to adhere to prescriptive rules.
Whilst the Code does not apply to firms registered with the Commission under the NRFSB Law
or the PB Law, to partnerships, or to Bailiwick branches of foreign domiciled companies, its content can be helpful as a guide to the Commission’s expectations when assessing compliance with this Chapter by those businesses.

Chapter 2 - Page 19
2.3. Board Responsibility for Compliance
10. The board of the firm has effective responsibility for compliance with Schedule 3 and the
Commission Rules. References to compliance in this Handbook generally are to be taken as references to compliance with Schedule 3 and the Commission Rules.
11. The board of the firm is responsible for managing the firm effectively and is in the best position
to understand and evaluate all potential risks to the firm, including those of ML and FT. The board must therefore take ownership of, and responsibility for, the business risk assessments and ensure that they remain up to date and relevant.
12. More information on the process and requirements for conducting business risk assessments can
be found in Chapter 3 of this Handbook.
13. The board must organise and control the firm effectively, including establishing and maintaining
appropriate and effective policies, procedures and controls as detailed below, and having adequate resources to manage and mitigate the identified risks of ML and FT taking into account the size, nature and complexity of its business.
14. Taking into account the conclusions of the business risk assessments, in accordance with
Paragraph 2(b) of Schedule 3, the firm shall have in place effective policies, procedures and controls to identify, assess, mitigate, manage, review and monitor those risks in a way that is consistent with the requirements of Schedule 3, the Relevant Enactments, the NRA and the Commission Rules in this Handbook.
15. In addition to the general duty to understand, assess and mitigate risks as set out in Paragraph 2
of Schedule 3 and the requirement to maintain effective policies, procedures and controls contained therein, the firm should be aware that other paragraphs of Schedule 3 and this Handbook also contain more specific requirements in respect of the policies, procedures and controls required to mitigate particular risks, threats and vulnerabilities.
16. These policies, procedures and controls should enable the firm to comply with the requirements
of Schedule 3 and the Commission Rules, including amongst other things, to:
(a) conduct, document and maintain business risk assessments to identify the inherent ML and FT risks to the firm and to define the firm’s AML and CFT risk appetite (see Chapter 3); (b) conduct risk assessments of all business relationships and occasional transactions to identify those to which Enhanced Customer Due Diligence (“ECDD”) measures and monitoring must be applied, and those to which Simplified Customer Due Diligence (“SCDD”) measures can be applied where this is considered appropriate (see Chapter 3); (c) apply sufficient Customer Due Diligence (“CDD”) measures to identify, and verify the identity of, customers, beneficial owners and other key principals, whether natural persons, legal persons and legal arrangements, and to establish the purpose and intended nature of the business relationship or occasional transaction (see Chapters 4-7); (d) apply ECDD measures to those business relationships and occasional transactions deemed to pose a high risk of ML or FT and/or enhanced measures to those business relationships or occasional transactionsinvolving, or in relation to, one or more of the higher risk factors prescribed by Paragraph 5(2) of Schedule 3 sufficient to mitigate the specific risks arising (see Chapter 8); (e) apply SCDD measures in an appropriate manner where the circumstances of a business relationship or occasional transaction are such that the ML and FT risks have been assessed as low (see Chapter 9); (f) conduct transaction and activity monitoring (see Chapter 11);

Chapter 2 - Page 20
(g) monitor business relationships on a frequency appropriate to the assessed risk to ensure that any unusual, adverse or suspicious activity is highlighted and given additional attention (see Chapter 11); (h) screen customers, payees, beneficial owners and other key principals to enable the prompt identification of any natural persons, legal persons or legal arrangements subject to United Nation (“UN”), UK or other sanction (see Chapter 12); (i) report promptly to the FIS where an employee knows or suspects, or has reasonable grounds for knowing or suspecting, that another person is involved in ML and/or FT (including in connection with an attempted transaction) (see Chapter 13); (j) screen transfers of funds for missing or incomplete payer and payee information where the firm is a payment service provider (“PSP”) (see Chapter 14); (k) screen potential employees to ensure the probity and competence of board and staff members (see Chapter 15); (l) provide suitable and sufficient AML and CFT training to all relevant employees, identify those employees to whom additional training must be provided and provide such additional training (see Chapter 15); (m) maintain records for the appropriate amount of time and in a manner which enables the firm to access relevant data in a timely manner (see Chapter 16); and (n) ensure that, where the firm is a majority owner or exercises control over a branch office or subsidiary established outside the Bailiwick, the branch office or subsidiary applies controls consistent with the requirements of Schedule 3 or requirements consistent with the FATF Recommendations.
2.4. Board Oversight of Compliance
17. In accordance with Paragraph 15(1)(c) of Schedule 3, the firm shall establish and maintain an
effective policy, for which responsibility shall be taken by the board, for the review of its compliance with the requirements of Schedule 3 and this Handbook, and such policy shall include provision as to the extent and frequency of such reviews.
18. The board must consider the appropriateness and effectiveness of its compliance arrangements
and its policy for the review of compliance at a minimum annually, or whenever material changes to the business of the firm or the requirements of Schedule 3 or this Handbook occur. Where, as a result of its review, changes to the compliance arrangements or review policy are required, the board must ensure that the firm makes those changes in a timely manner.
19. As part of its compliance arrangements, the firm is responsible for appointing an MLCO who is
responsible for the firm’s compliance with its policies, procedures and controls to forestall, prevent and detect ML and FT. This Section should therefore be read in conjunction with Section
2.8.1. of this Handbook which sets out the roles and responsibilities of the MLCO.
20. In addition to appointing an MLCO, the board of the firm must consider periodically whether,
based upon the size and risk profile of the firm, it would be appropriate to maintain an independent audit function to test the ML and FT policies, procedures and controls of the firm.
21. While neither Schedule 3 nor this Handbook mandate such an appointment, specified businesses
which are part of a large financial group are likely to have an audit function or be subject to oversight from a group function. Other specified businesses may utilise the services of an external auditor or other independent body to test the appropriateness and effectiveness of their policies, procedures and controls.
22. The board must ensure that the compliance review policy takes into account the size, nature and
complexity of the business of the firm, including the risks identified in the business risk

Chapter 2 - Page 21
assessments. The policy must include a requirement for sample testing of the effectiveness and adequacy of the firm’s policies, procedures and controls.
23. The board should take a risk-based approach when defining its compliance review policy and
ensure that those areas deemed to pose the greatest risk to the firm are reviewed more frequently. In this respect the policy should review the appropriateness, effectiveness and adequacy of the policies, procedures and controls established in accordance with the requirements of Schedule 3 and this Handbook. This includes, but is not limited to:
(a) the application of CDD measures, including ECDD, SCDD and enhanced measures; (b) the Management Information (“MI”) received by the board, including information on any branch offices and subsidiaries; (c) the management and testing of third parties upon which reliance is placed for the application of CDD measures, for example, via an introducer relationship or under an outsourcing arrangement; (d) the ongoing competence and effectiveness of the MLRO; (e) the handling of internal disclosures to the MLRO and external disclosures and any production orders or requests for information to or from the FIS; (f) the management of sanctions risks and the handling of sanctions notices; (g) the provision of AML and CFT training, including an assessment of the methods used and the effectiveness of the training received by employees; and (h) the policies, procedures and controls surrounding bribery and corruption, including both the employees and customers of the firm, for example, gifts and hospitality policies and registers.
24. In accordance with Paragraph 15(1)(d) of Schedule 3, the firm shall ensure that a review of its
compliance with Schedule 3 and this Handbook is discussed and minuted at a meeting of the board at appropriate intervals, and in considering what is appropriate, the firm shall have regard to the risk taking into account – (a) the size, nature and complexity of the firm, (b) its customers, products and services, and (c) the ways in which it provides those products and services.
25. The board may delegate some or all of its duties but must retain responsibility for the review of
overall compliance with the AML and CFT requirements of Schedule 3, this Handbook and the Relevant Enactments.
26. Where the firm identifies any deficiencies as a result of its compliance review policy, it must
take appropriate action to remediate those deficiencies as soon as practicable and give consideration to the requirements of Commission Rule 2.49. where the deficiencies identified are considered to be serious or material.
27. Where the firm is managed or administered by another specified business, the responsibility for
the firm and its compliance with Schedule 3, this Handbook and the Relevant Enactments is retained by the board of the managed or administered firm and not transferred to its manager or administrator.

Chapter 2 - Page 22
2.5. Outsourcing
28. Where the firm outsources a function to a third party (either within the Bailiwick or overseas, or
within its group or externally) the board remains ultimately responsible for the activities undertaken on its behalf and for compliance with the requirements of Schedule 3, this Handbook and the Relevant Enactments. The firm cannot contract out of its statutory and regulatory responsibilities to prevent and detect ML and FT.
29. This Section should be read as referring to the outsourcing of any function relevant to the firm’s
compliance with its obligations under Schedule 3, this Handbook and the Relevant Enactments, for example, the appointment of a third party as the firm’s MLCO or MLRO, or the use of a third party to gather the requisite identification data for the firm’s customers and other key principals.
30. Where the firm is considering the outsourcing of functions to a third party, it should:
(a) review the Commission’s guidance notes on outsourcing; (b) consider implementing a terms of reference or agreement describing the provisions of the arrangement; (c) ensure that the roles, responsibilities and respective duties of the firm and the outsourced service provider are clearly defined and documented; (d) ensure that the board, the MLRO, the MLCO, other third parties and all employees understand the roles, responsibilities and respective duties of each party; and (e) ensure that it has appropriate oversight of the work undertaken by the outsourced service provider.
31. Below are links to the Commission’s guidance notes on the outsourcing of functions. While the
documents are applicable only to those firms licensed under the Protection of Investors (Bailiwick of Guernsey) Law, 1987 (“the POI Law”), the Banking Supervision (Bailiwick of Guernsey) Law, 1994 (“the Banking Law”) and the Insurance Business (Bailiwick of Guernsey) Law, 2002 (“the IB Law”) respectively, the principles contained within are relevant across industry and provide a useful reference when considering an outsourcing arrangement:
https://www.gfsc.gg/sites/default/files/Outsourcing-Functions-by-Entities-LicencedUnder-the-POI-Law_0.pdf https://www.gfsc.gg/sites/default/files/Outsourcing-Risk-Guidance-Note-for-Banks_2.pdf https://www.gfsc.gg/sites/default/files/20180711%20-%20Outsourcing%20Guidance.pdf
32. Prior to a decision being made to establish an outsourcing arrangement, the firm must make an
assessment of the risk of any potential exposure to ML and FT and must maintain a record of that assessment as part of its business risk assessments.
33. The firm should monitor the risks identified by its assessment of an outsourcing arrangement and
review this assessment on an on-going basis in accordance with its business risk assessment obligations.
34. The firm should ensure, at the commencement of an outsourcing arrangement and on an ongoing
basis, that:
(a) the outsourced service provider:
(i) has the appropriate knowledge, skill and experience; (ii) is cognisant of the applicable AML and CFT requirements; (iii) is sufficiently resourced to perform the required activities;

Chapter 2 - Page 23
(iv) has in place satisfactory policies, procedures and controls which are, and continue to be, applied to an equivalent standard and which are kept up to date to reflect changes in regulatory requirements and emerging ML and FT risks; and (v) is screened and subject to appropriate due diligence to ensure the probity of the outsourced service provider; (b) the work undertaken by the outsourced service provider is monitored to ensure it complies with the requirements of Schedule 3, this Handbook and the Relevant Enactments; (c) any reports or progress summaries provided to the firm by the outsourced service provider contain meaningful, accurate and complete information about the activities undertaken, progress of work and areas of non-compliance identified; and (d) the reports received from the outsourced service provider explain in sufficient detail the materials reviewed and other sources investigated in arriving at its conclusions so as to allow the firm to understand how findings and conclusions were reached and to test or verify such findings and conclusions.
35. The fact that the firm has relied upon an outsourced service provider or the report of an
outsourced service provider will not be considered a mitigating factor where the firm has failed to comply with a requirement of Schedule 3, this Handbook or the Relevant Enactments. The board should therefore ensure the veracity of any reports provided by an outsourced service provider, for example, by spot-checking aspects of such reports.
36. The firm must ensure that the outsourced service provider has in place procedures which include
a provision that knowledge, suspicion, or reasonable grounds for knowledge or suspicion, of ML and/or FT activity in connection with the outsourcing firm’s business will be reported by the outsourced service provider to the MLRO of the outsourcing firm (subject to any tipping off provisions to which the outsourced service provider is subject) in a timely manner.
37. An exception to Commission Rule 2.36. would be where the outsourced service provider forms
a suspicion that the outsourcing firm is complicit in ML and/or FT activity. In such cases the outsourced service provider, where it is a specified business, must disclose its suspicion to the FIS in accordance with Chapter 13 of this Handbook and advise the Commission of its actions.
38. Where the firm chooses to outsource or subcontract work to an unregulated entity, it should bear
in mind that it remains subject to the obligation to maintain appropriate policies, procedures and controls to prevent ML and FT. In this context, the firm should consider whether such subcontracting increases the risk that it will be involved in, or used for, ML and/or FT, in which case appropriate and effective controls to address that risk should be implemented.
2.6. Foreign Branches and Subsidiaries
39. In accordance with Paragraph 15(1)(e) of Schedule 3, the firm shall ensure that any of its branch
offices and, where it is a body corporate, any body corporate of which it is the majority shareholder or control of which it otherwise exercises, which, in either case, is a specified business in any country or territory outside the Bailiwick (collectively “its subsidiaries”), complies there with:
(i) the requirements of Schedule 3 and this Handbook, and (ii) any requirements under the law applicable in that country or territory which are consistent with the FATF Recommendations, provided that, where requirements under (i) or (ii) above differ, the firm shall ensure that the requirement which provides the highest standard of compliance, by reference to the FATF Recommendations, is complied with.

Chapter 2 - Page 24
40. In determining whether the firm exercises control over another entity, examples could include
one or more of the following:
(a) where the firm determines appointments to the board or senior management of that entity; (b) where the firm determines that entity’s business model or risk appetite; and/or (c) where the firm is involved in the day-to-day management of that entity.
41. In addition to the entities covered by Paragraph 2.39. above, in accordance with Paragraph
15(1)(g) of Schedule 3, where the firm is an FSB, it shall ensure that the conduct of any agent that it uses is subject to requirements to forestall, prevent and detect ML and FT that are consistent with those in the FATF Recommendations in respect of such an agent.
42. The AML and CFT programmes should incorporate the measures required under Schedule 3,
should be appropriate to the business of its subsidiaries and should be implemented effectively at the level of those entities.
43. In accordance with Paragraph 15(1)(f) of Schedule 3, the firm shall ensure that it and its
subsidiaries effectively implement policies, procedures and controls in respect of the sharing of information (including but not limited to customer, account and transaction information) between themselves for the purposes of:
(a) carrying out CDD:
(b) sharing suspicions relating to ML and FT that have been formed and reported to the FIS (unless the FIS has instructed that they should not be so shared), and (c) otherwise forestalling, preventing and detecting ML and FT, whilst ensuring that such policies, procedures and controls protect the confidentiality of such information.
44. The policies, procedures and controls referenced above should ensure that adequate safeguards
on the confidentiality and use of information exchanged between the firm and its subsidiaries are in place and that such sharing and use is subject to the provisions of the data protection legislation of the jurisdictions within which its subsidiaries are located.
45. In accordance with Paragraph 15(2) of Schedule 3, the obligations in Paragraphs 2.39. and 2.43.
above apply to the extent that the law of the relevant country or territory allows and if the law of the country or territory does not so allow in relation to any requirement of Schedule 3, the firm shall notify the Commission accordingly.
46. In addition to advising the Commission, the firm should also ensure that appropriate controls are
implemented to mitigate any risks arising related to the specific areas where compliance with appropriate AML and CFT measures cannot be met.
47. The firm must be aware that the inability to observe appropriate AML and CFT measures is
particularly likely to occur in countries or territories which do not, or insufficiently apply, the FATF Recommendations. In such circumstances the firm must take appropriate steps to effectively deal with the specific ML and FT risks associated with conducting business in such a country or territory.
48. Where the firm is a money service provider registered with the Commission in accordance with
Schedule 4 to the Law, it must apply the requirements of this section where it uses agents to
provide services on behalf of the firm, whether by contract or under the direction of the firm.

Chapter 2 - Page 25
2.7. Liaison with the Commission
49. The board of the firm must ensure that the Commission is notified of any material failure to
comply with the provisions of Schedule 3, this Handbook or the Relevant Enactments, or of any serious breaches of the policies, procedures or controls of the firm.
50. The following are examples of the types of scenarios in which the Commission would expect to
be notified. This list is not definitive and there may be other scenarios where the Commission would reasonably expect to be notified:
(a) the firm identifies, either through its compliance monitoring arrangements or by other means (for example, a management letter from an auditor), areas of material noncompliance where remediation work is required; (b) the firm receives a report, whether orally or in writing, from an external party engaged to review its compliance arrangements, identifying areas of material non-compliance where remediation work is recommended; (c) the firm receives a report from a whistle-blower and an initial or provisional investigation reveals some substance to the concerns raised; (d) the firm is aware that an aspect of material non-compliance may have occurred across more than one member of its corporate group, including the firm (or the parent of the firm where it is a branch office), which may have a bearing on the firm’s compliance with its AML and CFT obligations and/or the effectiveness of the firm’s compliance arrangements; (e) the firm discovers that the party to whom it has outsourced functions critical to compliance with Schedule 3, this Handbook or the Relevant Enactments has failed to apply one or more of the requirements of Schedule 3, this Handbook or the Relevant Enactments and remediation work is required; (f) any aspect of material non-compliance identified involving a business relationship or occasional transaction with a relevant connection to a country listed in Appendix H to this Handbook and those covered by sanctions legislation applicable in the Bailiwick, regardless of the values involved; or (g) any breach of the requirements placed upon the firm by the Bailiwick’s sanctions framework, regardless of the number of business relationships/occasional transactions or values involved.
51. In addition to the above, the Commission would expect to be notified where the firm identifies a
breakdown of administrative or control procedures (for example, a failure of a computer system) or any other event arising which is likely to result in a failure to comply with the provisions of
Schedule 3, this Handbook and/or the Relevant Enactments.
52. The Commission recognises that from time to time the firm may identify instances of noncompliance as part of its ongoing monitoring or relationship risk assessment review programmes.
Provided that a matter meets the following criteria then notification to the Commission is not required:
(a) it is isolated in nature;
(b) it is readily resolvable within a short period of time; (c) it does not pose a significant risk to the firm; and (d) it does not compromise the accuracy of:
(i) the CDD information held for the customer, beneficial owner or other key principal; (ii) the firm’s understanding of the beneficial ownership of the customer; and (iii) the firm’s understanding of the purpose and intended activity of the business relationship.

Chapter 2 - Page 26
53. Notwithstanding that notification to the Commission is not required in the above circumstances,
the firm should document its assessment of a matter and its conclusions as to why it is not considered to be material. The Commission reserves the right to enquire about such instances of non-compliance during on-site visits, thematic reviews and other engagements with the firm.
54. Where the firm has determined that a matter warrants notification to the Commission, the
Commission would expect to receive early notice, even where the full extent of the matter is yet to be confirmed or the manner of remediation decided.
55. While not an exhaustive list, the following are examples of what the Commission considers to
constitute poor practice in relation to a failure to notify it under Commission Rule 2.49.:
(a) the firm lacks the resources to immediately address the non-compliance or seeks to undertake the necessary remediation work before notifying the Commission; (b) the firm has found no evidence that an actual financial crime has occurred as a result of the non-compliance; or (c) having identified a widespread weakness within its controls, the board decides to delay advising the Commission while it undertakes a full audit to assess the extent of the issue.
2.8. Key Persons
2.8.1. Money Laundering Compliance Officer
56. In accordance with Paragraph 15(1)(a) of Schedule 3, the firm shall, if it comprises more than
one individual, appoint a person of at least manager level as the Money Laundering Compliance Officer (“MLCO”) and provide the name, title and email address of that person to the Commission as soon as is reasonably practicable and, in any event, within fourteen days starting from the date of that person’s appointment.
57. Notifications made in accordance with Schedule 3 should be submitted via the Commission’s PQ
Portal:
https://online.gfsc.gg
58. The MLCO appointed by the firm must:
(a) be a natural person;
(b) be of at least manager level;
(c) have the appropriate knowledge, skill and experience to fulfil a compliance role within the firm; (d) be employed by the firm or an entity within the same group as the firm (in the case of managed or administered businesses it is acceptable for an employee of the manager or administrator of the firm to be appointed as the MLCO); and (e) be resident in the British Islands.
59. The firm must ensure that the MLCO:
(a) has timely and unrestricted access to the records of the firm; (b) has sufficient resources to perform his or her duties; (c) has the full co-operation of the firm’s staff; (d) is fully aware of his or her obligations and those of the firm; and (e) reports directly to, and has regular contact with, the board so as to enable the board to satisfy itself that all statutory obligations and provisions in Schedule 3, this Handbook and the Relevant Enactments are being met and that the firm is taking sufficiently robust measures to protect itself against the potential risk of being used for ML or FT.

Chapter 2 - Page 27
60. As defined in Paragraph 21(1) of Schedule 3, the MLCO appointed by the firm shall monitor
compliance with policies, procedures and controls to forestall, prevent and detect ML and FT.
61. In accordance with Section 2.3. above, the board is responsible for the firm’s compliance with
Schedule 3 and this Handbook, including establishing appropriate and effective policies,
procedures and controls to forestall, prevent and detect ML and FT. By contrast, the MLCO’s role is to monitor the firm’s compliance with its policies, procedures and controls and periodically report thereon to the board. In this respect the functions of the MLCO include:
(a) overseeing the monitoring and testing of AML and CFT policies, procedures, controls and systems in place to assess their appropriateness and effectiveness; (b) investigating any matters of concern or non-compliance arising from the firm’s compliance review policy; (c) establishing appropriate controls to mitigate any risks arising from the firm’s compliance review policy and to remediate issues where necessary and appropriate in a timely manner; (d) reporting periodically to the board on compliance matters, including the results of the testing undertaken and any issues that need to be brought to the board’s attention; and (e) acting as a point of contact with the Commission and to respond promptly to any requests for information made.
62. While it is not anticipated that the MLCO will personally conduct all monitoring and testing, the
expectation is that the MLCO will have oversight of any monitoring and testing being conducted by the firm, for example, by a compliance team or an outsourcing oversight team, in accordance with the firm’s compliance review policy.
63. The circumstances of the firm may be such that, due to the small number of employees, the
MLCO holds additional functions or is responsible for other aspects of the firm’s operations. Where this is the case, the firm must ensure that any conflicts of interest between the MLCO role and any other functions held are identified, documented and appropriately managed.
64. For the avoidance of doubt, the same individual can be appointed to the positions of Money
Laundering Reporting Officer (“MLRO”) and MLCO, provided the firm considers this appropriate having regard to the respective demands of the two roles and whether the individual has sufficient time and resources to fulfil both roles effectively.
2.8.2. Money Laundering Reporting Officer
65. In accordance with Paragraph 12(1)(a) of Schedule 3, the firm shall appoint a person of at least
manager level as the MLRO, provide the name, title and email address of that person to the Commission as soon as is reasonably practicable and, in any event, within fourteen days starting from the date of that person’s appointment, and ensure that all employees are aware of the name of that person.
66. In addition to notifying the Commission, in accordance with Paragraph 12(1)(d) of Schedule 3,
the firm shall provide the name, title and email address of the MLRO to the FIS as soon as is reasonably practicable and, in any event, within fourteen days starting from the date of that person’s appointment.
67. Notifications made in accordance with Schedule 3 should be submitted via the Commission’s PQ
Portal:
https://online.gfsc.gg

Chapter 2 - Page 28
68. The MLRO appointed by the firm must:
(a) be a natural person;
(b) be of at least manager level;
(c) have the appropriate knowledge, skill and experience; (d) be employed by the firm or an entity within the same group as the firm (in the case of a managed or administered business it is acceptable for an employee of the manager or administrator to be appointed as the MLRO); and (e) be resident in the Bailiwick.
69. The firm must ensure that the MLRO:
(a) is the main point of contact with the FIS in the handling of disclosures; (b) has unrestricted access to the CDD information of the firm’s customers, including the beneficial owners thereof; (c) has sufficient resources to perform his or her duties; (d) is available on a day-to-day basis; (e) receives full co-operation from all staff; (f) reports directly to, and has regular contact with, the board or equivalent of the firm; and (g) is fully aware of both his or her personal obligations and those of the firm under Schedule 3, this Handbook and the Relevant Enactments.
70. The firm must provide the MLRO with the authority to act independently in carrying out his or
her responsibilities under Part 1 of the Disclosure Law or Section 12, 15 or 15A of the Terrorism Law. The MLRO must be free to have direct access to the FIS in order that any suspicious activity may be reported as soon as possible. The MLRO must also be free to liaise with the FIS on any question of whether to proceed with a transaction in the circumstances.
2.8.3. Nominated Officer
71. In accordance with Paragraph 12(1)(b) (where the firm is an FSB) or 12(1)(c) (where the firm is
a PB) of Schedule 3, the firm shall, if it comprises more than one individual, nominate a person to – (a) receive disclosures, under Part I of the Disclosure Law and Section 12 or Section 15 of the Terrorism Law (a “Nominated Officer”), in the absence of the MLRO, and (b) otherwise carry out the functions of the MLRO in that officer’s absence, and ensure that all employees are aware of the name of that Nominated Officer.
72. In accordance with Paragraph 12(1)(d) of Schedule 3, the firm shall provide the name, title and
email address of any person nominated under Paragraphs 12(1)(b) or 12(1)(c) as set out above to the FIS as soon as is reasonably practicable and, in any event, within fourteen days starting from the date of that person’s appointment.
73. The Nominated Officer must:
(a) be a natural person; and
(b) have the appropriate knowledge, skill and experience.
74. There is no obligation to advise the Commission of the name, title or email address of the
Nominated Officer. However, where the Nominated Officer is acting in place of the MLRO to cover an extended period of absence (for example, maternity leave, sabbatical or long-term sick leave) the firm should consider appointing the Nominated Officer as the MLRO on a temporary

Chapter 2 - Page 29
basis. Where this occurs the Commission should be notified in accordance with Section 2.8.2. above.
75. The firm must communicate the name of the Nominated Officer to all employees of the firm and
ensure that all employees of the firm are aware of the natural person(s) to whom internal disclosures are to be made in the absence of the MLRO.
76. For the avoidance of doubt, in accordance with Paragraphs 12(1)(b)-(c) of Schedule 3, the
requirements of this section do not apply where the firm comprises one individual, for example, a personal fiduciary licence holder and or a natural person registered as a PB and acting alone.

Chapter 3
Risk-Based Approach
Contents of this Chapter
3.1. Introduction...............................................................................................................................32
Risk-Based Approach .........................................................................................................................32
3.2. Definition, Purpose and Benefits..............................................................................................32
3.3. Identification and Mitigation of Risks......................................................................................34
3.4. Accumulation of Risk ...............................................................................................................35
3.4.1. Weighing Risk Factors......................................................................................................35
3.5. Policies, Procedures and Controls.............................................................................................36
Business Risk Assessments.................................................................................................................36
3.6. Introduction...............................................................................................................................36
3.7. Content and Structure ...............................................................................................................37
3.8. Risk Appetite ............................................................................................................................38
3.9. Review ......................................................................................................................................39
3.10. Example Risk Factors...............................................................................................................40
3.11. New Products and Business Practices.......................................................................................41
3.12. New Technologies ....................................................................................................................41
Relationship Risk Assessment............................................................................................................41
3.13. Introduction...............................................................................................................................41
3.14. Management and Mitigation .....................................................................................................42
3.15. Notices, Instructions or Warnings.............................................................................................44
3.16. Mandatory High Risk Factors...................................................................................................44
3.17. Risk Factors ..............................................................................................................................45
3.17.1. Customer Risk Factors......................................................................................................46
3.17.2. Countries and Territories Risk Factors .............................................................................48
3.17.3. Products, Services and Transactions Risk Factors............................................................50
3.17.4. Delivery Channel Risk Factors.........................................................................................51

Chapter 3 - Page 32
3.1. Introduction

This Chapter is designed to assist the firm in taking a risk-based approach to the prevention of its
products and services being used for the purposes of ML and FT and is broken down into three main sections:
(a) Risk-Based Approach - which provides a high-level overview of the risk-based approach; (b) Business Risk Assessments - which details the relevant requirements of Schedule 3, together with the Commission Rules and guidance, in respect of the firm undertaking ML and FT business risk assessments and determining its risk appetite; and (c) Relationship Risk Assessments - which sets out the relevant obligations of Schedule 3, together with the Commission Rules and guidance, for the conducting of risk assessments of new and existing business relationships and occasional transactions. Risk-Based Approach
3.2. Definition, Purpose and Benefits
A risk-based approach towards the prevention and detection of ML and FT aims to support the
development of preventative and mitigating measures that are commensurate with the ML and FT risks identified by the firm and to deal with those risks in the most cost-effective and proportionate way.
Paragraph 2 of Schedule 3 provides a general duty for the firm to understand, assess and mitigate
risks. In this respect the firm shall:
(a) understand its ML and FT risks; and
(b) have in place effective policies, procedures and controls to:
(i) identify,
(ii) assess,
(iii) mitigate,
(iv) manage, and
(v) review and monitor, those risks in a way that is consistent with the requirements of Schedule 3, the Relevant Enactments, the requirements of this Handbook and the NRA.
A risk-based approach prescribes the following procedural steps to manage the ML and FT risks
faced by the firm:
(a) identifying the specific threats posed to the firm by ML and FT and those areas of the firm’s business with the greatest vulnerability; (b) assessing the likelihood of those threats occurring and the potential impact of them on the firm; (c) mitigating the likelihood of occurrence of identified threats and the potential for damage to be caused, primarily through the application of appropriate and effective policies, procedures and controls; (d) managing the residual risks arising from the threats and vulnerabilities that the firm has been unable to mitigate; and (e) reviewing and monitoring those risks to identify whether there have been any changes in the threats posed to the firm which necessitate changes to its policies, procedures and controls.

Chapter 3 - Page 33
5. In applying a risk-based approach and taking the steps detailed above, it is crucial that, regardless
of the specific considerations and actions of the firm, clear documentation is prepared and retained to ensure that the board and senior management can demonstrate their compliance with the requirements of Schedule 3 and the Commission Rules in this Handbook.
6. A risk-based approach starts with the identification and assessment of the risk that has to be
managed. In the context of Schedule 3 and this Handbook, a risk-based approach requires the firm to assess the risks of how it might be involved in ML and FT, taking into account its customers(and the beneficial owners of customers), countries and geographic areas, the products, services and transactions it offers or undertakes, and the delivery channels by which it provides those products, services and/or transactions.
7. In determining how the risk-based approach should be implemented, the firm should analyse and
seek to understand how the identified ML and FT risks affect its business. This determination should take into account a range of information, including (amongst others) the type and extent of the risks that the firm is willing to accept in order to achieve its strategic objectives (its “risk appetite”), its AML and CFT experience and the Bailiwick’s NRA.
8. Through the business risk assessments and determination of a risk appetite, the firm can establish
the basis for a risk-sensitive approach to managing and mitigating ML and FT risks. It should be noted, however, that a risk-based approach does not exempt the firm from the requirement to apply enhanced measures where it has identified higher risk factors as detailed in Chapter 8 of this Handbook.
9. Schedule 3 and this Handbook do not prohibit the offering of any products or services or the
acceptance of any customer, unless it is known, or there are reasonable grounds to suspect, that the customer, or the beneficial owner thereof, is undertaking or associated with ML or FT. The risk-based approach, as defined in Schedule 3 and this Handbook, instead requires that the risks posed by customers (and the beneficial owners of customers), countries and geographic areas, products, services, transactions and delivery channels are identified, assessed, managed and mitigated and that evidence of such is documented and reviewed on an on-going basis.
10. By adopting a risk-based approach the firm should ensure that measures to prevent or mitigate
ML and FT are commensurate with the risks identified. In this respect, the business risk assessments will also serve to enable the firm to make decisions on how to allocate its resources in the most efficient and effective way and to determine its appetite and tolerance for risk.
11. No system of checks will detect and prevent all ML and FT. A risk-based approach will, however,
serve to balance the cost burden placed upon the firm and its customers with a realistic assessment of the threat of the firm being used in connection with ML and/or FT. It focuses the effort where it is needed and has most impact.
12. The benefits of a risk-based approach include:
(a) recognising that the ML and FT threats to the firm vary across its customers, countries/geographic areas, products/services and delivery channels; (b) providing for the board to apply its own approach to the policies, procedures and controls of the firm in particular circumstances, enabling the board to differentiate between its customers in a way that matches the risk to its particular business; (c) helping to produce a more cost-effective system of risk management; (d) promoting the prioritisation of effort and activity by reference to the likelihood of ML and/or FT occurring; (e) reflecting experience and proportionality through the tailoring of effort and activity to risk; (f) enabling the application of the requirements of Schedule 3 and this Handbook sensibly and in consideration of all relevant risk factors; and

Chapter 3 - Page 34
(g) allowing for the consideration of the accumulation of identified risks and the determination of the level of overall risk, together with the appropriate level of mitigation to be applied.
13. It is important to acknowledge that various sectors and types of business, whether in terms of
products/services, delivery channels or types of customers, can differ materially. An approach to preventing ML and FT that is appropriate in one sector may be inappropriate in another.
Appendix D to this Handbook provides guidance on sector-specific risk factors to assist the firm
in the development of its risk management framework.
3.3. Identification and Mitigation of Risks
14. Risk can be seen as a function of three factors and a risk assessment involves making judgements
about all three of the following elements:
(a) threat – a person or group of persons, an object or an activity with the potential to cause harm; (b) vulnerability – an opportunity that can be exploited by the threat or that may support or facilitate its activities; and (c) consequence – the impact or harm that ML and FT may cause.
15. Having identified where it is vulnerable and the threats that it faces, the firm should take
appropriate steps to mitigate the opportunity for those risks to materialise. This will involve determining the necessary controls or procedures that need to be in place in order to reduce the risks identified. The documented risk assessments that are required to be undertaken by Schedule 3 will assist the firm in developing its risk-based approach.
16. In accordance with Paragraph 3(7) of Schedule 3, the firm shall have regard to:
(a) any relevant Commission Rules and guidance in this Handbook, (b) any relevant notice or instruction issued by the Commission under the Law, and (c) the NRA, in determining what constitutes high or low risk, what its risk appetite is, and what constitute appropriate measures to manage and mitigate risks.
17. In addition to those noted above, information on ML and FT risk factors could come from a
variety of other sources, whether these are accessed individually or through commercially available tools or databases that pool information from several sources. The sources could include:
(a) national and supranational risk assessments, such as those published by the EU, the UK and other countries or territories similar to the Bailiwick; (b) information published by law enforcement agencies (for example, the FIS) such as threat reports, alerts and typologies; (c) information published by the Commission, such as thematic reports, warnings and the reasoning set out in enforcement actions taken by it; (d) information on the purpose and rationale of UN, UK and other sanctions regimes; (e) Guidance on ML, FT and preventing the proliferation of weapons of mass destruction published by the States of Guernsey Policy and Resources Committee; (f) information from international standard-setting bodies, including the FATF, such as guidance papers and reports on specific threats or risks, as well as mutual evaluation reports when considering the risks associated with a particular country or geographic area; (g) information provided by industry bodies, such as typologies and emerging risks; (h) information published by non-governmental organisations (for example, Global Witness or Transparency International); and

Chapter 3 - Page 35
(i) information published by credible and reliable commercial sources, (for example, risk and intelligence reports) or open sources (for example, reputable newspapers).
18. Retaining documentation on the results of the firm’s risk assessment framework will assist the
firm to demonstrate how it:
(a) identifies and assesses the risks of being used for ML and FT; (b) agrees and implements appropriate and effective policies, procedures and controls to manage and mitigate ML and FT risk; (c) monitors and improves the effectiveness of its policies, procedures and controls; and (d) ensures accountability of the board in respect of the operation of its policies, procedures and controls.
3.4. Accumulation of Risk
19. In addition to the individual consideration of each risk factor, the firm must also consider all
such factors holistically to establish whether their concurrent or cumulative effect might increase or decrease the firm’s overall risk exposure and the dynamic that this could have on the controls implemented by the firm to mitigate risk.
20. Such an approach is relevant not only to the firm in its consideration of the risks posed to its
business as a whole as part of undertaking its business risk assessments, but also in the consideration of the risk that individual business relationships or occasional transactions pose.
21. There are also other operational factors which may increase the overall level of risk. These
factors should be considered in conjunction with the firm’s ML and FT risks. Examples of such factors could be the outsourcing of AML and CFT controls or other regulatory requirements to an external third party or another member of the same group as the firm; or the use of on-line or web-based services and cyber-crime risks which may be associated with those service offerings.
3.4.1. Weighing Risk Factors
22. In considering the risk of a business relationship or occasional transaction holistically, the firm
may decide to weigh risk factors differently depending on their relative importance.
23. When weighing risk factors, the firm should make an informed judgement about the relevance of
different risk factors in the context of a business relationship or occasional transaction. This will likely result in the firm allocating varying ‘scores’ to different factors; for example, the firm may decide that a customer’s personal links to a country, territory or geographic area associated with higher ML and/or FT risk is less relevant in light of the features of the product they seek.
24. Ultimately, the weight given to each risk factor is likely to vary from product to product and
customer to customer (or category of customer). When weighing risk factors, the firm should ensure that:
(a) the risk rating is not unduly influenced by just one risk factor; (b) economic or profit considerations do not influence the risk rating; (c) the weight assigned does not lead to a situation where it is impossible for any business relationship or occasional transaction to be classified as a high risk relationship; (d) the provisions of Paragraph 5(1) of Schedule 3 setting out the situations which will always present a high risk (for example, the involvement of foreign PEPs or correspondent banking relationships) cannot be over-ruled; and (e) it is able to override any automatically generated risk scores where necessary. The rationale for the decision to override such scores should be documented appropriately.

Chapter 3 - Page 36
25. Where the firm uses automated IT systems to allocate overall risk scores to business relationships
or occasional transactions and does not develop these in house but purchases them from an external provider, it should understand how the system works and how it combines risk factors to achieve an overall risk score. The firm should be able to satisfy itself that the scores allocated reflect the firm’s understanding of ML and FT risk and it should be able to demonstrate this.
3.5. Policies, Procedures and Controls
26. In accordance with Paragraph 3(6) of Schedule 3, the firm shall –
(a) have in place policies, procedures and controls approved by its board that are appropriate and effective, having regard to the assessed risk, to enable it to mitigate and manage:
(i) risks identified in the business risk assessments, and relationship risk assessments undertaken under Paragraph 3(4)(a) of Schedule 3; and (ii) risks relevant, or potentially relevant, to the firm identified in the NRA (which risks shall be incorporated into the business risk assessments); (b) regularly review and monitor the implementation of those policies, controls and procedures and enhance them if such enhancement is necessary or desirable for the mitigation and management of those risks; and (c) take additional measures to manage and mitigate higher risks identified in the business risk assessments and in relationship risk assessments undertaken under Paragraph 3(4)(a) of Schedule 3.
27. The firm’s policies, procedures and controls must take into account the nature and complexity
of the firm’s operation, together with the risks identified in its business risk assessments, and must be sufficiently detailed to allow the firm to demonstrate how the conclusion of each relationship risk assessment has been reached. Business Risk Assessments
3.6. Introduction
28. A key component of a risk-based approach involves the firm identifying areas where its products
and services could be exposed to the risks of ML and FT and taking appropriate steps to ensure that any identified risks are managed and mitigated through the establishment of appropriate and effective policies, procedures and controls.
29. The business risk assessments are designed to assist the firm in making such an assessment and
provide a method by which the firm can identify the extent to which its business and its products and services are exposed to ML and FT. Good quality business risk assessments are therefore vital for ensuring that the firm’s policies, procedures and controls are proportionate and targeted appropriately.
30. The board must ensure that the firm’s business risk assessments, together with details of the
firm’s risk appetite, are communicated to all relevant employees.
31. In communicating the firm’s business risk assessments and risk appetite, the firm should ensure
that relevant employees understand the implications of these on the day-to-day functions of relevant employees and their effect on the strategic objectives of the firm, in particular those relevant employees with customer-facing or business development roles.

Chapter 3 - Page 37
3.7. Content and Structure
32. In accordance with Paragraph 3(1)(a) of Schedule 3, the firm shall carry out and document a
suitable and sufficient ML business risk assessment, and a suitable and sufficient FT business risk assessment, which are specific to the firm.
33. In carrying out the business risk assessments in accordance with Paragraph 3(1) of Schedule 3,
the firm must ensure that the assessments of the risks of ML and FT are distinct from one another, clearly addressing the different threats posed by each risk and should reflect that appropriate steps have been taken in order to identify and assess the specific risks posed to the firm.
34. The format of the business risk assessments is a matter to be decided by the firm. However,
regardless of the format used, it is important that the business risk assessments are documented in accordance with Paragraph 3(1)(a) of Schedule 3 in order to provide clear evidence to demonstrate the basis upon which they have been conducted. Notwithstanding the requirement for the ML and FT business risk assessments to be distinct, there is nothing to prevent them being contained within one over-arching document recording, in its entirety, the firm’s assessment of ML and FT risk.
35. In accordance with Paragraph 3(3) of Schedule 3, the business risk assessments shall be
appropriate to the nature, size and complexity of the firm, and be in respect of:
(a) customers, and the beneficial owners of customers, (b) countries and geographic areas, and (c) products, services, transactions and delivery channels (as appropriate), and in particular in respect of the ML or FT risks that may arise in relation to:
(i) the development of new products and new business practices, before such products are made available and such practices adopted; and (ii) the use of new or developing technologies for both new and pre-existing products, before such technologies are used and adopted.
36. The business risk assessments must also take account of the findings of the NRA and reflect the
firm’s assessment of whether the risks identified in the NRA are relevant, or potentially relevant, to the firm, and where they are, identify the measures for mitigating those risks.
37. The firm should have regard to the ML and FT threats relevant to its sector as articulated in the
NRA, assess how those threats are relevant to the products and services it offers, and assess its vulnerability to ML and FT after taking into account mitigating measures. The sections of the NRA which discuss the modalities of ML and FT, and the case studies contained within, are particularly relevant. Despite there being no FT case studies in the NRA, some of the countries and patterns of behaviour involved in the ML case studies will be relevant to possible FT activity, especially in relation to secondary FT i.e. where the proceeds of crime are used to fund terrorism. Additionally the firm should have regard to FT typologies issued by the FATF. FATF FT Guidance
38. In accordance with Paragraph 3(2) of Schedule 3, in carrying out its business risk assessments,
the firm shall consider all relevant risk factors before determining:
(a) the level of overall risk to the firm;
(b) the firm’s risk appetite; and
(c) the appropriate level and type of mitigation to be applied.

Chapter 3 - Page 38
39. The business risk assessments should contain references as to how the firm manages or mitigates
the risks which it has identified and the policies, procedures and controls which have been established in this regard.
40. Industry sectors will have inherent and/or generic risk factors and these should be referenced in
the firm’s business risk assessments. Business risk assessments are likely to be deficient if the risks to the firm’s sector identified in the NRA are not considered or if the irrelevance of those risks to its business is not explained in the assessments. Additionally, the firm will also have risk factors particular to its own business which should be analysed in the business risk assessments.
41. The firm must not copy the business risk assessments prepared by another business, or use ‘offthe-shelf’ assessments which pre-identify suggested ML and FT risks without the firm ensuring
the assessments have been tailored to its business and the specific risks that it faces.
42. Such an approach in adopting an ‘off-the-shelf’ assessment can lead to the firm failing to
accurately identify the ML and FT risks specific to its business. This in turn can lead to inadequate or inappropriate policies, procedures and controls that are either ill-suited to the firm or fail to appropriately mitigate the firm’s risks.
43. In addition to the above, the business risk assessments should not:
(a) be a ‘cut and paste’ version of the relevant sections of the Handbook and/or the NRA. This does not demonstrate that the board has given serious consideration to the vulnerabilities specific to the products, services and customers of the firm; (b) be generic assessments which have simply been populated with general information. Again, this does not demonstrate that the board has given serious consideration to the vulnerabilities particular to its business; (c) contain unsubstantiated, highly generalised references to the risks faced by the firm, for example, a reference to all business being low risk or statements such as ‘there is a risk that our products could be used to finance terrorism’. Such statements would not be acceptable unless they are backed-up with specific information evidencing how this assessment had been made; (d) copy statements about a sector’s risks from the NRA without substantiating why those risks are relevant (or not relevant) to the firm; or (e) focus upon isolated risk factors, for example, concentrating solely upon a geographic location.
44. There may be occasions where threats span a number of risk categories, for example, there may
be operational risks associated with a piece of customer-facing technology in addition to ML and FT or other financial crime risks. Where the firm wishes to combine its ML and FT business risk assessments with assessments of other risks, such as conduct risk or credit risk, the firm should ensure that the assessments of ML and FT risk are clearly identified.
3.8. Risk Appetite
45. In accordance with Paragraph 3(2) of Schedule 3 the firm shall, having considered all relevant
risk factors, determine its risk appetite as part of carrying out its business risk assessments.
46. The determination of the firm’s risk appetite is an important element in carrying out its business
risk assessments, setting out the amount of ML and FT risk it is prepared to accept in pursuing its strategic objectives. Having identified the inherent ML and FT risks to its business, identifying the amount of such risk that it is willing to take on is an integral part of the design and implementation of appropriate and effective policies, procedures and controls to manage and mitigate risk.

Chapter 3 - Page 39
47. The board is responsible for setting the firm’s risk appetite, together with the overall attitude of
the firm to risk taking. The primary goal of the risk appetite is to define the amount of risk that the firm is willing to accept in the pursuit of its objectives, as well as outlining the boundaries of its risk taking, beyond which the firm is not prepared to accept risk.
48. In this respect the firm’s documented risk appetite should include a qualitative statement (for
example, detailing those categories of customer or country/territory that the firm deems to pose too great a risk) as well as quantitative measures to support its risk appetite, including the firm’s tolerance and capacity to take on risk, i.e. the maximum level of risk that it is possible to accept without exceeding or overstretching its administrative, operational and resourcing constraints.
49. In determining its risk appetite the firm should be realistic in the context of its business model.
A firm targeting business from high risk countries or territories, offering high risk products or services or with a large percentage of high risk relationships would consequently have a high risk appetite and its business risk assessments should be drafted accordingly.
50. The following is a non-exhaustive list of example questions that the firm could consider in
developing its risk appetite:
(a) What are the strategic objectives of the firm? Are they clear?
(b) What specific risks could pursuing these objectives expose the firm to? (c) How relevant to the firm’s objectives are the main risks to the firm’s sector that have been identified in the NRA? (d) What are the significant risks the board is willing to take? (e) What are the significant risks the board is not willing to take? (f) Is the board clear about the nature and extent of the significant risks it is willing to take in achieving its strategic objectives? (g) Have the board and senior management reviewed the capabilities of the firm to manage the risks that it faces? (h) What capacity does the firm have in terms of its ability to manage risks? (i) Do employees of the firm understand their role and responsibility for managing risk? (j) How much does the firm spend on compliance and risk management each year? How much does the firm need to spend to ensure its compliance and risk management controls can sufficiently mitigate the identified risks?
3.9. Review
51. In accordance with Paragraph 3(1)(b) of Schedule 3, the firm shall regularly review its business
risk assessments, at a minimum annually and more frequently when changes to the business of the firm occur, so as to keep them up to date.
52. The NRA process is an iterative one, which will involve the exercise being repeated over time.
Therefore, the firm must take into account the findings of any updated NRA and reflect the firm’s assessment of whether the risks identified in any updated NRA are relevant, or potentially relevant, to the firm, and where they are, identify the measures for mitigating those risks. This must form part of the next review (which must occur at a minimum of annually) of the firm’s business risk assessment, unless the Commission calls upon firms to do this sooner.
53. Just as the activities of the firm can change, so too can the corresponding ML and FT risks.
Mergers, acquisitions, the purchase or sale of a book of business, the adoption of a piece of technology or technological solution, the introduction of a new product or service, a restructuring or a change of external service provider are just some of the events which can affect both the type and extent of the risks to which the firm could be exposed. In light of any such changes the

Chapter 3 - Page 40
business risk assessments should be reviewed to consider whether the risks to the firm have changed and to ensure that the controls to mitigate those risks remain effective.
54. Other operational changes, for example, a change in employee numbers or a change to group
policies, can all have an impact upon the resources required to effectively manage ML and FT risks.
55. Where, as a result of the firm’s review, changes to the business risk assessments are required, in
accordance with Paragraph 3(1)(b) of Schedule 3 the firm shall make those changes.
56. Where changes to the business risk assessments are made, the firm must give consideration to
whether the policies, procedures and controls of the firm remain appropriate and effective in light of the revised business risk assessments and make any changes it considers appropriate in a timely manner.
3.10. Example Risk Factors
57. Below are example risk factors that may be considered by the firm as part of the assessment of
its ML and FT risks. The examples given are not intended to be exhaustive or to be used by the firm as checklists of risks.
58. Customer risk:
(a) The countries, territories and geographic areas with which customers (and the beneficial owners of customers) have a relevant connection; (b) The complexity of customer and beneficial ownership structures; (c) The complexity of legal persons and legal arrangements; (d) The use of introduced business arrangements; (e) The use or acceptance of intermediary relationships; (f) The number of business relationships assessed as high risk; (g) The countries and geographic areas targeted by the firm and from which the firm will accept new customers (including the beneficial owners of customers); (h) The number of customers and beneficial owners assessed as PEPs and their associated countries or territories; and (i) The number of customers and beneficial owners which are charities or non-profit organisations (“NPOs”) and their associated countries or geographic areas.
59. Product/service risk:
(a) The nature, scale, diversity and complexity of the products and services of the firm; (b) The target markets, both in terms of geography and class of customer; (c) The distribution channels utilised by the firm; (d) Whether the value of transactions is expected to be particularly high; (e) The nature, scale and countries/geographic areas associated with funds sent and received on behalf of customers; (f) Whether payments to any unknown or un-associated third parties are allowed; and (g) Whether the products/services/structure are of particular, or unusual, complexity.
60. Other potential sources of risk to consider:
(a) Internal and/or external audit findings; and (b) Typologies and findings of ML and FT case studies.

Chapter 3 - Page 41
3.11. New Products and Business Practices
61. In accordance with Paragraph 3(3)(c)(i) of Schedule 3, the firm shall, before making available
or adopting new products or business practices, ensure that its business risk assessments have identified and assessed the ML and FT risks arising from those products or practices.
62. References to new products should be read as referring to products which the firm has not
previously offered and which present new or differing ML or FT risks to the firm.
63. References to new business practices relate to new ways in which the firm’s products or services
are offered or delivered. For example, a new business practice could include the development of a customer-facing portal or other software where customers can interact with the firm.
64. If the firm decides to proceed with the offering or adoption of a new product or business practice,
the board of the firm must approve the risk assessment undertaken in accordance with Paragraph 3(3)(c)(i) of Schedule 3 and that approval must be documented.
3.12. New Technologies
65. In accordance with Paragraph 3(3)(c)(ii) of Schedule 3, the firm shall, before adopting and using
a new or developing technology for a new or pre-existing product, ensure that its business risk assessments have identified and assessed the risks arising from the technology’s use or adoption.
66. These technologies are likely to fall within the Financial Technology (“FinTech”) arena, which
includes technology aimed at disrupting the delivery or transaction channels of traditional products and services, as well as the creation of new products or services utilising enhancements in technology. Examples of such technologies include the use of distributed ledger technology in the delivery of traditional securities through to the trading or safekeeping of virtual assets.
67. The risk assessment of a new or developing technology must include, as a minimum, an
assessment of the ML and FT risks and vulnerabilities inherent in the use or adoption of the technology in order that appropriate controls can be implemented. This includes evaluating the technology itself, together with the anticipated use of the technology and the threats posed by this use.
68. It is not essential that the risk assessment of a technology extends to a highly technical,
comprehensive report on the specifications and functionality. The objective of the risk assessment is to evaluate the ML and FT risks and vulnerabilities inherent in the use of the technology and to identify the controls necessary to mitigate and limit the firm’s exposure.
69. If the firm decides to proceed with the adoption or use of a new or developing technology for a
new or pre-existing product, the board of the firm must approve the risk assessment undertaken in accordance with Paragraph 3(3)(c)(ii) of Schedule 3 and that approval must be documented.
70. Following the initial risk assessment of a new or developing technology, the firm should
periodically review its assessment in conjunction with its responsibility for the review of its wider ML and FT business risk assessments as described in Section 3.9. of this Handbook. Relationship Risk Assessment
3.13. Introduction
71. The purpose of this Section is to set out the Commission Rules and guidance surrounding the
assessment of risk in a business relationship or occasional transaction (“relationship risk

Chapter 3 - Page 42
assessment”) at the point of take-on, as well as the ongoing requirement to ensure that any relationship risk assessment remains appropriate and relevant as the relationship evolves.
72. The firm’s business risk assessments and its defined risk appetite will assist in determining the
take-on of any new business. The relationship risk assessment is the assessment of a new or existing business relationship or occasional transaction against the parameters determined within the risk appetite and the ML and FT risks identified in the business risk assessments.
73. There may be circumstances where the risks of ML and FT are high and ECDD measures are to
be applied. Similarly, there may be circumstances within which the firm can apply SCDD measures because it has assessed the risk of the business relationship or occasional transaction as being low. Further information on the relationship risk assessment process, including examples of high and low risk factors, can be found in this Section.
3.14. Management and Mitigation
74. In order to consider the extent of its potential exposure to the risks of ML and FT, in accordance
with Paragraph 3(4) of Schedule 3 the firm shall - (a) prior to the establishment of a business relationship or the carrying out of an occasional transaction, undertake a relationship risk assessment, and (b) regularly review any relationship risk assessment carried out under (a) so as to keep it up to date and, where changes to that relationship risk assessment are required, it shall make those changes.
75. Based on the outcome of its relationship risk assessment, the firm must decide whether or not to
accept (or continue) each business relationship or whether or not to accept any instructions to carry out an occasional transaction.
76. When undertaking or reviewing a relationship risk assessment, in accordance with Paragraph
3(5)(a) of Schedule 3 the firm shall take into account its risk appetite and risk factors relating to:
(i) the type or types of customer (and the beneficial owners of the customer); (ii) the country or geographic area; and (iii) the product, service, transaction and delivery channel that are relevant to the business relationship or occasional transaction.
77. The FATF publishes two lists identifying jurisdictions with weak measures to combat ML and
FT. The first list is of “High risk jurisdictions subject to a call for action” which identifies a number of countries and territories with significant strategic deficiencies in their regimes to counter ML, FT and financing of proliferation. Appendix H to this Handbook identifies those countries and territories which the FATF has listed as high risk and has called on jurisdictions to apply enhanced due diligence. In the most serious cases, it will also call upon jurisdictions to apply counter-measures to protect the international financial system from the ongoing ML, FT and proliferation financing risks emanating from that country.
78. The second list issued by the FATF is a statement of those “jurisdictions under increased
monitoring”. These jurisdictions are actively working with the FATF to address strategic deficiencies in their AML/CFT regimes. The FATF does not call for the application of enhanced due diligence measures to be applied to these jurisdictions, but encourages members to take into account the information it publishes about these jurisdictions in their risk analysis. These jurisdictions will be communicated to firms by way of updates to Appendix I, which lists these countries. Appendix I also lists countries and territories that are identified by the UK, US governments, intergovernmental and supranational organisations as presenting certain ML and

Chapter 3 - Page 43
FT risks. Alongside these sources, information is presented reflecting assessments of a country or territory by non-governmental organisations which firms may also find useful when they are determining the level of country risk presented by a business relationship or occasional transaction. The inclusion of a country or territory in Appendix I does not automatically imply that a business relationship or occasional transaction with a relevant connection to a country or territory on Appendix I is high risk.
79. For the purposes of Paragraph 3(5)(a) of Schedule 3, when considering country or geographical
area risk factors, the firm should:
(a) take into account the information set out in Appendix H to this Handbook when undertaking or reviewing a relationship risk assessment, as the firm shall apply ECDD measures to a business relationship or occasional transaction where the customer or beneficial owner has a relevant connection with a country or territory in Appendix H; (b) consider the specific ML and FT risks of the countries and territories listed in Appendix I and how those risks affect the overall risk within a business relationship or occasional transaction as set out in Section 3.4. of this Handbook; and (c) consider the relevance of the risk factors in Section 3.17.2. of this Handbook.
80. In addition to the risk factors set out above, the firm must also give consideration to the following
when undertaking or reviewing a relationship risk assessment:
(a) where the product or service provided by the firm is a life insurance policy, the type or types of beneficiary of that policy; (b) the purpose and intended nature of the business relationship or occasional transaction, including the possibility of legal persons and legal arrangements forming part of the relationship; (c) the type, volume, value and regularity of activity expected; and (d) the expected duration (if a business relationship).
81. For the purposes of Paragraph 3(5)(a) of Schedule 3 and Commission Rule 3.80.(a) above, the
firm’s consideration of the type or types of customer, beneficial owner or beneficiary should incorporate whether they are a natural person, legal person or legal arrangement, as well as their identity and background.
82. In accordance with Paragraph 3(5)(b) of Schedule 3, when undertaking or reviewing a
relationship risk assessment, the firm shall understand that the risk factors noted in Paragraph 3(5)(a) of Schedule 3 as set out above and any other risk factors, either singly or in combination, may increase or decrease the potential risk posed by the business relationship or occasional transaction.
83. In light of the above, when undertaking a relationship risk assessment the firm must ensure that
all relevant risk factors are considered, both singly and in combination, before making a determination as to the level of overall assessed risk.
84. Consideration of the purpose and intended nature of a business relationship or occasional
transaction in accordance with Commission Rule 3.80.(b) should include an assessment of the economic or other commercial rationale for the business relationship or occasional transaction.
85. The firm’s procedures may provide for standardised profiles to be used for relationship risk
assessments where the firm has satisfied itself, on reasonable grounds, that such an approach effectively manages the risk for each particular business relationship or occasional transaction. However, where the firm has a diverse customer base, or where a wide range of products and

Chapter 3 - Page 44
services are offered, it must develop a more structured and rigorous system to show that judgement has been exercised on an individual basis rather than on a generic or categorised basis.
86. Whatever method is used to assess the risk of a business relationship or occasional transaction,
the firm must maintain clear documented evidence as to the basis on which the relationship risk assessment has been made.
87. Where, despite there being high risk factors identified, the firm does not assess the overall risk
as high because of strong and compelling mitigating factors, the firm must identify the mitigating factors and, along with the reasons for the decision, document them and retain them on the relevant business relationship or occasional transaction file.
88. Based upon the results of the relationship risk assessment, the firm must determine, on the basis
of risk:
(a) the extent of the identification information to be obtained on the key principals to the business relationship or occasional transaction in accordance with Paragraphs 4 and 5 of
Schedule 3 and Chapters 4 to 8 of this Handbook;
(b) how and to what extent that information will be verified using identification data; (c) whether to apply SCDD measures where the business relationship or occasional transaction has been assessed as being low risk and displays one or more of the characteristics in Chapter 9 of this Handbook; and (d) the extent to which the resulting business relationship will be monitored on an ongoing basis.
89. The relationship risk assessment is to be carried out prior to the establishment of a business
relationship or the carrying out of an occasional transaction. However, given that risk is dynamic, it is important that, in the case of an existing business relationship, the relationship risk assessment be reviewed from time to time, the frequency of which will depend on the level of risk presented by the particular business relationship. It is also especially important where there is a trigger event marking a material departure from the business and risk profile of the customer which may be noted through the ongoing monitoring of transactions and activity (e.g., a customer acquires a new service or product or is subject to some form of adverse media). Moreover, a revision of a customer’s relationship risk assessment may also be required when the firm identifies new risk factors and amends its business risk assessments.
3.15. Notices, Instructions or Warnings
90. From time to time the Commission issues Notices, Instructions or Warnings which highlight
potential risks. This information, together with sanctions legislation applicable in the Bailiwick, must be considered when undertaking or reviewing a relationship risk assessment.
91. Further information on the Bailiwick’s sanctions regime and legislation can be found in Chapter
12 of this Handbook.
3.16. Mandatory High Risk Factors
92. In accordance with Paragraph 5(1) of Schedule 3, where the firm is required to carry out CDD
measures, it must also carry out ECDD measures in relation to high risk business relationships and occasional transactions, including, without limitation - (a) a business relationship or occasional transaction in which the customer or any beneficial owner is a foreign PEP; (b) where the firm is an FSB, a business relationship which is –

Chapter 3 - Page 45
(i) a correspondent banking relationship, or
(ii) similar to such a relationship in that it involves the provision of services, which themselves amount to financial services business or facilitate the carrying on of such business, by one FSB to another; (c) a business relationship or an occasional transaction – (i) where the customer or beneficial owner has a relevant connection with a country or territory that - (A) provides funding or support for terrorist activities, or does not apply (or insufficiently applies) the FATF Recommendations, or (B) is a country otherwise identified by the FATF as a country for which such measures are appropriate, (ii) which the firm considers to be a high risk relationship, taking into account any notices, instructions or warnings issued from time to time by the Commission and having regard to the NRA, (d) a business relationship or an occasional transaction which has been assessed as a high risk relationship, and (e) a business relationship or an occasional transaction in which the customer, the beneficial owner of the customer, or any other legal person in the ownership or control structure of the customer, is a legal person that has bearer shares or bearer warrants.
93. Chapter 8 of this Handbook sets out the requirements of Schedule 3 and the Commission Rules
in relation to high risk relationships and includes details of sources which may assist in the assessment of risk.
94. The firm is required to have regard to the NRA in determining what constitutes a high or low risk,
what its risk appetite is, and what constitutes appropriate measures to manage and mitigate risks. The sections of the NRA which discuss the modalities of ML and FT, and the case studies contained within, are particularly relevant to the firm when assessing and mitigating customer, product, service, transaction and delivery channel risk factors.
3.17. Risk Factors
95. The risk factors included within the following sections are purely for guidance and are provided
as examples of factors that the firm might consider when undertaking a relationship risk assessment. The following factors are not exhaustive and are not prescribed as a checklist. It is for the firm to assess and decide what is appropriate in the circumstances of the business relationship or occasional transaction and it is not expected that all factors will be considered in all cases.
96. The example indicators do not remove the ability of the firm to apply a risk-based approach. In
this respect the firm should take a holistic view of the risk associated with each business relationship or occasional transaction as set out in Section 3.4. of this Chapter. The presence of isolated risk factors does not necessarily move a business relationship or occasional transaction into a higher or lower risk category; however, in accordance with Section 3.4.1. above, certain risk factors could have a bigger contribution to the overall risk assessment than others.
97. If it is determined, through a relationship risk assessment, that there are types of customer,
activity, business or profession that are at risk of abuse from ML and/or FT, then the firm should apply higher AML and CFT requirements as dictated by the relevant risk factor(s).

Chapter 3 - Page 46
3.17.1. Customer Risk Factors
98. When identifying the risk associated with its customers, including the beneficial owners of
customers, the firm should consider the risk related to:
(f) the customer’s (and beneficial owner’s) business or professional activity; (g) the customer’s (and beneficial owner’s) reputation; and (h) the customer’s (and beneficial owner’s) nature and behaviour.
99. Risk factors that may be relevant when considering the risk associated with a customer’s or
beneficial owner’s business or professional activity include:
(a) Does the customer or beneficial owner have links to sectors that are commonly associated with higher corruption risk, such as construction, pharmaceuticals and healthcare, the arms trade and defence, the extractive industries or public procurement? (b) Does the customer or beneficial owner have links to sectors that are associated with higher ML and/or FT risk, for example, certain money service providers (“MSPs”), casinos or dealers in precious metals? (c) Does the customer or beneficial owner have links to sectors that involve significant amounts of cash? (d) Where the customer is a legal person or legal arrangement, what is the purpose of their establishment? For example, what is the nature of their business? (e) Does the customer have political connections, for example, are they a PEP, or is the beneficial owner a PEP? Does the customer or beneficial owner have any other relevant links to a PEP, for example, are any of the customer’s directors PEPs and, if so, do these PEPs exercise significant control over the customer or beneficial owner? In line with Paragraph 5(1) of Schedule 3, where a customer or the beneficial owner is a foreign PEP the firm shall apply ECDD measures. (f) Does the customer or beneficial owner hold another prominent position or enjoy a high public profile that might enable them to abuse this position for private gain? For example, are they senior local or regional public officials with the ability to influence the awarding of public contracts, decision-making members of high-profile sporting bodies or individuals who are known to influence the government and other senior decision-makers? (g) Is the customer a legal person subject to enforceable disclosure requirements that ensure reliable information about the customer’s beneficial owner is publicly available, for example, public companies listed on stock exchanges that make such disclosure a condition for listing? (h) Is the customer an FSB acting on its own account from a country or territory listed in
Appendix C to this Handbook? Is there evidence that the customer has been subject to
supervisory sanctions or enforcement for failure to comply with AML and CFT obligations or wider conduct requirements in recent years? (i) Is the customer a public administration or enterprise from a country or territory with low levels of corruption? (j) Is the customer’s or the beneficial owner’s background consistent with what the firm knows about their former, current or planned business activity, their business’s turnover, the source of funds and the customer’s or beneficial owner’s source of wealth? (k) Is the customer a money remitter in a higher risk jurisdiction for terrorism or terrorist financing whose activities could be abused for FT purposes? (l) Is the customer a Non-Profit Organisation (“NPO”) whose activities could be abused for FT purposes, in particular those NPOs operating directly or indirectly in higher risk jurisdictions for terrorism?
100. The following risk factors may be relevant when considering the risk associated with a customer’s
or beneficial owner’s reputation:

Chapter 3 - Page 47
(a) Are there adverse media reports or other relevant sources of information about the customer, for example, are there any allegations of criminality or terrorism against the customer or the beneficial owner? If so, are these reliable and credible? The firm should determine the credibility of allegations on the basis of the quality and independence of the source of the data and the persistence of reporting of these allegations, among other considerations. The firm should note that the absence of criminal convictions alone may not be sufficient to dismiss allegations of wrongdoing. (b) Has the customer, beneficial owner or anyone publicly known to be closely associated with them had their assets frozen due to administrative or criminal proceedings or allegations of terrorism or FT? Does the firm have reasonable grounds to suspect that the customer or beneficial owner or anyone publicly known to be closely associated with them has, at some point in the past, been subject to such an asset freeze? (c) Are there adverse reports or other relevant sources indicating that the customer, or beneficial owner (or anyone publicly known to be closely associated with them) supports or promotes violent extremism or terrorism? (d) Does the firm know if the customer or beneficial owner has been the subject of an internal or external disclosure in the past? (e) Does the firm have any in-house information about the customer’s or the beneficial owner’s integrity, obtained, for example, in the course of a long-standing business relationship?
101. The following risk factors may be relevant when considering the risk associated with a customer’s
or beneficial owner’s nature and behaviour. The firm should note that not all of these risk factors will be apparent at the outset, they may emerge only once a business relationship has been established:
(a) Does the customer have legitimate reasons for being unable to provide robust evidence of their identity, for example, because they are an asylum seeker? (b) Does the firm have any doubts about the veracity or accuracy of the customer’s or beneficial owner’s identity? (c) Are there indications that the customer might seek to avoid the establishment of a business relationship? For example, does the customer look to carry out one transaction or several one-off transactions where the establishment of a business relationship might make more economic sense? (d) Is the customer’s ownership and control structure transparent and does it make sense? If the customer’s ownership and control structure is complex or opaque, is there an obvious commercial or lawful rationale? (e) Does the customer issue bearer shares or does it have nominee shareholders? (f) Is the customer a legal person or legal arrangement that could be used as a personal asset holding vehicle? (g) Is there a sound reason for changes in the customer’s ownership and control structure? (h) Does the customer request transactions that are complex, unusual or unexpectedly large or have an unusual or unexpected pattern without an apparent economic or lawful purpose or a sound commercial rationale? Are there grounds to suspect that the customer is trying to evade specific thresholds, such as those subject to mandatory reporting, either in the Bailiwick or the customer’s home country or territory? (i) Does the customer request unnecessary or unreasonable levels of secrecy? For example, is the customer reluctant to share identification data, or do they appear to want to disguise the true nature of their business? (j) Can the customer’s or beneficial owner’s source of funds or source of wealth be easily established, for example, through their occupation, inheritance or investments? (k) Does the customer use the products and services they have taken out as expected when the business relationship was first established?

Chapter 3 - Page 48
(l) Has the customer made unexpected financial donations to NPOs whose activities could be abused for FT purposes, in particular those NPOs operating directly or indirectly in higher risk jurisdictions for terrorism?
3.17.2. Countries and Territories Risk Factors
102. Internationally, it is recognised that ML often involves using the financial systems of a number
of jurisdictions. Analysis was undertaken as part of the NRA as to how the Bailiwick typically fits into this pattern. The findings from this analysis were that in the majority of cases the Bailiwick's involvement is distant from or peripheral to the criminal enterprises. This indicates in turn that in most cases involving foreign criminal proceeds, the Bailiwick is likely to be some way removed from the criminality itself and to come a considerable distance down the chain of laundering activity, therefore, the firm should consider country risk in the round, where risks are higher ensuring it fully understands the source of those funds.
103. When identifying the risk associated with countries and territories, the firm should consider the
risk related to those countries and territories with which the customer or beneficial owner has a relevant connection.
104. The firm should note that the nature and purpose of the business relationship will often determine
the relative importance of individual country and geographical risk factors. For example:
(a) Where the funds used in the business relationship or occasional transaction have been generated abroad, the level of predicate offences to ML and the effectiveness of a country’s or territory’s legal system will be particularly relevant. (b) Where funds are received from, or sent to, countries or territories where groups committing terrorist offences are known to be operating, the firm should consider to what extent this could be expected to, or might give rise to, suspicion based on what the firm knows about the purpose and nature of the business relationship or occasional transaction. (c) Where the customer is an FSB, the firm should pay particular attention to the adequacy of the country’s or territory’s AML and CFT regime and the effectiveness of AML and CFT supervision. (d) Where the customer or beneficial owner is a legal person or legal arrangement, the firm should take into account the extent to which the country or territory in which the customer or beneficial owner is registered effectively complies with international tax transparency standards.
105. Risk factors the firm should consider when identifying the effectiveness of a country’s or
territory’s AML and CFT regime include:
(a) Has the country or territory been identified by a mutual evaluation as having strategic deficiencies in its AML and CFT regime? In accordance with Paragraph 5(1)(c)(i) of
Schedule 3, ECDD measures shall be applied where the customer or beneficial owner has
a relevant connection to a country or territory that does not apply (or insufficiently applies) the FATF Recommendations. Further information can be found in Section 3.15. of this
Chapter.
(b) Is there information from more than one credible and reliable source about the quality of the country’s or territory’s AML and CFT controls, including information about the quality and effectiveness of regulatory enforcement and oversight? Examples of possible sources include mutual evaluation reports by the FATF or FATF-style regional bodies (in particular Recommendations 10, 26 and 27 and Immediate Outcomes 3 and 4), the FATF’s list of high-risk and non-cooperative jurisdictions, International Monetary Fund (“IMF”) assessments and Financial Sector Assessment Programme reports. The firm should note that membership of the FATF or a FATF-style regional body (for example, MONEYVAL)

Chapter 3 - Page 49
does not, of itself, mean that the country’s or territory’s AML and CFT regime is adequate and effective. (c) Information in Appendices H and I to this Handbook, which list a number of countries and territories that are identified by relevant and external sources as presenting a higher risk of ML and FT.
106. Risk factors the firm should consider when identifying the level of FT risk associated with a
country or territory include:
(a) Is there information (for example, from law enforcement or credible and reliable open media sources) suggesting that a country or territory provides funding or support for terrorist activities or organisations within that country or territory? (b) Is there information (for example, from law enforcement or credible and reliable open media sources) suggesting that groups committing terrorist offences are known to be operating in the country or territory? (c) Is the country or territory subject to financial sanctions, embargoes or measures that are related to terrorism, financing of terrorism or proliferation issued by, for example, the UN, UK or other sanctions? (d) Are there communities within the country or territory that may be actively targeted by terrorist organisations for support or cover or who may be sympathetic to terrorist actors because of diaspora links or other connections? (e) Is the country or territory rich in natural/environmental resources and is known to have active terrorist organisations operating within it? (f) Is the country or territory a regional or international financial centre in close proximity to a conflict zone or to a country or territory identified as funding or supporting terrorist activities which could increase the risk of that finance centre being used as a transit jurisdiction to move funds linked with terrorist activity? (g) Is FT criminalised or inadequately criminalised in the country or territory? Information on this may be found in its FATF or equivalent mutual evaluation report.
107. Risk factors the firm should consider when identifying a country’s or territory’s level of
transparency and tax compliance include:
(a) Is there information from more than one credible and reliable source that the country has been deemed compliant with international tax transparency and information sharing standards? Is there evidence that relevant rules are effectively implemented in practice? Examples of possible sources include reports by the Global Forum on Transparency and the Exchange of Information for Tax Purposes of the OECD, which rate jurisdictions for tax transparency and information sharing purposes; assessments of the country’s or territory’s commitment to automatic exchange of information based on the Common Reporting Standard; assessments of compliance with Recommendations 9, 24 and 25 and Immediate Outcomes 2 and 5 of the FATF Recommendations by the FATF or FATF-style regional bodies; and IMF assessments (for example, IMF staff assessments of offshore financial centres). (b) Has the country or territory committed to, and effectively implemented, the Common Reporting Standard on Automatic Exchange of Information, which the G20 adopted in 2014? (c) Has the country or territory put in place reliable and accessible beneficial ownership registers?
108. Risk factors the firm should consider when identifying the risk associated with the level of
predicate offences to ML in a country or territory include:
(a) Is there information from credible and reliable public sources about the level of predicate offences to ML in the country or territory, for example, corruption, organised crime, tax

Chapter 3 - Page 50
crime and serious fraud? Examples include corruption perceptions indices; OECD country reports on the implementation of the OECD’s anti-bribery convention; and the UN Office on Drugs and Crime World Drug Report. (b) Is there information from more than one credible and reliable source about the capacity of the country’s or territory’s investigative and judicial system to effectively investigate and prosecute these offences?
3.17.3. Products, Services and Transactions Risk Factors
109. When identifying the risk associated with its products, services or transactions, the firm should
consider the risk related to:
(a) the level of transparency, or opaqueness, the product, service or transaction affords; (b) the complexity of the product, service or transaction; and (c) the value or size of the product, service or transaction.
110. Risk factors that may be relevant when considering the risk associated with a product, service or
transaction’s transparency include:
(a) To what extent do products or services allow the customer or beneficial owner structures to remain anonymous, or facilitate hiding their identity? Examples of such products and services include bearer shares, fiduciary deposits, personal asset holding vehicles, and legal entities such as foundations that can be structured in such a way as to take advantage of anonymity and allow dealings with shell companies or companies with nominee shareholders. (b) To what extent is it possible for a third party that is not part of the business relationship to give instructions, for example, in the case of certain correspondent banking relationships?
111. Risk factors that may be relevant when considering the risk associated with a product, service or
transaction’s complexity include:
(a) To what extent is the transaction complex and does it involve multiple parties or multiple countries or territories, for example, in the case of certain trade finance transactions? Are transactions straightforward, for example, are regular payments made into a pension fund? (b) To what extent do products or services allow payments from third parties or accept overpayments where this would not normally be expected? Where third party payments are expected, does the firm know the third party’s identity, for example, is it a state benefit authority or a guarantor? Or are products and services funded exclusively by fund transfers from the customer’s own account at another FSB that is subject to AML and CFT standards and oversight that are comparable to those in the Bailiwick? (c) Does the firm understand the risks associated with its new or innovative product or service, in particular where this involves the use of new technologies or payment methods?
112. Risk factors that may be relevant when considering the risk associated with a product, service or
transaction’s value or size include:
(a) To what extent are products or services cash intensive, for example, many payment services and certain current accounts? (b) To what extent do products or services facilitate or encourage high-value transactions? Are there any caps on transaction values or levels of premium that could limit the use of the product or service for ML and FT purposes?

Chapter 3 - Page 51
3.17.4. Delivery Channel Risk Factors
113. When identifying the risk associated with the way in which the customer obtains the products or
services they require, the firm should consider the risk related to:
(a) the extent to which the business relationship is conducted on a non-face-to-face basis; and (b) any introducers of business or other intermediaries the firm might use and the nature of their relationship with the firm.
114. When assessing the risk associated with the way in which the customer obtains the products or
services, the firm should consider a number of factors including:
(a) Is the customer physically present for identification purposes? If they are not, has the firm used a reliable form of identification data? Has it taken steps to prevent impersonation or identity fraud? (b) Has the customer been introduced by another part of the same financial group and, if so, to what extent can the firm rely on this introduction as reassurance that the customer will not expose the firm to excessive ML or FT risk? What has the firm done to satisfy itself that the group entity applies CDD measures equivalent to those of the firm? (c) Has the customer been introduced by a third party (for example, an FSB that is not part of the same group)? What has the firm done to be satisfied that:
(i) the third party applies CDD measures and keeps records to a standard equivalent to the FATF Recommendations; (ii) the third party will provide, immediately upon request, relevant copies of identification data in accordance with Paragraph 10 of Schedule 3 and Chapter 10 of this Handbook; and (iii) the quality of the third party’s CDD measures is such that it can be relied upon? (d) Has the customer been introduced through a tied agent, that is, without direct firm contact? To what extent can the firm be satisfied that the agent has obtained enough information so that the firm knows its customer and the level of risk associated with the business relationship? (e) If independent or tied agents are used, to what extent are they involved on an ongoing basis in the conduct of business? How does this affect the firm’s knowledge of the customer and ongoing risk management? (f) Where a firm uses an intermediary, are there any indications that the intermediary’s level of compliance with applicable AML legislation or regulation is inadequate, for example, has the intermediary been sanctioned for breaches of AML or CFT obligations?

Chapter 4
Customer Due Diligence
Contents of this Chapter
4.1. Introduction...............................................................................................................................54
4.2. Overriding Obligations .............................................................................................................54
4.3. Key Principals...........................................................................................................................55
4.3.1. The Customer....................................................................................................................55
4.3.2. A Person Purporting to Act on Behalf of the Customer....................................................56
4.3.3. The Beneficial Owner of the Customer ............................................................................56
4.3.4. A Person on Behalf of Whom the Customer is Acting .....................................................57
4.4. Policies, Procedures and Controls.............................................................................................57
4.5. Timing.......................................................................................................................................58
4.6. Acquisition of a Business or Block of Customers ....................................................................59
4.7. Failure to Complete Customer Due Diligence ..........................................................................60
4.8. Collective Investment Schemes................................................................................................61
4.8.1. Responsibility for Investor CDD ......................................................................................61
4.8.2. Identifying and Verifying the Identity of Investors in Collective Investment Schemes...62
4.8.3. Collective Investment Scheme Traded on a Recognised Stock Exchange .......................63

Chapter 4 – Page 54
4.1. Introduction

The application of CDD measures to business relationships and occasional transactions is
important for two key reasons:
(a) to help the firm, at the time that CDD measures are applied, to be satisfied that customers (and the beneficial owners of customers) are who they say they are; to know whether the customer is acting on behalf of another; and that there is no legal barrier (for example, government sanctions) to providing them with the product or service requested; and (b) to enable the firm to assist law enforcement, by providing available information on customers, beneficial owners or activities being investigated.
This Chapter sets out the Commission Rules and provides guidance in respect of the CDD
measures to be applied to business relationships and occasional transactions, including details of the policies, procedures and controls required by the firm in order to meet the relevant requirements of Schedule 3 and this Handbook.
The content of this Chapter should be read in conjunction with the following three Chapters: 5.
Natural Persons; 6. Certification; and 7. Legal Persons and Legal Arrangements. These Chapters specify the CDD measures to be applied based upon the type of customer (or beneficial owner) with which the firm is entering into a business relationship or undertaking an occasional transaction.
Reference should also be made to Chapters 8. Enhanced Customer Due Diligence and 9.
Simplified Customer Due Diligence which provide details of the ECDD measures to be applied to high risk relationships and the enhanced measures for those with specific higher risk factors, together with the circumstances in which the firm can apply SCDD measures and the details of such measures.
4.2. Overriding Obligations
In accordance with Paragraph 4(2) of Schedule 3, the firm shall apply CDD measures when:
(a) establishing a business relationship,
(b) carrying out an occasional transaction,
(c) the firm knows or suspects or has reasonable grounds for knowing or suspecting - (i) that, notwithstanding any exemptions or thresholds pursuant to Schedule 3, any party to a business relationship is engaged in ML or FT, or (ii) that it is carrying out a transaction on behalf of a person, including a beneficial owner, who is engaged in ML or FT, and (d) the firm has doubts about the veracity or adequacy of previously obtained identification data.
In accordance with Paragraph 4(5) of Schedule 3, where the firm:
(a) forms a suspicion of ML or FT by a customer or other person, and (b) reasonably believes that carrying out the steps in Paragraphs 4(3), 5(3) or 11 of Schedule 3 would tip off that customer or person, it shall not carry out those steps, but shall instead make a disclosure pursuant to Part I of the Disclosure Law, or Section 15 or 15A, or Section 12 (as appropriate) of the Terrorism Law.

Chapter 4 – Page 55
7. Where the firm is a PSP, it is also required to apply CDD measures when carrying out occasional
transactions which are wire transfers in the circumstances detailed in Chapter 14 of this Handbook.
8. In accordance with Paragraphs 8(1) and 8(2) of Schedule 3, in relation to all customers the firm
shall:
(a) not set up or keep anonymous accounts or accounts in fictitious names; (b) maintain accounts in a manner which facilitates the meeting of the requirements of Schedule 3 and the relevant Commission Rules and guidance in this Handbook; (c) not enter into, or continue, a correspondent banking relationship with a shell bank; and (d) take appropriate measures to ensure that it does not enter into, or continue, a correspondent banking relationship where the respondent bank is known to permit its accounts to be used by a shell bank.
9. Sound CDD policies and procedures are a key component of an effective AML and CFT
framework and are vital for the firm because they:
(a) constitute an essential part of risk management, providing the basis for identifying, assessing, mitigating and managing risk; (b) help to protect the firm and the integrity of the Bailiwick by reducing the likelihood of the firm becoming a vehicle for, or a victim of, financial crime and/or FT; (c) help the firm, at the time CDD is carried out, to take comfort that the customer and other parties included in a business relationship or occasional transaction are who they say they are and that it is appropriate to provide them with the product or service requested; and (d) help the firm to identify, during the course of a continuing business relationship, factors which are unusual and which may lead to knowing or suspecting or having reasonable grounds for knowing or suspecting that the parties involved in a business relationship or occasional transaction may be carrying out ML or FT.
10. Accordingly, CDD is an on-going and cumulative process, the extent of which is determined by
both the risk attributed to, and the particular circumstances of, a business relationship or occasional transaction.
4.3. Key Principals
11. Paragraph 4(3) of Schedule 3 defines the four categories of party which may be associated with
a business relationship or occasional transaction (collectively referred to in the Handbook as “key principals”) and sets out the extent of the CDD measures that are to be applied to each of them, specifically:
(a) the customer;
(b) any person purporting to act on behalf of the customer; (c) the beneficial owner of the customer; and (d) any person on behalf of whom the customer is acting.
4.3.1. The Customer
12. In accordance with Paragraph 4(3)(a) of Schedule 3, the customer shall be identified and the
identity of the customer verified using identification data.
13. Chapters 5 and 7 of this Handbook provide for the CDD measures to be applied where the
customer is a natural person, or a legal person and legal arrangement respectively.

Chapter 4 – Page 56
Fig. 1 – CDD Measures for Key Principals
4.3.2. A Person Purporting to Act on Behalf of the Customer
14. In accordance with Paragraph 4(3)(b) of Schedule 3, any person purporting to act on behalf of
the customer shall be identified and that person’s identity and authority to so act shall be verified.
15. Examples of such persons will include a guardian of a natural person, the authorised signatories
(or equivalent) acting for or on behalf of a legal person or legal arrangement, those to whom powers of attorney have been granted, the directors (or equivalent) who are acting on behalf of a legal person, and any other person acting on behalf of the customer within a business relationship or occasional transaction.
16. In taking measures to verify the identity of any person purporting to act on behalf of the customer,
the firm should take into account the risk posed by the business relationship or occasional transaction, the materiality of the authority delegated to the individual and the likelihood of that person giving the firm instructions concerning the use or transfer of funds or assets.
17. Examples of the measures the firm could take to verify the authority of a person to act could
include obtaining a copy of the authorised signatories list, power of attorney or other authority or mandate providing the person with the authority to act on behalf of the customer.
18. The identification and verification of the identity of any person identified in accordance with
Paragraph 4(3)(b) of Schedule 3 should be undertaken in accordance with Chapter 5 of this Handbook.
4.3.3. The Beneficial Owner of the Customer
19. In accordance with Paragraph 4(3)(c) of Schedule 3, the beneficial owner shall be identified and
reasonable measures shall be taken to verify such identity using identification data and such measures shall include, in the case of a customer which is a legal person or legal arrangement, measures to understand the ownership and control structure of the customer.
20. Paragraph 22 of Schedule 3 sets out the definition of beneficial owner. It should be noted that
the definition varies based upon the type of legal person or legal arrangement involved in a business relationship or occasional transaction. Further detail can be found in Chapter 7 of this Handbook.

Chapter 4 – Page 57
21. For the purposes of Paragraph 4(3)(c) of Schedule 3, ‘reasonable measures’ should be read as
referring to the taking of measures, which are commensurate with the ML and FT risks which have been identified within the business relationship or occasional transaction, to understand the ownership and control structure of the customer and to verify that the beneficial owner of the customer is who he or she is claimed to be.
22. Where the business relationship or occasional transaction is a high risk relationship, the
measures to understand the ownership and control structure of the customer will be greater than for low or standard risk relationships and may require the firm to ask more questions of the customer and require additional information about the customer’s beneficial ownership. Similarly the extent of the measures considered to be reasonable to verify the identity of the beneficial owner will be greater for high risk relationships and may require the firm to undertake more rigorous checks on the beneficial owner or obtain more robust forms of identification data to satisfy the firm that it has accurately verified the beneficial owner’s identity.
4.3.4. A Person on Behalf of Whom the Customer is Acting
23. In accordance with Paragraph 4(3)(d) of Schedule 3, a determination shall be made as to whether
the customer is acting on behalf of another person and, if the customer is so acting, reasonable measures shall be taken to identify that other person and to obtain sufficient identification data to verify the identity of that other person.
24. For the purposes of Paragraph 4(3)(d) of Schedule 3, ‘reasonable measures’ should be read as
referring to the taking of measures, which are commensurate with the ML and FT risks which have been identified within the business relationship or occasional transaction, to establish the identity of any natural person on whose behalf the firm has determined the customer is acting. Where the risk of the business relationship or occasional transaction is high, the extent of the measures considered to be reasonable will naturally be greater than those applied to low risk relationships.
25. The firm should refer to the CDD measures set out in Chapters 5 and 7 of this Handbook which
the firm should take reasonable measures to apply to any person which the firm determines to fall within Paragraph 4(3)(d) of Schedule 3.
4.4. Policies, Procedures and Controls
26. The firm must have take-on policies, procedures and controls in place which explain how to
identify, and verify the identity of, the customer, beneficial owner and other key principals identified by Paragraph 4(3) of Schedule 3 to a level appropriate to the characteristics and assessed risk of the business relationship or occasional transaction.
27. The firm must assess, on the basis of risk, how much identification information to request, what
to verify, and how to verify it, in order to be satisfied as to the identity of a customer, beneficial owner or other key principal.
28. The firm’s policies, procedures and controls in respect of its CDD measures must:
(a) be risk-based to differentiate between what is expected in low risk relationships, what is expected in high risk relationships and what is expected in situations which are neither high risk nor low risk; (b) provide for enhanced measures to be applied in the circumstances where such measures are required in accordance with Paragraph 5(2) of Schedule 3; (c) impose the least necessary burden on customers, beneficial owners and other key principals consistent with meeting the requirements of Schedule 3 and the Commission Rules;

Chapter 4 – Page 58
(d) not constrain access to financial services (for example, by those without driving licences or passports); and (e) deal sensibly and sensitively with special groups for whom special processes may be appropriate (for example, the elderly and students studying overseas).
29. Identification data providing evidence to verify identity and address can come from a range of
sources, including physical or digital documents, databases and electronic data sources. These sources may differ in their integrity, suitability, reliability and independence, for example, some identification data is issued by governments after due diligence has been undertaken on an individual’s identity, i.e. national identity cards and passports, while other identification data may be issued with few or no checks undertaken on the subject.
30. In light of this, the firm should consider the suitability of identification data prior to its
acceptance, including its source and whether underlying identity checks have been undertaken by the issuing body or authority. The firm should also consider the susceptibility of a document or source to forgery when determining its acceptability.
31. Where the firm does not receive, or have sight of, the original physical documentation used to
verify identity and where instead copy documentation is provided, the firm must ensure that the copy documentation has been certified by a suitable third party.
32. Further information on the policies, procedures and controls required in respect of certification
can be found within Chapter 6 of this Handbook.
33. Where the firm is not familiar with the form of the identification data obtained to verify identity
or address, appropriate measures should be undertaken by the firm to satisfy itself that the identification data is genuine. Evidence of the steps taken by the firm should be retained as proof of its understanding and conclusions in respect of the documents received.
34. All key documents (or parts thereof) must be understood by an employee of the firm and that
understanding must be recorded and retained with the relevant document.
35. The translation of documents should be considered on a case by case basis as it may be obvious
to the firm or an employee in certain instances what a document is and what it means. In all cases the firm should record its understanding of the document and where relevant the reason why it has not sought to translate a document.
36. Notwithstanding the above, the firm must translate all key documents (or parts thereof) into
English at the reasonable request of the Commission or the FIS.
37. Where identification data accepted by the firm to verify the identity of a natural person contains
the individual’s signature and/or a photograph of the individual, the firm should ensure that the photograph and/or signature is clearly legible on the copy or scan of the document retained by the firm.
4.5. Timing
38. In accordance with Paragraph 7(1) of Schedule 3, the identification and verification of the identity
of any person or legal arrangement pursuant to Paragraphs 4 to 6 of Schedule 3 shall, subject to Paragraphs 4(1)(b) and 7(2) of Schedule 3, be carried out before or during the course of establishing a business relationship or before carrying out an occasional transaction.
39. There will be occasions when the circumstances are such that the verification of the identity of a
customer or beneficial owner, cannot commence or be completed until such time as a business

Chapter 4 – Page 59
relationship has been established. This may be acceptable in certain circumstances, provided the firm is satisfied as to the reasons causing the delay.
40. In this respect, Paragraph 7(2) of Schedule 3 provides that the verification of the identity of a
customer and any of the beneficial owners may be completed following the establishment of a business relationship provided that to do so would be consistent with the risk assessment of the business relationship conducted pursuant to Paragraph 3(4)(a) of Schedule 3, and:
(a) the verification is completed as soon as reasonably practicable thereafter; (b) the need to do so is essential not to interrupt the normal conduct of business; and (c) appropriate and effective policies, procedures and controls are in place which operate so as to manage risk, including, without limitation, a set of measures, such as a limitation of the number, types and/or amount of transactions that can be performed or the monitoring of large or complex transactions being carried outside the expected norms for that business relationship.
41. Paragraph 7(2) of Schedule 3 does not, however, permit the retrospective identification of a
customer or beneficial owner after the establishment of a business relationship, save in the circumstances detailed in Chapter 7 of this Handbook, for example, where beneficiaries are identified by class and are therefore unknown to the firm at the commencement of a business relationship.
42. Where the verification of the identity of a customer or beneficial owner takes place after the
establishment of a business relationship, the firm must have appropriate and effective policies, procedures and controls in place so as to manage the risk arising from the delay. These policies, procedures and controls must include:
(a) establishing that it is not a high risk relationship; (b) monitoring by senior management of the business relationship to ensure verification of identity is completed as soon as reasonably practicable; and (c) ensuring funds received are not passed to third parties.
43. The firm should be aware that there may be occasions where the circumstances are such that a
business relationship has been established or an occasional transaction has been carried out and the identification and verification procedures cannot be completed. In these circumstances the firm should refer to Section 4.7. of this Handbook.
44. With regard to occasional transactions, if the identity of the customer is known, verification of
identity is not required in the case of any transactions (whether singly or linked) below the £10,000 threshold for occasional transactions as set out in Schedule 3, unless at any time it appears that two or more transactions which appear to have been small one-off transactions are in fact linked and constitute a significant one-off transaction.
4.6. Acquisition of a Business or Block of Customers
45. There may be circumstances where the firm acquires another specified business with established
business relationships or acquires from a specified business, or non-Bailiwick business, a block of customers that it will be servicing from the Bailiwick.
46. Before acquiring a business or block of customers, the firm must conduct enquiries on the vendor
sufficient to establish the level and the appropriateness of identification data held in relation to the customers of the business to be acquired.

Chapter 4 – Page 60
47. Where deficiencies in the identification data held are identified (either at the time of transfer or
subsequently), the firm must determine and implement a programme to remedy any such deficiencies in a timely manner. The firm must also give consideration to notifying the Commission in accordance with the requirements of Commission Rule 2.49.
48. In addition to conducting due diligence on the vendor, the firm may consider it appropriate to
rely on the information and identification data previously obtained by the vendor for its customers and business relationships where the following criteria are met:
(a) the vendor is an Appendix C business;
(b) the firm has assessed that the CDD policies, procedures and controls operated by the vendor were satisfactory, including consideration of the findings of any relevant reviews by the Commission, an overseas regulatory body (where applicable) or other third party; and (c) the firm has obtained from the vendor, identification data (or copies thereof) for each business relationship acquired.
49. Where the firm disposes of a book of business, it should ensure that the record keeping
requirements of Paragraph 14 of Schedule 3 and the Commission Rules in Chapter 16 of this Handbook are met in respect of the business being disposed of.
4.7. Failure to Complete Customer Due Diligence
50. In accordance with Paragraph 9 of Schedule 3, where the firm can not comply with any of
Paragraph 4(3)(a) to (d) or Paragraph 11(1)(a) to (b) of Schedule 3 it shall:
(a) in the case of an existing business relationship, terminate that business relationship; (b) in the case of a proposed business relationship or occasional transaction, not enter into that business relationship or carry out that occasional transaction with the customer; and (c) consider whether a disclosure must be made pursuant to Part I of the Disclosure Law, or Sections 15 or 15A, or Section 12 (as appropriate) of the Terrorism Law.
51. It is recognised that the immediate termination of a business relationship may not be possible
due to contractual or legal reasons outside the control of the firm. The timing of the termination of an established business relationship will also depend upon the nature of the underlying products or services. As an example, while a bank can close an account and return deposited funds to a customer relatively easily, the compulsory redemption of an investment in a CIS, particularly where it is closed-ended or where valuation dates are infrequent, may be more problematic.
52. Where termination of a business relationship cannot be completed (for example, because the firm
has lost contact with the customer) the firm should have procedures and controls in place to ensure that assets or funds held are ‘blocked’ or placed on a ‘suspense’ account until such time as contact with the customer is re-established or the firm has otherwise dealt with the funds or assets in accordance with its policy for dormant accounts.
53. Where the immediate termination of a business relationship is not possible for whatever reason,
the firm must ensure that the risk is managed and mitigated effectively until such time as the business relationship can be terminated.
54. The firm must ensure that where funds have already been received, they are returned to the source
from which they originated, regardless of whether the source is the customer or a third party. Where the firm has been unable to return the funds to the account from which they were received,

Chapter 4 – Page 61
for instance because the originating bank account has been closed, the firm must take appropriate steps to return the funds to the same party in another form.
55. Where this is not possible (for example, if the relevant party no longer exists) the firm should
take appropriate steps to return any funds to an appropriate third party and document the reasoning for the steps taken.
56. Where the firm has terminated, or not proceeded with establishing, a business relationship or
occasional transaction, it must consider the circumstances giving rise to the failure to complete CDD measures and whether these warrant a disclosure to the FIS.
4.8. Collective Investment Schemes
4.8.1. Responsibility for Investor CDD
57. As part of the process of applying to the Commission for the authorisation or registration of a
closed-ended CIS (“CECIS”) or open-ended CIS (“OECIS”), the board of the CIS (or General Partner (“GP”) of a Limited Partnership (“LP”); trustee of a unit trust; or foundation official of a foundation as appropriate) will nominate a firm (the “nominated firm”) which is licensed under the POI Law and contracted to, or connected with, the CIS to be responsible for meeting the requirements of Schedule 3 and this Handbook for investors into the CIS, in addition to its own obligations.
58. The nominated firm must advise the Commission that it has been so nominated during the course
of the application process, and in any case prior to the authorisation or registration of the CIS.
59. The nominated firm must treat all investors into the CIS as if they were its customers and ensure
that the relevant provisions of Schedule 3 and this Handbook are met, for example, conducting relationship risk assessments and identifying, and verifying the identity of, the investors, including the beneficial owners and other key principals thereof.
60. Whilst the application of CDD measures (including ECDD and enhanced measures as necessary)
may be undertaken by another party (for example, under an outsourcing arrangement) the nominated firm will be responsible for ensuring that appropriate identification data is held on all investors, including the beneficial owners thereof, which meets the relevant requirements of
Schedule 3 and this Handbook.
61. Where the nominated firm provides services to a CIS, the shares of which are traded on a stock
exchange, the nominated firm should refer to the provisions of Section 4.8.3. of this Handbook:
62. Where the firm provides services to a CIS and has not been nominated under Paragraph 4.57.
above, the firm should treat the CIS as its customer and conduct CDD in accordance with the requirements for a CIS authorised or registered by the Commission.
63. There may be occasions where the nominated firm will change throughout the life of a CIS, for
example, as a result of a change of designated manager. Where the firm becomes the nominated firm for a CIS which has already been authorised or registered by the Commission, it must advise the Commission in writing that it has been so nominated as soon as reasonably practicable after its nomination.
64. Where the firm becomes nominated for a CIS with existing investors, the firm should give
consideration to the requirements of Section 4.6. of this Handbook.

Chapter 4 – Page 62
65. Notifications made in accordance with Commission Rule 4.63. should be submitted via the
Commission’s Online Submissions Portal, through the completion of a Form 235. https://submit.gfsc.gg/
4.8.2. Identifying and Verifying the Identity of Investors in Collective Investment Schemes
66. This Section details the obligations for the application of CDD measures to investors, including
the beneficial owners thereof, and applies where the firm:
(a) has been nominated under Paragraph 4.57. of this Handbook; or (b) is acting in the capacity of the administrator or transfer agent of a non-Guernsey CIS (“NGCIS”), unless the contractual arrangements for the services provided by the firm require otherwise.
67. Fundamental to understanding the CDD obligations for CIS investors is a recognition that the
overall arrangements by which interests in a CIS are offered to investors, together with the arrangements under which a CIS consequently deals with investors, will determine the CDD measures to be applied.
68. When undertaking its responsibilities, the firm should be mindful of the vulnerabilities of CISs
and the methods by which CISs may be used by persons or entities for ML and/or FT purposes. For example:
(a) CISs are often distributed on a non-face-to-face basis, with access to those CISs (particularly where they are OECISs) relatively quick and easy to achieve, together with an ability for holdings to be transferred between different parties; (b) OECISs, particularly those with frequent (i.e. daily or weekly) dealing, can provide the ability for short holding periods and the high turnover of share/unit purchases/redemptions; and (c) Notwithstanding the often medium to long-term nature of CISs, which can contribute to limiting the attractiveness of these products for ML purposes, they may still appeal to money launderers on the basis of their ability to generate growth and income.
69. Investments into a CIS will generally fall into one of four broad categories, each presenting its
own risks and having its own obligations in respect of the CDD measures to be applied. Commission Rule 4.70. below sets out the party to be treated as the customer and the CDD measures to be applied to that customer (including the beneficial ownerthereof) for each category of investment.
70. Method of Investment Party to be Treated as the Customer
(a) A natural or legal person or legal arrangement directly purchasing units of, or shares in, a CIS on their own account, and not on behalf of other, underlying parties. The firm must treat the investor as if it were its customer and apply CDD measures (including ECDD and/or enhanced measures as applicable) to the investor, including the beneficial owner of that investor, in accordance with the requirements of
Schedule 3 and this Handbook.
(b) An investor that, as part of its economic activity, directly purchases the units of, or shares in, a CIS in its own name and exercises control over the investment for the ultimate benefit of one or more third parties who do not control the investment or investment decisions and where funds (and any related income) arising from the investment in the In both scenarios (b) and (c), where the investor is an Appendix C business acting as an intermediary for one or more third parties, the firm can treat the investor (i.e. the intermediary) as the customer, provided the relationship has been assessed as low risk and the requirements of Section 9.8. of this Handbook are met.

Chapter 4 – Page 63
CIS will only be returned to the registered owner of the shares or units in the CIS. Where the intermediary relationship has been assessed as being other than low risk, the firm cannot treat the intermediary as its customer and CDD measures (including ECDD and/or enhanced measures as applicable) must also be applied to the underlying investors (i.e. the intermediary’s customers), including the beneficial owners thereof, in accordance with the requirements of
Schedule 3 and this Handbook.
(c) An investor, for example a financial intermediary, that acts in its own name and is the registered owner of the shares or units but acts on the account of, and pursuant to specific instructions from, one or more third parties and where funds (and any related income) arising from the investment in the CIS will only be returned to the registered owner of the shares or units in the CIS. (d) A business’ customer, for example a financial intermediary’s customer, where the business is not the registered owner of the shares or units (for example, because the CIS uses a financial intermediary to distribute fund shares or units, and the investor purchases units or shares through the business and the business does not become the legal owner of the units or shares). The firm must treat the underlying investor, i.e. the intermediary’s customer, as if it were its customer and apply CDD measures (including ECDD and/or enhanced measures as applicable) to the investor, including the beneficial owner thereof, in accordance with the requirements of Schedule 3 and this Handbook. Where the intermediary meets the definition of an
Appendix C business, the firm could consider
treating the intermediary as an introducer, provided the requirements of Chapter 10 of this Handbook are met.
4.8.3. Collective Investment Scheme Traded on a Recognised Stock Exchange
71. This Section relates to authorised and registered CISs, constituted as companies, whose shares
are listed and traded on recognised stock exchanges like those of other publicly held companies, such as investment trusts and exchange traded funds (“traded CISs”).
72. This approach is recognised by IOSCO in its Anti-Money Laundering Guidance for Collective
Investment Schemes issued in October 2005, which states:
“Closed-ended exchange-listed CISs are just like any other public company that lists its shares on an exchange, and public companies – other than financial institutions – do not have specific anti-money laundering responsibilities”.
73. With regard to such publicly listed companies, the FATF sets out its position on the treatment of
listed companies in its Methodology for Assessing Technical Compliance with the FATF Recommendations and the Effectiveness of AML/CFT Systems dated February 2013, which states that:
“Where the customer or the owner of the controlling interest is a company listed on a stock exchange and subject to disclosure requirements (either by stock exchange rules or through law or enforceable means) which impose requirements to ensure adequate transparency of beneficial ownership, or is a majority-owned subsidiary of such a company, it is not necessary to identify and verify the identity of any shareholder or beneficial owner of such companies. The relevant identification data may be obtained from a public register, from the customer or from other reliable sources”.
74. The shares of a traded CIS are not sold or traded directly with investors, but are issued, distributed
and traded through placing agents, broker/dealers and other market intermediaries to individual and corporate investors. As such, a traded CIS and the nominated firm thereof do not have the

Chapter 4 – Page 64
same opportunity to engage with investors prior to accepting an investment, approving a transfer or undertaking a corporate action such as a share buy-back or dividend distribution.
75. Where the shares of a CIS are traded on a recognised stock exchange within the meaning of the
Beneficial Ownership Regulations, in accordance with Paragraph 4(4) of Schedule 3 it is not necessary for the firm nominated by that CIS under Paragraph 4.57. to identify, and verify the identity of any of the investors in that scheme.
76. Where the firm has been nominated under Paragraph 4.57. for a traded CIS, it must understand the
routes by which investors could enter the CIS and have considered the risk presented by these routes to entry in its risk assessment of the CIS carried out under Paragraph 3(4) of Schedule 3 and this Handbook.

Chapter 5
Natural Persons
Contents of this Chapter
5.1. Introduction..............................................................................................................................66
5.2. Identifying Natural Persons......................................................................................................66
5.3. Verifying the Identity of Natural Persons................................................................................67
5.4. Verification of Residential Address.........................................................................................68
5.4.1. Overseas Natural Persons..................................................................................................68
5.5. Online Bank Statements or Utility Bills...................................................................................68
5.6. Electronic Verification.............................................................................................................69
5.7. Independent Data Sources........................................................................................................70
5.8. Guarding Against the Financial Exclusion of Bailiwick Residents.........................................70

Chapter 5 - Page 66
5.1. Introduction

The purpose of this Chapter is to set out the information to be obtained, as a minimum, for a
natural person who acts as a key principal in one or more of the following capacities within a business relationship or occasional transaction:
(a) the customer;
(b) the beneficial owner of the customer;
(c) a natural person purporting to act on behalf of the customer; or (d) a natural person on behalf of whom the customer is acting.
Establishing that a natural person falling within Paragraph 4(3) of Schedule 3 as set out above is
the person that he or she claims to be is a combination of being satisfied that:
(a) the person exists, based on the accumulation of information about the person’s identity; and (b) the customer, beneficial owner or other key principal is that person, by verifying from identification data, satisfactory confirmatory evidence of that person’s identity.
This Chapter sets out the aspects of a natural person’s identity which must be established, together
with the characteristics of that natural person’s identity to be verified using identification data, in order to comply with the requirements of Schedule 3.
The requirements of this Chapter apply:
(a) when establishing a business relationship; (b) when carrying out an occasional transaction; and (c) where any of the parties set out above to a business relationship change throughout the life of that relationship.
5.2. Identifying Natural Persons
Where the firm is required to identify a natural person falling within Paragraph 5.1. above, it must
collect relevant information on the identity of that natural person which includes:
(a) legal name;
(b) any former names (such as maiden name) and any other names used; (c) principal residential address; (d) date and place of birth; (e) nationality (including all nationalities where the individual holds more than one); and (f) any occupation, public position held and, where appropriate, the name of any employer.
In accordance with Paragraph 4(3)(f) of Schedule 3, as part its CDD measures the firm shall make
a determination as to whether the customer or beneficial owner is a PEP and, if so, whether he or she is a foreign PEP, a domestic PEP or international organisation PEP.
Further information on the identification and treatment of PEPs can be found in Section 8.5. of
this Handbook.

Chapter 5 - Page 67
5.3. Verifying the Identity of Natural Persons
8. Subject to Section 9.3. of this Handbook, the firm must verify a natural person’s identity using
identification data, the extent of which is to be determined based on the conclusion of the relationship risk assessment. As a minimum, the firm must verify:
For all natural persons:
(a) legal name;
(b) date of birth; and
(c) residential address.
For natural persons connected with business relationships or occasional transactions which are other than low risk, additionally:
(d) place of birth; and
(e) nationality.
9. In order to verify the above and other information collected, the following identification data is
considered to be the best possible:
(a) current passport, bearing a photograph of the natural person; (b) current national identity card, bearing a photograph of the natural person; (c) armed forces identity card, bearing a photograph of the natural person; (d) driving licence, bearing a photograph of the natural person; or (e) independent data sources (including electronic sources) (see Section 5.7. below).
10. The examples quoted above are not exclusive. There may be other forms of identification data
of an equivalent nature which may be produced as satisfactory evidence of the identity of a natural person.
11. Regardless of its form, the firm must be satisfied as to the validity and veracity of the identification
data used to verify the identity of a natural person and its evidential value should be based on the assessed risk of the business relationship or occasional transaction. In this respect, the firm should be aware that certain documents may be more susceptible to fraud than others, or have less robust controls in respect of their issue, for example, some jurisdictions may issue driving licences without due diligence being undertaken on the holder.
12. When changes occur which result in a modification to a natural person’s profile (for example, a
change of name) the firm should apply a risk-based approach to updating that person’s CDD records and consider what, if any, additional identification data is required to verify the change.
13. In addition to the measures set out above, where the firm has determined that a business
relationship or occasional transaction is high risk, in accordance with Paragraph 5(3) of Schedule 3 the firm shall also apply ECDD measures to that business relationship or occasional transaction. Those ECDD measures shall include, inter alia, taking one or more steps as would be appropriate to the particular business relationship or occasional transaction and could include, in accordance with Paragraph 5(3)(a)(v)(B) of Schedule 3, verifying additional aspects of the customer’s identity.
14. Examples of additional aspects of the customer’s identity that the firm could verify, where that
customer is a natural person, include his or her occupation or any former name(s). Further detail in respect of ECDD measures can be found in Chapter 8 of this Handbook.

Chapter 5 - Page 68
5.4. Verification of Residential Address
15. The following are examples of suitable methods to verify the residential address of a natural
person:
(a) a recent bank/credit card statement or utility bill; (b) correspondence from an independent source such as a central or local government department or agency (in the Bailiwick and the Bailiwick of Jersey this will include States departments and parish authorities); (c) commercial or electronic data sources; (d) a letter from an Appendix C business with which the individual has an existing business relationship and which confirms residential address; (e) a tenancy agreement; (f) a personal visit to the residential address; or (g) an electoral roll.
16. Where a natural person’s principal residential address changes during the course of a business
relationship, the firm is considered to have verified the new address where it has maintained ongoing written correspondence with the natural person at that new address (i.e. it has sent and subsequently received responses to written correspondence addressed and sent by post to the new address).
5.4.1. Overseas Natural Persons
17. There may be occasions when a natural person who is not resident in the Bailiwick is unable to
provide evidence of his or her residential address using the means set out in Paragraph 5.15. above. Examples of such individuals include residents of countries without postal deliveries or street addresses who rely on post office boxes or an employers’ addresses for the delivery of mail.
18. Notwithstanding the above, it is essential for law enforcement purposes that a record of a natural
person’s residential address (or details of how that person’s place of residence can be reached) is held by the firm. As such, it is not acceptable to simply record details of a post office box number as a natural person’s address.
19. Where the firm has determined that an individual has a valid reason for being unable to produce
more usual documentation to verify their residential address and who would otherwise be excluded from establishing a business relationship or undertaking an occasional transaction with the firm, the residential address can be verified by other means, provided the firm is satisfied that the method employed adequately verifies the address of the natural person and any additional risk has been appropriately mitigated.
20. An example of such an alternative method could be a letter from a director or officer of a
reputable overseas employer confirming residence at a stated overseas address (or providing detailed directions to locate a place of residence).
5.5. Online Bank Statements or Utility Bills
21. Where the residential address of a natural person is to be verified through the use of a bank/credit
card statement or utility bill, the default option is to obtain a form of verification which has been delivered to that natural person by post. However, the receipt of such items via the traditional postal system is being replaced by the use of online billing or the delivery of bank or utility statements via e-mail (an “electronic statement”).
22. Examples of electronic statements include:

Chapter 5 - Page 69
(a) an online statement from a recognised bank, building society, credit card company or recognised lender bearing the name and residential address of the natural person; or (b) an online bill in relation to rates, council tax or utilities bearing the name and residential address of the natural person.
23. Where the firm wishes to accept an electronic statement as verification of a natural person’s
address, it must be satisfied as to the validity and veracity of the electronic statement presented.
24. The firm should recognise that some electronic sources may be more easily tampered with, i.e.
the data contained within them subject to amendment, than others. If suspicions are raised in relation to the integrity of any electronic statement obtained, the firm should take whatever practical and proportionate steps are available to establish whether these suspicions are substantiated, and if so, whether the relevant electronic statement should be accepted.
25. An example of a step the firm could take where it has concerns over the veracity of a document
is to corroborate the content of that document using an independent source, for example, a commercial or electronic data source such as a land registry, electoral roll or similar.
5.6. Electronic Verification
26. Electronic verification is the use of an electronic method or system to verify, in whole or in part,
the identity of a natural person by matching specified personal information against electronically captured physical documentation and/or independent electronic data sources.
27. Electronic verification can be used to verify all or any combination of the mandatory data points
required by Commission Rule 5.8. Where an electronic verification system does not fulfil all of these requirements, the firm must use one or more other methods to ensure that a natural person is fully verified in accordance with the requirements of this Handbook.
28. Electronic verification systems range in scope from the electronic capture of identity information
and identification data on a face-to-face basis through to the self-capture of uncertified documentation by a natural person using an interactive application (“App”) on a tablet or mobile phone. In the latter example, a photograph (or a series of photographs or a video) of the natural person are obtained through the App, together with photographs of identification data and address verification documents. The photographs are then independently reviewed and corroborated.
29. Whilst the use of electronic verification can help to reduce the time and cost involved in gathering
information and identification data for a natural person, the firm should be mindful of any additional risks posed by placing reliance on an electronic method or system. This should include understanding the method and level of review and corroboration within the system and the potential for the system to be abused.
30. Knowledge and understanding of the functionality and capabilities of a system can help provide
assurance of its suitability. In particular, there should be certainty of the methods applied to corroborate identification data. The use of more than one confirmatory source to match data enhances the assurance of authenticity.
31. Further information on the certification of identification data received via an electronic
verification system can be found in Section 6.5. of this Handbook.

Chapter 5 - Page 70
5.7. Independent Data Sources
32. Identification data does not have to be in paper form. Independent data sources can provide a
wide range of confirmatory material on natural persons and are becoming increasingly accessible, for example, through improved availability of public information and the emergence of commercially available data sources such as electronic databases and research firms. Sources include:
(a) electoral roll;
(b) telephone directories;
(c) credit reference agency checks;
(d) business information services; and
(e) electronic checks provided by commercial agencies.
33. Where the firm is seeking to verify the identity of a natural person using an independent data
source, whether by accessing the source directly or by using an independent third party organisation (such as a credit reference agency), an understanding of the depth, breadth and quality of the data is important in order to determine that the method of verification does in fact provide satisfactory evidence of identity.
34. Independent data sources can be used to verify all or any combination of the mandatory data points
required by Commission Rule 5.8. Where an independent data source does not fulfil all of these requirements, the firm must use one or more other methods to ensure that a natural person is fully verified in accordance with the requirements of this Handbook.
35. When relying on independent data sources to verify identity, the firm should ensure that the
source, scope and quality of that data is suitable and sufficient and that the process provides for the information to be captured and recorded.
5.8. Guarding Against the Financial Exclusion of Bailiwick Residents
36. There may be occasions when a Bailiwick resident natural person encounters difficulties in
providing evidence of his or her Bailiwick residential address using the sources identified previously in this Chapter. Examples of such circumstances include:
(a) a Short-Term Employment Permit holder who does not have a permanent residential address in the Bailiwick; (b) a natural person living in the Bailiwick in accommodation provided by that person’s employer, with family (for example, in the case of minors), or in care homes, who may not pay directly for utility services; or (c) a Bailiwick student living in university, college, school, or shared accommodation, who may not pay directly for utility services.
37. Where a natural person has a valid reason for being unable to produce the requested documents
and who would otherwise be excluded from accessing the firm’s products and services, identification procedures should provide for alternate means of verifying a natural person’s Bailiwick residential address. The following are examples of alternate methods of verifying an address:
(a) a letter from the head of the household at which the natural person resides confirming that the applicant lives at that Bailiwick address, setting out the relationship between the natural person and the head of the household, together with evidence that the head of the household resides at the address; (b) a letter from the residential home or care home confirming residence of the natural person;

Chapter 5 - Page 71
(c) a Resident Certificate or Resident Permit; (d) a letter from a director or manager of the Bailiwick employer confirming residence at a stated Bailiwick address and indicating the expected duration of employment. In the case of a Short-Term Employment Permit holder, the worker’s residential address in his or her country of origin should also be obtained and reasonable measures taken to verify that address; or (e) in the case of a Bailiwick student, a letter from a Bailiwick resident parent or a copy of the acceptance letter for a place at the college/university. The student’s residential address in the Bailiwick should also be obtained and reasonable measures taken to verify that address.

Chapter 6
Certification
Contents of this Chapter
6.1. Introduction...............................................................................................................................74
6.2. Obligations................................................................................................................................74
6.3. Requirements for Natural Person Certifiers..............................................................................75
6.4. Assessing the Suitability of Natural Person Certifiers..............................................................76
6.5. Certification Requirements for Electronic System Certifiers ...................................................77
6.6. Certification of Documentation for Legal Persons and Legal Arrangements...........................77
6.7. Chains of Copy Certified Documentation.................................................................................78

Chapter 6 - Page 74
6.1. Introduction
Certification is the process whereby, instead of a natural person presenting his/her self and identification data in person to the firm, the individual uses a suitable trusted third party to confirm a positive link between his/her identity and identification data. The certified identification data is then provided to the firm as verification of that natural person’s identity. The use of third party certification serves to mitigate the risk arising from a business relationship or occasional transaction where the firm has had no face-to-face contact with a natural person who is a key principal within that relationship. It also guards against the risk that identification data provided is fraudulent or misleading and does not correspond to the individual whose identity is to be verified. Certification has two purposes:
(a) to provide assurance to the firm that a natural person is who he or she purports to be; and (b) to confirm that the natural person is the owner of the identification data used for the purpose of the firm verifying identity. Until recently certification has required that trusted third parties are natural persons of sufficient standing and subject to appropriate ongoing requirements in respect of their integrity. However, with developments in technology the trusted third party could now take the form of an electronic system which, through the integration of controls such as those detailed later in this Chapter, can provide sufficient corroboration equivalent to that provided by a natural person certifier. This Chapter is split into three sections and provides distinct requirements for certification depending upon the method of certification to be used:
(a) natural persons certifying hard-copy identification data; (b) natural persons electronically certifying scanned identification data; and (c) electronic methods of certifying identification data. Fig. 2, Process of Certification
6.2. Obligations
For certification to be effective, the certifier should be a trusted third party who, in the case of natural person certification, has seen the original identification data and, where that identification data includes a photograph, met the individual in person. Only following these two steps can the certifier provide the necessary assurance to the firm about the individual’s identity.

Chapter 6 - Page 75
In order to ensure this effectiveness, the firm should have as part of its compliance arrangements:
(a) a policy and/or procedures which reflect the firm’s risk appetite towards relying upon certified identification data; (b) a policy in relation to those third parties considered by the firm to constitute suitable certifiers; and (c) procedures allowing for the firm to verify the suitability of those third parties who have certified identification data upon which the firm intends to rely. The firm must exercise caution when accepting certified identification data, especially where such identification data originates from a country or territory perceived to represent a high risk, or from unregulated entities in any country or territory.
6.3. Requirements for Natural Person Certifiers
Whilst there is no specific wording to be used by the certifier, the firm must ensure that the certifier signs and dates the certification and provides sufficient information to confirm the following:
(a) that he/she has seen the original identification data verifying identity or residential address; (b) that he/she has met the natural person who is the subject of the identification data; and (c) adequate information about the certifier in order that the firm can undertake the required assessment of the suitability of the certifier and so that contact can be made with the certifier in the event of a query. The certification should be provided by the certifier either on a copy of the identification data which is the subject of the certification or attached to that document by way of a covering letter or other record which accompanies the identification data. For the purposes of Commission Rule 6.9.(c) ‘adequate information’ should include:
(a) the full name of the certifier;
(b) the professional position or capacity held by the certifier (including professional body membership details where relevant); and (c) details of at least one contact method (for example, postal address, contact telephone number and/or e-mail address). Certification by a natural person can take two forms; (a) paper-based certification where the certification is stamped or written onto a photocopy of the identification data or attached thereto; or (b) electronic certification where hard-copy identification data is scanned and certified electronically by the natural person. The process for utilising electronic certification as set out in Paragraph 6.12.(b) above mirrors that for paper-based documentation. If the certifier accepts the identification data presented by the customer, then using digital encryption or a suitably robust alternative, the certifier will apply a digital signature (or equivalent) to an electronic copy of the identification data. This encrypted file is then provided electronically to the firm. Where the firm utilises a system allowing for natural persons to certify identification data electronically, or otherwise receives identification data which has been certified by a natural person electronically, it must satisfy itself as to the veracity of the certification process prior to accepting identification data certified in such a manner.

Chapter 6 - Page 76
Where the firm wishes to accept soft-copy certified identification data, the preference should be to receive digitally certified (or equivalent) identification data using the process set out in Paragraphs 6.12.(b) to 6.14. above. However, there may be situations where the certifier does not have access to such technology, or is otherwise unable to digitally certify documents, and where the provision of hard-copy documentation via the postal system is unfeasible or uneconomical. Where the firm receives identification data covered by Paragraph 6.12.(a) in scanned soft-copy form, the firm must be satisfied as to the veracity of the identification data provided and that the receipt of such identification data in soft-copy form does not pose an increased risk to the firm. In satisfying itself as to the veracity of the scanned soft-copy identification data received, the firm should consider, amongst other factors, the type of identification data used (for example, is it known to be easily manipulated) and the source of the document(s) received (for example, were they provided by the subject of the identification data, or by an independent source such as the certifier or a representative thereof).
6.4. Assessing the Suitability of Natural Person Certifiers
Where copy identification data certified by a natural person is accepted, regardless of the manner or form of the identification data, the firm must satisfy itself that the certifier is a suitable and appropriate person to provide validation of the identification data based on the assessed risk of the business relationship or occasional transaction, together with the level of reliance being placed on the certified documents. The firm should, as part of its compliance arrangements, have in place a policy which enables it to determine whether an individual is suitable to certify documents and therefore whether reliance can be placed upon the certified identification data provided. The policy should take account of factors including whether the certifier:
(a) is closely related or otherwise connected to the person whose identity is being certified; (b) holds an appropriate public position with a high level of trust and for which background checks or similar vetting of the certifier’s fitness and propriety will have been undertaken; (c) is a member of a professional body which undertakes independent oversight of compliance with its own rules or standards of professional conduct; (d) is required to satisfy criteria similar to the ‘fit and proper’ requirements of the minimum licensing criteria in the Bailiwick and is required to be vetted or approved as part of the regulation in the jurisdiction in which it operates; (e) is employed by another business forming part of a group of which the firm is also a member where the same or equivalent AML and CFT policies, procedures and controls apply; or (f) is subject to other professional rules or a member of an industry body (or equivalent) providing for the integrity of the certifier’s conduct. The firm’s policy for assessing the suitability of a certifier should include consideration of the circumstances where the firm deems it appropriate to validate the credentials of the certifier. As part of the steps taken to validate the credentials of a certifier, the firm may also include the consideration of factors such as:
(a) the reputation and track record of the certifier; (b) the firm’s previous experience of accepting certified documents from persons in the same profession or country or territory; (c) the adequacy of the framework to counter ML and FT applicable in the country or territory in which the certifier is located; and

Chapter 6 - Page 77
(d) the extent to which the framework applies to the certifier.
6.5. Certification Requirements for Electronic System Certifiers
In addition to the traditional paper-based method of identity verification, the firm can also utilise electronic means of gathering natural person identification data, details of which are provided in
Section 5.6. of this Handbook.
As technology has evolved and software enhanced, greater controls have been incorporated into the validation process which have effectively negated the need for natural person certification. These electronic controls can provide an equally robust confirmation of a natural person’s identity, together with the corroboration between the natural person and the identification data used, and examples include:
(a) a requirement for photographs to be taken at the time of the system’s use (for example, the App takes control of the device’s camera and automatically captures images of the identification data and natural person); (b) the inclusion of anti-impersonation measures (for example, a requirement for the natural person to verbally repeat words, phrases or passcodes dictated by the firm during a video call); (c) the corroboration of the images within identification data (both physically and/or stored on the Radio-Frequency Identification (“RFID”) chip), together with a self-taken photograph of the natural person; (d) a process whereby the images taken are independently verified, either by a suitably trained individual or computer system, to confirm the authenticity of the identification data used to verify identity (for example, that the identification data has not been fraudulently altered, is listed on a missing/stolen documents list, etc.); (e) the corroboration of biometric information (for example, finger prints, voice identification, etc.); and/or (f) geotagging/geolocation (i.e. the inclusion of geographical identification metadata to confirm the location in which the user interacted with the system). Where the firm adopts a system providing for the electronic verification of natural person identity, the firm must assess the veracity of the controls inherent within the system in order to determine whether the firm can place reliance on the results produced, or if additional steps are necessary to complement the existing controls. The additional steps undertaken by the firm could include:
(a) requiring a representative of the firm to be present with the natural person when the onboarding software is being used; and/or (b) issuing each relevant natural person with a code or similar unique identifier which is then included within the photographs taken of the natural person and/or identification data.
6.6. Certification of Documentation for Legal Persons and Legal Arrangements
Where the firm is provided with documentsto verify the identity of a legal person which are copies of the originals, the firm must ensure they have been certified by the company secretary, director, manager or equivalent officer, or by a suitable third party certifier. Where the firm is provided with documents to verify the identity and legal status of a foundation which are copies of the originals, the firm must ensure they are certified by a foundation official or by a suitable third party certifier.

Chapter 6 - Page 78
Where the firm is provided with documents to verify the identity and legal status of a trust or other legal arrangement which are copies of the originals, the firm must ensure they are certified by a representative of the trustee (or equivalent) or by a suitable third party certifier. Certification should be provided in a similar form to that set out under Section 6.3. of this
Chapter, either through the certifying of a hard-copy document, or through the use of a digital
signature (or equivalent) applied to an electronic copy of the document.
While there are no specific requirements in respect of the wording used, the firm must satisfy itself that the natural person certifying the document is a suitable and appropriate person within the specific circumstances of the business relationship or occasional transaction.
6.7. Chains of Copy Certified Documentation
As detailed previously, the acceptance of original identification data, or identification data which has been certified in accordance with this Chapter, serves to protect the firm from the risk of it relying upon identification data which is fraudulent or misleading, or which does not correspond to the individual whose identity is to be verified. The benefits of this mitigation are limited, however, where documents have passed through a chain of certifiers (for example, other FSBs) and the link between the customer (or other key principal) and the firm has become distant. Noting this concern, the firm should not place reliance upon copies of certified copies of original identification data, other than in justifiable instances. The firm should always consider the risk of placing reliance upon copies of certified copies of identification data and consider whether it would be more appropriate to obtain the original, or original certified copies of, identification data. Where the firm accepts copies of certified copy identification data, the following criteria must be met:
(a) the copy identification data has been provided by an Appendix C business; (b) the Appendix C business has confirmed that the copy provided is a true copy of the identification data which it holds; (c) the Appendix C business has seen the original identification data that it has copied to the firm, or the identification data that has been copied to the firm was provided to the Appendix C business by a suitable certifier, and in the case of the latter, the firm is satisfied that the individual who certified the identification data accepted by the Appendix C business which it is copying to the firm would qualify as a suitable certifier under the firm’s policies and procedures; and (d) where the identification data copied by the Appendix C business to the firm relates to the verification of a natural person’s identity, the firm is satisfied that the copy identification data provides evidence that the natural person is who he or she is said to be. For the purposes of Paragraph 6.32. above, examples of justifiable instances include:
(a) the provision of copies of identification data held by the trustee of a trust in respect of the beneficial owners of that trust to a bank for the purposes of opening an account on behalf of that trust; or (b) the provision of copies of identification data held by an Appendix C business to a legal professional engaged by the Appendix C business to provide advice in connection with a customer of, and at the request of, the Appendix C business.

Chapter 6 - Page 79
Fig. 3, Chains of Certification
For the avoidance of doubt this Section does not apply in respect of business relationships or occasional transactions falling within the introduced business provisions of Chapter 10 of this Handbook or where the firm acquires a business or block of customers in accordance with Paragraph 4.45. of this Handbook. In such circumstances, the firm places reliance upon a third party to have applied CDD measures to a customer, beneficial owner or other key principal in accordance with its own policies, procedures and controls. As such, the firm may accept copies of certified copy documentation either as part of the testing of that third party or through its acquisition of a block of customers. Fig. 4, Flow of Copy Certified Documentation

Chapter 7
Legal Persons and Legal Arrangements
Contents of this Chapter
7.1. Introduction...............................................................................................................................82
7.2. Transparency of Beneficial Ownership.....................................................................................83
7.3. Measures to Prevent the Misuse of Nominee Shareholders and Nominee Directors................84
7.3.1. Nominee Shareholders......................................................................................................84
7.3.2. Nominee Directors............................................................................................................85
7.4. Legal Persons............................................................................................................................85
7.4.1. Identifying and Verifying the Identity of Legal Persons...................................................85
7.4.2. Identifying and Verifying the Identity of the Beneficial Owners of Legal Persons..........86
7.5. Legal Bodies Listed on a Recognised Stock Exchange ............................................................91
7.6. Protected Cell Companies.........................................................................................................91
7.7. Incorporated Cell Companies....................................................................................................93
7.8. Limited Partnerships and Limited Liability Partnerships .........................................................93
7.9. Foundations...............................................................................................................................94
7.9.1. Obligations of Businesses Establishing or Administering Foundations ...........................94
7.9.2. Obligations when Dealing with Foundations....................................................................95
7.9.3. Verifying the Identity of the Beneficial Owners of Foundations......................................96
7.10. Trusts and Other Legal Arrangements......................................................................................96
7.10.1. Obligations of Trustees (or Equivalent)............................................................................96
7.10.2. Obligations when Dealing with Trusts or Other Legal Arrangements..............................97
7.10.3. Verifying the Identity of the Beneficial Owners of Trusts or Other Legal Arrangements98
7.11. CDD Measures for Particular Categories of Legal Person and Legal Arrangement...............101
7.11.1. Charities and Non-Profit Organisations..........................................................................101
7.11.2. Governments, Supranational Organisations and State-Owned Enterprises ....................102
7.11.3. Sovereign Wealth Funds.................................................................................................103
7.12. CDD Measures for Particular Products and Services .............................................................103
7.12.1. Life and Other Investment Linked Insurance..................................................................104
7.12.2. Employee Benefit Schemes, Share Option Plans and Pension Schemes........................104
7.12.3. Non-Guernsey Collective Investment Schemes..............................................................105

Chapter 7 – Page 82
7.1. Introduction
The purpose of this Chapter is to set out the information to be obtained, as a minimum, for a legal person or legal arrangement which acts as a key principal in one or more of the following capacities within a business relationship or occasional transaction as set out in Paragraph 4(3) of Schedule 3:
(a) the customer;
(b) the beneficial owner of the customer;
(c) a legal person or legal arrangement purporting to act on behalf of the customer; or (d) a legal person or legal arrangement on behalf of which the customer is acting. The identification and verification requirements in respect of legal persons and legal arrangements are different from those for natural persons. While a legal person or legal arrangement has a legal status which can be verified, each business relationship or occasional transaction involving a legal person or legal arrangement will also contain a number of associated natural persons, for example, as beneficial owners. This Chapter should therefore be read in conjunction with Chapters 4 and 5 which set out the CDD measures to be applied to natural persons acting for or on behalf of, or otherwise associated with, a customer which is a legal person or legal arrangement. Legal person refers to any entity, other than a natural person, which is treated as a person for limited legal purposes, i.e. it can sue and be sued, it can own property and it can enter into contracts in its own right. This can include companies, other bodies corporate, foundations, anstalts, associations, or other similar entities which are not legal arrangements. Legal arrangements do not have separate legal personality and therefore form business relationships through their trustees (or equivalent). With regard to trusts, it is the trustee of the trust who will enter into a business relationship or occasional transaction on behalf of the trust and should be considered, along with the trust, as the firm’s customer. There are a wide variety of trusts and other similar arrangements, ranging from large, nationally and internationally active organisations subject to a high degree of public scrutiny and transparency, through to trusts set up under testamentary arrangements and trusts established for wealth management purposes. The firm should be alive to, and take measures to prevent, the misuse of legal persons and legal arrangements for ML and FT. It is imperative that when compiling a relationship risk assessment, the firm considers the breadth of ML and FT risks that the differing size, scale, activity and structure of the legal person or legal arrangement could pose. Less transparent and/or more complex structures present higher risks which could require additional information or research to determine an appropriate risk classification. Based on the outcome of its relationship risk assessment, the firm must consider how the customer and any other legal persons or legal arrangements falling within the requirements of Paragraph 4(3)(a)-(d) of Schedule 3 are to be identified and the identification data in respect of those legal persons or legal arrangements which must be obtained to verify that identity, including ECDD measures and/or enhanced measures where necessary. Where the firm acts as resident agent for a legal person established in the Bailiwick, it is also subject to the Beneficial Ownership Law and the
Beneficial Ownership Regulations and the reporting requirements contained therein. Beneficial Ownership of Legal Persons (Guernsey) Law, 2017 Beneficial Ownership (Definition) Regulations, 2017

Chapter 7 – Page 83
7.2. Transparency of Beneficial Ownership
It is crucial that the firm has a full picture of its customer, including those natural persons with ownership or control over the customer’s affairs. This is important so as to identify, firstly the various legal obligations that fall due within the Bailiwick and beyond and, secondly, whether the legal person or legal arrangement is being abused for criminal purposes. As financial crime legislation, including tax legislation, becomes ever more sophisticated, so too do the ways in which a person may structure his, her or its affairs in order to mask the true beneficial ownership. When applying CDD measures in relation to customers that are legal persons or legal arrangements, in accordance with Paragraph 4(3)(c) of Schedule 3 the firm shall identify and take reasonable measures to verify the identity of the beneficial owner of the legal person or legal arrangement. The definition of beneficial owner in the context of legal persons is to be distinguished from the concepts of legal ownership and control. On one hand, legal ownership means the natural or legal person(s) who, according to applicable law, own the legal person. On the other hand, control refers to the ability to make relevant decisions within the legal person, for example, by owning a controlling block of shares. An essential element of the definition of beneficial owner is that it extends beyond legal ownership and control and focusses on ultimate (actual) ownership and control. In other words, the definition identifies the natural (not legal) persons who actually own and take advantage of the capital or assets of the legal person, as well as those who really exert effective control over it (whether or not they occupy formal positions within that legal person), rather than just the natural or legal persons who are legally (on paper) entitled to do so. In the context of a trust, beneficial ownership includes both the natural persons receiving benefit from the trust (for example, a beneficiary, those in a class of beneficiaries or any other person who benefits from the trust) as well as those connected with, or having control over, the trust’s affairs, including the settlor(s), trustee(s), protector(s) and enforcer(s). Paragraph 4(3)(c) of Schedule 3 also requires that, in the case of a business relationship or occasional transaction within which the customer is a legal person or legal arrangement, that the firm shall take measures to understand the ownership and control structure of that customer. When taking measures to understand the ownership and control structure of a customer in accordance with Paragraph 4(3)(c) of Schedule 3, it is not necessary to verify the identity of every legal person or legal arrangement within a structure. However, the firm must take reasonable measures to gather sufficient information on the identity of any intermediate entities to allow it to identify those natural persons falling within the definition of beneficial owner and to identify whether any
intermediate entity has issued bearer shares or bearer warrants. Further detail is provided within this Chapter in relation to identifying the beneficial owner in the particular types of legal persons and legal arrangements with which the firm could enter a business relationship or undertake an occasional transaction. When identifying, and taking reasonable measures to verify the identity of, the beneficial owner of a legal person or legal arrangement as required by the sections of this Chapter, the firm must act in accordance with the identification and verification requirements of Schedule 3 and this Handbook for natural persons, legal persons and legal arrangements.

Chapter 7 – Page 84
Where a key principal is a legal person or legal arrangement authorised or registered by the Commission as a CIS under the POI Law, the CDD measures to be applied to that legal person or legal arrangement are set out in Section 9.5. of this Handbook. Where a business relationship or occasional transaction involving a legal person or legal arrangement (taking into account the beneficial owner(s) of such) presents a high risk and/or requires the application of enhanced measures, the firm should refer to the obligations set out within Chapter 8 of this Handbook.
7.3. Measures to Prevent the Misuse of Nominee Shareholders and Nominee Directors
The use of nominee shareholders and nominee directors can provide a means to obscure ultimate ownership and control of a legal person or legal arrangement. To minimise the risk to the firm of providing products or services to a customer using such arrangements, it is critical that legal and beneficial ownership is recorded thoroughly and that appropriate steps are taken to establish the true identity of those persons with ultimate ownership and control of a customer. The firm must have appropriate and effective procedures to prevent the misuse of nominee shareholders and nominee directors. These must include a requirement to consider whether a legal person has nominee shareholders and/or nominee directors and the means to identify, and take reasonable measures to verify the identity of, any natural person who ultimately controls a legal person or legal arrangement for which nominee shareholders and/or nominee directors are identified in the ownership and control structure. Where the firm identifies that the customer is a legal person with nominee shareholders, or is owned by a legal person with nominee shareholders, in accordance with Paragraph 5(2)(d) of
Schedule 3 it shall apply enhanced measures as set out in Section 8.12. of this Handbook,
regardless of the risk rating attributed to the business relationship or occasional transaction. For the purposes of identifying the beneficial owner of a legal person or legal arrangement, a nominee shareholder or nominee director would not be considered to have ultimate ownership or control of the customer. The firm must therefore look through the nominee shareholder or nominee director and identify from whom instructions are being taken by a nominee director and for whom shares or interests are held by the nominee shareholder.
7.3.1. Nominee Shareholders
A nominee shareholder is a natural or legal person recorded in the share register as the shareholder of a legal person who holds the shares or interest in that legal person on behalf of another. The identity of the true beneficial owner(s) is not disclosed on the register. In this instance the nominee shareholder cannot be considered the beneficial owner. Nominee shareholders can be used to hide or obscure the beneficial ownership of a legal person, for example, a natural person may indirectly hold a majority interest in a legal person through the use of nominee shareholders who each hold a minimal interest and thereby obscure the identity of the natural person who actually holds effective control. To mitigate the increased risk posed by nominee shareholders, the provision of, or acting as, a nominee shareholder in the Bailiwick by way of business is an activity which requires licensing under the Fiduciaries Law and is therefore subject to the requirements of Schedule 3 and the Commission Rules in this Handbook. A similar approach is adopted in a number of other jurisdictions, such as the Bailiwick of Jersey and the Isle of Man. While this factor may reduce the inherent risk with nominee shareholders, it does not provide for the disapplication of Commission Rule 7.23.

Chapter 7 – Page 85
7.3.2. Nominee Directors
A nominee directoris a natural or legal person who acts on behalf of another. A nominee director therefore cannot be considered to be the beneficial owner on the basis that they are being used by someone else who can ultimately exercise effective control over that legal person. Steps have been taken within the Bailiwick to counter the risk of natural or legal persons acting as nominee director by requiring that those who provide or act as director be licensed under the Fiduciaries Law and therefore subject to the requirements of Schedule 3 and the Commission Rules in this Handbook. However, the firm should remain alert in respect of legal persons from all jurisdictions for indications that a director might be acting on the instructions of another person. Further guidance is provided in the Commission’s Codes of Practice for Company Directors and Corporate Service Providers:
https://www.gfsc.gg/sites/default/files/Code-of-practice-Directors-2009.pdf https://www.gfsc.gg/sites/default/files/Code-of-practice-CSPs-2009.pdf Factors which may indicate that a person is acting as a director on behalf of an undisclosed party could include:
(a) where the individual’s credentials, such as their occupation, are inconsistent with the legal person’s activity and purpose; (b) where the individual holds other unrelated board appointments; or (c) there are indications in communications the firm has with the legal person that the director could be taking instructions from another person whose relationship with that legal person is unclear.
7.4. Legal Persons
7.4.1. Identifying and Verifying the Identity of Legal Persons
Where a legal person is a key principal to a business relationship or occasional transaction, the firm must identify and verify the identity of that legal person (or take reasonable measures to do so in accordance with Paragraph 4(3)(c) or (d) of Schedule 3), including as a minimum:
(a) the name of the legal person, including any trading names; (b) any official identification number; (c) the legal form and law to which the legal person is subject; (d) the date and country/territory of incorporation/registration/establishment (as applicable); (e) the registered office address and principal place of business (where different from the registered office); and (f) the names of the natural persons having a senior management position (for example, the directors (or equivalent)) in the legal person. The following non-exhaustive list provides examples of documents considered suitable to verify one or more aspect of the identity of a legal person:
(a) a copy of the Certificate of Incorporation (or equivalent); (b) a copy of the Memorandum and Articles of Incorporation (or equivalent); (c) a copy of the latest audited financial statements; (d) a copy of the latest annual return; (e) a copy of the register of directors; (f) a copy of the register of shareholders;

Chapter 7 – Page 86
(g) a company registry search including confirmation that the legal person has not been, and is not in the process of being, dissolved, struck off, wound up or terminated; (h) independent information sources, including electronic sources; (i) a copy of the board resolution authorising the opening of any account and recording the account signatories; and/or (j) a personal visit to the principal place of business. Where the documents obtained are copies of the originals, the firm should refer to the requirements of Section 6.6. of this Handbook. In seeking to identify and verify the names of the natural persons having a senior management position in accordance with Commission Rule 7.31.(f), the firm should obtain information on the identity of the directors of the legal person or equivalent positions who impose binding obligations upon a legal person, including authorised signatories, and verify that those positions are held. Where one or more directors (or equivalent) or authorised signatories act for or on behalf of the legal person in a business relationship or occasional transaction with the firm, those persons should be identified, and their identity verified, in accordance with Section 4.3.2 of this Handbook. Where this is through a corporate director of a legal person, the firm should identify and verify the names of the directors of the corporate director and identify and verify the natural persons who will be representing the corporate director acting for the legal person. Where an individual authorised to act on behalf of the legal person is acting in the course of employment with a transparent legal person it is not necessary to identify and verify the identity of the person, providing that confirmation has been received from the transparent legal person that the individual is authorised to act. It may be the case that not all directors (or equivalent) of a legal person will be acting for it within the relationship with the firm. The firm will have to identify and verify that the individual holds that position, but if that person does not act for the legal person in an executive capacity in the relationship with the firm, the firm does not need to identify and verify the identity of that director.
7.4.2. Identifying and Verifying the Identity of the Beneficial Owners of Legal Persons
Paragraph 22(2) of Schedule 3 defines beneficial owner for the purposes of identification and verification as being:
Step 1. the natural person who ultimately controls the legal person through ownership; or, if no such person exists or can be identified, Step 2. the natural person who ultimately controls the legal person through other means; or, if no such person exists or can be identified, Step 3. the natural person who holds the position of a senior managing official of the legal person. The steps set out in Paragraph 7.37. above are not alternative options. Establishing the beneficial ownership of a legal person is a cascading process, beginning with Step 1. If no beneficial owner is identified at Step 1 or there are doubts as to the accuracy of the natural person identified as the beneficial owner, the firm should move to Step 2 and where no natural person is identified under either Steps 1 and/or 2, ultimately Step 3.

Chapter 7 – Page 87
Fig. 5 – Three Step Test of Beneficial Ownership For the purposes of Step 1, in accordance with Paragraph 22(6) of Schedule 3, a person has control of a legal person through ownership if that person holds, directly or indirectly, any of the following:
(a) if the legal person is a company,
(i) more than 25% of the shares in the company, (ii) more than 25% of the voting rights in the company, or (iii) the right to appoint or remove directors holding a majority of voting rights on all or substantially all matters at meetings of the board, (b) if the legal person is any other form of legal person other than a foundation, (i) more than 25% of the shares in the legal person or an interest equivalent to a shareholding of more than 25%, including but not limited to an entitlement to more than 25% of the assets of the legal person in the event of its winding up or dissolution, (ii) more than 25% of the voting rights in the conduct or management of the legal person, or (iii) the right to appoint or remove a majority of the managing officials of the legal person holding a majority of voting rights on all or substantially all matters at meetings of the legal person that are equivalent to board meetings. For the purposes of Paragraph 7.39. above, in accordance with Paragraph 22(6) of Schedule 3 holding more than 25% of the shares in a company means holding a right or rights to share in more than 25% of the capital or, as the case may be, the profits of the company. It should be noted that, in accordance with Paragraph 22(7) of Schedule 3, a person holds shares or rights for the purposes of Paragraphs 7.39. and 7.40. above if:
(a) those shares or rights constitute joint interests; (b) those shares or rights are held under a joint arrangement; (c) those shares or rights are held on behalf of that person by a nominee;

Chapter 7 – Page 88
(d) in the case of rights, that person controls their exercise; (e) in the case of rights only exercisable in certain circumstances, those rights are to be taken into account; or (f) in the case of rights attached to shares held by way of security provided by a person, the rights are still exercisable by that person. In accordance with Paragraph 22(11) of Schedule 3, for the purposes of Schedule 3 and this Handbook, references (however expressed) to, (a) a person controlling the exercise of a right, (b) taking rights into account, or (c) rights being exercisable by a person, shall be construed consistently with Paragraphs 10(2), 11 and 12(a)-(b) of the Beneficial Ownership Regulations respectively. It should be borne in mind that a natural person could also indirectly hold an ownership interest in a legal person. This situation could arise where, for example, a person holds their ownership in the legal person through a legal arrangement. In all cases it is important to note that, if a natural person is identified within an ownership structure in more than one way, the value of each of that person’s holdings will be looked at cumulatively in order to assess that person’s overall holding. In accordance with Paragraph 22(4) of Schedule 3, in any case where a trust or other legal arrangement controls a legal person through ownership, the beneficial owners of that legal person are the beneficial owners of that trust or other legal arrangement as detailed in Section
7.10. of this Chapter.
In accordance with Paragraph 22(5) of Schedule 3, in any case where a transparent legal person has control of a legal person through ownership (“the controlled legal person”), that transparent legal person shall be treated as a natural person for the purposes of Schedule 3 and this Handbook, and therefore (for the avoidance of doubt) as the beneficial owner of the controlled legal person. A transparent legal person is defined in Paragraph 22(10) of Schedule 3 as being:
(a) a company that is listed on a recognised stock exchange within the meaning of the Beneficial Ownership Regulations, or a majority owned subsidiary of such a company; (b) a States trading company within the meaning of the States Trading Companies (Bailiwick of Guernsey) Law, 2001; (c) a legal person controlled by the States of Alderney through ownership within the meaning of the Beneficial Ownership (Alderney) (Definition) Regulations, 2017 (or any successor regulations made under Section 25 of the Beneficial Ownership of Legal Persons (Alderney) Law, 2017; or (d) a regulated person within the meaning of Section 41(2) of the Beneficial Ownership Law, being a person who:
(i) holds or is deemed to hold a licence granted to it by the Commission under the Regulatory Laws; (ii) carries on a PB for the purposes of the PB Law; or (iii) carries on a registered FSB for the purposes of the NRFSB Law. Ownership interests can be so diversified that there may be no natural person, whether acting alone or together with another, who ultimately controls a legal person through ownership. Where

Chapter 7 – Page 89
this is the case, the firm should move to Step 2 and seek to identify and verify the identity of the natural person who ultimately controls the legal person through other means. As set out in Paragraph 22(3) of Schedule 3, there may also be a case where:
(a) the natural person who controls the legal person through ownership has been identified in accordance with Step 1, (b) there are reasonable grounds to believe that the legal person is also ultimately controlled by another natural person through other means, and (c) that other natural person can be identified. In the above situation, or where there is doubt as to whether a natural person identified in Step 1 is the beneficial owner, the beneficial owners in relation to the legal person are the person with the controlling ownership interest and the other natural person believed to be ultimately exercising control over the legal person by other means (i.e. the persons identified within both Steps 1 and 2). Whether or not this situation arises will depend on the specific factors of each case. By way of example, it may arise where the natural person with the controlling ownership interest is dominated by another because of a familial, employment, historical or contractual association, or where another natural person holds certain powers in relation to the legal person which are being or are likely to be used in practice to affect decisions taken by the natural person with the controlling ownership interest. Fig. 6 – Control Through Other Means In this example, A Co is a legal person which is the customer to a business relationship with the firm. B holds 100% of the voting rights in A Co. Although B works as a gardener with no other source of income, A Co has considerable assets. B’s employer, C, is a well-known international businesswoman who is famous for her desire for privacy, in particular about the location of her assets. The firm therefore has reason to believe that, although B controls A Co through ownership, C is also ultimately controlling A Co through other means, i.e. her relationship with B, and both B and C are to be treated as beneficial owners of A Co. For the purposes of Steps 1 and 2 in Paragraph 7.37., a natural person holds a share or right directly when that share or right is held in that person’s own name. This may be held by the natural person alone or jointly with another. Direct holdings will generally be recorded in the constitutional documents of a legal person (for example, a register of shares). However, the firm should be mindful that the information in the constitutional documents may not be definitive (for example, there may be persons controlling that legal person through other means as in Fig. 6 above). Conversely, a natural person holds a share or right indirectly where the ownership structure of a legal person involves one or more other entities, i.e. a chain of ownership. Where this is the case the firm should look through the chain of ownership to establish the ownership interests in each entity to ensure that all natural persons with an indirect holding of more than 25% of the shares or rights in the legal person are identified. The ownership interests within a chain that need to be quantified are most likely
to be shares or rights (or possibly vested beneficial interests in the case of a foundation). However, the relevance of an ownership interest will depend on the

Chapter 7 – Page 90
particular features of the intermediate entities, some of which may be established under the laws of other jurisdictions. An indirect holding within a chain of ownership may arise in one of two ways. The first is when an entity holds more than 25% of the shares or rights in the legal person and an individual has a majority stake (i.e. a greater than 50% shareholding or similar) in that entity so can control those shares or rights. The majority stake may be held directly, but it may also be held through a chain of ownership with the individual holding a majority stake in each intervening entity. The second is where the overall value of an individual’s holding in shares or rights in the legal person, when quantified back through the ownership chain, amounts to more than 25%. An individual who has indirect ownership in either or both of these ways is a beneficial owner of the legal person. Finally, where no natural person is identified under either of Step 1 or Step 2 in Paragraph 7.37., in accordance with Step 3 the firm would identify and take reasonable measures to verify the identity of the natural person who holds the position of a senior managing official of the legal person. The senior managing official could be the natural person responsible for strategic decisions that fundamentally affect the business or general direction of the legal person (for example, a director (or equivalent)) or the natural person exercising executive control over the daily or regular affairs of the legal person through a senior management position (for example, the chief executive officer or chief finance officer). In both cases, this would not normally include a person who does not have executive functions, such as a non-executive director. In situations where there is more than one official of a legal person with strategic decision making powers and none is senior to the others, for the purposes of Schedule 3 and this Handbook, all should be treated as senior managing officials. In the case of partnerships; associations; clubs; societies; charities; church bodies; institutes; mutual and friendly societies; and co-operative and provident societies, the senior managing officials will often include members of the governing body or committee plus executives. In the case of foundations, this will include members of the governing council and any supervisors. Fig. 7 – Direct Holding vs. Indirect Holding In this example, A Co is a legal person which is the customer to an occasional transaction with the firm. B holds 70% of the shares in A Co through a direct holding and is therefore a beneficial owner of A Co. The remaining 30% of the shares are held by C Fn, a foreign foundation. D holds 80% of the shares in C Fn so has an indirect holding in A Co quantified at 24% overall (i.e. 80% of 30%). This means D does not have an overall holding in A Co of more than 25% under the quantification test, but does hold a majority stake in an entity which holds more than 25% of the
voting rights in A Co, therefore D is a beneficial owner in A Co. E and F each hold 10% of the shares in C Fn, so each has an indirect holding in the shares of A Co of 3% overall (i.e. 10% of 30%). As they have neither an overall holding in A Co of more than 25% under the quantification test, nor a majority stake in an entity which holds more than 25% of the voting rights in A Co, they are not beneficial owners of A Co.

Chapter 7 – Page 91
7.5. Legal Bodies Listed on a Recognised Stock Exchange
In accordance with Paragraph 4(4) of Schedule 3, the firm shall not be required to identify any shareholder or beneficial owner in relation to:
(a) a customer, and
(b) a person which ultimately controls a customer, that is a company listed on a recognised stock exchange within the meaning of the Beneficial Ownership Regulations, or a majority owned subsidiary of such a company. Beneficial Ownership (Definition) Regulations, 2017 In order for the firm to consider the company as the principal to be identified, it must obtain documentation which confirms that the company is listed on a recognised stock exchange. For the purposes of Paragraph 4(4) of Schedule 3 and Commission Rule 7.59. above, in accordance with the Beneficial Ownership Regulations the following are deemed to be recognised stock exchanges:
(a) any regulated market within the meaning of the European Directive on Markets in Financial Instruments 2004/39/EU; (b) the International Stock Exchange Authority Limited; (c) the Alternative Investment Market; (d) the Specialist Funds Market; (e) the Australian Stock Exchange; (f) the New York Stock Exchange; (g) the National Association of Securities Dealers Automated Quotation System; (h) the Cayman Islands Stock Exchange; (i) the Bermuda Stock Exchange; (j) the Hong Kong Stock Exchange; (k) the Johannesburg Stock Exchange; and (l) the SIX Swiss Exchange. EU Markets in Financial Instruments Directive 2004
7.6. Protected Cell Companies
A protected cell company (“PCC”) is a single legal entity with one board of directors and one set of memorandum and articles of incorporation. A PCC can create an unlimited number of protected cells (“PCs”), the assets and liabilities of which are separate from those of the PCC (with the assets of the latter referred to as “non-cellular” or “core”). Importantly, the PCs are not separate legal entities and therefore cannot transact as such. A PCC can be a newly incorporated entity or alternatively an existing company can be converted to a PCC. In either case the formation of, or conversion to, a PCC within the Bailiwick requires, under the Companies (Guernsey) Law, 2008 as amended, the prior written consent of the Commission. A PCC may create any number of PCs, the assets and liabilities of which are segregated from the non-cellular assets of the PCC and from the assets and liabilities of other PCs. However, a PC may not own shares in its own PCC or another PC of the same PCC.

Chapter 7 – Page 92
Where a PCC is a key principal to a business relationship or occasional transaction, the firm must apply CDD measures to both the core and the relevant PC(s), including the beneficial owners of such, in accordance with the requirements for legal persons. Notwithstanding the segregation in respect of the assets and liabilities of the core and PCs as detailed above, for the purposes of identifying and verifying the identity of the beneficial owner in accordance with Paragraph 4(3) of Schedule 3, the test for control through ownership of a PCC is two-fold and will differ depending on the circumstances of the firm’s relationship with the PCC (or a PC thereof):
(a) Where the firm is entering into a business relationship or undertaking an occasional transaction with a PC (for example, the provision of a bank account for a particular PC), the beneficial ownership should be calculated separately in respect of:
(i) the shares or rights in the particular PC; and (ii) the shares or rights in the core. (b) Where the firm acts as administrator of the PCC, the beneficial ownership should be calculated in respect of the shares or rights in the PCC as a whole in the same way as with any other legal person and ignoring any segregation (i.e. including any shares or rights held in the core, as well as all PCs). For the purposes of Paragraph 7.65.(b), a natural person’s direct or indirect holding of shares or rights in a PCC is therefore calculated by including all shares or rights that the person holds in the PCC, whether those shares or rights form part of the core or are held within one or more PCs. The effect of this is that a person cannot try to conceal his or her beneficial ownership of a PCC by dividing shares among different PCs. Fig. 8 – Beneficial Ownership of PCCs In this example, A PCC is a PCC with three cells. E holds all of the shares in the core and 50% of the shares in C PC. E is therefore a beneficial owner of C PC, and holds 37% of all shares, making her a beneficial owner of A PCC. Likewise, G holds 100% of the shares in D PC and 80% of the shares in B PC. G is therefore a beneficial owner of D PC and B PC, and holds 45% of the total shares making him a beneficial owner of A PCC. I holds 50% of the shares in C PC and 12.5% of the shares in A PCC. I is therefore a beneficial owner of C PC, but not A PCC. Finally, F holds 20% of the shares in B PC and 5% of the total shares in the PCC. F is neither a beneficial owner of B PC or the A PCC structure. The CDD measures to be applied to a PCC authorised or registered by the Commission as a CIS under Section 8 of the POI Law where it acts as a key principal to a business relationship or occasional transaction are set out in Section 9.5. of this Handbook. The CDD measures for PCCs which are licensed under the Insurance Business (Bailiwick of Guernsey) Law, 2002 as amended (“the IB Law”) and where the beneficial owner of the relevant PC or PCC is a business which is listed on a recognised stock exchange within the meaning of the Beneficial Ownership Regulations (or by a majority owned subsidiary of such a listed business) are the same as those set out in Section 7.5. of this Handbook.

Chapter 7 – Page 93
7.7. Incorporated Cell Companies
An incorporated cell company (“ICC”) is structured similarly to a PCC with a non-cellular core and an unlimited number of cells (“ICs”). However, in contrast, the ICs of an ICC are separately incorporated and are therefore distinct legal entities with their own memorandum and articles of incorporation and boards of directors. It is of note that the boards of the ICC and the boards of the ICs must be identically composed, so any director of an ICC must also be a director of each of its ICs. Similar to a PCC, the assets and liabilities of each IC are segregated from the assets and liabilities of the ICC and from the assets and liabilities of the other ICs. While an IC can hold its own assets, those assets cannot include shares in its own ICC. As a result of each IC having separate legal personality, the ICs have the ability to contract with third parties and with other ICs in their own right. An IC must therefore contract in respect of its own affairs and the ICC has no power to enter into transactions on behalf of any of its ICs. Each IC can also have distinct beneficial owners. Where an ICC or IC is a key principal to a business relationship or occasional transaction, the firm must apply CDD measures to the relevant ICC or IC, and to the beneficial owners thereof, in accordance with the requirements for legal persons. The CDD measures to be applied to an ICC or IC authorised or registered by the Commission as a CIS under Section 8 of the POI Law where it acts as a key principal to a business relationship or occasional transaction are set out in Section 9.5. of this Handbook. The CDD measures for ICs or ICCs which are licensed under the IB Law and where the beneficial owner of the relevant IC or ICC is a business which is listed on a recognised stock exchange within the meaning of the Beneficial Ownership Regulations (or by a majority owned subsidiary of such a listed business) are the same as those set out in Section 7.5. of this Handbook.
7.8. Limited Partnerships and Limited Liability Partnerships
An LP is a form of partnership with or without legal personality at the election of the GP. Its members include one or more GP, who has actual authority over the LP, for example to bind the LP in contracts with third parties, and is liable for all debts of the LP, and one or more limited partner who contributes (or agrees to contribute) to the capital of the LP and who (subject to certain provisions) is not liable for the debts of the LP. A Limited Liability Partnership (“LLP”) is a body corporate with legal personality separate from that of its members and is therefore liable for its own debts. As a consequence of this legal personality, LLPs established within the Bailiwick must be registered and therefore public records exist similar to those for legal persons. With regard to the members of an LLP, there must be at least two who, unless otherwise stipulated within the members’ agreement, may take part in the conduct and management of the LLP and are entitled to share equally in the profits of the LLP. Where an LP or LLP is a key principal to a business relationship or occasional transaction, the firm must identify, and verify the identity of, that LP/LLP (or take reasonable measures to do so in accordance with Paragraph 4(3)(c) or (d) of Schedule 3), as set out in Section 7.4. above. The following non-exhaustive list provides examples of documents considered suitable to verify one or more aspect of the identity of the LP/LLP in accordance with Commission Rule 7.78.:

Chapter 7 – Page 94
(a) a copy of the LP/LLP agreement;
(b) a copy of the certificate of registration/establishment; (c) a copy of the register of limited partners; (d) a copy of the resolution of the GP (in the case of an LP) or members (in the case of an LLP) authorising the opening of any bank account and recording the account signatories; (e) a copy of the latest audited financial statements; and/or (f) information obtained from independent data sources, including electronic sources, for example a search of a register of LPs/LLPs. Where the documents obtained are copies of the originals, the firm should refer to the requirements of Section 6.6. of this Handbook. When seeking to identify, and verify the identity of, the beneficial owners of an LP/LLP, the firm must act in accordance with the requirements for legal persons in Schedule 3 and the Commission Rules in Section 7.4.2. of this Handbook. Fig. 9 – Limited Partnership In this example, A LP is a limited partnership which is the customer to a business relationship with the firm. 52% of the voting rights in A LP are held by B Co, a limited company, with the remaining 48% held by a foundation, C Fn. D holds 50% of the shares in B Co so has an indirect holding in the voting rights in A LP of 26% overall (i.e. 50% of 52%). This means D does not hold a majority stake in an entity that holds more than 25% of the voting rights in A LP, but has an overall holding in the voting rights in A LP under the quantification test of more than 25%. Therefore D is a beneficial owner of A LP. E and F each hold 25% of the shares in B Co so both have an indirect holding in the voting rights in A LP of 13% overall (i.e. 25% of 52%). As they have neither an overall holding in the voting rights in A LP under the quantification test of more than 25%, nor a majority stake in B Co, an entity which holds more than 25% of the voting rights in A LP, they are not beneficial owners of A LP. G has a vested beneficial interest in 100% of the assets of C Fn, so has an indirect holding in the voting rights in A LP of 48% overall (i.e. 100% of 48%). This means that G both holds a majority stake in an entity that holds more than 25% of the voting rights in A LP and has an overall holding in the voting rights in A LP under the quantification test of more than 25%. Therefore, G is a beneficial owner of A LP under both tests.
7.9. Foundations
7.9.1. Obligations of Businesses Establishing or Administering Foundations
During the course of establishing or administering a foundation relationship, the firm must, in order to identify and verify the identity of the customer and beneficial owners, identify:
(a) the founder(s), including the initial founder(s) and any persons or legal arrangements subsequently endowing the foundation; (b) all councillors;

Chapter 7 – Page 95
(c) any guardian(s);
(d) any beneficial owner, including any default recipient; and (e) any other natural person who exercises ultimate effective control over the foundation.
7.9.2. Obligations when Dealing with Foundations
Where a foundation is a key principal to a business relationship or occasional transaction, the firm must:
(a) identify and verify the identity of the foundation (or take reasonable measures to do so in accordance with Paragraph 4(3)(c) or (d) of Schedule 3), including without limitation:
(i) the full name;
(ii) the legal status of the foundation;
(iii) any official identification number (for example, a registered number, tax identification number or registered charity or NPO number, where relevant); (iv) the date and country or territory of establishment/registration; and (v) the registered office address and principal place of operation/administration (where different from the registered office); (b) identify and verify the identity of any registered agent of the foundation, other than where the agent is a transparent legal person; (c) identify the following:
(i) the founder(s), including the initial founder(s) and any persons or legal arrangements subsequently endowing the foundation; (ii) all councillors; (iii) any guardian(s); (iv) any beneficial owner, including any default recipient; and (v) any other natural person who exercises ultimate effective control over the foundation; and (d) understand the ownership and control structure of the foundation and the purpose and intended nature of the business relationship or occasional transaction. The following non-exhaustive list provides examples of documents considered suitable to verify one or more aspect of the identity of a foundation:
(a) a copy of the Certificate of Registration; (b) a registry search, if applicable, including confirmation that the foundation has not been, and is not in the process of being, dissolved, struck off, wound up or terminated; (c) a copy of the latest audited financial statements; (d) a copy of the Charter; and/or (e) a copy of the Council Resolution authorising the opening of the account and recording account signatories. Where the documents obtained are copies of the originals, the firm should refer to the requirements of Section 6.6. of this Handbook. Verification of the identity of the beneficial owners of a foundation must be undertaken either by the firm itself or, provided that the Commission Rules in Chapter 10 of this Handbook are met, by requesting the registered agent, where one has been appointed, to provide the relevant information on the identity of such parties by way of a certificate or summary sheet.

Chapter 7 – Page 96
7.9.3. Verifying the Identity of the Beneficial Owners of Foundations
Paragraph 22(6)(c) of Schedule 3 defines that a person has control of a foundation through ownership if that person holds, directly or indirectly, any of the following:
(a) an interest equivalent to a shareholding of more than 25% including but not limited to an entitlement to more than 25% of the assets of the foundation in the event of its winding up or dissolution; (b) more than 25% of the voting rights in the conduct or management of the foundation; (c) the right to appoint or remove a majority of the managing officials of the foundation holding a majority of voting rights on all or substantially all matters at meetings of the foundation that are equivalent to board meetings; (d) a vested beneficial interest or future entitlement to benefit from more than 25% of the assets of the foundation. Other than where a business relationship or occasional transaction has been assessed as high risk, the firm must take reasonable measures to verify the identity of any natural person falling within Paragraph 7.87. above prior to any distribution of foundation assets to (or on behalf of) that natural person. Where a business relationship has been assessed as being high risk, the firm must, where possible, take reasonable measures to verify the identity of any natural person falling within Paragraph 7.87. above at the time that the assessment of risk is made. Where it is not possible to do so (for example, because that person has not been born or is disenfranchised) the reasons must be documented and retained on the relevant customer’s file. The firm must take reasonable measures to verify the identity of those parties identified by Commission Rule 7.82. or 7.83. other than the beneficial owners (for example, the founder(s), foundation official(s), councillors, guardian(s) and any other person(s) with ultimate effective control over the foundation (including the beneficial owners of such entities where they are legal persons or legal arrangements)) before or during the course of establishing a business relationship or before carrying out an occasional transaction. Regardless of form, where the firm identifies that a founder is acting on behalf of another person, i.e. as a nominee founder, the firm must identify and take reasonable measures to verify the identity of the true economic founder. With regard to Paragraph 7.87.(d), the persons falling within this category will depend on the specific circumstances of the foundation. However, this will generally include individuals who under the terms of the official documents of the foundation have a future entitlement to a substantial benefit from the foundation. As a matter of practice and policy, this will generally mean an entitlement to a benefit which in the hands of an individual recipient equates to more than 25% of the total assets of the foundation. In other words, it is not intended that, where a foundation’s official documents anticipate the provision of benefits to a potentially large group, (for example, by providing funds to supply food to the inhabitants of a flooded village) members of that group should be treated as beneficial owners.
7.10. Trusts and Other Legal Arrangements
7.10.1. Obligations of Trustees (or Equivalent)
During the course of establishing a trust relationship for which it is to act as trustee, the firm must, in order to identify and verify the identity of the customer and beneficial owners, identify:

Chapter 7 – Page 97
(a) the settlor(s), including the initial settlor(s) and any persons or legal arrangements subsequently settling funds into the trust; (b) any protector(s), enforcer(s) and co-trustee(s); (c) any beneficiary (whether his or her interest under the trust is vested, contingent or discretionary and whether that interest is held directly by that person or as the beneficial owner of a legal person or a legal arrangement that is a beneficiary of the trust), any class of beneficiaries and any other person who is likely to benefit from the trust; and (d) any other natural person who exercises ultimate effective control over the trust. Where the firm is establishing a legal arrangement other than a trust for which it is to act in a position equivalent to that of a trustee, the firm must identify those persons fulfilling positions equivalent to those set out in Commission Rule 7.93. above. In identifying any person who is likely to benefit from the trust in accordance with Commission Rule 7.93.(c), the firm should seek to establish whether any documentation other than the trust deed, for example, a letter of wishes, identifies persons other than beneficiaries who, in the view of the trustee, are likely to benefit from the trust. The information collected by the firm on the identity of persons described in Commission Rule 7.93.(c) above must at a minimum include their full name and date of birth. The extent to which the other information specified in Commission Rule 5.5. is obtained by the firm will depend on the likelihood of that person benefiting from the trust, with such an assessment documented. All information on the identity of that natural person specified under Commission Rule 5.5. must be collected and the identity of that person verified by the firm in accordance with Commission Rule
5.8. prior to any distribution of trust assets in accordance with Commission Rule 7.108., unless
Commission Rule 7.109. applies. For the avoidance of doubt where a legal person or a legal arrangement has been identified as “any other person” the firm must apply this rule to its beneficial owner/s. Information on the verification of the beneficial owners of a trust can be found in Section 7.10.3. of this Handbook.
7.10.2. Obligations when Dealing with Trusts or Other Legal Arrangements
Where a trust is a key principal to a business relationship or occasional transaction, the firm must:
(a) identify and verify the identity of the trust (or take reasonable measures to do so in accordance with Paragraph 4(3)(c) or (d) of Schedule 3), including without limitation:
(i) the full name;
(ii) any official identification number (for example, a tax identification number or registered charity or NPO number, where relevant); and (iii) the date and place of establishment of the trust; (b) identify and take reasonable measures to verify the identity of the trustees of the trust, unless, in accordance with Section 9.6., they are themselves subject to this Handbook; (c) require the trustees (or equivalent) of the trust or other legal arrangement to provide the firm with details of the identities of the beneficial owners of the trust, including:
(i) the settlor(s), including the initial settlor(s) and any persons or legal arrangements subsequently settling funds into the trust; (ii) any protector(s), enforcer(s) and co-trustee(s);

Chapter 7 – Page 98
(iii) any beneficiary (whether his or her interest under the trust is vested, contingent or discretionary and whether that interest is held directly by that person or as the beneficial owner of a legal person or a legal arrangement that is a beneficiary of the trust), any class of beneficiaries and any other person who to the best of the trustee’s knowledge, is likely to benefit from the trust; and (iv) any other natural person who exercises ultimate effective control over the trust; and (d) understand the ownership and control structure of the trust or other legal arrangement and the purpose and intended nature of the business relationship or occasional transaction. When verifying the identity of the trust in accordance with Commission Rule 7.98.(a), the firm does not need to obtain copies of the entire trust instrument (for example, trust deed or declaration of trust); obtaining copies of relevant extracts of such an instrument may suffice.

When collecting from the trustees information on the identity of persons described in Commission Rule 7.98.(c)(iii) above, the firm must at a minimum obtain their full name and date of birth. The extent to which the other information specified in Commission Rule 5.5. is obtained by the firm will depend on the likelihood of that person benefiting from the trust, with such an assessment documented. All information on the identity of that natural person specified under Commission Rule 5.5. must be collected and the identity of that person verified by the firm in accordance with Commission Rule 5.8. prior to any distribution of trust assets in accordance with Commission Rule 7.108., unless Commission Rule 7.109. applies. For the avoidance of doubt where a legal person or legal arrangement has been identified as “any other person” the firm must apply this rule to its beneficial owner/s. Where the business relationship or occasional transaction has been assessed as high risk, the firm must obtain relevant extracts of the trust deed, deeds of amendments and letter(s) of wishes (as applicable to verify the points covered by Commission Rule 7.98.(a)(i)-(iii) above), together with an appropriate assurance from the trustee that the content of such documents does not contain contradictory information with other identification data gathered. In identifying any person who is likely to benefit from the trust in accordance with Commission Rule 7.98.(c)(iii), the firm should seek to establish from the trustee whether there are persons, other than beneficiaries identified in the trust deed, who are likely to benefit from the trust, for example, persons named in a letter of wishes or other related documents. Where documents obtained are copies of the originals, the firm should refer to the requirements of Section 6.6. of this Handbook.
7.10.3. Verifying the Identity of the Beneficial Owners of Trusts or Other Legal Arrangements
In accordance with Paragraph 4(3) of Schedule 3, in relation to a trust the firm shall take measures to understand the ownership and control structure of the trust and identify and take reasonable measures to verify the identity of the beneficial owner. In accordance with Paragraph 22(8) of Schedule 3, in relation to a trust beneficial owner means:
(a) any beneficiary who is a natural person, whether his or her interest under the trust is vested, contingent or discretionary, and whether that interest is held directly by that person or as the beneficial owner of a legal person or legal arrangement that is a beneficiary of the trust; (b) any trustee, settlor, protector or enforcer of the trust who is a natural person or that is a transparent legal person;

Chapter 7 – Page 99
(c) if any trustee, settlor, protector or enforcer of the trust is a legal person (other than a transparent legal person) or a legal arrangement, any natural person who is the beneficial owner of that legal person or legal arrangement; (d) any natural person (other than a beneficiary, trustee, settlor, protector or enforcer of the trust), who has, under the trust deed of the trust or any similar document, power to:
(i) appoint or remove any of the trust’s trustees; (ii) direct the distribution of funds or assets of the trust; (iii) direct investment decisions of the trust; (iv) amend the trust deed; or (v) revoke the trust; (e) any transparent legal person (other than a trustee, settlor, protector or enforcer of the trust) that holds any of the powers set out in (d); (f) where a legal person (other than an transparent legal person) or legal arrangement holds any of the powers within subparagraph (d) (other than a trustee, settlor, protector or enforcer of the trust), any natural person who is a beneficial owner of that legal person or legal arrangement; and (g) any other natural person who exercises ultimate effective control over the trust. In the case of a legal arrangement other than a trust, in accordance with Paragraph 22(9) of
Schedule 3, beneficial owner means any natural person or transparent legal person who is in a
position in relation to that legal arrangement that is equivalent to the position of any natural person or transparent legal person set out in Paragraph 22(8) of Schedule 3 as set out above. For the avoidance of doubt, the firm should treat a transparent legal person as a natural person for the purposes of Schedule 3 and this Handbook. In doing so, the transparent legal person should be identified and its identity verified in accordance with Commission Rule 7.31. However, the firm does not need to determine the beneficial ownership of the transparent legal person. Other than where a business relationship or occasional transaction has been assessed as being high risk, the firm must take reasonable measures to verify the identity of any natural person who is a beneficiary of, or any other natural person who benefits from, the trust prior to any distribution of trust assets to (or on behalf of) that natural person. Where a business relationship or occasional transaction has been assessed as being high risk, the firm must, where possible, take reasonable measures to verify the identity of all beneficiaries and other persons who are likely to benefit from the trust at the time that the assessment of risk is made as set out in Commission Rules 7.96. and 7.100. Where it is not possible to do so (for example, because the beneficiaries have not yet been born or are excluded) the reasons must be documented and retained on the relevant customer’s file. The vast majority of trusts established and administered in the Bailiwick are discretionary trusts. Under a discretionary trust the beneficiaries have no right to any ascertainable part of the income or capital of the trust property. Rather, the trustees are vested with a power, which they are obliged to consider exercising, to pay the beneficiaries, or apply for their benefit, such part of the income or capital of the trust as the trustees think fit. Consequently, a beneficiary’s interest in trust property is merely discretionary except to the extent that the trustee has decided to appoint a benefit to him or her.
Schedule 3 recognises the differences between the interests of beneficiaries under discretionary
trusts, as well as those under fixed trusts whose interests have not yet arisen and who are, therefore, contingent beneficiaries. In this respect, Commission Rule 7.108. allows, other than in

Chapter 7 – Page 100
relation to high risk relationships, for the verification of the identity of a beneficiary to take place at the time that a distribution of trust assets or property occurs to, or on behalf of, that beneficiary. Where the beneficiaries of a trust are designated by characteristics or by class, the firm must obtain sufficient information concerning the beneficiaries to satisfy itself that it will be able to identify, and verify the identity of, a beneficiary at the time of a distribution or when the beneficiary gains vested rights, for example, a beneficiary who is unaware of their beneficiary status until a point in time or a minor who reaches the age of majority. The firm must take reasonable measures to verify the identity of those beneficial owners exercising control over the affairs of the trust, i.e. any settlor(s), trustee(s), protector(s) and enforcer(s), including the beneficial owners of such entities where they are legal persons or legal arrangements, before or during the course of establishing a business relationship or before carrying out an occasional transaction. Verification of the beneficial owners of a trust must be undertaken either by the firm itself or, provided that the Commission Rules in Chapter 10 of this Handbook are met, by requesting the trustee to provide the relevant information on the identity of such parties by way of a certificate or summary sheet. For the purposes of Paragraph 4(3) of Schedule 3 and Commission Rule 7.113., in taking measures to identify and reasonable measures to verify the identity of a beneficial owner of a corporate trustee, consideration should be given to the ML and FT risk associated with the ownership of the corporate trustee, whether it is appropriately regulated and the influence and/or control a particular beneficial owner of the corporate trustee has over the business and affairs of that corporate trustee in respect of the assets of the applicable trust. Where the trustee or its parent is subject to the same or equivalent provisions of the Handbook in the jurisdiction from which its business is conducted and where it is supervised for compliance with those provisions, it may be possible to rely on information in the public domain or provided by the trustee regarding the identity of its beneficial owners and its directors or other controlling persons by way of a summary sheet and/or structure chart, without the need to gather identification data on those individuals. Such an approach would be consistent with the following guidance from the FATF’s guidance paper on applying a risk-based approach for TCSPs detailed below:
“Where the trustee is a listed entity (or an entity forming part of a listed group) or an entity established and regulated to carry on trust business in a jurisdiction identified by credible sources as having appropriate AML/CFT laws, regulations and other measures, the TCSP should obtain information to enable it to satisfy itself as to the identity of the directors or other controlling persons. A TCSP can rely on external evidence, such as information in the public domain, to satisfy itself as to the beneficial owner of the regulated trustee (e.g. the web-site of the body which regulates the trustee and of the regulated trustee itself).” In making this determination, the firm should take note of reports and assessments by the FATF and/or FATF-style regional bodies, in particular of findings, recommendations and ratings of compliance with FATF Recommendation 28 or precursor recommendation which assesses the adequacy of supervision of trustees and document the conclusions of its assessment. The FATF's consolidated list of Mutual Evaluation Report ratings can be found below. https://www.fatf-gafi.org/media/fatf/documents/4th-Round-Ratings.pdf Where neither the trustee nor its parent is based in a jurisdiction with equivalent provisions of the Handbook in the jurisdiction from which its business is conducted and where it is supervised

Chapter 7 – Page 101
for compliance with those provisions, reasonable measures to verify the identity of the beneficial owners of the corporate trustee will be required. This will involve the collection of identification data on those beneficial owners, together with evidence of their ownership, for example, via copies of the share register of the corporate trustee or regulatory returns.
7.11. CDD Measures for Particular Categories of Legal Person and Legal Arrangement
This Section provides additional guidance to assist the firm in interpreting the preceding requirements of this Chapter when dealing with the following particular types of legal person or legal arrangement as a customer or other key principal:

Charities and Non-Profit Organisations;
Governments, Supranational Organisations and State-Owned Enterprises; and
Sovereign Wealth Funds.
7.11.1. Charities and Non-Profit Organisations
Charities and NPOs play a vital role in the world economy, as well as many national economies and social systems. Their efforts complement the activity of the governmental and business sectors in providing essential services, comfort and hope to those in need around the world. It is recognised, however, that charities and NPOs are vulnerable to exploitation by criminals, terrorists and terrorist organisations. In this respect, a charitable or benevolent purpose can be used to disguise underlying terrorist or criminal involvement, both in the raising of capital and in the subsequent distribution of funds, as well as through the provision of logistical and other support to terrorist or criminal organisations and operations. This is of particular concern where the charity or NPO has connections with higher risk countries or territories. Not all charities and NPOs are subject to scrutiny through legislation or registration requirements. Consequently, a criminal or terrorist organisation can exploit the inherent vulnerabilities in the regimes in some jurisdictions. Additionally, some charities and NPOs are predominantly cash orientated and present a mechanism to disguise and confuse the detection of the original source(s) of funds. When carrying out a relationship risk assessment, the following are examples of risk factors specific to charities and NPOs which could be considered by the firm, both singly and cumulatively, in addition to those factors set out in Chapter 3 of this Handbook:
(a) the jurisdiction(s) within which funds are raised by the charity or NPO; (b) the jurisdiction(s) within which funds are spent or distributed by the charity or NPO; (c) the methods of fund raising utilised by the charity or NPO; (d) the purpose for which the charity or NPO has been established; and (e) the nature of the projects (or equivalent) for which the charity or NPO provides funding. In considering the risk factors set out above, the firm may deem it appropriate to make a distinction between those charities or NPOs with a limited geographical remit and those with unlimited geographical scope, for example, medical and emergency relief charities. Where a charity or NPO has a defined area of benefit, it is only able to expend its funds within that defined area and can quite properly be transferring funds to that country or territory. It would otherwise be less clear why the charity or NPO should be transferring funds to a third country and this would therefore be unusual. Where the customer is a trust, foundation or other legal arrangement, there may be a situation where a charity or NPO is identified as a “long-stop” beneficiary, for example, under a calamity/disaster clause (or equivalent). In such cases the firm would not be expected to consider

Chapter 7 – Page 102
the factors identified above when carrying out a relationship risk assessment, except where all other intended beneficiary arrangements have failed, or if the firm considers it appropriate in the circumstances. With regard to the beneficial ownership of charities and NPOs, for the vast majority there will likely be no natural person who would be deemed to have control through ownership or other means in accordance with the definition of beneficial owner in Schedule 3. At most there may be a class of persons who stand to benefit from the charity’s objectives and these will likely be self-evident from an understanding of the charity or NPO’s nature and purpose. However, these persons are unlikely to have ultimate effective control over the affairs of the charity or NPO’s. Noting the above, where the charity or NPO is a legal person, the senior managing official for the purposes of establishing beneficial ownership will often be a senior member of the governing body or committee of the charity or NPO, or may extend to an executive where the governing body does not have day-to-day control over the charity’s or NPO’s affairs. Many jurisdictions require the registration of at least a portion of charities or NPOs for the purpose of ensuring the transparency of that jurisdiction’s NPO sector. Whilst on its own not sufficient as verification of the identity of a charity or NPO, registration may allow the firm to gather further information on a charity or NPO, including details on its nature and purpose, and may act to support any verification undertaken. Within the Bailiwick the Guernsey Registry maintains lists of both registered charities and NPOs, excluding Sark (see Appendix B).
7.11.2. Governments, Supranational Organisations and State-Owned Enterprises
Where the customer in a business relationship or occasional transaction, or the beneficial owner of the customer, is an overseas government or government department, a local authority, an agency established by the law of a foreign country or territory, a supranational organisation, or body owned (or majority owned) by any of the former, the firm should consider the measures set out within this Section. Where the customer, or a beneficial owner or other key principal of the customer, is a Bailiwick public authority, the firm should refer to Section 9.4. of this Handbook. Bodies engaged in public administration are different from state-owned bodies which conduct business. The nature and risk of the business relationship or occasional transaction will therefore differ. Public administration involves a different revenue/payment stream from that of most business and may be funded from government sources or other forms of public revenue. On the other hand, state-owned businesses may engage in a wide range of activities, some of which could involve higher risk factors. Such entities may be partly publicly funded and may derive some or all of their revenues from trading activities. In assessing the risk of a business relationship or occasional transaction with, or involving, a government entity, the firm should pay particular attention to the risks associated with the country or territory from which the government entity originates, together with the risks associated with the source of the government entity’s funds and wealth. When seeking to understand the ownership and control structure of the government entity in accordance with Paragraph 4(3)(c) of Schedule 3, the firm should consider the entity’s relationship with its home state authority. In the majority of cases, it is unlikely that there will be an identifiable natural person with control of the entity through ownership or other means. In such cases, the firm should look to identify the natural person who holds the position of a senior managing official of the government entity in accordance with Step 3 of Paragraph 7.37. above.

Chapter 7 – Page 103
Given the nature of government and supranational entities, it is likely that the directors (or equivalent) will include individuals falling within the definition of a PEP. The firm should therefore be alive to the increased likelihood of the existence of such persons within a business relationship or occasional transaction. Where the firm identifies that a foreign PEP or an international organisation PEP is acting on behalf of a government entity, but where the PEP does not fall within the definition of beneficial owner and where no property of that PEP is handled in the particular business relationship or occasional transaction, the firm should consider this factor as part of its risk assessment of the relationship, including consideration of the nature of the PEP’s role and reason why the PEP holds such a role. Where the firm has determined that, but for the function held by the natural person, the business relationship or occasional transaction would be other than high risk, it is not required to apply ECDD measures. One such example could be a government or state-level pension scheme investing in a Bailiwick CIS where members of the pension committee/board of trustees (or equivalent) are PEPs through their senior government positions but where they do not meet the definition of the senior managing official of the scheme. Those persons have no economic interest in the funds involved in the business relationship or occasional transaction (beyond any pension rights) and the risk of the relationship being used as a vehicle for the laundering of any personal funds is minimal.
7.11.3. Sovereign Wealth Funds
A Sovereign Wealth Fund (“SWF”) is a state-owned investment fund used to invest in real and financial assets with the purpose of benefiting a country’s economy. An SWF consists of a pool or pools of money derived from various sources including central bank reserves, commodity exports and foreign-exchange reserves. There is a general concern that SWFs are capable of being used to meet political rather than purely financial objectives, by acquiring controlling interests in strategically important industries or destabilising economies. For this reason, understanding the nature and purpose of an SWF and the business relationship or occasional transaction is key. Many SWFs are members of the International Forum of Sovereign Wealth Funds (“IFSWF”). Established in 2009 by a group of 23 state-owned international investors, the IFSWF is a global network of SWFs. The purpose of the IFSWF is to exchange views on issues of common interest with the aim of facilitating an understanding of the activities of SWFs and of the Santiago Principles which provide a clearer understanding of SWFs by promoting transparency, good governance, accountability and prudent investment practices. Whilst membership alone is not sufficient as verification of an SWF, further information on the IFSWF members, including details on their ownership, nature, objects and purpose can be found on the IFSWF website and may act to support any verification undertaken. When seeking to identify the beneficial owner of an SWF which is a legal person, it is unlikely that there will be an identifiable natural person with control of the SWF through ownership or by other means. In such cases the firm should look to identify the natural person who holds the position of senior managing official of the SWF in accordance with Step 3 of Paragraph 7.37. above.
7.12. CDD Measures for Particular Products and Services
In addition to the CDD measures detailed previously for legal persons and legal arrangements with which the firm deals as part of its business relationships and occasional transactions, there

Chapter 7 – Page 104
may be instances where the firm offers particular products or services which have unique risks associated with them. This section provides Commission Rules and guidance in respect of the CDD measures to be applied by the firm where it provides the following products or services:

Life and Other Investment Linked Insurance;
Employee Benefit Schemes, Share Option Plans or Pension Schemes; or
Custody or Management to Non-Guernsey Collective Investment Schemes.
7.12.1. Life and Other Investment Linked Insurance
Where the product or service provided by the firm is the issuing of a life or other investment linked insurance policy, the firm must, in addition to identifying and verifying the customer and taking reasonable measures to verify the identity of the beneficial owner, also undertake the following measures in relation to any beneficiary as soon as they are identified or designated:
(a) for a beneficiary that is identified as a specifically named natural or legal person or legal arrangement, take the name of the natural or legal person or legal arrangement; and (b) for a beneficiary that is designated by characteristics or by class (for example, a spouse or child) or by other means (for example, under a will), obtain sufficient information concerning the beneficiary for the firm to satisfy itself that it will be able to establish the identity of the beneficiary at the time of distribution. In addition to considering whether the beneficial owner of a life or other investment linked insurance policy is a PEP in accordance with Paragraph 4(3)(f) of Schedule 3, the firm must also make a determination as to whether any beneficiary of such a policy (or the beneficial owner of a beneficiary where that beneficiary is a legal person or legal arrangement) is a PEP at the time that the beneficiary is identified or designated. Where the firm determines that the beneficial owner, any beneficiary, or the beneficial owner of any beneficiary of a life or other investment linked insurance product is a PEP, the firm must act in accordance with the requirements of Paragraph 5 of Schedule 3 and Section 8.5. of this Handbook. Verification of the identity of any beneficiary identified in accordance with Commission Rule
7.144. must occur prior to any distribution to (or on behalf of) that beneficiary.
When carrying out a relationship risk assessment as required by Paragraph 3 of Schedule 3 and
Chapter 3 of this Handbook, the firm must include any beneficiary identified by Commission
Rule 7.144. above as a relevant risk factor in considering the overall risk of the business relationship or occasional transaction. Where the firm has determined that a beneficiary which is a legal person or legal arrangement poses a high risk, the firm must carry out ECDD measures in accordance with Chapter 8 of this Handbook. This must include identifying and taking reasonable measures to verify the identity of the beneficial owner of the beneficiary prior to any distribution to (or on behalf of) the beneficiary.
7.12.2. Employee Benefit Schemes, Share Option Plans and Pension Schemes
Where the product or service provided by the firm is:
(a) an employee benefit scheme or arrangement;

Chapter 7 – Page 105
(b) an employee share option plan;
(c) a pension scheme or arrangement;
(d) a superannuation scheme; or
(e) a similar scheme or arrangement; and where contributions are made by an employer or by way of deductions from wages and the scheme rules do not permit assignment of a member’s interest under the scheme, then the sponsoring employer, the trustee, the foundation council and any other person who has control over the business relationship or occasional transaction (for example, the administrator or the scheme manager) are to be considered as key principals and must be identified and verified by the firm in accordance with the requirements of Schedule 3 and this Handbook. Where contributions to the scheme are made by the sponsoring employer, or by way of deductions from wages or otherwise through the payroll process, there is no requirement to apply CDD measures to the member throughout the life of the business relationship. However, the firm should be alive to the risk associated with the disbursement of pension funds, for example, the receipt of fraudulent requests for payment or the member being subject to UN, UK or other sanction. Where a member or other third party makes contributions to a scheme or arrangement (outside of the sponsoring employer’s payroll process) which would fall within the definition of an occasional transaction (for example, a voluntary contribution of more than £10,000 into the scheme) or a business relationship (for example, following the cessation of employment, making arrangements for smaller, regular ongoing contributions), the firm must apply CDD measures, including ECDD measures and/or enhanced measures as appropriate, to that member or third party. Where a member’s interest in a scheme or arrangement is distributed to a third party (for example, a named beneficiary upon the death of the member), the firm should establish the rationale for the distribution and consider the extent of the CDD measures to be applied to the third party in order for the firm to satisfy itself that the third party’s interest is legitimate and that the third party (for example, the beneficiary) does not pose a risk to the firm. When carrying out a relationship risk assessment in accordance with Paragraph 3 of Schedule 3 and Chapter 3 of this Handbook, the firm must include the natural or legal person(s) or legal arrangement(s) providing funds to the scheme or arrangement as a relevant risk factor when determining the overall risk of the business relationship or occasional transaction.
7.12.3. Non-Guernsey Collective Investment Schemes
Where the firm is providing management or custody services, within the scope of a licence issued to it by the Commission under the POI Law, to a CIS established outside the Bailiwick it may, in certain circumstances, place reliance on the administrator or transfer agent of the NGCIS to have applied CDD measures to the investors in that scheme. Where the firm provides management or custody services and wishes to rely on the CDD measures of the administrator of the NGCIS, the firm must:
(a) apply CDD measures to the administrator or transfer agent to ensure that it is an Appendix C business and regulated and supervised for investment business; and (b) require the administrator or transfer agent to provide a written confirmation which:

Chapter 7 – Page 106
(i) confirms that the administrator or transfer agent has appropriate risk-grading procedures in place to differentiate between the CDD measures for high risk relationships and low risk relationships; (ii) contains adequate assurance that the administrator or transfer agent applies the necessary CDD measures to the investors in the NGCIS (including the beneficial owners of such); and (iii) contains an assurance that the administrator or transfer agent will notify the firm where an investor in the NGCIS, or the beneficial owner of such, is categorised as a PEP. In addition, the firm must have a programme for reviewing the CDD procedures of the administrator or transfer agent and testing the application of those procedures in respect of the underlying investors within the NGCIS. Where the firm is acting as the administrator of an NGCIS and its functions include that of registrar/transfer agent or similar, the firm must apply CDD measures to the investors into the NGCIS as if they were its customers in accordance with the requirements of Section 4.8.2. of this Handbook. Where the firm is entering into a business relationship or conducting an occasional transaction with an NGCIS which is its customer (for example, an accountant providing services to the NGCIS) the firm should treat the NGCIS as a legal person or legal arrangement and apply CDD measures in accordance with the relevant sections of this Chapter.

Chapter 8
Enhanced Customer Due Diligence
Contents of this Chapter
8.1. Objectives.................................................................................................................................108
8.2. Policies, Procedures and Controls ............................................................................................110
8.2.1. ECDD Measures (High Risk Relationships)...................................................................110
8.2.2. Enhanced Measures (Higher Risk Factors).....................................................................111
8.2.3. ECDD and Enhanced Measures (High Risk Relationships with Higher Risk Factors)..111
8.3. Source of Funds and Source of Wealth ....................................................................................112
8.4. Interplay Between SCDD and Enhanced Measures .................................................................114
ECDD Measures................................................................................................................................114
8.5. Politically Exposed Persons......................................................................................................114
8.5.1. Introduction.....................................................................................................................114
8.5.2. Identification of PEPs.....................................................................................................114
8.5.3. International Organisation PEPs.....................................................................................117
8.5.4. Immediate Family Members...........................................................................................117
8.5.5. Close Associates .............................................................................................................118
8.5.6. Former PEPs ...................................................................................................................118
8.5.6.1. Domestic PEPs, Family Members and Close Associates........................................119
8.5.6.2. International Organisation PEPs, Family Members and Close Associates.............120
8.5.6.3. Foreign PEPs, Family Members and Close Associates...........................................121
8.6. Correspondent Relationships....................................................................................................122
8.7. High Risk Countries and Territories.........................................................................................123
8.8. Bearer Shares and Bearer Warrants..........................................................................................123
Enhanced Measures..........................................................................................................................124
8.9. Non-Resident Customer............................................................................................................125
8.10. Customer Provided with Private Banking Services..................................................................126
8.11. Customer is a Personal Asset Holding Vehicle ........................................................................126
8.12. Customer with Nominee Shareholders.....................................................................................127

Chapter 8 – Page 108
8.1. Objectives

This Chapter relates to business relationships and occasional transactions which have been
assessed by the firm as:
(a) presenting a high risk of ML and/or FT taking into account the requirements of Paragraph 5(1) of Schedule 3; and/or (b) involving one or more of the higher risk factors set out in Paragraphs 5(2)(a)-(d) of
Schedule 3
and should be read in conjunction with Chapter 3 of this Handbook which provides Commission Rules and guidance on the assessment of risk and Chapters 4 to 7 of this Handbook which set out the CDD measures to be applied.
In accordance with Paragraph 5(1) of Schedule 3, where the firm is required to carry out CDD, it
shall also carry out ECDD in relation to high risk business relationships and occasional transactions, including, without limitation - (a) a business relationship or occasional transaction in which the customer or any beneficial owner is a foreign PEP (see Section 8.5. of this Handbook), (b) where the firm is an FSB, a business relationship which is - (i) a correspondent banking relationship, or (ii) similar to such a relationship in that it involves the provision of services, which themselves amount to financial services business or facilitate the carrying on of such business, by one FSB to another (see Section 8.6. of this Handbook), (c) a business relationship or occasional transaction - (i) where the customer or beneficial owner has a relevant connection with a country or territory that - (A) provides funding or support for terrorist activities, or does not apply (or insufficiently applies) the FATF Recommendations, or (B) is a country otherwise identified by the FATF as a country for which such measures are appropriate (see Section 8.7. of this Handbook), (ii) which the firm considers to be a high risk relationship, taking into account any notices, instructions or warnings issued from time to time by the Commission and having regard to the NRA, (d) a business relationship or an occasional transaction which has been assessed as a high risk relationship, and (e) a business relationship or an occasional transaction in which the customer, the beneficial owner of the customer, or any other legal person in the ownership or control structure of the customer, is a legal person that has bearer shares or bearer warrants (see Section 8.8. of this Handbook).
In accordance with Paragraph 5(2) of Schedule 3, the firm shall also carry out enhanced measures
in relation to business relationships and occasional transactions, whether otherwise high risk or not, which involve or are in relation to - (a) a customer who is not resident in the Bailiwick (see Section 8.9. of this Handbook); (b) the provision of private banking services (see Section 8.10. of this Handbook);

Chapter 8 – Page 109
(c) a customer which is a legal person or legal arrangement used for personal asset holding purposes (see Section 8.11. of this Handbook); or (d) a customer which is – (i) a legal person with nominee shareholders, or (ii) owned by a legal person with nominee shareholders (see Section 8.12. of this Handbook).
4. Paragraphs 5(1) and 5(2) of Schedule 3 are distinct from one another. Paragraph 5(1) requires
that ECDD measures are applied to all high risk relationships. The requirement to apply enhanced measures to mitigate particular higher risk factors as set out in Paragraph 5(2) of
Schedule 3 can apply to business relationships and occasional transactions across the risk
spectrum from low to high risk.
5. The presence of one or more of the higher risk factors set out in Paragraph 5(2) of Schedule 3
may not necessarily equate to the overall risk of the business relationship or occasional transaction being high. However, in accordance with Commission Rule 3.19., the firm must have regard to the cumulative effect that one or more of these factors could have on the overall risk of the business relationship or occasional transaction when conducting a relationship risk assessment. Fig. 10 – Enhanced Measures Flowchart

Chapter 8 – Page 110
Nature of Business Relationship or
Occasional Transaction Measures to be Applied
Low risk relationship exhibiting one or more of the higher risk factors set out in Paragraph 5(2) of
Schedule 3.
SCDD or CDD measures, together with enhanced measures appropriate to the higher risk factor(s) present. Standard risk business relationship or occasional transaction exhibiting one or more of the higher risk factors set out in Paragraph 5(2) of Schedule 3. CDD measures, together with enhanced measures appropriate to the higher risk factor(s) present High risk relationship which meets one or more of the criteria in Paragraph 5(1) of Schedule 3. CDD measures, together with ECDD measures as set out in Section 8.2.1. of this Handbook High risk relationship which meets one or more of the criteria in Paragraph 5(1) of Schedule 3 and exhibits one or more of the higher risk factors set out in Paragraph 5(2) of Schedule 3. CDD measures and ECDD measures as set out in
Section 8.2.1. of this Handbook, together with
enhanced measures appropriate to the higher risk factor(s) present.
Fig. 11 – Application of Due Diligence and Enhanced Measures Depending on Risk
8.2. Policies, Procedures and Controls
8.2.1. ECDD Measures (High Risk Relationships)
6. The firm must ensure that its policies, procedures and controls require the application of ECDD
measures where the firm has determined, taking into account the circumstances set out in Paragraph 5(1) of Schedule 3 and the risk factors provided in Chapter 3 of this Handbook, that a business relationship or occasional transaction is high risk.
7. In accordance with Paragraph 5(3)(a) of Schedule 3, references to ECDD shall mean -
obtaining senior management approval for establishing a business relationship or undertaking an occasional transaction, obtaining senior management approval for, in the case of an existing business relationship with a foreign PEP, continuing that business relationship, taking reasonable measures to establish and understand the source of any funds and of the wealth of – (A) the customer, and (B) the beneficial owner, where the beneficial owner is a PEP, carrying out more frequent and more extensive ongoing monitoring, including increasing the number and timing of controls applied and selecting patterns of activity or transactions that need further examination in accordance with Paragraph 11 of Schedule 3 (see Chapter 11 of this Handbook), and taking one or more of the following steps as would be appropriate to the particular business relationship or occasional transaction, (A) obtaining additional information about the customer, such as the type, volume and value of the customer’s assets and additional information about the customer’s beneficial owners, (B) verifying additional aspects of the customer’s identity, (C) obtaining additional information to understand the purpose and intended nature of each business relationship and occasional transaction, and (D) taking reasonable measures to establish and understand the source of wealth of beneficial owners not falling within Paragraph 5(3)(iii).

Chapter 8 – Page 111
8. Examples of steps the firm could take in accordance with Paragraphs 5(3)(v)(A)-(D) of Schedule
3 could include:
(a) supplementing the firm’s understanding of the purpose and intended nature of the business relationship by obtaining information on the reasons for intended or performed transactions; (b) commissioning independent research by a specialist firm or consultant pertaining to the purpose and objective of the business relationship or occasional transaction and evidencing information in relation to the customer and/or the beneficial owner; (c) where the customer is a legal person, identifying, and verifying the identity of, other directors (or equivalent) of the customer in addition to those senior managing officials identified as beneficial owners in accordance with Step 3 of Paragraph 7.37. of this Handbook and/or those natural persons acting on behalf of the customer captured by
Section 4.3.2.; and/or
(d) obtaining internal information from group representatives or offices based in a jurisdiction where the customer has a connection.
9. In addition to the requirements of Paragraph 5(3) of Schedule 3 as set out above, listed below are
examples of further steps the firm could take as part of its ECDD measures to address specific risks arising from a high risk relationship:
(a) in the case of an existing business relationship which has, following a relationship risk assessment, been assessed as high risk not involving a foreign PEP, obtaining senior management approval for continuing that relationship; and/or (b) requiring the first payment be carried out through an account in the customer’s name with an Appendix C business.
8.2.2. Enhanced Measures (Higher Risk Factors)
10. In accordance with Paragraph 5(2) of Schedule 3, the firm’s policies, procedures and controls must
require the application of enhanced measures as detailed in Sections 8.9. - 8.12. of this Handbook to business relationships and occasional transactions involving or in relation to one or more of the higher risk factors in Paragraph 5(2)(a)-(d) of Schedule 3.
11. There may be a business relationship or occasional transaction which involves or is in relation to
more than one of the higherrisk factors set out in Paragraph 5(2)(a)-(d) of Schedule 3 (for example, a non-resident customer using private banking services). In such cases, the firm must apply enhanced measures sufficient to mitigate each of the higher risk factors present within the business relationship or occasional transaction.
8.2.3. ECDD and Enhanced Measures (High Risk Relationships with Higher Risk Factors)
12. There may also be circumstances in which a high risk relationship involves or is in relation to one
or more of the higher risk factors in Paragraph 5(2)(a)-(d) of Schedule 3. In such cases the firm must apply ECDD measures as well as applying sufficient enhanced measures to mitigate the particular higher risk factor(s) present.
13. In accordance with Commission Rule 8.12. above, the enhanced measures applied by the firm
should be specific to the particular higher risk factor(s) present in a business relationship or occasional transaction. However, there may be situations where an enhanced measure taken by the firm addresses more than one higher risk factor, or where the ECDD measures applied by the firm to a high risk relationship also mitigate one or more higher risk factor(s).

Chapter 8 – Page 112
14. For example, it may be that the firm is providing private banking services to a customer who is a
foreign PEP and the firm is satisfied that the ECDD measures applied to address the fact that the customer is a PEP equally mitigate the higher risk associated with the provision of private banking services (for example, by taking reasonable measures to establish the source of funds and the source of the customer’s wealth).
15. The policies, procedures and controls of the firm should allow for it to determine, based upon the
specific higher risk factors present in a business relationship or occasional transaction and its assessment of the overall risk of that relationship, which and how many enhanced measures it would be appropriate to apply to mitigate the specific risks identified.
8.3. Source of Funds and Source of Wealth
16. In accordance with Paragraph 5(3)(a)(iii) of Schedule 3, as part of its ECDD measures the firm
shall take reasonable measures to establish and understand the source of any funds and of the wealth of – (A) the customer, and (B) the beneficial owner, where the beneficial owner is a PEP.
17. The taking of reasonable measures to establish and understand a customer’s source of wealth
(and that of any beneficial owner who is a PEP), together with measures to establish and understand the source of any funds used in a business relationship or occasional transaction, are important aspects of the due diligence process. These steps serve to assist the firm in satisfying itself that such wealth and funds are not the proceeds of criminal activity and are consistent with the firm’s knowledge of the customer and beneficial owner, and the nature of the business relationship or occasional transaction.
18. In addition to taking reasonable measures to establish the source of any funds and of the wealth
of the customer/beneficial owner for high risk relationships as part of ECDD measures, the firm may also determine that it would be appropriate to apply the measures in Paragraph 5(3)(a)(iii) of Schedule 3 as an enhanced measure to apply to a business relationship or occasional transaction involving or in relation to one or more of the higher risk factors in Paragraph 5(2) of
Schedule 3 but where the overall risk of the business relationship or occasional transaction is
other than high.
19. The source of funds refers to the activity which generated the particular funds for a business
relationship or occasional transaction. Source of wealth is distinct from source of funds and describes the activities which have generated the total net worth of the customer or beneficial owner both within and outside a business relationship, i.e. those activities which have generated a customer’s or beneficial owner’s net assets and property.
20. The firm must, in taking reasonable measures to establish the source of any funds and wealth,
document and evidence consideration of the risk implications of the source of the funds and wealth and the geographical sphere of the activities in which they have been generated.
21. In determining what constitutes ‘reasonable measures’ to establish the source of funds and
wealth, i.e. show them to be true, the firm should have regard to the particular risk factors present in a business relationship or occasional transaction, together with its overall assessed risk. Such risk factors include, inter alia, the value of the customer’s or beneficial owner’s assets, together with the value of the funds involved in the business relationship or occasional transaction, the type and complexity of the customer or beneficial owner, the customer’s or beneficial owner’s economic activity and employment, and the nature of the services provided by the firm.

Chapter 8 – Page 113
22. Information on the source of funds and wealth will generally be obtained from the customer or
beneficial owner in the first instance and the extent to which this is corroborated through additional information or documentation should be commensurate with the risk. The firm may have a business relationship where it can establish to its satisfaction the source of funds and source of wealth from the customer or beneficial owner without seeking to corroborate that information because it is consistent with the knowledge the firm holds about the business relationship or occasional transaction and because the values involved are relatively low and commensurate with the type of product or service being provided by the firm.
23. For example, the firm may have a natural person customer located in a higher risk jurisdiction
utilising its products or services for a relatively small amount of funds and where the firm has determined that the only factor making it a high risk relationship is geographic risk. In such a case placing reliance upon the information provided by the customer on the source of funds and wealth as part of the firm’s ECDD measures could be considered ‘reasonable’ because it is consistent with the information and knowledge it has built up about the customer through CDD measures, together with the other elements of its ECDD measures and the enhanced measures applied because the customer is not resident in the Bailiwick.
24. On the other hand, ‘reasonable measures’ will require corroborating information where the
customer or beneficial owner is from a higher risk country or territory, where the values involved in the business relationship or occasional transaction are large and where the sources of funds and wealth are not easily discernible from the customer’s or beneficial owner’s disclosed income and business interests.
25. The extent to which the firm corroborates the information provided by the customer or beneficial
owner on the source of funds and wealth is a function of risk and not a ‘one size fits all’ approach. Where corroboration of the information provided by the customer or beneficial owner is required, the firm could consider one or more of the means set out in the following non-exhaustive list:
(a) commissioning an independent and reliable report from a specialist agency; (b) obtaining certified copies of corroborating documentation such as contracts of sale, property deeds, salary slips, etc.; (c) where the firm is part of a group, obtaining reliable information from another member of the group with which the customer or beneficial owner has a connection; (d) obtaining information from a reliable third party (for example, a professionally qualified solicitor, accountant or tax advisor) who has an office in a country or territory connected with the customer or beneficial owner; (e) where the customer has been introduced to the firm, obtaining information from the introducer; (f) where information is publicly available or available through subscription databases, obtaining information from a reliable public or private third party source; or (g) obtaining information from financial statements that have been prepared and audited in accordance with generally accepted accounting principles.
26. It would not be considered sufficient for the firm to accept a customer’s or beneficial owner’s
responses on an application form at face value, particularly where vague answers are given (for example, ‘employment’ or ‘salary’) without further clarification. As noted previously, the firm should seek to corroborate the source of funds and source of wealth, particularly where the value of funds, or the risk of the business relationship or occasional transaction, is high, for example, by taking steps to understand where the customer or beneficial owner was employed and his or her actual level of income.
27. Similarly, establishing the source of funds involved in a business relationship or occasional
transaction should not be limited to knowing from which financial institution the funds may have

Chapter 8 – Page 114
been transferred. The steps taken by the firm should be substantive and seek to establish the provenance of the funds or the reason for the funds having been acquired.
28. The obligation to take reasonable measures to establish the source of funds extends beyond those
funds present at the commencement of a business relationship. In this respect, the firm’s monitoring arrangements should include assessing, on an ongoing basis, whether the transactional activity of a business relationship is consistent with the risk profile of that relationship, the nature of the product provided and the firm’s understanding of the customer’s and beneficial owner’s source of wealth.
8.4. Interplay Between SCDD and Enhanced Measures
29. It may be possible to apply SCDD measures as specified in Chapter 9 of this Handbook to a
business relationship or occasional transaction involving or in relation to one or more of the higher risk factors set out in Paragraph 5(2) of Schedule 3, provided that enhanced measures are applied to address the particular higher risk factors present.
30. By way of example, it may be possible, where the firm has assessed the ML and FT risk of a
business relationship or occasional transaction to be low, to apply the SCDD measures set out in Section 9.3. of this Handbook to a natural person resident in the Bailiwick using a personal asset holding vehicle, provided the firm also applies an enhanced measure to satisfy itself that the use of such a personal asset holding vehicle is genuine and legitimate.
31. Similarly it may be possible, where the firm has assessed the ML and FT risk as low, to apply the
SCDD measures set out in Section 9.6. of this Handbook to a non-resident Appendix C business, provided that an enhanced measure is also applied to mitigate the risk associated with a nonresident customer, for example, to determine and understand why the Appendix C business is obtaining the services in the Bailiwick and not in its home jurisdiction. ECDD Measures
8.5. Politically Exposed Persons
8.5.1. Introduction
32. Due to their position and influence, PEPs may have the potential to abuse their positions for the
purpose of committing ML and related predicate offences, including bribery and corruption, as well as conducting activity related to FT. Where a PEP also has connections to countries or business sectors where corruption is widespread, the risk is further increased.
33. PEP status itself does not incriminate individuals or their associates and connected entities.
However, it will mean that a customer or beneficial owner who is a foreign PEP is subject to ECDD measures and that a domestic PEP or international organisation PEP may, on the basis of risk, be subject to ECDD measures.
34. There is no ‘one-size fits all’ approach to applying ECDD measures for PEPs. The nature of the
measures applied will be commensurate with the type of PEP, the specific risks that are identified and the nature of the PEP’s position and ability to influence.
8.5.2. Identification of PEPs
35. In accordance with Paragraph 4(3)(f) of Schedule 3, as part of its CDD measures the firm shall
make a determination as to whether the customer or beneficial owner is a PEP, and if so, whether he or she is a foreign PEP, a domestic PEP or an international organisation PEP.

Chapter 8 – Page 115
36. As referenced above, Paragraph 5(4) of Schedule 3 defines three categories of PEP, referred to
as follows for the purpose of this Handbook:
(a) “foreign PEP” – a natural person who has, or has had at any time, a prominent public function, or who has been elected or appointed to such a function, in a country or territory other than the Bailiwick; (b) “domestic PEP” – a natural person who has, or has had at any time, a prominent public function, or who has been elected or appointed to such a function, within the Bailiwick; and (c) “international organisation PEP” – a natural person who is, or has been at any time, entrusted with a prominent function by an international organisation.
37. In accordance with the definition of PEP contained within Paragraph 5(4) of Schedule 3,
prominent public function includes, without limitation - (i) heads of state or heads of government; (ii) senior politicians and other important officials of political parties; (iii) senior government officials; (iv) senior members of the judiciary; (v) senior military officers; and (vi) senior executives of state owned body corporates.
38. When seeking to establish whether a natural person falls within the definition of a PEP,
‘prominent’ should be interpreted as relating only to those persons in positions of seniority in the areas covered by Paragraph 8.37. above. Middle ranking or more junior individuals in the foregoing categories are explicitly excluded from the definition.
39. Notwithstanding the above, the term ‘prominent’ is not defined either in Schedule 3 or this
Handbook as the precise level of seniority which triggers the requirement to treat an individual as a PEP will depend upon a range of factors, including the role held by the individual, the particular organisational framework of the government or international organisation concerned, and the powers, responsibilities and influence associated with particular public functions.
40. In accordance with Paragraph 5(5A) of Schedule 3, a person is not a PEP for the purposes of
Schedule 3 if that person –
(a) was not a PEP within the meaning of Regulation 5(2)(b) of the FSB Regulations or Regulation 5(2)(b) of the PB Regulations, when those regulations were in force, and (b) ceased to be entrusted with a prominent public function in respect of the Bailiwick before 31 March 2019.
41. To assist in the identification of natural persons falling within the definition of domestic PEP,
Appendix E to this Handbook lists those positions in Guernsey, Alderney and Sark deemed to
fall within the categories listed in Paragraph 8.37. above. Where an individual ceased to hold a prominent public function listed in Appendix E prior to 31 March 2019, in accordance with Paragraph 5(5A) of Schedule 3 there is no requirement for the individual to be identified as a PEP, or to consider as part of its relationship risk assessment the implication of the person having held a prominent public function in the Bailiwick.
42. Authorities in other jurisdictions may publish lists, similar to Appendix E to this Handbook, of
those natural persons considered to fall within the definition of a PEP within their jurisdiction. These could be helpful for the firm in determining whether to treat an individual as a PEP. However, the firm should be mindful that these classifications will be based upon perceptions of

Chapter 8 – Page 116
risk applicable within other jurisdictions and that these may not necessarily be appropriate perceptions from the perspective of the firm.
43. In determining whether a customer or beneficial owner is a PEP, the firm could consider:
(a) using sources such as the UN, the EU, the UK Foreign and Commonwealth Office and the Group of States Against Corruption to establish, as far as is reasonably possible, whether or not a customer or beneficial owner, is a natural person who is the current or former holder of a prominent public function in a foreign country or territory, or for an international organisation; (b) using sources such as the States of Guernsey, States of Alderney and Chief Pleas of Sark to establish, as far as is reasonably possible, whether or not a customer or beneficial owner is a natural person who is the current or former holder of a prominent public function within the Bailiwick; (c) seeking confirmation from a customer or beneficial owner, for example through a question within an application form, as to whether they hold, or have held, a prominent public function either within the Bailiwick or beyond, or for an international organisation; or (d) using commercially available databases to identify such persons.
44. In accordance with Paragraph 5(1)(a) of Schedule 3, where the firm determines that an individual
who is the customer or beneficial owner to a business relationship or occasional transaction is a foreign PEP, it shall carry out ECDD in relation to that business relationship or occasional transaction.
45. Where the firm identifies that a customer or beneficial owner is a domestic PEP or international
organisation PEP, it must gather sufficient information to understand the particular characteristics of the public function that the natural person has been entrusted with and factor this information into the relationship risk assessment conducted in accordance with Paragraph 3 of Schedule 3 and
Chapter 3 of this Handbook.
46. Where, having conducted a relationship risk assessment, the firm concludes that the business
relationship or occasional transaction involving a domestic PEP or international organisation PEP is high risk, the firm must apply ECDD measures in accordance with Paragraph 5(3)(a) of
Schedule 3 and Section 8.2.1. of this Handbook.
47. Where the firm concludes that the business relationship or occasional transaction with the
domestic PEP or international organisation PEP does not present a high level of risk, it is not necessary to apply ECDD measures, provided that the firm has applied SCDD or CDD measures and any enhanced measures necessary in accordance with Paragraph 5(2) of Schedule 3.
48. Where the firm identifies that a foreign PEP is a director (or equivalent) of a customer, or a
person acting or purporting to act for a customer, but where the PEP does not fall within the definition of beneficial owner and where no funds or assets of that PEP are handled in the particular business relationship or occasional transaction, the firm should include as part of its relationship risk assessment consideration of the nature of the PEP’s role and the reason why the PEP holds such a role.
49. Where the firm has determined as part of its relationship risk assessment that, but for the function
held by the PEP in the circumstances in Paragraph 8.48. above, the business relationship or occasional transaction would be other than high risk, it could decide to apply, based on risk, CDD measures appropriate to the form of the customer in accordance with Chapters 4 to 9 of this Handbook, including enhanced measures as applicable.

Chapter 8 – Page 117
50. One such example would be a foreign public sector pension scheme investing into a CIS. In such
a case there may be members of the pension committee who are PEPs, holding their position on the committee by virtue of their political position and with no ability to exercise ultimate effective control over the pension scheme. Such persons have no economic interest in the funds involved in the business relationship or occasional transaction (beyond potentially any pension rights as a resident of that country or organisation) and the risk of the relationship being used as a vehicle for the laundering of any funds or assets personally held by the PEP or the financing of terrorism is low.
8.5.3. International Organisation PEPs
51. In accordance with Paragraph 5(4)(b) of Schedule 3, the definition of a PEP includes a natural
person who is, or has been, entrusted with a prominent public function by an international organisation. This includes members of senior management or individuals who have been entrusted with equivalent functions, for example, directors, councillors and members of the board or equivalent of an international organisation.
52. Paragraph 21 of Schedule 3 defines an international organisation as an entity:
(a) which was established by a formal political agreement between its member states that has the status of an international treaty; (b) the existence of which is recognised by law in its member states; and (c) which is not treated as a resident institutional unit of the country in which it is located.
53. Examples of international organisations covered by Schedule 3 and this Handbook include the
UN, the World Bank and the North Atlantic Treaty Organization (“NATO”).
54. There may be other examples of international organisations, for example, international sporting
federations, which do not fall within the Schedule 3 definition, but where the firm considers that ECDD measures should be applied to a business relationship or occasional transaction. There are no prescribed requirements in this regard and any decision taken should be based on the firm’s assessment of risk.
8.5.4. Immediate Family Members
55. In addition to the specific risks posed by PEPs, the firm should be alive to the potential for the
abuse of a business relationship or occasional transaction with or by a family member of a PEP. This abuse could be for the purpose of moving the proceeds of crime or facilitating the placement and concealment of such proceeds without specific connection to the PEP themselves.
56. In accordance with Paragraph 5(4)(c) of Schedule 3, an immediate family member of a PEP shall
include, without limitation:
(a) a spouse;
(b) a partner, being a person who is considered by the law of the country or territory in which the relevant public function is held as being equivalent to a spouse; (c) a parent; (d) a child; (e) a sibling; (f) a parent-in-law; and (g) a grandchild.
57. The list of immediate family members included within Paragraph 5(4)(c) of Schedule 3 as set out
above is without limitation and the firm should take a proportionate, risk-based approach to the treatment of wider family members. This determination will depend on the social, economic and

Chapter 8 – Page 118
cultural structure of the country of the PEP. It should also be noted that the number of persons who qualify as immediate family members is fluid and may change over time.
58. In deciding whether a member of a wider family unit would be considered as an immediate family
member of a PEP, the firm should determine the extent of the influence that a particular PEP relationship or association has and assess the level of risk that exists through the particular connection with a PEP.
59. This determination will include such relevant factors as the influence that particular types of
family members generally have and how broad the circle of close family members and dependents tends to be. In some cultures the number of family members who are considered to be close or who have influence may be quite small, while in others the circle of family members may be broader and extend to cousins or even clans.
8.5.5. Close Associates
60. In accordance with Paragraph 5(4)(d) of Schedule 3, a close associate of a person referred to in
Paragraphs 5(4)(a) or (b) shall include, without limitation - a person who is widely known to maintain a close business relationship with such a person, or a person who is in a position to conduct substantial financial transactions on behalf such a person.
61. Those persons considered to be close associates could include known partners outside the family
unit who would not qualify as immediate family members (for example, girlfriends, boyfriends and extra-marital partners), prominent members of the same political party, civil organisation, labour or employee union as the PEP, and business partners or associates, especially those that share beneficial ownership of a legal person or legal arrangement with the PEP, or who are otherwise connected (for example, through joint membership of a company board where the PEP and/or close associate is a beneficial owner).
62. As with an immediate family member, the interpretation of whether an individual should be
considered to be a close associate will depend upon the social, economic and cultural context of the relationship.
63. Where the firm determines that a natural person who is the customer or beneficial owner to a
business relationship or occasional transaction is an immediate family member or close associate of a domestic PEP or international organisation PEP, the firm should treat that person in accordance with the requirements set out in Schedule 3 and this Handbook for the category of PEP to which they are connected. For example, the child of a domestic PEP should be treated in accordance with the provisions for domestic PEPs.
8.5.6. Former PEPs
64. On the basis of the potential for PEPs to abuse their prominent positions for the purpose of
committing various financial crimes, the default position on the treatment of PEPs in the FATF Recommendations is that once you are a foreign PEP, or a family member or close associate of such a person, the relationship should always be subject to ECDD measures.
65. Notwithstanding the above, there may be situations where a business relationship or occasional
transaction involves persons who have held prominent public positions historically but who would otherwise not be considered to be high risk.

Chapter 8 – Page 119
66. Accordingly, Paragraph 5 of Schedule 3 provides flexibility in respect of the timeframe within
which certain natural persons are to be classified as PEPs. Details of these timeframes are included within Sections 8.5.6.1. to 8.5.6.3. of this Handbook below and differ depending on the type of PEP and the position that the PEP holds. Category of PEP Role of PEP Time Period for Declassification Foreign PEP A head of state or head of government (or an immediate family member or close associate of such a person). Never A person with the power to direct the spending of significant sums (or an immediate family member or close associate of such a person). Never All other foreign PEPs (including immediate family members and close associates thereof). 7 years from cessation of role International Organisation PEP A head of an international organisation (or an immediate family member or close associate of such a person). Never A person with the power to direct the spending of significant sums (or an immediate family member or close associate of such a person). Never All other international organisation PEPs (including immediate family members and close associates thereof). 7 years from cessation of role Domestic PEP All domestic PEPs (including immediate family members and close associates thereof). 5 years from cessation of role Fig. 12 - Timescales for Declassification PEPs
67. Details on the requirements of Schedule 3, together with additional guidance, are provided within
the following sections setting out the steps to be taken by the firm when it is looking to establish a business relationship or undertake an occasional transaction within which the customer or beneficial owner is a former PEP.
68. In accordance with Paragraph 5(8) of Schedule 3 (and as reflected in Fig. 12 above), the measures
set out in Sections 8.5.6.1. - 8.5.6.3. below apply in respect of persons falling within Paragraphs 5(4)(c)-(d) of Schedule 3 (immediate family members and close associates) in respect of the person in question as they do in respect of that person.
8.5.6.1. Domestic PEPs, Family Members and Close Associates
69. In accordance with Paragraph 5(5) of Schedule 3, the firm may treat a domestic PEP as not being
a PEP five years after the person ceased to be entrusted with a public function (for the purposes of this Handbook, a “former domestic PEP”) if the senior management of the firm has documented that the firm is satisfied that – (a) it understands the source of the funds within the business relationship or occasional transaction, and (b) there is no reason to continue to treat the person as a PEP.
70. For any natural person falling within Paragraph 5(5) of Schedule 3, the firm can make a decision
to declassify that person as a domestic PEP following a period of five years, such period commencing on the date that they, or the associated domestic PEP in the case of an immediate family member or close associate, ceased to be entrusted with any prominent public function within the Bailiwick.
71. Where, during the course of a business relationship (or in the case of a prospective business
relationship or occasional transaction, prior to the firm being engaged), the customer or

Chapter 8 – Page 120
beneficial owner becomes a former domestic PEP, consideration of their previous function as
part of a relationship risk assessment in accordance with Commission Rule 8.45. is not required,
provided that the criteria in Paragraph 8.69. above are met.
72. Where the firm identifies, in accordance with Paragraph 4(3)(f) of Schedule 3, that the customer
to a prospective business relationship or occasional transaction, or any beneficial owner of such, has held a prominent public function within the Bailiwick within the past five years, the firm should consider this as a factor when undertaking its relationship risk assessment in accordance with Commission Rule 8.45. above.
8.5.6.2. International Organisation PEPs, Family Members and Close Associates
73. In accordance with Paragraph 5(6) of Schedule 3, subject to Paragraph 5(9), the firm may treat an
international organisation PEP as not being such a PEP seven years after the person ceased to be entrusted with a prominent function by an international organisation if the senior management of the firm has documented that the firm is satisfied that - (a) it understands the source of the funds within the business relationship or occasional transaction, and (b) there is no reason to continue to treat the person as a PEP.
74. In accordance with Paragraph 5(9) of Schedule 3, the provisions set out in Paragraph 8.73. above
do not apply in respect of -
(a) a head of an international organisation,
(b) a person with the power to direct the spending of significant sums, or (c) persons falling within Paragraphs 5(4)(c)-(d) of Schedule 3 (immediate family members and close associates) in respect of such persons.
75. In determining whether an international organisation PEP falls within Paragraph 8.74.(b) above,
the firm should consider whether:
(a) the international organisation PEP has/had authority over, or access to, significant assets and funds, policies and/or operations of the international organisation; (b) the international organisation PEP has/had access to, or control or influence over, the accounts of the international organisation; and (c) the international organisation PEP has/had control over the awarding of contracts or similar by the international organisation.
76. For any other natural person falling within Paragraph 5(4)(b) of Schedule 3, the firm can make a
decision to declassify that person as an international organisation PEP following a period of seven years, such period commencing on the date that they, or the associated international organisation PEP in the case of an immediate family member or close associate, ceased to be entrusted with any prominent public function (a “former international organisation PEP”).
77. Where, during the course of a business relationship (or in the case of a prospective business
relationship or occasional transaction, prior to the firm being engaged) the customer or beneficial owner becomes a former international organisation PEP, consideration of their previous function as part of a relationship risk assessment in accordance with Commission Rule
8.45. is not required, provided that the criteria in Paragraph 5(6) of Schedule 3 are met.
78. Where the firm identifies, in accordance with Paragraph 4(3)(f) of Schedule 3, that the customer
or beneficial owner to a prospective business relationship or occasional transaction has held a prominent public function with an international organisation within the past seven years, the

Chapter 8 – Page 121
firm should consider this as a factor when undertaking its relationship risk assessment in accordance with Commission Rule 8.45. above.
8.5.6.3. Foreign PEPs, Family Members and Close Associates
79. In accordance with Paragraph 5(7) of Schedule 3, subject to Paragraph 5(9), the firm may treat any
foreign PEP as not being a PEP seven years after the person ceased to be entrusted with a public function if the senior management of the firm has documented that the firm is satisfied that - (a) it has established and understands the source of the person’s wealth, and that of the funds within the business relationship or occasional transaction, and (b) there is no reason to continue to treat the person as a PEP.
80. In accordance with Paragraph 5(9) of Schedule 3, the provisions set out in Paragraph 8.79. above
do not apply in respect of -
(a) a head of state or head of government,
(b) a person with the power to direct the spending of significant sums, or (c) persons falling within Paragraphs 5(4)(c)-(d) of Schedule 3 (immediate family members and close associates) in respect of such persons.
81. In determining whether a foreign PEP falls within Paragraph 8.80.(b) above, the firm should
consider whether:
(a) the foreign PEP has/had access to, or authority, control or influence over, significant state assets and funds, policies and/or operations; (b) the foreign PEP has/had control over regulatory approvals, including awarding licences and concessions; (c) the foreign PEP has/had the formal or informal ability to control mechanisms established to prevent and detect ML and/or FT (for example, control over law enforcement or other public sector investigative agencies); and (d) the foreign PEP has/had access to, or authority, control or influence over, the assets of state owned enterprises.
82. For all other foreign PEPs falling within Paragraph 5(4)(a) of Schedule 3, the firm could decide
to declassify a natural person as a foreign PEP following a period of seven years, such period commencing on the date that they, or the associated foreign PEP in the case of an immediate family member or close associate, ceased to be entrusted with any prominent public function (a “former foreign PEP”).
83. Where, during the course of a business relationship (or in the case of a prospective business
relationship or occasional transaction, prior to the firm being engaged) the customer or beneficial owner becomes a former foreign PEP, the firm is not required to apply the measures set out in Paragraph 8.44. of this Handbook for that natural person provided that the criteria in Paragraph 5(7) of Schedule 3 are met.
84. Where the firm identifies, in accordance with Paragraph 4(3)(f) of Schedule 3, that the customer
or beneficial owner to a prospective business relationship or occasional transaction has held a prominent public function outside the Bailiwick within the past seven years, it should continue to treat that individual as a foreign PEP in accordance with the requirements of Paragraph 5 of
Schedule 3 and Section 8.5.2. of this Handbook.

Chapter 8 – Page 122
8.6. Correspondent Relationships
85. Correspondent banking is the provision of banking services by one bank to another bank (“the
respondent bank”). Used by banks throughout the world, correspondent accounts enable banks to conduct business and provide services that they do not offer directly. There are also similar relationships in other areas of financial services business.
86. In accordance with Paragraph 5(1)(b) of Schedule 3, the firm shall apply ECDD measures in
relation to a business relationship or occasional transaction which is a correspondent banking relationship, or similar to such a relationship in that it involves the provision of services, which themselves amount to financial services business or facilitate the carrying on of such business, by one financial services business to another.
87. Additionally, in accordance with Paragraph 8(2) of Schedule 3, the firm shall:
(a) not enter into, or continue, a correspondent banking relationship with a shell bank; and (b) take appropriate measures to ensure that it does not enter into, or continue, a correspondent banking relationship where the respondent bank is known to permit its accounts to be used by a shell bank.
88. In relation to correspondent banking relationships and similar correspondent relationships
established for securities transactions or funds transfers, whether for the firm as principal or for its customers, the firm must apply the measures set out in (a) to (e) below and, where relevant, those in Commission Rule 8.89. below:
(a) gather sufficient information about a respondent institution to understand fully the nature of the respondent institution’s business; (b) determine from publicly available information the reputation of the respondent institution and the quality of supervision, including whether it has been subject to an ML or FT investigation or regulatory action; (c) assess the respondent institution’s AML and CFT policies, procedures and controls and ascertain that they are adequate, appropriate and effective; (d) obtain board approval before establishing new correspondent relationships; and (e) clearly understand and document the respective AML and CFT responsibilities of each institution.
89. Where a correspondent relationship involves the maintenance of ‘payable-through accounts’, the
firm must also take steps in order to satisfy itself that:
(a) the customer (the respondent institution) has complied with all of the required CDD measures set out in Schedule 3 and this Handbook on those of its customers with direct access to the accounts of the correspondent institution; and (b) the respondent institution is able to provide relevant customer identification data upon request to the correspondent institution.
90. The firm must ensure that appropriate and effective policies, procedures and controls are in place
when establishing a correspondent relationship with a foreign bank or other financial services business.
91. Additionally, the firm must have appropriate and effective policies, procedures and controls in
place to ensure compliance with the requirements of Paragraph 8 of Schedule 3 in respect of shell banks.

Chapter 8 – Page 123
8.7. High Risk Countries and Territories
92. In accordance with Paragraph 5(1)(c)(i) of Schedule 3, the firm shall apply ECDD measures to a
business relationship or occasional transaction where the customer or beneficial owner has a relevant connection with a country or territory that - (A) provides funding or support for terrorist activities, or does not apply (or insufficiently applies) the FATF Recommendations, or (B) is a country otherwise identified by the FATF as a country for which such measures are appropriate.
93. For the purposes of Paragraph 5(1)(c), Paragraph 5(10) of Schedule 3 defines that a customer or
beneficial owner has a ‘relevant connection’ with a country or territory if the customer or beneficial owner – (a) is the government, or a public authority, of the country or territory, (b) is a PEP within the meaning of Paragraph 5(4) of Schedule 3 in respect of the country or territory, (c) is resident in the country or territory, (d) has a business address in the country or territory, (e) derives funds from – (i) assets held by the customer or beneficial owner, or on behalf of the customer or beneficial owner, in the country or territory, or (ii) income arising in the country or territory, or (f) has any other connection with the country or territory which the firm considers, in light of the firm’s duties under Schedule 3 (including but not limited to its duties under Paragraph 2 of Schedule 3), to be a relevant connection for those purposes.
94. The firm must have policies, procedures and controls in place which enable it to determine those
countries or territories falling within Paragraph 5(1)(c)(i) of Schedule 3.
95. The FATF regularly updates its public statement, “High Risk Jurisdictions subject to a Call for
Action” in which it calls on all members and urges all jurisdictions to apply enhanced due diligence, and in the most serious cases, countries are called upon to apply counter-measures to protect the international financial system from the ongoing ML, FT, and proliferation financing risks emanating from the country. This list is often externally referred to as the “black list”. For the purposes of applying Paragraph 5(1)(c)(i) of Schedule 3, Appendix H to this Handbook identifies those countries and territories which the FATF has listed as high risk.
96. As part of its policies, procedures and controls, the firm must:
(a) be aware of concerns about weaknesses in the AML and CFT systems of other countries or territories; and (b) consider any updates to Appendix H of this Handbook and Notices, Instructions and Warnings issued from time to time by the Commission.
8.8. Bearer Shares and Bearer Warrants
97. In accordance with Paragraph 5(1)(e) of Schedule 3, the firm shall apply ECDD measures to a
business relationship or occasional transaction in which the customer, the beneficial owner of the customer, or any other legal person in the ownership and control structure of the customer, is a legal person that has bearer shares or bearer warrants.

Chapter 8 – Page 124
98. A bearer share is a share that is owned by, and gives all associated rights to, the person who is
in control or possession of the share. The bearer share is not recorded by indefeasible title (for example, on a register) and transfer of the ownership of the share does not need to go through a register to be effected. As there are no records as to the holder, it is often difficult to identify the true or ultimate beneficial owner of a bearer share, or more broadly, bearer share companies.
99. Where the firm’s risk appetite allows for a customer, the beneficial owner of a customer, or any
other legal person in the ownership and control structure of the customer to have bearer shares and/or bearer warrants, the firm must have appropriate and effective policies, procedures and controls in place to mitigate the risk posed by their use.
100. Where the firm establishes or maintains a business relationship or undertakes an occasional
transaction falling within Paragraph 5(1)(e) of Schedule 3, the firm must apply both of the following measures in respect of that business relationship or occasional transaction, together with the ECDD measures set out in Paragraph 5(1) of Schedule 3:
(a) determine and satisfy itself as to the reasons why the customer, the beneficial owner of the customer, or other legal person in the ownership and control structure of the customer has bearer shares and/or bearer warrants; and (b) have custody of the bearer shares and/or bearer warrants, or be satisfied as to their location and immobilisation. This should include confirming the number and location of the bearer shares and/or bearer warrants on a periodic basis, or alternatively, receiving a written undertaking from the custodian of those bearer shares and/or bearer warrants that the firm will be notified of any changes to records relating to them and their custodian.
101. The firm must apply the above policies, procedures and controls to a business relationship or
occasional transaction irrespective of whether the identified bearer share or bearer warrant represents an amount below the relevant threshold for ownership or control of the legal person. Enhanced Measures
102. In accordance with Paragraph 5(2) of Schedule 3, the firm shall carry out enhanced measures in
relation to business relationships and occasional transactions, whether otherwise high risk or not, which involve or are in relation to - (a) a customer who is not resident in the Bailiwick; (b) the provision of private banking services; (c) a customer which is a legal person or legal arrangement used for personal asset holding purposes; or (d) a customer which is – (i) a legal person with nominee shareholders, or (ii) owned by a legal person with nominee shareholders.
103. Paragraph 5(3)(b) of Schedule 3 defines enhanced measures as being the carrying out of
appropriate and adequate enhanced measures in relation to a business relationship or occasional transaction, to mitigate and manage the specific higher risk of ML and FT resulting from the matters listed in Paragraph 5(2) of Schedule 3 that are relevant to that relationship or transaction.
104. For a number of business relationships or occasional transactions there is likely to be more than
one specified business involved and the firm should be aware that the enhanced measures it applies may be different to those applied by another specified businessto mitigate differing higher risk factors.

Chapter 8 – Page 125
105. By way of example, a fiduciary establishes a trust for a non-resident customer to whom it applies
enhanced measures as set out in Section 8.9. below. The fiduciary then acts as the customer in a business relationship with another specified business where, acting as trustee, it opens a bank account on behalf of the trust with a private bank. The bank will apply enhanced measures to mitigate the higher risks associated with its customer being a personal asset holding vehicle and the provision of private banking services as detailed in Sections 8.10. and 8.11., which may be different to those applied by the fiduciary.
8.9. Non-Resident Customer
106. Customers who are not resident in a country or territory but who nevertheless seek to form a
business relationship or conduct an occasional transaction with a business in that country or territory will generally have legitimate reasons for doing so. However, some such customers may present a higher risk of ML and/or FT, for example, by attempting to move illicit funds away from their country or territory of residence or attempting to further conceal the source of funds from that country or territory.
107. For the purposes of Paragraph 5(2)(a) of Schedule 3, examples of enhanced measures the firm
could apply in respect of a business relationship or occasional transaction involving or in relation to a customer who is not resident in the Bailiwick could include:
(a) taking steps to understand the reason(s) behind the customer seeking to establish a business relationship or carry out an occasional transaction with the firm; (b) the use of external data sources to collect information on the customer and the particular country risk in order to build a customer business and risk profile similar to that available for a resident customer; (c) taking reasonable measures to establish and understand the source of the funds used within the business relationship or occasional transaction and considering whether this is consistent with the firm’s understanding of the customer and the rationale for the business relationship or occasional transaction (see Section 8.3. of this Handbook).
108. For the purposes of Paragraph 8.107.(a), when determining the reasons for establishing a business
relationship or undertaking an occasional transaction, the firm should document its determination. The reasons given should be more detailed and substantive than merely ‘tax planning’, ‘asset protection’ or similar.
109. Where the firm determines that the rationale for the customer establishing a business relationship
or undertaking an occasional transaction with the firm is tax planning or tax mitigation, the firm should seek to understand the underlying tax rationale for the business relationship or occasional transaction. Where concerns are raised about this rationale, the firm could consider requesting a copy of the tax opinion or tax advice to support its understanding of the customer’s arrangements.
110. With regard to Paragraph 8.107.(c) above, when seeking to establish the source of any funds, the
firm should consider both the activities which generated those funds in order to understand the provenance of the funds and any potential implications to those funds being moved to the Bailiwick. For example, is the customer seeking to circumvent capital controls by moving the funds to the firm.

Chapter 8 – Page 126
8.10. Customer Provided with Private Banking Services
111. Private banking is generally understood to be the provision of personalised banking and/or
investment services to high-net-worth customers in a closely managed relationship. It may involve complex, bespoke arrangements and high value transactions across multiple countries and territories. Such customers may therefore present a higher risk of ML and/or FT.
112. For the purposes of this Section a service is regarded as a private banking service if it meets all
four of the following criteria:
(a) is offered or proposed to personal, private client, customers (either directly or through a legal person or legal arrangement) identified by the firm as being eligible for the service on the basis of their net worth; (b) involves high value investment; (c) is non-standardised; and (d) is tailored to the customer’s needs.
113. For the avoidance of doubt, private banking services are not considered to be solely the preserve
of a bank (with the exception of accepting deposits) but could feasibly be offered by a firm licensed under the POI Law. A business licensed under the Fiduciaries Law who facilitates private banking services as part of its duties as a trustee is not considered to be providing private banking services.
114. For the purposes of Paragraph 5(2)(b) of Schedule 3, examples of enhanced measures the firm
could apply in respect of a business relationship or occasional transaction involving or in relation to the provision of private banking services could include:
(a) reviewing the business relationship more frequently, including all documents, data and information obtained as part of the firm’s CDD measures in order to ensure that they continue to be appropriate and relevant; (b) where transaction monitoring thresholds are used, ensuring that these are appropriate for the circumstances of the business relationship and considering whether they should be reduced to provide greater oversight of transactions connected with the business relationship; (c) taking reasonable measures to establish and understand the source of any funds and of the wealth of the customer and beneficial owner (see Section 8.3. of this Handbook).
115. Where the firm offers private banking services alongside other corporate or retail services, it
should consider on a case by case basis whether a customer utilises such private banking services, taking into account Paragraph 8.112. above, or whether the products and/or services provided to the customer fall within more traditional retail banking services. If the latter, there is no requirement to apply the enhanced measures set out above.
8.11. Customer is a Personal Asset Holding Vehicle
116. Personal asset holding vehicles are legal persons or legal arrangements established by natural
persons for the specific purpose of holding assets for investment. Whilst there are some perfectly legitimate reasons for establishing a personal asset holding vehicle, the use of such, either a legal person or legal arrangement, can serve to conceal the true source of wealth and funds, or the identity of the ultimate beneficial owner of the investment. The use of personal asset holding vehicles therefore presents a higher risk, making it more difficult for the firm to establish the true beneficial ownership of a customer.

Chapter 8 – Page 127
117. Notwithstanding the above, the extent of the risk associated with the personal asset holding
vehicle could vary depending upon whether a regulated trust and corporate service provider is providing corporate services to the personal asset holding vehicle. This will in turn determine the extent of the enhanced measures to be applied by the firm to the customer.
118. For the purposes of Paragraph 5(2)(c) of Schedule 3, examples of enhanced measures the firm
could apply in respect of a business relationship or occasional transaction involving or in relation to a customer which is a legal person or legal arrangement used for personal asset holding purposes could include:
(a) determining the purpose and rationale for making use of a personal asset holding vehicle rather than a beneficial owner holding assets in their own name and satisfying itself that the use of such a vehicle has a genuine and legitimate purpose; (b) taking reasonable measures to establish and understand the source of any funds and of the wealth of the customer and beneficial owner (see Section 8.3. of this Handbook).
119. Paragraph 5(2)(c) applies where the personal asset holding vehicle is the customer or the third
party where the customer is a trustee or general partner acting on behalf of a personal asset holding vehicle.
120. For the purposes of Paragraph 8.118.(a) above, when determining the purpose and rationale for
the use of an asset holding vehicle, the firm should document its determination. The reasons given should be more detailed and substantive than merely ‘tax planning’, ‘asset protection’ or similar.
121. Where the firm determines that the rationale for the customer making use of a personal asset
holding vehicle is tax planning or tax mitigation, the firm should seek to understand the underlying tax rationale. Where concerns are raised about this rationale, the firm could consider requesting a copy of the tax opinion or tax advice to support its understanding of the customer’s arrangements.
8.12. Customer with Nominee Shareholders
122. There may be sound commercial reasons for a customer using nominee shareholders, for
example, to ease administration and reduce costs by tasking the nominee to undertake essential corporate actions in the administration of the structure.
123. Notwithstanding the above, as detailed in Section 7.3. of this Handbook, the use of nominee
shareholders can provide a customer with the means to obscure true ownership and control by separating legal and beneficial ownership. The use of nominee shareholders therefore presents a higher risk, making it more difficult for the firm to establish the true beneficial ownership of a customer.
124. For the purposes of Paragraph 5(2)(d) of Schedule 3, examples of enhanced measures the firm
could apply in respect of a business relationship or occasional transaction involving or in relation to a customer which is a legal person with nominee shareholders, or owned by a legal person with nominee shareholders, could include:
(a) determining and satisfying itself as to the reasons why the customer, or a legal person which owns the customer, is making use of nominee shareholders; (b) using external data sources to collect information on the fitness and propriety of the nominee shareholder (such as their regulated status and reputation) and the particular country risk;

Chapter 8 – Page 128
(c) where nominees are used in intermediary relationships falling within Section 9.8. of this Handbook, the measures the firm must take in accordance with the Commission Rules in
Section 9.8.2.
125. Where the firm enters into a business relationship or undertakes an occasional transaction with
a CIS which is authorised or registered by the Commission and has not been nominated as the party responsible for applying CDD measures to investors in that CIS in accordance with Section
4.8.1. of this Handbook, it is not required to apply enhanced measures in respect of that CIS
where the CIS has nominee shareholders, for example, an intermediary investing into the CIS on behalf its own customers.

Chapter 9
Simplified Customer Due Diligence
Contents of this Chapter
9.1. Introduction.............................................................................................................................130
9.2. Simplified Customer Due Diligence Measures.......................................................................130
9.3. Bailiwick Residents ................................................................................................................131
9.4. Bailiwick Public Authorities...................................................................................................131
9.5. Collective Investment Schemes Authorised or Registered by the Commission .....................132
9.6. Appendix C Businesses...........................................................................................................133
9.6.1. Determination of Appendix C Countries and Territories................................................133
9.7. Receipt of Funds as Verification of Identity...........................................................................134
9.8. Intermediary Relationships.....................................................................................................135
9.8.1. Risk Assessment .............................................................................................................135
9.8.2. Criteria for Establishing an Intermediary Relationship...................................................135
9.8.3. Qualifying Products and Services...................................................................................137
9.8.3.1. Investment of Life Company Funds........................................................................137
9.8.3.2. Investment Activity.................................................................................................137
9.8.3.3. Investments into Collective Investment Schemes...................................................137
9.8.3.4. Insurance Activity...................................................................................................139
9.9. Pooled Bank Accounts............................................................................................................139
9.9.1. Establishing a Pooled Banking Relationship ..................................................................140

Chapter 9 - Page 130
9.1. Introduction
This Chapter provides for the treatment of business relationships and occasional transactions which have been assessed as being low risk relationships pursuant to Paragraph 3 of Schedule 3 and Chapter 3 of this Handbook. It sets out the ability to apply SCDD measures to business relationships or occasional transactions in specific circumstances and defines those simplified measures which can be applied. This Chapter should also be read in conjunction with Chapters 4 to 7 of this Handbook which provide for the overarching CDD obligations and the specific requirements for the differing categories of natural persons, legal persons and legal arrangements with which the firm could deal as part of a business relationship or occasional transaction.
9.2. Simplified Customer Due Diligence Measures
The general rule is that business relationships and occasional transactions are subject to the full range of CDD measures as set out in Schedule 3 and this Handbook, including the requirement to identify and verify the identity of the customer and to identify and take reasonable measures to verify the identity of the beneficial owner. However, there may be circumstances where the risks of ML and FT have been assessed by the firm as being low. Examples could include:
(a) a Bailiwick resident customer where the purpose and intended nature of the business relationship or occasional transaction is clearly understood by the firm; (b) a business relationship or occasional transaction where the risks associated with the relationship are inherently low and information on the identity of the customer and beneficial owner is publicly available, or where adequate checks and controls exist elsewhere in publicly available systems; or (c) a business relationship or occasional transaction in which the customer is an Appendix C business. There may also be circumstances where the risk of ML and FT has been assessed as low by the Bailiwick as part of its NRA. In these circumstances, the firm may consider applying SCDD measures when identifying, and verifying the identity of, the customer and beneficial owner. National Risk Assessment In accordance with Paragraph 6(1) of Schedule 3, where the firm is required to carry out CDD in relation to a business relationship or occasional transaction which has been assessed as a low risk relationship pursuant to Paragraph 3(4)(a) or in accordance with the NRA, it may, subject to the provisions of Paragraphs 6(2) and 6(3) of Schedule 3, apply reduced or SCDD measures. In accordance with Paragraph 6(2) of Schedule 3, the discretion in Paragraph 6(1) as set out above may only be exercised by the firm:
(a) in accordance with the requirements set out in this Handbook, and (b) where it complies with the requirements of Paragraph 3 of Schedule 3. The SCDD measures applied by the firm should be commensurate with the low risk factors and should relate only to relationship acceptance measures or to aspects of ongoing monitoring (excluding sanctions screening). Examples of possible measures could include:

Chapter 9 - Page 131
(a) reducing the verification measures applied to the customer and/or beneficial owner, in accordance with the following sections of this Chapter; (b) reducing the degree of on-going monitoring and scrutiny of transactions, based on a reasonable monetary threshold; or (c) not collecting specific information or carrying out specific measures to understand the purpose and intended nature of the business relationship or occasional transaction, but inferring the purpose and nature from the type of transaction(s) or business relationship established. The firm must ensure that, when it becomes aware of circumstances which affect the assessed risk of a business relationship or occasional transaction to which SCDD measures have been applied, a review of the relationship risk assessment is undertaken and a determination is made as to whether the identification data held remains appropriate to the revised risk of the business relationship or occasional transaction. Where the firm has taken a decision to apply SCDD measures, documentary evidence must be retained which reflects the reason for the decision. The documentation retained must provide justification for the decision, including why it is deemed acceptable to apply SCDD measures having regard to the circumstances of the business relationship or occasional transaction and the risks of ML and FT. In accordance with Paragraph 6(3) of Schedule 3, for the avoidance of doubt, the discretion to apply SCDD measures shall not be exercised:
(a) where the firm forms a suspicion that any party to a business relationship or occasional transaction or any beneficial owner is or has been engaged in ML or FT, or (b) in relation to a business relationship or occasional transaction where the risk is other than low.
9.3. Bailiwick Residents
Where the customer, beneficial owner or other key principal to a business relationship or occasional transaction is a natural person resident in the Bailiwick, the firm may apply SCDD measures in respect of that natural person, provided the requirements as set out in Section 9.2. above are met. Where the firm has determined that it can apply SCDD measures because the risk has been assessed as low, it may elect to verify one of points (b) date of birth and (c) residential address under Commission Rule 5.8., in addition to (a) legal name. Notwithstanding the above, it should be borne in mind that not all Bailiwick residents are intrinsically low risk. The firm must ensure that a relationship risk assessment is undertaken in accordance with the requirements of Paragraph 3 of Schedule 3 and Chapter 3 of this Handbook and that where the business relationship or occasional transaction is considered to be other than low risk, that the appropriate CDD, and where necessary ECDD, measures are applied.
9.4. Bailiwick Public Authorities
Where the customer, beneficial owner or other key principal to a business relationship or occasional transaction has been identified as a Bailiwick public authority, the firm may choose to apply SCDD measures in respect of that public authority. Where SCDD measures are applied, it is not necessary for the firm to apply full verification measures to the public authority (and the beneficial owners thereof), other than where the firm considers this course of action appropriate in the circumstances.

Chapter 9 - Page 132
The firm must identify, and verify the identity of, the Bailiwick public authority, including as a minimum:
(a) the full name of the public authority;
(b) the nature and status of the public authority; (c) the address of the public authority; and (d) the names of the directors (or equivalent) of the public authority. The following are examples of Bailiwick public authorities:
(a) a government department;
(b) an agency established by law;
(c) a parish authority/douzaine; and
(d) a body majority owned by an authority listed in points (a) to (c) above. Where a natural person authorised to act on behalf of a Bailiwick public authority is acting in the course of employment, it is not necessary to identify and verify the identity of that person. However, the firm should verify the natural person’s authority to so act. It may be that an individual acting on behalf of a Bailiwick public authority falls within the definition of a domestic PEP. However, in the context of acting for the Bailiwick public authority, the individual is directing funds belonging to the authority and not their personal funds. The firm may therefore determine that the measures required under Commission Rule 9.15. are sufficient and that the prominent public function held by the natural person does not pose an increased risk to the firm in the context of the business relationship or occasional transaction with the Bailiwick public authority.
9.5. Collective Investment Schemes Authorised or Registered by the Commission
Where the customer, beneficial owner or other key principal to a business relationship or occasional transaction is a CIS authorised or registered by the Commission, the firm (other than where it has been nominated as the party responsible for applying CDD measures to investors in accordance with Section 4.8.1. of this Handbook) may consider the CIS to be the principal for the purposes of the firm’s CDD measures. Where this is the case, in verifying the identity of the CIS the firm must, as a minimum, obtain documentation which confirms the CIS is authorised or registered by the Commission. Further information about CISs authorised and registered by the Commission can be found on the Commission’s website:
https://www.gfsc.gg/industry-sectors/investment/regulated-entities Where a natural person authorised to act on behalf of a CIS to which this Section applies is doing so in the course of employment with that CIS or its Designated Manager, it is not necessary to identify and verify the identity of that person. However, the firm should verify the person’s authority to act on behalf of the CIS. As an example, where a bank is opening an account for a CIS authorised or registered by the Commission, the bank may treat the CIS as the customer to be identified and verified.

Chapter 9 - Page 133
9.6. Appendix C Businesses
Appendix C to this Handbook lists those countries or territories which the Commission considers
require regulated FSBs, and in limited circumstances PBs, to have in place standards to combat ML and FT consistent with the FATF Recommendations and where such businesses are appropriately supervised for compliance with those requirements. Appendix C is reviewed periodically with countries or territories being added or removed as appropriate. The fact that a country or territory has requirements to combat ML and FT that are consistent with the FATF Recommendations means only that the necessary legislation and other means of ensuring compliance with the FATF Recommendations are in force in that country or territory. It does not provide assurance that a particular overseas business is subject to that legislation, or that it has implemented the necessary measures to ensure compliance with that legislation. The inclusion of a country or territory in Appendix C does not mean that the country or territory in question is intrinsically low risk, nor does it mean that any business relationship or occasional transaction in which the customer or beneficial owner has a connection to such a country is to be automatically treated as a low risk relationship. Where the customer has been identified as an Appendix C business and the purpose and intended nature of the business relationship or occasional transaction is understood, subject to Commission Rule 9.28. and with the exception of the circumstances set out in Paragraph 9.31. below, verification of the identity of the Appendix C business is not required. With the exception of the provisions in Sections 9.8. and 9.9. of this Chapter, if the Appendix C business is acting for or on behalf of another party the firm must, in accordance with Paragraph 4(3)(d) of Schedule 3, take reasonable measures to identify and verify the identity of that third party in accordance with the requirements of Schedule 3 and this Handbook. Where a natural person authorised to act on behalf of an Appendix C business is doing so in the course of employment with that business, it is acceptable for the firm not to identify and verify the identity of that person. However, the firm should verify the person’s authority to act on behalf of the Appendix C business. One such example would be a director (or equivalent) of a Bailiwick fiduciary who is acting in the course of his fiduciary obligations or an administrator executing instructions on behalf of a CIS. The firm is not obliged to deal with regulated FSBs or PBs in the jurisdictions listed in Appendix C as if they were local, notwithstanding that they meet the requirements identified in Appendix
C. The firm may, in deciding whether or not to deal with a regulated FSB or PB, impose higher
standards than the minimum standards identified in this Handbook where it considers this necessary. The provisions in this Section cannot be applied to an Appendix C business (other than a trust and corporate service provider licensed by the Commission) which, acting as the trustee of a trust, is the customer or other key principal to a business relationship or occasional transaction.
9.6.1. Determination of Appendix C Countries and Territories
In accordance with Paragraph 16(2) of Schedule 3, when exercising its functions the Commission must take into account information on, or in relation to:
(a) the ML and FT risk associated with particular countries, territories and geographic areas; and

Chapter 9 - Page 134
(b) the level of cooperation it expects to receive from relevant authorities in those countries, territories and areas. In making its determination of those jurisdictions listed in Appendix C, in addition to the factors set out in Paragraph 16(2) of Schedule 3, the Commission will also take into consideration several other factors including:
(a) the jurisdiction’s membership of the FATF and/or a FATF-style regional body; (b) reports and assessments by the FATF and/or other regional body for compliance with the FATF Recommendations; (c) good governance indicators; (d) the level of drug trafficking, bribery and corruption and other financial and organised crime within the jurisdiction; and (e) the extent of terrorism and terrorist financing activities within the jurisdiction. When reviewing assessments undertaken by the FATF or other FATF-style regional bodies of a country/territory’s compliance with the FATF Recommendations, particular attention is given to:
(a) the findings, recommendations and ratings of compliance with the FATF Recommendations (in particular Recommendations 10, 11 and 12); and (b) the findings, recommendations and ratings of effectiveness of the country or territory’s AML and CFT regime against the FATF’s eleven ‘Immediate Outcomes’ set out within its methodology for compliance with the FATF Recommendations.
9.7. Receipt of Funds as Verification of Identity
Where the customer and beneficial owner have been identified and the business relationship or occasional transaction is considered to be low risk, the firm may consider the receipt of funds to provide satisfactory means of verifying identity. In order to utilise this provision, the firm must ensure that:
(a) all initial and future funds are received from an Appendix C business; (b) all initial and future funds come from an account in the sole or joint name of the customer or beneficial owner; (c) payments are only paid to an account in the customer’s name (i.e. no third party payments allowed), or in respect of real estate transactions, to an account in the name of the vendor of the property or in the name of the legal professional acting on behalf of the purchaser; (d) no changes are made to the product or service that enable funds to be received from or paid to third parties; and (e) no cash withdrawals are permitted other than by the customer, or a beneficial owner, on a face-to-face basis where the identity of the customer or beneficial owner can be confirmed, and in the case of significant cash transactions, the reasons for cash withdrawal are verified. The firm must ensure that, once a business relationship has been established, should any of the conditions set out in Commission Rule 9.36. no longer be met, full verification of the identity of the customer and beneficial owner is carried out in accordance with the requirements of Schedule 3 and this Handbook. Should the firm have reason to suspect the motives behind a particular transaction or believe that the business relationship or occasional transaction is being structured to avoid the firm’s standard CDD measures, it must ensure that the receipt of funds is not used to verify the identity of the customer or beneficial owner.

Chapter 9 - Page 135
The firm must retain documentary evidence to demonstrate the reasonableness of its conclusion that the risk of the business relationship being established or the occasional transaction being undertaken is low.
9.8. Intermediary Relationships
An intermediary relationship is where the firm enters into a business relationship with an intermediary who is acting for or on behalf of its customers and where the business relationship the firm has is with the intermediary and not the intermediary’s customers. If the firm has assessed the ML and FT risks of the relationship with the intermediary as low, it may, subject to certain criteria being met and only in respect of certain qualifying products and services, treat the intermediary as its customer for CDD purposes, instead of identifying and verifying the identity of the intermediary’s customer(s). The firm should be aware that money launderers are attracted by the availability of complex products and services that operate internationally within a reputable and secure financial services environment. In this respect, the firm should be alert to the risk of an intermediary relationship being used to mask the true beneficial ownership of an underlying customer for criminal purposes.
Section 9.8.2. of this Handbook sets out the criteria which must be met for an intermediary
relationship to be established by the firm. In such casesthe firm will not have a direct relationship with the intermediary’s customer and it will therefore not be necessary to apply CDD measures to the intermediary’s customers, unless the firm considers this course of action to be appropriate in the circumstances. The intermediary does however have a direct relationship with its customer.
9.8.1. Risk Assessment
Before establishing an intermediary relationship, the firm must undertake a relationship risk assessment of the proposed business relationship with the intermediary. Such an assessment will allow the firm to determine the risk in placing reliance on an intermediary and to consider whether it is appropriate to treat the intermediary as the firm’s customer or whether it feels the risk would be better managed if it were to:
(a) treat the intermediary as an introducer in accordance with Chapter 10 of this Handbook; or (b) apply CDD measures to the customer (including the beneficial owner and other key principals) for whom the intermediary is acting.
Chapter 10 of this Handbook provides for the identification and verification requirements in
relation to introduced business relationships, i.e. where an Appendix C business enters into a business relationship with the firm on behalf of one or more third parties, who are its customers.
9.8.2. Criteria for Establishing an Intermediary Relationship
When establishing an intermediary relationship, the firm must apply CDD measures to the intermediary to ensure that the intermediary is either:
(a) an Appendix C business; or
(b) a wholly owned nominee subsidiary vehicle of an Appendix C business which applies the policies, procedures and controls of, and is subject to oversight from, the Appendix C business;

Chapter 9 - Page 136
excluding a trust and corporate service provider unless that trust and corporate service provider is licensed under the Fiduciary Law. Where the condition in Commission Rule 9.46. is met and the business relationship with the intermediary has been assessed as being low risk, the firm can exercise its own judgement in the circumstances as to the level of CDD measures to be applied to the intermediary. However, at a minimum the firm must:
(a) identify and, subject to the provisions of Section 9.6. of this Handbook, verify the identity of the intermediary; and (b) receive written confirmation from the intermediary which:
(i) confirms that the intermediary has appropriate risk-grading procedures in place to differentiate between the CDD requirements for high risk relationships and low risk relationships; (ii) contains adequate assurance that the intermediary applies appropriate and effective CDD measures in respect of its customers, including ECDD measures for PEPs and other high risk relationships; (iii) contains sufficient information to enable the firm to understand the purpose and intended nature of the intermediary relationship; and (iv) confirms that the account will only be operated by the intermediary and that the intermediary has ultimate, effective control over the relevant product or service. Where an intermediary relationship has been established, the firm must prepare and retain documentary evidence of the following:
(a) the adequacy of its process to determine the risk of the intermediary relationship and the reasonableness of its conclusions that it is a low risk relationship; (b) that it has applied CDD measures to the intermediary; and (c) that the intermediary relationship relates solely to the provision of products or services which meet the requirements of Section 9.8.3. below. In circumstances where the criteria for an intermediary relationship are not completely satisfied or are no longer met (for example, because the proposed intermediary is not an Appendix C business or the risk of the intermediary relationship has been assessed as being other than low) then the relationship must not be considered as an intermediary relationship. Where the firm has determined, in accordance with Commission Rule 9.49., that it cannot treat an intermediary as the customer, the firm must treat the underlying customers of the intermediary as if they were the firm’s customers and must apply its own CDD measures in accordance with the requirements of Schedule 3 and this Handbook. The firm should always consider whether the risk would be better managed if it applied CDD measures to the person or legal arrangement, including the beneficial owner and other key principals, for whom the intermediary is acting rather than treating the intermediary as its customer. The following are examples of steps the firm could take where, in accordance with Commission Rule 9.50., the firm is required to apply CDD measures to an intermediary’s customers:
(a) open individual accounts in the names of each of the customers on behalf of whom the intermediary was acting and apply CDD measures to each of those customers, including the beneficial owners and other key principals; or

Chapter 9 - Page 137
(b) open an account in the name of the intermediary, provided that the firm also receives a complete list of the underlying customers from the intermediary to allow it to apply its own CDD measures to those customers, including the beneficial owners and other key principals.
9.8.3. Qualifying Products and Services
For an intermediary to be considered as the customer of the firm, the intermediary relationship must be for the provision of one of the following products and services:
(a) Investment of life company funds to back the life company’s policyholder liabilities where the life company opens an account (see Section 9.8.3.1. below); (b) Undertaking various restricted activities by a POI licensee, as part of its relationship falling within the scope of the POI Law, with another regulated FSB where the funds (and any income) may not be returned to a third party unless that third party was the source of funds (see Section 9.8.3.2. below); (c) Investments into a CIS or NGCIS (for example, by a discretionary or advisory investment manager or custodian) acting in its own name and as the registered owner of the shares or units of the CIS (see Section 9.8.3.3. below); or (d) The offering of insurance products to another regulated FSB by a Guernsey licensed insurer, as part of its relationship falling within the scope of the IB Law.
9.8.3.1. Investment of Life Company Funds
Where the firm is licensed under the Banking Law and provides services to a life insurance company through the opening of an account for the investment of funds to back the life company’s policyholder liabilities, the firm can treat the life insurance company as its customer. Where the firm is licensed under the POI Law and a life insurance company is investing its policy holder funds into a CIS authorised or registered by the Commission or an NGCIS, the firm can treat the life insurance company as its customer. If the account or investment has a policy identifier then the firm must require an undertaking from the life company that it is the legal and beneficial owner of the funds and that the policyholder has not been led to believe that he or she has rights over an account or investment in the Bailiwick.
9.8.3.2. Investment Activity
Where the firm is licensed under the POI Law and undertakes various restricted activities within the scope of its licence as part of its relationship with another regulated FSB, the firm can treat that regulated FSB as its customer. Where the firm utilises these provisions, any funds received from the intermediary (and any income resulting from the investment of such) must not be returned to a third party, unless that third party was the source of the funds and the firm is satisfied that the involvement of the third party does not pose an increased ML or FT risk.
9.8.3.3. Investments into Collective Investment Schemes
Where the firm has been nominated in accordance with Paragraph 4.57. and an investment is made into a CIS or NGCIS (referred to in this section as a “CIS”) by an intermediary, for example, a discretionary or advisory investment manager or custodian acting in its own name and as the registered owner of the shares as set out in Section 4.8.2. of this Handbook, the nominated firm can treat the intermediary as its customer.

Chapter 9 - Page 138
Investments made into a CIS via an intermediary as described under Commission Rule 4.70.(b)- (c), where the identity of the underlying investors is not disclosed to the CIS or the nominated firm, is common practice within the fund sector across the world and is recognised within guidance issued by IOSCO, the Basel Committee on Banking Supervision and in the European Supervisory Authorities’ (“ESAs”) Risk Factors Guidelines issued under the Fourth Anti-Money Laundering Directive. Notwithstanding the above, the ability for an underlying investor to invest into a CIS on an undisclosed basis increases the risk of a CIS being abused for ML or FT purposes. This is particularly relevant where there are a very limited number of investors in a CIS who could exercise control over the assets of that CIS, either through ownership or by other means. In this respect it is possible for an individual person or family office to hold, via an intermediary or intermediaries, more than 25% of the shares/units or voting rights of a CIS, or exercise control through other means, which as identified under the Bailiwick’s Beneficial Ownership regime, would classify the underlying investor as a beneficial owner, but their identity would not be known. The nominated firm should be aware that certain types of CIS, such as hedge funds, real estate and private equity funds, tend to have a smaller number of investors which can be private individuals as well as institutional investors, for example, pension funds or funds of funds. CISs that are designated for a very limited number of high-net-worth individuals or family offices can have an inherently higher risk of abuse for ML and/or FT purposes as compared to retail or institutional funds. In such cases, underlying investors are more likely to be in a position to exercise control over the CIS and use the CIS as a personal asset holding vehicle. Personal asset holding vehicles should not be authorised/registered under the POI Law, as Paragraph 1(1)(b) of Schedule 1 to the POI Law states, inter alia:
‘a CIS is any arrangement relating to property of any description (including money)…in which the investors do not have a day-to-day control over the management of the property to which the arrangement relates (whether or not they have any right to be consulted or give directions)’. However, the nominated firm should be aware that an authorised or registered CIS could have, or may develop over time, the attributes of a personal asset holding vehicle. Where the nominated firm wishes to utilise the intermediary provisions in respect of a CIS which is designated for a very limited number of investors, the nominated firm must have assessed the risk of the CIS being used by those investors as a personal asset holding vehicle as low. The conclusions of this assessment must be documented and reviewed on a periodic basis. In conducting its assessment in accordance with Commission Rule 9.65. above, the nominated firm should consider factors such as the manner in which the shares or units of the CIS are distributed; the powers afforded to the share/unit holders of the CIS and their ability to influence any decision making; and details of any unusual connections between share/unit holders, board members and other parties connected with the CIS. The assessment undertaken by the nominated firm could form part of its relationship risk assessment of the particular CIS, or be undertaken and recorded as a separate assessment. Where the CIS targetsinstitutional investors, as opposed to individuals, or retail investors through professional intermediaries, the risk of the CIS becoming a personal asset holding vehicle, for which a small group of individuals would be considered beneficial owners under the Bailiwick’s Beneficial Ownership regime, is likely to be low.

Chapter 9 - Page 139
Similarly, a CIS could be established by an Appendix C business as an in-house scheme for that
Appendix C business’ customers and for which the Appendix C business would be acting as the
intermediary (i.e. the registered share/unit holder). Even in these cases, the nominated firm could, after reasonable enquiries about the CIS’ distribution and operation, determine that the risk of that CIS being used as a personal asset holding vehicle is low. Where the nominated firm has assessed that the risk of a CIS being used as a personal asset holding vehicle is other than low, it must not treat an intermediary as its customer and must look through the intermediary relationship to apply CDD measures (including ECDD and enhanced measures as applicable) to the intermediary’s underlying customers, including the beneficial owners and other key principals.
9.8.3.4. Insurance Activity
Where the firm is licensed under the IB Law and offers insurance products within the scope of its licence as part of its relationship with another regulated FSB, the firm can treat that regulated FSB as its customer. Where firm utilises these provisions, any funds received from the intermediary (and any income resulting from the investment of such) must not be returned to a third party, unless that third party was the source of the funds and the firm is satisfied that the involvement of the third party does not pose an increased ML or FT risk.
9.9. Pooled Bank Accounts
Banks often accept pooled deposits on behalf of FSBs and other professional firms. These accounts may contain the funds of more than one underlying customer and are generally held on an undisclosed basis. Where the firm is licensed by the Commission under the Banking Law and has identified an account operated by it on behalf of one of the following types of account holder, the firm may treat this party as its customer:
(a) an account in the name of a fiduciary licensed by the Commission, or supervised by an equivalent authority in the Bailiwick of Jersey, or a wholly owned subsidiary of such a business which meets the requirements of Paragraph 9.75. below, where:
(i) the holding of funds in the account is on a short-term basis; or (ii) the holding of funds in the account relates to the provision of treasury/cash management services by the fiduciary on behalf of its customers; (b) an account in the name of a firm of lawyers or estate agents registered with the Commission, or supervised by an equivalent authority in the Bailiwick of Jersey, where the holding of funds in the account is on a short-term basis and is necessary to facilitate a transaction; (c) a client money account in the name of a firm licenced under the POI Law, or subject to equivalent licensing and oversight by an authority in the Bailiwick of Jersey, where the funds are subject to the Licensees (Conduct of Business) Rules 2016 or equivalent legislation in the Bailiwick of Jersey; or (d) a client money account in the name of a firm licenced under the IMII Law, or subject to equivalent licensing and oversight by an authority in the Bailiwick of Jersey, where the funds are subject to the Insurance Managers and Insurance Intermediaries (Client Money) Regulations 2008 or equivalent legislation in the Bailiwick of Jersey.

Chapter 9 - Page 140
The requirements referred to in Paragraph 9.74.(a) above are that the wholly owned subsidiary:
(a) has no customers which are not customers of the fiduciary in the Bailiwick or Bailiwick of Jersey; and (b) applies the same AML and CFT policies, procedures and controls as the fiduciary in the Bailiwick or Bailiwick of Jersey. For the purposes of Paragraphs 9.74.(a)(i) and (b) above, funds are considered to have been held on a ‘short-term’ basis where they are held, undisclosed, for no longer than 40 days. Where the firm is licensed by the Commission under the Banking Law and holds deposits on a fiduciary basis on behalf of an overseas bank falling within the definition of an Appendix C business, the firm should treat the overseas bank as its customer in accordance with Section 9.6. of this Handbook.
9.9.1. Establishing a Pooled Banking Relationship
Where the firm operates an account falling within the provisions of Paragraph 9.74. and the business relationship with the account holder has been assessed as being low risk, the firm can exercise its own judgement as to the level of CDD measures to be applied to the account holder in the particular circumstances. However, as a minimum the firm must:
(a) identify and, subject to the provisions of Section 9.6. of this Handbook, verify the identity of the account holder; and (b) receive written confirmation from the account holder which:
(i) confirms that the account holder has appropriate risk-grading procedures in place to differentiate between the CDD measures appropriate for high risk relationships and those for low risk relationships; (ii) contains adequate assurance that the account holder applies appropriate and effective CDD measures in respect of its customers (and the beneficial owners and other key principals), including ECDD measures for PEPs and other high risk relationships; (iii) contains sufficient information to enable the firm to understand the purpose and intended nature of the relationship; and (iv) confirms that the account will only be operated by the account holder and that the account holder has ultimate effective control over the relevant product or service. Where a business relationship has been established with an account holder for the provision of a pooled account, the firm must prepare and retain documentary evidence of the following:
(a) the adequacy of its processes to determine the risk of the business relationship with the account holder and the reasonableness of its conclusions that it is a low risk relationship; (b) that it has applied CDD measures in respect of the account holder; and (c) that the business relationship with the account holder relates solely to the provision of an account falling within Paragraph 9.74.(a)-(d) above. Where the firm operates a pooled account on behalf of an account holder which:
(a) does not fall within Paragraph 9.74.(a)-(d) above; or (b) has been assessed as being other than low risk, for example, because the firm has concerns in respect of the manner in which a pooled account is being operated,

Chapter 9 - Page 141
then the firm must not treat the account holder as its customer and must apply its own CDD measures on the underlying customers (including the beneficial owners and other key principals) within the pooled account in accordance with the requirements of Schedule 3 and this Handbook. The firm should always consider whether the risk would be better managed if the firm applied CDD measures on the customer, beneficial owner and other key principals for whom the account holder is acting rather than treating the account holder as the customer.

Chapter 10
Introduced Business
Contents of this Chapter
10.1. Introduction.........................................................................................................................144
10.2. Risk Exposure .....................................................................................................................144
10.3. Establishing an Introducer Relationship .............................................................................144
10.4. Testing.................................................................................................................................146
10.5. Termination.........................................................................................................................146
10.6. Group Introducers...............................................................................................................147
10.7. Chains of Introducers..........................................................................................................147

Chapter 10 - Page 144
10.1. Introduction

An introduced business relationship or occasional transaction is a formal arrangement whereby
an Appendix C business (or an overseas branch of, or member of the same group of bodies as, the firm) acting on behalf of one or more third parties who are also its customers, establishes a business relationship or undertakes an occasional transaction with a specified business on behalf of that customer. Introduced business relationships or occasional transactions may be on behalf of a single customer or on behalf of more than one customer, including a pool of such persons.
A business relationship established by an introducer on behalf of more than one of its customers
is described by this Handbook as a pooled relationship. Further information on pooled relationships can be found in Section 9.9. of this Handbook.
This Chapter does not apply to outsourcing or agency relationships. Under an introducer
arrangement the third party will apply its own procedures to perform the CDD measures for the customer, subject to an initial assessment of the third party by the firm and to ongoing periodic testing. This contrasts with an outsourced or agency relationship, where the outsourced service provider or agency is regarded as part of the delegating firm, applying the delegating firm’s CDD measures in accordance with the delegating firm’s procedures and subject to oversight and control of the effective implementation of those procedures by the delegating firm.
10.2. Risk Exposure
Introduced business by its very nature has the capacity to be high risk, i.e. relying on a third party
to have adequately applied CDD measures to mitigate the risk of the firm being involved in, or abused for, ML or FT. In this respect, while the firm is still required to hold sufficient identifying information about its customer and the beneficial owner thereof, the firm places reliance on a third party to have adequately and appropriately verified the identity of that customer and beneficial owner, and to retain evidence of that verification.
The firm must recognise the increased risk posed by introduced business and ensure that its
consideration of these risks is adequately documented within its business risk assessments.
In addition to an explanation of any risks identified, the firm’s business risk assessments should
also include a description of the policies, procedures and controls established to mitigate and manage such risk.
The firm must consider, for each business relationship or occasional transaction, whether it is
appropriate on the basis of risk to rely on a certificate or summary sheet from an introducer in accordance with Paragraph 10 of Schedule 3 or whether it considers it necessary to do more.
In accordance with Paragraph 10(3) of Schedule 3, where reliance is placed upon an introducer,
the responsibility for complying with the relevant provisions of Paragraph 4 of Schedule 3 shall remain with the firm.
10.3. Establishing an Introducer Relationship
In accordance with Paragraph 10(1) of Schedule 3, in the circumstances set out in Paragraph 10(2)
as reflected below, the firm may accept a written confirmation of identity and other matters from an introducer in relation to the requirements of Paragraph 4(3)(a)–(e) of Schedule 3, provided that:
(a) the firm also requires copies of identification data and any other relevant documentation on the identity of the customer and beneficial owner to be made available by the introducer to the firm immediately upon request; and

Chapter 10 - Page 145
(b) the introducer keeps such identification data and documents.
10. In accordance with Paragraph 10(2) of Schedule 3, the circumstances referred to in Paragraph 10.9.
above are that the introducer:
(a) is an Appendix C business; or
(b) is either an overseas branch office of, or a member of the same group of legal persons or legal arrangements as, the firm, and (i) the ultimate legal person or legal arrangement of the group of legal persons or legal arrangements of which both the introducer and the firm are members, is an Appendix C business; and (ii) the conduct of the introducer is subject to requirements to forestall, prevent and detect ML and FT (including the application of any appropriate additional measures to effectively handle the risk of ML or FT) that are consistent with those in the FATF Recommendations in respect of such a business (particularly Recommendations 10, 11 and 12), and the introducer has implemented a programme to combat ML and FT that is consistent with the requirements of Recommendation 18; and (iii) the conduct both of the introducer, and of the group of legal persons or legal arrangements of which both the introducer and the firm are members, is supervised or monitored for compliance with the requirements referred to in (ii) above, by the Commission or an overseas regulatory authority.
11. In addition to the confirmations required by Paragraph 10(1) of Schedule 3, when establishing an
introducer relationship, the firm must also satisfy itself that the introducer:
(a) has appropriate risk-grading procedures in place to differentiate between the CDD requirements for high risk relationships and low risk relationships; (b) applies appropriate and effective CDD measures to its customers, and the beneficial owners and other key principals thereof, including ECDD measures to foreign PEPs and other high risk relationships; and (c) has appropriate record keeping requirements similar to those set out in Paragraph 14 of
Schedule 3.
12. The CDD measures referred to in Paragraph 10(1) of Schedule 3 include the following elements:
(a) identifying the customer and verifying the customer’s identity using identification data; (b) identifying any person purporting to act on behalf of the customer and verifying that person’s identity and their authority to so act; (c) identifying the beneficial owner and taking reasonable measures to verify the identity of the beneficial owner, including, in the case of a customer which is a legal person or legal arrangement, taking measures to understand the ownership and control structure of the customer; (d) determining whether the customeris acting on behalf of another person and, if the customer is so acting, taking reasonable measures to identify that other person and to obtain sufficient identification data to verify the identity of that other person; and (e) understanding, and as appropriate obtaining information to support this understanding of, the purpose and intended nature of the business relationship or occasional transaction.
13. A template certificate which may be used by the firm for introduced business can be found in
Appendix F to this Handbook.
14. The firm must take appropriate steps to be satisfied that the introducer will supply, immediately
upon request, certified copies or originals of the identification data and other relevant documents

Chapter 10 - Page 146
it has collected under the CDD measures applied to its customers, including the beneficial owner and other key principals thereof.
15. Where an introduced business relationship presents a high risk of ML or FT, consideration should
be given to whether it is appropriate for the firm to rely solely upon the information provided by the introducer or whether supplemental CDD information and/or documentation is required.
16. It is the responsibility of the introducer to inform the firm of any changes to the parties involved
in an introducer arrangement, for example, to the relationship structure, the profile, or any CDD held. As part of establishing an introduced relationship the firm should seek confirmation from the introducer that it will notify the firm of changes to the customer, or the beneficial owner thereof, without delay.
10.4. Testing
17. The firm must have a scheduled programme of testing to ensure that, on an on-going basis, an
introducer is able to fulfil the requirement that certified copy or original identification data that it has collected will be provided to the firm immediately upon request. This will involve the firm adopting ongoing procedures to ensure it has the means to obtain that identification data.
18. The testing programme should be risk-based and commensurate with the risk exposure, size and
scope of the business introduced. The programme should provide appropriate and sufficient assurance to the firm that it can continue to rely upon an introducer to fulfil its obligation to provide identification data immediately upon request. In this respect, priority should be given to those introducers posing the highest risk to the firm, i.e. those with the greatest number of introduced relationships and/or the highest risk customers.
19. Notwithstanding the above, the firm should set a minimum timeframe within which all
introducers will be subject to appropriate periodic testing and record this within its introducer testing procedure.
20. The scope of the testing undertaken should include verification that the information received
from the introducer on a certificate or summary sheet containing information about the identity of the underlying customer, beneficial owner and other key principals, continues to be accurate and up to date. This allows the firm to determine whether, based on any changes, it wishes to continue to rely upon the arrangement or whether the firm may wish to seek further information from the introducer about the underlying customer and/or associated key principals.
21. Where, as a result of a test carried out, the firm is not satisfied that the introducer has appropriate
policies and procedures in place, maintains appropriate records, or will provide evidence of those records immediately if requested to do so, the firm must apply CDD measures in accordance with Paragraph 4 of Schedule 3 for that customer, including the beneficial owner and other key principals thereof, and give consideration to terminating its relationship with the introducer.
10.5. Termination
22. In the event that an introducer terminates its relationship with an introduced customer, the firm
should consider how best it will continue to maintain compliance with its CDD obligations for that customer and associated key principals. In this respect, the firm should give consideration to the following:
(a) instructing the introducer to provide the firm with copies of the identification data held for the customer, beneficial owner and other key principals; or

Chapter 10 - Page 147
(b) gathering its own identification data on the customer, beneficial owner and other key principals, and terminating the introducer relationship.
10.6. Group Introducers
23. Where a customer is introduced to the firm by a member of the firm’s wider group, it is not
necessary for the identity of the customer or any key principal to be re-verified, provided that the group entity acting as introducer provides the firm, in accordance with Paragraph 10(1) of
Schedule 3, with written confirmation that it:
(a) applies CDD requirements in line with Paragraph 4 of Schedule 3; (b) meets the requirements of Paragraph 10(2) of Schedule 3 to be classified as an introducer; (c) applies record keeping requirements in line with Paragraph 14 of Schedule 3; and (d) will provide copies of identification data immediately upon request.
24. Where the firm has access to the identification data of the introducing group member’s customers
and associated key principals, for example, via a group-wide document management system, the testing obligations set out in Commission Rule 10.17. will be deemed to have been met, provided the firm reviews the identification data held on a periodic basis.
25. Notwithstanding the above, the firm must not regard group introduced business as intrinsically
low risk and must decide, on the basis of risk, whether it is appropriate to rely on a certificate or summary sheet from a group introducer. Where a certificate or summary sheet is not deemed appropriate, the firm must consider the steps it is required to take, bearing in mind that the ultimate responsibility for the application of CDD measures remains with the firm.
10.7. Chains of Introducers
26. Chains of introducers are not permitted and the firm must not place reliance on an introducer
which forms part of a chain.
27. Thisrequirement is intended to avoid a situation whereby, should the middle institution fall away,
the receiving business is left in difficulty vis-à-vis obtaining copies of identification data and other relevant documentation relating to the introduced customer from the original introducer.

Chapter 11
Monitoring Transactions and Activity
Contents of this Chapter
11.1. Introduction.........................................................................................................................150
11.2. Objectives ...........................................................................................................................150
11.3. Obligations..........................................................................................................................151
11.4. PEP Relationships...............................................................................................................151
11.5. High Risk Transactions or Activity ....................................................................................152
11.6. Real-Time and Post-Event Transaction Monitoring ...........................................................152
11.7. Automated and Manual Monitoring....................................................................................153
11.7.1. Automated Monitoring Methods.....................................................................................153
11.8. Examination ........................................................................................................................154
11.9. Ongoing Customer Due Diligence......................................................................................155
11.10. Oversight of Monitoring Controls.......................................................................................156

Chapter 11 - Page 150
11.1. Introduction

The regular monitoring of a business relationship, including any transactions and other activity
carried out as part of that relationship, is one of the most important aspects of effective ongoing CDD measures.
It is vital that the firm understands a customer’s background and is aware of changes in the
circumstances of the customer and beneficial owner throughout the life-cycle of a business relationship. The firm can usually only determine when it might have reasonable grounds for knowing or suspecting that ML and/or FT is occurring if it has the means of assessing when a transaction or activity falls outside the normal expectations for a particular business relationship.
There are two strands to effective ongoing monitoring:
(a) The first relates to the transactions and activity which occur on a day-to-day basis within a business relationship and which need to be monitored to ensure they remain consistent with the firm’s understanding of the customer and the product or service it is providing to the customer. (b) The second relates to the customer themselves and the requirement for the firm to ensure that it continues to have a good understanding of its customers and their beneficial owners. This is achieved through maintaining relevant and appropriate CDD and applying appropriate ongoing screening.
This Chapter deals with the requirement for the firm to monitor business relationships on an
ongoing basis, including the application of scrutiny to large and unusual or complex transactions or activity so that ML and FT may be identified and prevented.
11.2. Objectives
A key prerequisite to managing the risk of a business relationship is understanding the customer,
and beneficial owner, and where changes to those parties occur. It is also important to maintain a thorough understanding of the business relationship and to appropriately monitor transactions in order to be in a position to detect, and subsequently report, suspicious activity.
The type of monitoring applied by the firm will depend on a number of factors and should be
developed with reference to the firm’s business risk assessments and risk appetite. The factors forming part of this consideration will include the size and nature of the firm’s business, including the characteristics of its customer-base and the complexity and volume of expected transactions or activity.
The monitoring of business relationships should involve the application of scrutiny to large and
unusual or complex transactions, as well as to patterns of transactions or activity, to ensure that such transactions and activity are consistent with the firm’s knowledge of the customer, their business and risk profile, including where necessary, the source of funds. Particular attention should be paid to high risk relationships (for example, those involving foreign PEPs), high risk countries and territories and high risk transactions.
An unusual transaction or activity may be in a form that is inconsistent with the expected pattern
of activity within a particular business relationship, or with the normal business activities for the type of product or service that is being delivered. For example, unusual patterns of transactions with no apparent or visible economic or lawful purpose.
The nature of the monitoring in any given case will depend on the business of the firm, the
frequency of activity and the types of business. Monitoring may include reference to: specific

Chapter 11 - Page 151
types of transactions; the relationship profile; a comparison of activities or profiles with that of a similar customer or peer group; or a combination of these approaches.
11.3. Obligations
10. In accordance with Paragraph 11(1) of Schedule 3, the firm shall perform ongoing and effective
monitoring of any business relationship, which shall include – (a) reviewing identification data and records to ensure they are kept up to date, accurate and relevant, and updating such data and records when they are not up to date, accurate or relevant; (b) scrutinising any transactions or other activity to ensure that the transactions are consistent with the firm’s knowledge of the customer, their business and risk profile (including, where necessary, the source of funds) and paying particular attention to all – (i) complex transactions; (ii) transactions which are both large and unusual; and (iii) unusual patterns of activity or transactions, which have no apparent economic purpose or no apparent lawful purpose; and (c) ensuring that the way in which identification data is recorded and stored is such as to facilitate the ongoing monitoring of each business relationship.
11. In accordance with Paragraph 11(2) of Schedule 3, the extent of any monitoring carried out and
the frequency at which it is carried out shall be determined on the basis of materiality and risk including, without limitation, whether or not the business relationship is a high risk relationship.
12. Examples of the additional monitoring arrangements for high risk relationships could include:
(a) undertaking more frequent reviews of high risk relationships and updating CDD information on a more regular basis; (b) undertaking more regular reviews of transactions and activity against the profile and expected activity of the business relationship; (c) applying lower monetary thresholds for the monitoring of transactions and activity; (d) reviews being conducted by persons not directly involved in managing the relationship, for example, the MLCO; (e) ensuring that the firm has adequate MI systems to provide the board and MLCO with the timely information needed to identify, analyse and effectively monitor high risk relationships and accounts; (f) appropriate approval procedures for high value transactions in respect of high risk relationships; and/or (g) a greater understanding of the personal circumstances of high risk relationships, including an awareness of sources of third party information.
13. The firm must consider the possibility for legal persons and legal arrangements to be used as
vehicles for ML and FT.
11.4. PEP Relationships
14. The system of monitoring used by the firm must provide for the ability to identify where a
customer or beneficial owner becomes a PEP during the course of the business relationship and whether that person is a foreign PEP, domestic PEP or international organisation PEP.

Chapter 11 - Page 152
15. In accordance with Paragraph 5(3)(a)(ii) of Schedule 3, where a customer or beneficial owner
becomes a foreign PEP during the course of an existing business relationship, as part of the ECDD measures subsequently applied the firm shall obtain senior management approval to continue that relationship.
16. Where the firm identifies during the course of a business relationship that the customer or
beneficial owner is a domestic PEP or international organisation PEP, it should refer to the requirements of Commission Rule 8.45.
17. It is not expected that the firm will have a thorough knowledge of, or fully research, a family
connection. The extent to which a connection is researched should be based upon the size, scale, complexity and involvement of the person in the context of the business relationship and the profile of the business relationship, including its asset value.
18. It is possible that family members and/or associates may not inform the firm, or even be aware,
of their PEP status and therefore independent screening and monitoring should be conducted. It is also possible that an individual’s PEP status may not be present at take-on, for example, where that person takes office during the life of a business relationship. It is therefore important that ongoing monitoring exists in order to identify changes of status and risk classification.
11.5. High Risk Transactions or Activity
19. When conducting ongoing monitoring, the following are examples of red flags which may
indicate high risk transactions or activity within a business relationship:
(a) an unusual transaction in the context of the firm’s understanding of the business relationship (for example, abnormal size or frequency for that customer or peer group, or a transaction or activity involving an unknown third party); (b) funds originating from, or destined for, an unusual location, whether specific to an individual business relationship, or for a generic customer or product type; (c) the unexpected dormancy of an account, or transactions or activity unexpectedly occurring after a period of dormancy; (d) unusual patterns of transactions or activity which have no apparent economic or lawful purpose; (e) an instruction to effect payments for advisory or consulting activities with no apparent connection to the known activities of the customer or their business; (f) the involvement of charitable or political donations or sponsorship; or (g) a relevant connection with a country or territory that has significant levels of corruption, or provides funding or support for terrorist activities.
20. Transactions or activity to or from jurisdictions specified in Appendix H to this Handbook, any
Commission Notices, Instructions or Warnings and those covered by sanctions legislation applicable in the Bailiwick must be subject to a greater level of caution and scrutiny. https://www.gfsc.gg/commission/financial-crime/notices-instructions-warnings
11.6. Real-Time and Post-Event Transaction Monitoring
21. Monitoring procedures should involve a combination of real-time and post-event monitoring.
Real-time monitoring focuses on transactions and activity where information or instructions are received before or as the instruction is processed. Post-event monitoring involves periodic, for example monthly, reviews of transactions and activity which have occurred over the preceding period.

Chapter 11 - Page 153
22. Real-time monitoring of activity can be effective at reducing exposure to ML, FT and predicate
offences such as bribery and corruption, whereas post-event monitoring may be more effective at identifying patterns of unusual transactions or activities.
23. In this respect, regardless of the split of real-time and post-event monitoring, the over-arching
purpose of the monitoring process employed should be to ensure that unusual transactions and activity are identified and flagged for further examination.
11.7. Automated and Manual Monitoring
24. The firm’s monitoring processes should be appropriate having regard to its size, activities and
complexity, together with the risks identified by the firm within its business risk assessments. While bigger firms with large volumes of transactions will likely favour an automated system, the firm may conclude that a manual real-time and/or post-event monitoring process is sufficient given the size and scale of its business.
25. Notwithstanding the method of monitoring used, in accordance with the requirements of
Paragraph 11(2) of Schedule 3, the firm should adapt the parameters of its processes, in particular the extent and frequency of monitoring, on the basis of materiality and risk, including, without limitation, whether or not a business relationship is a high risk relationship.
26. In establishing the expected norms of a business relationship and in turn the appropriate
parameters for its monitoring processes to be effective, the firm should consider, as a minimum, the nature and level of expected transactions and activity and the assessed risk of the business relationships that are being monitored.
27. The rationale for deciding upon either a manual or automated method of monitoring, together
with the criteria in defining the parameters of that monitoring, should be based on the conclusions of the firm’s business risk assessments and risk appetite. The decision made by the firm should be documented as part of this process, together with an explanation demonstrating why the board consider the chosen method to be appropriate and effective.
11.7.1. Automated Monitoring Methods
28. Where the firm has a large number of business relationships or a high level of activity, effective
monitoring is likely to necessitate the automation of the monitoring process. Such automated systems may be used to facilitate the monitoring of significant volumes of transactions or business relationships, and associated customers and beneficial owners. Automated systems may also be utilised where the firm operates in an environment where the opportunity for human scrutiny of individual transactions and activity is limited, for example, in e-commerce.
29. The use of automated monitoring methods can be effective in both strands of ongoing monitoring:
(a) identifying a transaction and/or activity which warrant further scrutiny; and (b) screening customers and beneficial owners to business relationships, as well as the payers and payees to individual transactions, for connections to persons subject to UN, UK or other sanction or posing an increased risk. For example, PEPs, those convicted of criminal acts, or those persons in respect of whom adverse media exists.
30. With regard to the monitoring of transactions and activity, exception procedures and reports can
provide a simple but effective means of monitoring all incoming and outgoing transactions and activity to identify those involving, amongst other things:
(a) particular countries, territories or geographical locations; (b) particular products, services and/or accounts; or

Chapter 11 - Page 154
(c) transactions or activity falling outside of predetermined parameters within a given time frame.
31. Where an automated monitoring method is used, whether specific to the firm or a group-wide
system, the firm must:
(a) understand how the system works and how to use the system (for example, making full use of guidance); (b) understand when changes are to be made to the system (including the nature and extent of any changes); (c) understand the system’s coverage (including the extent of the transactions, activity and/or parties monitored); (d) understand the sources of data used (including both the source(s) of internal data fed into the system and the source(s) of external data to which it is compared); (e) understand the nature of the system’s output (exceptions, alerts etc.); (f) set clear procedures for dealing with potential matches, driven on the basis of risk rather than resources; and (g) record the basis for discounting alerts (for example, false positives) to ensure there is an appropriate audit trail.
32. Subject to Commission Rule 11.33. below, the firm must ensure that the parameters of any
automated system allow for the generation of alerts for large and unusual, complex, or higher risk transactions or activity which must be subject to further investigation.
33. Where the firm is a branch office or subsidiary of an international group and uses group-wide
systems for transaction and activity monitoring, the ability for the firm to dictate the particular characteristics of the monitoring conducted by the system may be limited. Where this is the case, notwithstanding the group-wide nature of the system, the firm must be satisfied that it provides adequate mitigation of the risks applicable to the business of the firm.
34. The firm should be aware that the use of computerised monitoring systems does not remove the
requirement for relevant employees to remain vigilant. It is essential that the firm continues to attach importance to human alertness. Factors such as a person’s intuition; direct contact with a customer either face-to-face or on the telephone; and the ability, through practical experience, to recognise transactions and activities which do not seem to have a lawful or economic purpose, or make sense for a particular customer, cannot be automated.
11.8. Examination
35. In accordance with Paragraph 11(3) of Schedule 3, where within an existing business relationship
there are complex, or large and unusual, transactions, or unusual patterns of transactions, which have no apparent economic or lawful purpose, the firm shall:
(a) examine the background and purpose of those transactions, and (b) increase the degree and nature of monitoring of the business relationship.
36. As part of its examination, the firm should give consideration to the following:
(a) reviewing the identified transaction or activity in conjunction with the relationship risk assessment and the CDD information held; (b) understanding the background of the activity and making further enquiries to obtain any additional information required to enable a determination to be made by the firm as to whether the transaction or activity has a rational explanation and economic purpose;

Chapter 11 - Page 155
(c) reviewing the appropriateness of the relationship risk assessment in light of the unusual transaction or activity, together with any supplemental CDD information obtained; and (d) considering the transaction or activity in the context of any other connected business relationships and the cumulative effect this may have on the risk attributed to those relationships.
37. For the purposes of Paragraph 11(3) of Schedule 3, what constitutes a large and unusual or
complex transaction will be based on the particular circumstances of a business relationship and will therefore vary from customer to customer.
38. The firm must ensure that the examination of any large and unusual, complex, or otherwise higher
risk transaction or pattern of transactions or other activity is sufficiently documented and that such documentation is retained in a readily accessible manner in order to assist the Commission, the FIS, other domestic competent authorities and auditors.
39. The firm must ensure that procedures are maintained which require that an internal disclosure is
filed with the MLRO in accordance with the requirements of Chapter 13 of this Handbook where the circumstances of the transaction or activity raise a suspicion of ML and/or FT.
40. Following the conclusion of its examination, the firm should give consideration to whether
follow-up action is necessary in light of the identified transaction or activity. This could include, but is not limited to:
(a) applying ECDD measures where this is considered necessary or where the firm has reassessed the business relationship as being high risk as a consequence of the transaction or activity; (b) considering whether further employee training in the identification of large and unusual, complex, or higher risk transactions and activity is needed; (c) subject to Commission Rule 11.33. above, considering whether there is a need to adjust the monitoring system (for example, refining monitoring parameters or enhancing controls for more vulnerable products, services and/or business units); and/or (d) applying increased levels of on-going monitoring for particular relationships.
11.9. Ongoing Customer Due Diligence
41. The requirement to conduct ongoing CDD will ensure that the firm is aware of any changes in
the development of a business relationship. The extent of the firm’s ongoing CDD measures must be determined on a risk-sensitive basis. However, the firm must be aware that as a business relationship develops, the risks of ML and FT may change.
42. The Commission would expect ongoing CDD to be conducted on a periodic basis in line with the
requirement to review relationship risk assessments in accordance with Paragraph 3(4)(b) of
Schedule 3, or where a trigger event occurs in the intervening period.
43. It should be noted that it is not necessary to re-verify or obtain current identification data unless
an assessment has been made that the identification data held is not adequate for the assessed risk of the business relationship or there are doubts about the veracity of the information already held. Examples of such could include a material change in the way that the business of the customer is conducted which is inconsistent with its existing business profile, or where the firm becomes aware of changes to a customer’s or beneficial owner’s circumstances, such as a change of address.

Chapter 11 - Page 156
44. In order to reduce the burden on customers and other key principals in low risk relationships,
trigger events (for example, the opening of a new account or the purchase of a further product) may present a convenient opportunity to review the CDD information held.
11.10. Oversight of Monitoring Controls
45. The MLCO should have access to, and familiarise his or her self with, the results and output from
the firm’s monitoring processes. Such output should be reviewed by the MLCO who in turn should report regularly to the board, providing relevant MIsuch as statistics and key performance indicators, together with details of any trends and actions taken where concerns or discrepancies have been identified.
46. The board should consider the appropriateness and effectiveness of the firm’s monitoring
processes as part of its annual review of the firm’s business risk assessments and associated policies, procedures and controls. This should include consideration of the extent and frequency of such monitoring, based on materiality and risk as set out in the business risk assessments.
47. Where the firm identifies weaknesses within its monitoring arrangements, it should ensure that
these are rectified in a timely manner and consideration should be given to notifying the Commission in accordance with the requirements of Section 2.7. of this Handbook.

Chapter 12
UN, UK and Other Sanctions
Contents of this Chapter
12.1. Introduction.........................................................................................................................158
12.2. Overview.............................................................................................................................158
12.3. The Bailiwick’s Sanctions Regime .....................................................................................159
12.4. The Bailiwick’s Sanctions Regime – Sanctions Committee...............................................159
12.5. The Bailiwick’s Sanctions Regime – External Relations Group ........................................160
12.6. Obligation to Report ...........................................................................................................160
12.7. Designated Persons.............................................................................................................160
12.8. Licences..............................................................................................................................160
12.9. Policies, Procedures and Controls.......................................................................................161
12.10. Customer Screening ............................................................................................................162
12.11. Compliance Monitoring Arrangements ..............................................................................162

Chapter 12 - Page 158
12.1. Introduction

A sanction is a measure imposed by a government using laws and regulations to apply restrictive
measures against a country, regime, individual, entity, industry or type of activity believed to be violating international law and could include one or more of the following:
(a) the freezing of funds;
(b) the withdrawal of financial services;
(c) a ban or restriction on trade;
(d) a ban or restriction on travel; or
(e) suspension from international organisations.
The ultimate objective of a sanction varies according to the situation. For instance, an arms
embargo and a ban on the export of certain items or raw materials could be aimed at supporting a peace process and restricting the financing of weapons by combatants. Sanctions may also be aimed at preventing the proliferation of weapons of mass destruction, disrupting terrorist operations, or trying to change the policies and actions of the target. Sanctions of this kind are a tool used increasingly for enforcing foreign policy by putting pressure on a state or entity in order to maintain or restore international peace and security. Often, sanctions are used as an alternative to force. All recent UN, UK and EU sanctions contain information as to their intended aim or purpose.
This Chapter outlines the statutory provisions applicable to firms within the Bailiwick concerning
UN, UK, EU and other sanctions. It also covers the policies, procedures and controls required in order to comply with the Bailiwick’s sanctions regime and the provisions for the disclosure of information to the relevant authorities in respect of designated persons and the freezing of funds.
12.2. Overview
The UN is the supranational body which determines sanction measures, which the UK adopts
alongside enacting its own sanction measures, which are applied in the Bailiwick.
The UN Security Council can take measures to maintain, or restore, international peace or
security. Such measures range from economic sanctions to international military action. Each UN member state is then called upon to implement the requirements of a sanctions measure in its own territory.
The UK puts in place sanctions measures to fulfil a range of purposes, including complying with
UN and other international obligations supporting foreign policy and national security objectives, as well as maintaining international peace and security and preventing terrorism. The UK implements a range of sanctions regimes through regulations made under the Sanctions and AntiMoney Laundering Act 2018 (the “Sanctions Act”). The Sanctions Act provides the main legal basis for the UK to impose, update and lift sanctions.
The EU applies sanctions in pursuit of the specific objectives of the Common Foreign and
Security Council as set out in the Treaty of the European Union. EU sanctions are either adopted to ensure compliance with UN sanctions requirements or enacted autonomously by the EU to advance specific EU objectives. European Council regulations imposing sanctions apply directly in member states. However, further legislation is required in each member state to impose penalties for sanctions breaches under European Council regulations.
European Council regulations impose restrictive measures in respect of designated persons, that
is, persons, groups or entities designated by the UN Sanctions Committee or the EU’s Security Council. These designated persons are listed in Annex 1 to European Council regulations.

Chapter 12 - Page 159
9. A country may also impose sanctions unilaterally as an extension of its own foreign policy, for
example, the UK via HM Treasury or the US via OFAC, and can request that other jurisdictions implement sanctions against a person, group or entity.
12.3. The Bailiwick’s Sanctions Regime
10. The Bailiwick has enacted numerous pieces of legislation which implement sanctions measures,
many dealing specifically with FT, the aim of which is to limit the availability of funds and financial services to terrorists and terrorist organisations:

The Terrorist Asset-Freezing Law
The Afghanistan (Sanctions) (EU Exit) Regulations 2020
The ISIL (Da’esh) and Al-Qaida (United Nations Sanctions) (EU Exit) Regulations 2019
The Terrorism Law

In addition to the sanctions regime implemented by the above enactments, the Bailiwick has
passed additional legislation to implement a wide range of country-specific sanctions enabling the implementation of sanctions imposed by the UN and/or the UK. Sanctions are implemented through regulations made under the Sanctions Law.
While the Bailiwick’s sanctions regime is based upon legislation that broadly mirrors equivalent
legislation in the UK, it is completely separate from, and operates independently of, the UK regime.
Notwithstanding the Bailiwick’s independent sanctions regime, trans-jurisdictional issues may
arise at times. Many transfers of funds will be made to or from another jurisdiction that operates a sanctions regime and in such cases a licence, authorisation, or notification may be required in both jurisdictions. In addition, the legislative frameworks of some jurisdictions contain provisions which have extra-territorial effect, so that they may apply to some of the parties involved in a Bailiwick transaction on the grounds of nationality or place of incorporation even if the jurisdiction in question is not involved in that transaction.
Whilst not directly enforceable in the Bailiwick, the firm should be aware, in particular, of
sanctions implemented by OFAC. OFAC regulations apply to any persons or entities, wherever based, trading in US Dollars, as well as:
(a) US citizens and permanent resident immigrants regardless of where they are located; (b) persons and entities within the US; (c) US incorporated entities and their foreign branches; (d) in the cases of certain sanctions, such as those regarding Cuba and North Korea, all foreign subsidiaries owned or controlled by US companies; and (e) in certain cases, foreign persons in possession of US origin goods.
12.4. The Bailiwick’s Sanctions Regime – Sanctions Committee
The Bailiwick has established a Sanctions Committee to co-ordinate sanction activities, ensure
information is distributed publicly and to provide advice on sanctions. The Sanctions Committee reports to the External Relations Group of the States of Guernsey’s Policy and Resources Committee and to the Bailiwick’s AML/CFT Advisory Committee.

Chapter 12 - Page 160
12.5. The Bailiwick’s Sanctions Regime – External Relations Group
16. The External Relations Group is mandated on behalf of the Policy and Resources Committee to:
(a) agree to implement new sanctions measures; (b) license frozen funds; and (c) administer notifications and authorities, for example, those under specific ordinances.
17. The External Relations Group also works with HM Treasury and the Foreign Commonwealth &
Development Office.
12.6. Obligation to Report
18. Under the Terrorist Asset-Freezing Law and the Sanctions Law, it is a criminal offence for the
firm to fail to disclose to the Policy and Resources Committee any knowledge or suspicion it may have that a customer or potential customer is a designated person or has committed any of the offences set out in the Terrorist Asset-Freezing Law or the Sanctions Law. This requirement is in addition to the reporting obligations in the Disclosure Law and the Terrorism Law. A guidance note issued by the Policy and Resources Committee regarding obligations under the Sanctions Law can be found through the following link:
https://www.gov.gg/CHttpHandler.ashx?id=121933&p=0
19. The firm should be aware that the effects of failing to comply with sanctions orders could have
serious repercussions. This could include prosecution for criminal offences and/or financial penalties, levied not only against the firm, but potentially also personally against the senior management of the firm. Any such prosecution is likely to result in extensive reputational damage for the firm, its board and the Bailiwick as an international finance centre.
12.7. Designated Persons
20. For the purposes of the Terrorist Asset-Freezing Law, a designated person means any natural or
legal person, group or entity which is:
(a) designated by the Policy and Resources Committee under the Terrorist Asset-Freezing Law; (b) the subject of a designation under and within the meaning of the UK’s Terrorist AssetFreezing etc. Act 2010; (c) included in the list provided for by Article 2(3) of Council Regulation (EC) No 2580/2001 of 27 December 2001 on specific restrictive measures directed against certain persons and entities with a view to combating terrorism (as amended from time to time); or (d) subject to a designation under and within the meaning of the Counter-Terrorism (International Sanctions) (EU Exit) Regulations 2019.
12.8. Licences
21. The States of Guernsey’s Policy and Resources Committee may grant a licence permitting the
release of specified funds which would otherwise be caught by the provisions of the Terrorist Asset-Freezing Law and of the Sanctions Law. No offence is committed in respect of such funds provided that the terms of the licence are complied with.
22. The Policy and Resources Committee will consider applications for licences under the Terrorist
Asset-Freezing Law and the Sanctions Law from any party. Such licences will normally only be

Chapter 12 - Page 161
issued in respect of funding for necessities such as food, medical treatment and accommodation, but funding for extraordinary expenses will also be considered.
12.9. Policies, Procedures and Controls
23. The firm must have in place appropriate and effective policies, procedures and controls to identify,
in a timely manner, whether a prospective or existing customer, or any beneficial owner, key principal or other connected party, is the subject of a sanction issued by the UN, UK or the States of Guernsey’s Policy and Resources Committee.
24. Examples of other connected parties for the purposes of Commission Rule 12.23. above include
individuals or groups not deemed to be beneficial owners but who own rights or interests in a legal person customer and third party recipients of transactions.
25. For the purposes of Commission Rule 12.23., HM Treasury maintains a list which includes all
persons whose designations are effective in the Bailiwick (including designations by the UN), other than those persons specifically designated by the Policy and Resources Committee under the Terrorist Asset-Freezing Law who are separately listed by the States of Guernsey. Both lists can be found through the below links:
www.gov.uk/government/publications/financial-sanctions-consolidated-list-oftargets/consolidated-list-of-targets www.gov.gg/sanctionsmeasures
26. It should be noted that the UN and EU do not have a notification facility for advising when the
lists of designated persons maintained by them are updated. However, HM Treasury (including UN and EU designations) and OFAC both offer facilities for notification by e-mail when a financial sanctions related release is published. Below are links to both facilities:
public.govdelivery.com/accounts/UKHMTREAS/subscriber/new service.govdelivery.com/accounts/USTREAS/subscriber/new?topic_id=USTREAS_61
27. In addition, as referenced previously, OFAC sanctions apply to all transactions in US Dollars.
Therefore where the firm is party to such a transaction it should be mindful of the US sanctions regime. OFAC publishes a list of individuals and companies owned or controlled by, or acting for or on behalf of, targeted countries. It also lists individuals, groups and entities, such as terrorists and narcotics traffickers designated under programmes that are not country specific. Collectively such individuals and companies are called Specially Designated Nationals (“SDNs”). The assets of SDNs are blocked and US entities are prohibited from dealing with them. The list of SDNs, and a free OFAC search facility, can be found through the below links:
www.treasury.gov/resource-center/sanctions/SDN-List/Pages/default.aspx sanctionssearch.ofac.treas.gov/
28. The firm must have in place a system and/or control to detect and block transactions connected
with those natural persons, legal persons and legal arrangements designated by the Bailiwick’s sanctions regime.
29. The transaction monitoring systems and/or controls used should enable the firm to identify:
(a) transactions, both incoming and outgoing, involving designated persons; and

Chapter 12 - Page 162
(b) where the firm is a bank or PSP, transactions where insufficient identifying information has been provided in accordance with the wire transfer requirements, potentially for the purpose of circumventing sanctions monitoring controls (see Chapter 14 of this Handbook).
12.10. Customer Screening
30. In order to comply with Commission Rule 12.23. above, as a minimum the firm should undertake
sanctions screening for all new business relationships and occasional transactions, including the customer, beneficial owner and other key principals, at the time of take-on, during periodic reviews and when there is a trigger event generating a relationship review.
31. Following changes to the lists of persons designated by the UN or UK, the States of Guernsey
Policy and Resources Committee will issue sanctions notices to alert firms to such changes. These sanctions notices are issued by the FIS via THEMIS and the Commission through its website. mlro.gov.gg www.gfsc.gg/news/sanctions
32. The firm should have appropriate procedures and controls in place to ensure that the content of
such notices is reviewed without delay, including a comparison of the firm’s customer base against the designated persons listed within the notices. Where a positive match is identified the firm should ensure that the requisite report is filed in accordance with the legislation relevant to the particular sanctions notice.
33. Where the firm utilises an automated method of sanctions screening, the firm should maintain,
or have access to, an audit trail of the screening conducted by the system. The audit trail should enable the firm to demonstrate the dates on which screening checks have been undertaken and the results of those checks, thus allowing the firm to satisfy itself, and demonstrate to third parties, that the system is operating effectively. Where the firm is part of a wider group and utilises a group-wide screening system, the firm should seek written confirmation from its head office that such an audit trail exists and that the firm can have access to any specific records upon request.
12.11. Compliance Monitoring Arrangements
34. The firm must ensure that its compliance monitoring arrangements include an assessment of the
effectiveness of the firm’s sanctions controls and their compliance with the Bailiwick’s sanctions regime.
35. Testing undertaken in respect of any sanctions screening system should cover the following:
(a) ensuring that the screening system has been correctly configured and that the relevant preset rules have been activated; (b) assessing the accuracy of the screening system or method utilised, for example, through an analysis of the alerts generated, to ensure that designated persons are promptly identified; (c) determining the appropriateness of the firm’s controls for the business undertaken, including the method and frequency of testing; (d) where upgrades have been applied, ensuring that the system performs as expected; (e) where reliance is placed upon a third party for sanctions screening, the firm should verify the effectiveness of the screening being undertaken by that party; and

Chapter 12 - Page 163
(f) determining the appropriateness of the action taken by the firm where a sanctions match has been identified to ensure that the proceeds associated with designated persons are controlled and the necessary reporting undertaken in compliance with applicable regulatory requirements.
36. As part of its compliance testing, the firm should give consideration to assessing the sensitivity
of any screening tools used, i.e. testing the system’s ‘fuzzy logic’. Such tests could be conducted by using real-life case studies, entering the name of sanctioned natural or legal persons to ensure that the expected results are achieved.

Chapter 13
Reporting Suspicion
Contents of this Chapter
13.1. Introduction.........................................................................................................................166
13.2. Definition of Knowledge or Suspicion ...............................................................................167
13.3. Obligation to Disclose.........................................................................................................167
13.4. Attempted Transactions ......................................................................................................168
13.5. Potential Red Flags.............................................................................................................169
13.6. Policies, Procedures and Controls.......................................................................................170
13.7. Internal Disclosures ............................................................................................................170
13.8. Form and Manner of Disclosure to the FIS.........................................................................171
13.9. Information to be Provided with a Disclosure ....................................................................171
13.10. Group Reporting .................................................................................................................172
13.11. The Response of the FIS.....................................................................................................172
13.12. Consent Requests................................................................................................................173
13.13. Tipping Off .........................................................................................................................174
13.14. Terminating a Business Relationship..................................................................................174
13.15. FIS Requests for Additional Information............................................................................175
13.16. Management Information....................................................................................................175
13.17. Record Keeping ..................................................................................................................175
13.18. Legal Professional Privilege and Privileged Circumstances...............................................176
13.18.1. Introduction.................................................................................................................176
13.18.2. Overview of LPP.........................................................................................................177
13.18.3. Advice Privilege..........................................................................................................177
13.18.4. Litigation Privilege .....................................................................................................177
13.18.5. Important Points to Consider with LPP ......................................................................178
13.18.6. Exceptions to LPP.......................................................................................................178
13.18.7. Privileged Circumstances............................................................................................178
13.18.8. Differences Between LPP and Privileged Circumstances...........................................179
13.18.9. Making a Disclosure ...................................................................................................179
13.19. THEMIS Notices ................................................................................................................180

Chapter 13 - Page 166
13.1. Introduction

This Chapter outlines the statutory provisions concerning the disclosure of information; the
policies, procedures and controls necessary for reporting and disclosing suspicion; and the provision of information for the purposes of the reporting and disclosing of suspicion.
The obligations to report and disclose suspicion are set out within the Disclosure Law and the
Terrorism Law (together “the Reporting Laws”). Additional obligations are set out in the Disclosure (Bailiwick of Guernsey) Regulations, 2007 as amended (“the Disclosure Regulations”) and the Terrorism and Crime (Bailiwick of Guernsey) Regulations, 2007 as amended (together “the Reporting Regulations”), together with Schedule 3.
References in this Chapter to suspicion are references to suspicion that another person is engaged
in ML or FT, or that certain property is, or is derived from, the proceeds of criminal conduct or terrorist property, as the case may be.
References in this Chapter to criminal conduct are references to any conduct which constitutes a
criminal offence under the law of any part of the Bailiwick, or is, or corresponds to, conduct which, if it all took place in any part of the Bailiwick, would constitute an offence under the law of that part of the Bailiwick.
References in this Chapter to ML are references to offences under Sections 38, 39 and 40 of the
Law or Part IV of the Drug Trafficking (Bailiwick of Guernsey) Law, 2000 as amended (“the Drug Trafficking Law”).
The overall purpose of Sections 38, 39 and 40 of the Law and Part IV of the Drug Trafficking
Law is to create extremely wide ranging ‘all crime’ prohibitions on ML, covering the following activities:
concealing or transferring the proceeds of criminal conduct or drug trafficking; assisting another person to retain the proceeds of criminal conduct or drug trafficking; and the acquisition, possession or use of the proceeds of criminal conduct or drug trafficking.
References in this Chapter to FT are references to offences under Sections 8, 9, 10 or 11 of the
Terrorism Law, Sections 9, 10, 11, 12 or 13 of the Terrorist Asset-Freezing Law or under Ordinances implementing international sanctions measures in respect of terrorism that are listed at Section 79 of the Terrorism Law. These offences apply not only to the financing of terrorist acts, but also to the financing of terrorist organisations, or individual terrorists, even in the absence of a link to a specific terrorist act or acts. The offences cover the following activities:
fund raising for the purpose of terrorism; using or possessing money or other property that is intended to be, or may be, used for the purposes of terrorism; funding arrangements for the purposes of terrorism; money laundering of terrorist property; and making funds or other economic resources available to persons included in terrorismrelated sanctions lists.
The ML offences in Sections 38 to 40 of the Law and Part IV of the Drug Trafficking Law are
expressed as not applying to acts carried out with the consent of a police officer, where that consent is given following a disclosure of suspicion. The same applies in respect of the FT offences at Sections 9 to 11 of the Terrorism Law. The effect of these provisions is that if, following the making of a report and disclosure of suspicion under the Reporting Laws, the FIS consents to the firm or person in question carrying out a relevant act, the firm or person will have a defence to a possible charge of ML or FT, as the case may be, in relation to that act. This is

Chapter 13 - Page 167
referred to informally as the consent regime and is covered further at Section 13.12. of this
Chapter.
9. Pursuant to the Reporting Regulations, the firm shall report and disclose suspicion to the FIS
using the prescribed manner, specifically the online reporting facility THEMIS. Further information on the form and manner of disclosing suspicion can be found in Section 13.8. of this
Chapter.
10. The firm should note that the court will take account of the Commission Rules and guidance
provided in this Handbook in considering compliance with the disclosure requirements of the Reporting Laws, the Reporting Regulations and Schedule 3.
11. References in this Chapter to a transaction or activity include an attempted or proposed
transaction or activity, or an attempt or proposal to enter into a business relationship or undertake an occasional transaction.
13.2. Definition of Knowledge or Suspicion
12. The Reporting Regulations do not define suspicion, though there is a body of UK case law which
has been applied in the Bailiwick and which can assist employees of the firm in determining if there is sufficient knowledge or suspicion to file an internal disclosure with the MLRO, and in turn assist the MLRO in determining whether to make an external disclosure to the FIS.
13. In the case of R v Hilda Gondwe Da Silva1
, the following was considered to amount to suspicion:
‘there is a possibility, which is more than fanciful, that the relevant facts exist. A vague feeling of unease would not suffice. But the statute does not require the suspicion to be ‘clear’ or ‘firmly grounded and targeted on specific facts’, or based upon ‘reasonable grounds’’.
14. In the case of Shah v HSBC2
, the English High Court took the view that there is a very low threshold for suspicion, which does not have to be either reasonable or rational.
15. The English courts have therefore defined suspicion as beyond mere speculation, being based on
some substance. It is something less than personal or subjective knowledge and does not require proof based on firm evidence. The individual filing a disclosure must think there is a possibility, more than merely fanciful, that the relevant facts exist and the suspicion must be of a settled nature, i.e. more than an ‘inkling’ or ‘fleeting thought’.
13.3. Obligation to Disclose
16. In accordance with the requirements of the Reporting Laws, all suspicious transactions and
activity, including attempted transactions and activity, are to be reported regardless of the value of the transaction.
17. A suspicion may be based upon:
(a) a transaction or attempted transaction or activity which is inconsistent with a customer’s (or beneficial owner’s) known legitimate business, activities or lifestyle or is inconsistent with the normal business for that type of product/service; or (b) information from other sources, including law enforcement agencies, other government bodies (for example, Income Tax), the media, intermediaries, or the customer themselves. 1 R v Hilda Gondwe Da Silva [2006] 2 Crim App R 35 2 Shah v HSBC Private Bank (UK) Limited [2012] EWHC 1283

Chapter 13 - Page 168
18. An important precondition for the recognition of suspicious activity is for the firm to know
enough about the business relationship or occasional transaction to recognise that a transaction or activity is unusual in the context. Such knowledge would arise mainly from complying with the monitoring and on-going CDD requirements in Paragraph 11 of Schedule 3 and Chapter 11 of this Handbook.
19. The board of the firm and all employees should appreciate and understand the significance of
what is often referred to as the objective test of suspicion. It is a criminal offence for anyone employed by the firm to fail to report where they have knowledge, suspicion, or reasonable grounds for knowledge or suspicion, that another person is laundering the proceeds of any criminal conduct or is carrying out terrorist financing.
20. What may constitute reasonable grounds for knowledge or suspicion will be determined from
facts or circumstances from which an honest and reasonable person employed by the firm would have inferred knowledge or formed the suspicion that another was engaged in ML or FT.
21. A transaction or activity which appears unusual is not necessarily suspicious. An unusual
transaction or activity is, in the first instance, likely to be a basis for further enquiry, which may in turn require judgement as to whether it is suspicious. As an example, an out of the ordinary transaction or activity within a business relationship should prompt the firm to conduct enquiries about the transaction or activity.
22. There may be a number of reasons why the firm is not entirely happy with CDD information or
where the firm otherwise needs to ask questions. Examples of such are provided within Section
13.5. of this Chapter. Where the firm has queries, regardless of the level of suspicion, to assist
them in formulating or negating a suspicion, any enquiries of the customer or other key principal should be made having due regard to the tipping off provisions.
23. The firm should consider whether the nature of a particular suspicion is such that all of the assets
of the business relationship are potentially suspect. Where it is not possible to separate assets which are suspicious from those which are legitimate, it will be necessary to carefully consider all future transactions or activity and the nature of the continuing relationship. The firm should also consider implementing an appropriate risk-based strategy to deal with any risk associated with the business relationship.
24. It should be noted that suspicion of ML or FT could relate to assets whether they directly or
indirectly relate to criminal conduct.
25. While the firm is not expected to conduct the kind of investigation carried out by law enforcement
agencies, it must act responsibly when asking questions to satisfy any gaps in its CDD, or its understanding of a particular transaction or activity or proposed transaction or activity.
13.4. Attempted Transactions
26. The definition of ML and FT in the Reporting Laws includes an attempt to carry out an offence
of ML or FT. This means that attempted transactions fall within the scope of the reporting obligations. An attempted transaction could be classified as one that a customer intended to conduct with the firm and took some form of action or activity to do so but failed to complete. An attempted transaction is different from a single request for information, such as an enquiry as to the fee applicable to a specific transaction. The customer must enter into negotiations or discussions with the firm to conduct the transaction or activity and such activity must involve specific measures to be taken by either the customer or the firm.

Chapter 13 - Page 169
27. The obligation to report suspicion applies to all types of activity and attempted transactions or
activity, including circumstances where there is no existing business relationship with the customer and no such business relationship is subsequently established.
28. During the course of attempting to set up a new business relationship, due consideration should
be given during the CDD process to key points raised with or by the customer, for example, if the customer fails to explain the source of funds; if the purpose of the account or advice required does not make sense; or if questions are asked about the disclosure to tax authorities of the existence of an account or the disclosure to other similar authorities. Depending upon the information received, the firm may form a suspicion of ML and/or FT in which case a disclosure shall be submitted to the FIS in accordance with the Disclosure Law or the Terrorism Law.
29. The FIS has published a guidance document concerning ‘Attempted Transactions’. The objective
of the document is to assist firms in the determination of whether a disclosure should be submitted to the FIS. http://www.guernseyfiu.gov.gg/CHttpHandler.ashx?id=91507&p=0
13.5. Potential Red Flags
30. The following is a non-exhaustive list of possible ML and FT red flags that the firm should be
mindful of when dealing with a business relationship or occasional transaction:
(a) The deposit or withdrawal of unusually large amounts of cash from an account. (b) Deposits or withdrawals at a frequency that is inconsistent with the firm’s understanding of that customer and their circumstances. (c) Transactions involving the unexplained movement of funds, either as cash or wire transfers. (d) Payments received from, or requests to make payments to, unknown or un-associated third parties. (e) Personal and business related money flows that are difficult to distinguish from each other. (f) Financial activity which is inconsistent with the legitimate or expected activity of the customer. (g) An account or business relationship becomes active after a period of dormancy. (h) The customer is unable or reluctant to provide details or credible explanations for establishing a business relationship, opening an account or conducting a transaction. (i) The customer holds multiple accounts for no apparent commercial or other reason. (j) Bank drafts cashed in for foreign currency. (k) Cash deposited domestically with the funds subsequently withdrawn from ATMs in another jurisdiction. (l) Early surrender of an insurance policy incurring substantial loss. (m) Frequent early repayment of loans. (n) Frequent transfers indicated as loans sent from relatives. (o) Funds transferred to a charity or NPO with suspected links to a terrorist organisation. (p) High level of funds placed on store value cards. (q) Insurance policy being closed with a request for the payment to be made to a third party. (r) Large amounts of cash from unexplained sources. (s) Obtained loan and repaid balance in cash. (t) Purchase of high value assets followed by immediate resale with payment requested via cheque. (u) Request by a third party (outside of the Bailiwick) to pay cash (in excess of €10,000) for purchase of high value assets, for example, vehicles.

Chapter 13 - Page 170
31. The above list is not exhaustive and its content is purely provided to reflect examples of possible
red flags. The existence of one or more red flag does not automatically indicate suspicion and there may be a legitimate reason why a customer has acted in the manner identified.
13.6. Policies, Procedures and Controls
32. In accordance with Paragraph 12(1)(h) of Schedule 3, the firm shall ensure that it establishes and
maintains such other appropriate and effective procedures and controls as are necessary to ensure compliance with requirements to make disclosures under Part I of the Disclosure Law, and Sections 15 and 15A or Section 12 (as appropriate) of the Terrorism Law.
33. In establishing appropriate and effective policies, procedures and controls to facilitate compliance
with the requirements of the Reporting Laws and the Reporting Regulations, the firm’s policies, procedures and controls must ensure that:
(a) each suspicion of ML or FT is reported to the MLRO, or in his or her absence a Nominated Officer, regardless of the amount involved and regardless of whether, amongst other things, it is thought to involve tax matters, in a manner sufficient to satisfy the statutory obligations of the employee; (b) where an employee of the firm knows or suspects, or has reasonable grounds for knowing or suspecting, that someone is engaged in ML and/or FT, an internal disclosure is made to the MLRO, or in his or her absence a Nominated Officer, of the firm; (c) the MLRO or Nominated Officer promptly considers each internal disclosure and determines whether it results in there being knowledge or suspicion, or reasonable grounds for knowledge or suspicion, that someone is engaged in ML and/or FT or that certain property represents, or is derived from, the proceeds of criminal conduct or terrorist property; (d) where the MLRO or Nominated Officer has determined that an internal disclosure does result in there being such knowledge or suspicion, or reasonable grounds for knowledge or suspicion, that someone is engaged in ML and/or FT, that the MLRO or Nominated Officer discloses that suspicion to the FIS; and (e) all internal and external disclosures made in the above manner are of a high quality and meet the standards set out in this Handbook and in any feedback and guidance notices issued by the FIS and the Commission.
13.7. Internal Disclosures
34. In accordance with Paragraph 12(1)(e) Schedule 3, the firm shall ensure that where an employee,
other than the MLRO, is required to make a disclosure under Part I of the Disclosure Law, or
Section 15 or Section 12 (as appropriate) of the Terrorism Law, that this is done by way of a report
to the MLRO, or, in that officer’s absence, to a Nominated Officer.
35. The firm must have appropriate and effective internal disclosure policies, procedures and controls
to ensure that:
(a) all employees know to whom within the firm and in what format their suspicions must be disclosed; (b) all internal disclosures are considered by the MLRO, or in his or her absence a Nominated Officer, and where the MLRO or Nominated Officer makes a decision not to make an external disclosure to the FIS, the reasons for the decision not to disclose are documented and retained; (c) enquiries made by an MLRO or Nominated Officer in respect of disclosures are recorded and documented; and

Chapter 13 - Page 171
(d) once an external disclosure has been made to the FIS, the MLRO or Nominated Officer immediately informs the FIS where subsequent relevant information or documentation is received.
36. The MLRO should consider whether to include within the firm’s procedures the provision of an
acknowledgment to evidence the submission of an internal disclosure. Such an acknowledgement would provide confirmation to the submitter that his or her statutory obligations have been fulfilled.
13.8. Form and Manner of Disclosure to the FIS
37. In accordance with the requirements of the Reporting Laws, suspicion of ML shall be disclosed
under the provisions of the Disclosure Law and suspicions relating to FT shall be disclosed under the Terrorism Law.
38. The Reporting Laws require that information contained in an internal disclosure made to an
MLRO or Nominated Officer is disclosed to the FIS where the MLRO or Nominated Officer knows or suspects, or has reasonable grounds for knowing or suspecting, as a result of the internal disclosure, that a person is engaged in ML and/or FT.
39. In accordance with Paragraph 12(1)(f) of Schedule 3, the firm shall ensure that the MLRO, or in
that officer’s absence a Nominated Officer, in determining whether or not he or she is required to make a disclosure under Part I of the Disclosure Law, or Section 15A or Section 12 (as appropriate) of the Terrorism Law, takes into account all relevant information.
40. The Reporting Regulations provide that disclosures to the FIS are to be made in the prescribed
manner, specifically through the online reporting facility THEMIS:
mlro.gov.gg
41. In exceptional circumstances a disclosure can be made using the form set out in the Schedule to
the Disclosure Regulations. However, in accordance with Regulation 1(2) of the Disclosure Regulations, the firm shall obtain the consent of an authorised officer (SIO, Inspector or above) prior to submitting such a form.
42. In accordance with Paragraph 12(1)(g) of Schedule 3, the firm shall ensure that the MLRO, or, in
his or her absence, a Nominated Officer, is given prompt access to any other information which may be of assistance to him or her in considering any report.
43. Prior to making a disclosure to the FIS, the firm should consider all available information in
respect of the business relationship or occasional transaction. Notwithstanding this consideration, disclosures to the FIS should be made promptly following a determination by the MLRO or Nominated Officer that a disclosure is appropriate.
44. Where the MLRO or Nominated Officer considers that a disclosure should be made urgently, for
example, where the customer’s product is already part of a current investigation, initial notification to the FIS may be made by telephone on +44(0) 1481 714081. http://www.guernseyfiu.gov.gg/article/5991/FIU-Contact
13.9. Information to be Provided with a Disclosure
45. The firm should provide the FIS with a full account of the circumstances and grounds (suspected
underlying criminality) for suspicion. In providing such detail the firm should include as much

Chapter 13 - Page 172
relevant information and documentation as possible (for example, CDD information, statements, contract notes, minutes, transcripts, etc.) to demonstrate why suspicion has been raised and to enable the FIS to fully understand the purpose and intended nature of the business relationship or occasional transaction.
46. The firm should examine all connected accounts and/or relationships and provide detailed,
current balances of such to the FIS. Research of connected accounts or relationships should not delay the firm making a disclosure to the FIS.
47. The Reporting Laws provide that a disclosure made in good faith to a police officer does not
contravene any obligation as to confidentiality or other restriction on the disclosure of information imposed by statute, contract or otherwise. Additionally, the Reporting Laws require that disclosures made under them include information or documentation relating to the knowledge, suspicion, or reasonable grounds for suspicion, that the person in respect of whom the disclosure is made is engaged in ML and/or FT, and any fact or matter upon which such knowledge, suspicion, or reasonable grounds for suspicion, is based.
48. The firm is also required to provide the FIS with the reasons for suspicion. The firm should
clearly define the grounds for suspicion and any specific indicators or suspected criminality within the main body of the disclosure. The firm may have multiple grounds, i.e. ML and tax evasion or bribery and corruption and fraud.
49. For the purposes of the above, ‘information’ or ‘document’ includes any information or document
relating to:
(a) any money or property;
(b) any transaction concerning such money or property; or (c) the parties to any such transaction.
50. Where the firm is a legal professional, consideration should be given to Section 13.18. of this
Handbook which provides guidance in respect of information or documentation which may be subject to legal professional privilege.
13.10. Group Reporting
51. It is for each firm or group to consider whether, in addition to any disclosure made in the
Bailiwick, the MLRO should report suspicions within the firm or group, for example, to the compliance department at head office. A report to head office, the parent or group does not remove the requirement to disclose suspicions to the FIS.
52. When deciding whether to report within the firm or group, consideration should be given to the
sensitivity of the disclosure and the risks involved in the sharing of this information, for example, if the subject of the disclosure is under ongoing investigation by the FIS. In this respect, consideration should be given by the firm to anonymising disclosures prior to onward reporting.
13.11. The Response of the FIS
53. Upon submitting a disclosure to the FIS via THEMIS, a response acknowledging receipt will be
sent automatically. Similarly if, following appropriate permission from the FIS, a paper disclosure has been submitted, a response acknowledging receipt will be sent to the firm.
54. If the FIS consider that the disclosure, whether through THEMIS or in paper form, contains
information that is not of a qualitative nature as detailed in Section 13.9. above, the firm will be notified and sufficient additional information should be provided to the FIS.

Chapter 13 - Page 173
55. Access to disclosures will be restricted to appropriate authorities and any information provided
by the FIS emanating from such disclosures will normally be anonymous. In the event of a prosecution, the source of the information will be protected as far as the law allows.
56. In addition, the FIS will, so far as is possible, supply on request and through planned initiatives,
information as to the current status of any investigations emanating from a disclosure as well as more general information regarding identified trends and indicators.
13.12. Consent Requests
57. It is for each firm, group or person to consider whether any disclosure of suspicion made to the
FIS concerns an ‘act’ that would constitute an ML offence as detailed in Section 13.1. above.
58. If the firm, group or person suspects such an ‘act’ may be committed and the firm, group or
person intends to carry out such an ‘act’, a request should be submitted, as part of the firm’s disclosure to the FIS, outlining the suspected ‘act’ and seeking consent from a police officer to undertake the ‘act’.
59. Upon receipt of a request, the FIS will consider whether or not to grant consent under the
provisions of the relevant legislation:
(a) If the disclosure and/or request does not contain sufficient information to demonstrate why suspicion has been raised and to enable the FIS to fully understand the purpose and intended nature of the business relationship or occasional transaction, a reply may be sent stating that:
‘Based upon the information provided the FIS does not consider the request made to be a consent issue’. Such a response does not imply that the intended transaction or activity could not constitute an offence, only that the FIS has not received sufficient information in order to make that determination and therefore if consent would apply. (b) If consent is granted a response may be sent stating that:
‘Based upon the information provided you have consent to continue or maintain the account(s) or other relationship’. It should be noted that a consent to continue or maintain an account or relationship, granted by a police officer, only provides a criminal defence to the offence in relation to the ‘act’ specified in the request. It should also be noted that such a consent does not release the firm, group or person from their obligation in respect of all future transactions and activity on the account or arising from the relationship. (c) If there are cogent grounds to suspect that the funds represent the proceeds of crime, the FIS may withhold consent and advise the firm accordingly.
60. The firm, group or person may wish to consider submitting a further disclosure should the
circumstances detailed in the original disclosure change in such a way as to give rise to further knowledge or suspicion of ML or FT not already disclosed to the FIS.
61. The FIS will endeavour to reply to a consent request as soon as practicable. Nevertheless, it
should be noted that the FIS is not mandated by law to respond within a specified timeframe.

Chapter 13 - Page 174
The firm should not continue with the intended transaction or activity until a response from the FIS has been received.
13.13. Tipping Off
62. The Reporting Laws provide that it is a criminal offence for a person, who knows or suspects that
an internal disclosure to an MLRO or an external disclosure to the FIS has been or will be made, or any information or other matter concerning a disclosure has been or will be communicated to an MLRO or the FIS, to disclose to any other person information or any other matter about, or relating to, that knowledge or suspicion unless it is for a purpose set out in the Reporting Laws.
63. The purposes detailed in the Reporting Laws include, but are not limited to, the prevention,
detection, investigation or prosecution of criminal offences, whether in the Bailiwick or elsewhere.
64. Reasonable enquiries of a customer, conducted in a discreet manner, regarding the background
to a transaction or activity which has given rise to the suspicion is prudent practice, forms an integral part of CDD and on-going monitoring, and should not give rise to tipping off.
65. If the firm identifies open source information on the customer (for example, a media article
indicating that the customer is or has been subject to criminal proceedings) this should not give rise to tipping off. However, the firm should consider disclosing the matter to the FIS in accordance with Section 13.3. above.
66. HM Procureur has issued a paper entitled ‘Guidance on Prosecution for Tipping Off’ which
permits disclosures to be made to members of the same organisation or linked organisations to discharge their AML and CFT responsibilities, save where there are grounds to believe that this may prejudice an investigation. http://www.guernseylawofficers.gg/CHttpHandler.ashx?id=116561&p=0
67. The firm’s policies, procedures and controls must enable the MLRO to consider whether it is
appropriate to disclose a suspicion to the FIS or to make a request for consent or whether, in assessing the circumstances, it would in the first instance be more appropriate to obtain more information to assist with the decision. Such procedures must also provide for the MLRO to consider whether it would be more appropriate to decline to proceed with a transaction and to give due thought to the future of the business relationship as a whole before proceeding.
13.14. Terminating a Business Relationship
68. Whether or not to terminate a business relationship is a commercial decision, except where
required by law, for example, where the firm cannot obtain the required CDD information (see
Chapter 4 of this Handbook and Paragraph 9 of Schedule 3).
69. There will be occasions where it is feasible for the firm to agree a joint strategy with the FIS, but
the FIS will not seek to influence what is ultimately a decision for the firm regarding the future of its business relationship with the customer and the online reporting facility cannot be used for this purpose.
70. Where the firm takes the decision to terminate a business relationship after it has made a
disclosure or requested FIS consent and is concerned that, in doing so, it may prejudice an investigation or contravene the tipping off obligations, it should engage with the FIS accordingly. However, the decision whether or not to terminate a business relationship is a decision that ultimately rests with the firm.

Chapter 13 - Page 175
13.15. FIS Requests for Additional Information
71. Under Regulation 2 of the Reporting Regulations, the FIS may serve a written notice on a person
who has made a disclosure requiring that person to provide additional information relating to the disclosure. Such additional information may provide clarification of the grounds for suspicion and allow the person to whom the disclosure has been made to make a judgement as to how to proceed.
72. An amendment to the Reporting Regulations came into force on 7 August 2014 providing that,
if a disclosure has been made, the FIS can request information relating to that disclosure from a third party if it is satisfied that there are reasonable grounds to believe that the third party possesses relevant information and that there are reasonable grounds to believe that the information is necessary for the FIS to properly discharge its functions.
73. Regulation 2A of the Reporting Regulations applies where a person has made a disclosure under
Section 1, 2 or 3 of the Disclosure Law and/or under Section 12, 15 or 15C of the Terrorism Law
and the police officer to whom the disclosure was made believes, as a result, that a third party may possess relevant information.
74. A police officer may, by notice in writing served upon a third party, require that third party to
provide the police officer or any other specified officer with such additional information relating to the initial disclosure as it may require. Any such additional information will be requested in writing.
75. Ordinarily the information requested under Regulation 2 or Regulation 2A of the Reporting
Regulations shall be provided within seven days, though the FIS may extend that time period when justification is provided by the firm regarding the need to extend the period. The time period may also be reduced if the information is required urgently.
76. The firm has a statutory obligation to provide additional information pursuant to Regulation 2 or
Regulation 2A of the Reporting Regulations. The police officer would have obtained authority from the Head of the FIS or an officer of the rank of SIO or Inspector (or above) for a notice to be served. Failure without reasonable excuse to comply with a notice (including within the specified time frame) is a criminal offence.
13.16. Management Information
77. The regular receipt of adequate and appropriate MI is beneficial in helping the board ensure that
the firm can discharge its responsibilities fully under Paragraph 12(1)(h) of Schedule 3.
78. The MI provided to the board must include, as a minimum:
(a) the number of internal disclosures received by the MLRO or a Nominated Officer; (b) the number of external disclosures reported onward to the FIS; (c) an indication of the length of time taken by the MLRO or Nominated Officer in deciding whether or not to externalise an internal disclosure; and (d) the nature of the disclosures.
13.17. Record Keeping
79. In accordance with Commission Rule 16.17., in addition to the record keeping requirements in
respect of individual disclosures, the firm must also maintain a register recording all internal and external disclosures to allow for the MLRO to maintain oversight of matters. This will assist in,

Chapter 13 - Page 176
amongst other things, identifying trends in internal and external disclosures and vulnerabilities across the firm’s customer base.
13.18. Legal Professional Privilege and Privileged Circumstances
13.18.1. Introduction
80. There may be times when there are tensions between lawyers’ professional and ethical
obligations to their customers and their reporting obligations under the Reporting Laws, the Reporting Regulations and Schedule 3. Lawyers are subject to unique ethical and legal obligations that mean that in limited circumstances they may be restricted in their ability to disclose a suspicion of ML or FT. The concept of legal professional privilege (“LPP”) recognises a customer’s fundamental human right to be candid with his or her legal adviser, without fear of later disclosure to his or her prejudice.
81. Section 3(6)(c)-(d) of the Disclosure Law and Sections 12(6)(c)-(d) and 15(6)(a)-(b) of the
Terrorism Law recognise that there may be limited circumstances in which a failure to report may be excused by providing that a person does not commit an offence for failing to disclose a suspicion of ML or FT where:
(a) he or she has some other reasonable excuse for not disclosing the information or other matter; or (b) he or she is a professional legal adviser and the information or other matter came to him in privileged circumstances.
82. The same provisions are included in the equivalent UK legislation and at the time of publication
of this Handbook there is no judicial guidance (either in the UK or the Bailiwick) on what might constitute a ‘reasonable excuse’ under Section 3(6)(c) of the Disclosure Law and Sections 12(6)(c) and 15(6)(a) of the Terrorism Law referenced above.
83. Whilst it will ultimately be for the courts to decide if a reason for not making a disclosure was a
reasonable excuse, the Commission agrees with the position taken by the UK Legal Sector Affinity Group3 that a person will have a reasonable excuse for not making an authorised disclosure when the knowledge or suspicion of ML or FT is based on privileged information and LPP is not excluded by the exceptions set out below.
84. In any given case a person should clearly document his or her reasons for concluding that there
is a reasonable excuse for non-disclosure.
85. As noted above, distinct from LPP, in accordance with Section 3(6)(d) of the Disclosure Law and
Sections 12(6)(d) and 15(6)(b) of the Terrorism Law, a legal professional adviser may also have a defence from prosecution for failure to report where information or another matter giving rise to knowledge or suspicion of ML of FT ‘came to him in privileged circumstances’.
86. The Reporting Laws in turn state that information or another matter comes to a professional legal
adviser in privileged circumstances if it is communicated or given to them:
(a) by (or by a representative of) a customer in connection with the provision of legal advice; (b) by (or by a representative of) a person seeking legal advice; or (c) by a person in connection with legal proceedings or contemplated legal proceedings. 3 The group of AML supervisors for the UK legal sector. The Commission’s position as set out here is based on guidance issued by the UK Legal Sector Affinity Group in March 2018: https://www.lawsociety.org.uk/policycampaigns/articles/anti-money-laundering-guidance/.

Chapter 13 - Page 177
87. Neither LPP nor the privileged circumstances exemption will apply if the information is
communicated or given to the legal professional with the intention of furthering a criminal purpose.
88. The remainder of this Section examines the tension between a legal professional’s duties and the
provisions of the Reporting Laws and the Reporting Regulations and should be read in conjunction with the rest of this Chapter. If you are still in doubt as to your position, you should seek independent legal advice.
13.18.2. Overview of LPP
89. LPP is a privilege against disclosure, ensuring customers know that certain documents and
information provided to legal professionals cannot be disclosed at all. It recognises the customer’s fundamental human right to be candid with his or her legal adviser, without fear of later disclosure to his or her prejudice. It is an absolute right and cannot be overridden by any other interest.
90. LPP does not, however, extend to everything legal professionals have a duty to keep confidential.
LPP protects only those confidential communications falling under either (or both) of the two heads of privilege – advice privilege or litigation privilege.
91. LPP belongs to the customer, not the legal professional, and may only be waived by the customer.
13.18.3. Advice Privilege
92. Communications between a legal professional adviser, acting in his or her capacity as a legal
professional, and his or her customer, are privileged if they are both:
(a) confidential; and
(b) made for the dominant purpose of seeking legal advice from a legal professional or providing legal advice to a customer.
93. Communications are not privileged merely because a customer is speaking or writing to a legal
professional. The protection applies only to those communications that directly seek or provide advice, or which are given in a legal context, that involves the legal professional using his or her legal skills and which are directly related to the performance of the legal professional’s professional duties.
13.18.4. Litigation Privilege
94. Litigation privilege, which is wider than advice privilege, protects confidential communications
made after litigation has started, or is reasonably in prospect, between any of the following:
(a) a legal professional and a customer;
(b) a legal professional and an agent, whether or not that agent is a legal professional; or (c) a legal professional and a third party.
95. These communications are to be for the sole or dominant purpose of litigation, for any of the
following:
(a) seeking or giving advice in relation to it; (b) obtaining evidence to be used in it; or (c) obtaining information leading to obtaining such evidence.

Chapter 13 - Page 178
13.18.5. Important Points to Consider with LPP
96. An original document not brought into existence for privileged purposes and so not already
privileged, does not become privileged merely by being given to a legal professional for advice or other privileged purpose.
97. Further, where the customer of a legal professional is a corporate entity, communication between
the legal professional and the employees of a corporate customer may not be protected by LPP if the employee cannot be considered to be the customer for the purposes of the retainer. As such, some employees will be customers, while others will not.
98. It is not a breach of LPP to discuss a matter with the firm’s MLRO for the purposes of receiving
advice on whether to make a disclosure.
13.18.6. Exceptions to LPP
99. LPP protects advice given by a legal professional adviser to a customer on avoiding committing
a crime or warning them that proposed actions could attract prosecution. LPP does not, however, extend to documents which themselves form part of a criminal or fraudulent act, or communications which take place in order to obtain advice with the intention of carrying out an offence. It is irrelevant whether or not the legal professional is aware that they are being used for that purpose.
100. It is not just the customer’s intention which is relevant for the purpose of ascertaining whether
information was communicated for the furtherance of a criminal purpose. It is also sufficient that a third party intends the legal professional/communication to be made with that purpose (for example, where the innocent customer is being used by a third party).
101. If the legal professional knows the transaction or activity being worked on constitutes criminal
conduct, he or she risks committing an offence by facilitating criminal conduct and/or failing to disclose knowledge or suspicion of ML or FT. In those circumstances, communications relating to the transaction or activity are not privileged and can be disclosed.
102. If the firm merely suspects a transaction or activity might constitute an ML and/or FT offence,
the position is more complex. If the suspicions are correct, communications with the customer are not privileged. If the suspicions are unfounded, the communications should remain privileged and are therefore not required to be disclosed.
103. LPP will also be lost where there has been an express or implied waiver. This may occur where
the communication is no longer confidential, as confidentiality is a requirement for both types of LPP.
13.18.7. Privileged Circumstances
104. Distinct from LPP, and as noted in Paragraph 13.85. above, the Reporting Laws both recognise
another type of protected communication, one which is received in ‘privileged circumstances’. This is not the same as LPP, it is merely an exemption from the requirement to disclose knowledge or suspicion of ML or FT, although in many cases the communication will also be covered by LPP.
105. The essential elements of the privileged circumstances exemption are:
(a) the information or material is communicated to a ‘professional legal adviser’ (not defined in the Reporting Laws):

Chapter 13 - Page 179
(i) by a customer (or their representative) in connection with the giving of legal advice; (ii) by a person (or their representative) seeking legal advice; or (iii) by a person in connection with actual or contemplated legal proceedings; and (b) the information or material was not communicated or given to the professional legal adviser with a view to furthering a criminal purpose.
106. The exceptions set out in Section 13.18.6. above should be considered when assessing what
constitutes furthering a criminal purpose.
13.18.8. Differences Between LPP and Privileged Circumstances
107. Where litigation is neither contemplated nor reasonably in prospect, except in very limited
circumstances, communications between a legal adviser and third parties will not generally be protected by LPP.
108. However, the extension of the privileged circumstances concept to cover information
communicated by representatives of a customer or person seeking legal advice, means that this exemption may apply in circumstances where LPP would not. For example, it may include communications with:
(a) a junior employee of a customer (if it is reasonable in the circumstances to consider them to be a representative of the customer); or (b) other professionals who are providing information to the legal adviser on behalf of the customer as part of the transaction.
109. The specific facts of each case should be considered when deciding whether or not a person is a
representative for the purposes of privileged circumstances, and the legal adviser is encouraged to document this consideration.
110. Confidentiality is also not a necessary element of the privileged circumstances exemption.
Disclosure of a communication to a third party may not therefore exclude the application of the privileged circumstances exception in the same way that it would result in LPP being lost.
13.18.9. Making a Disclosure
111. When faced with information or matter that forms the basis of suspicion, it is recommended that
a legal professional ask himself the following questions:
(a) What information would I need to include in a disclosure?
(b) Is any of that information subject to LPP?
(c) Did any of that information come to me in ‘privileged circumstances’?
(d) If the answer to (b) and (c) is no, the disclosure should be filed without disclosing any privileged communications; (e) If information is subject to LPP and/or came to me in privileged circumstances, has it for any reason lost its privileged status? (i) Has LPP been lost due to disclosure? (ii) Has the customer otherwise waived their LPP? (iii) Is there reasonable evidence for me to conclude that the material was communicated to me with a view to furthering a criminal purpose? (f) Can I file a coherent disclosure without disclosing the material that came to me in privileged circumstances?

Chapter 13 - Page 180
112. If the privileged status has not been lost and a coherent internal disclosure can be filed without
disclosing the protected material, a disclosure should be filed on this basis. If privileged status has been lost then the legal professional should disclose the information.
113. In all cases the legal professional should document his or her reasons and ethical considerations
which formed the basis of his or her decision whether or not to make a disclosure.
13.19. THEMIS Notices
114. THEMIS has the facility to provide firms with notices which are sent via a generic e-mail address
to individual users. These notices are a mechanism through which the FIS provides information to all THEMIS users or to specific ‘targeted’ distribution groups or firms, dependent upon the information or guidance that is being issued.
115. Notices sent via THEMIS include updates on changes to the legislative framework, news of
forthcoming presentations or seminars and updates in respect of EU, UN and other sanctions. In addition to generic updates, the FIS may specifically ‘target’ certain distribution groups or firms in respect of a notification that a certain entity or group of entities is under investigation by the FIS or other law enforcement agencies. In this respect, THEMIS is the mechanism by which specific ‘targeted’ notices will be distributed to MLROs.
116. The MLRO should refer to the THEMIS portal whenever a notification is issued by the FIS and
additionally at regular intervals on an ad hoc basis. Where targeted notices are issued, the firm should establish if it maintains a business relationship, or has conducted an occasional transaction, with the entities listed on the notice, or if it has information which may assist the FIS. The firm should consider whether the receipt of a targeted notice from law enforcement is sufficient grounds for suspicion to make an external disclosure to the FIS in accordance with
Section 13.3. of this Handbook. It should be noted that the FIS have the facility to monitor
whether notices have been received and/or read by the recipient.

Chapter 14
Wire Transfers
Contents of this Chapter
14.1. Introduction.........................................................................................................................182
14.2. Scope...................................................................................................................................183
14.3. Outgoing Transfers – Obligations upon the PSP of the Payer............................................185
14.3.1. Transfers for Non-Account Holders................................................................................185
14.3.2. Transfers for Account Holders........................................................................................186
14.3.3. Detection of Missing or Incomplete Information............................................................187
14.4. Batch Files – Transfers Inside or Outside the British Islands.............................................187
14.5. Incoming Transfer – Obligations upon the PSP of the Payee.............................................187
14.5.1. Detection of Missing or Incomplete Information............................................................188
14.6. Failure to Supply Information.............................................................................................189
14.7. Obligations upon an Intermediary PSP...............................................................................190
14.8. Reporting.............................................................................................................................191
14.8.1. Reporting Suspicions......................................................................................................191
14.8.2. Reporting Breaches.........................................................................................................191
14.9. Record Keeping ..................................................................................................................192

Chapter 14 - Page 182
14.1. Introduction

The Transfer of Funds (Guernsey) Ordinance 2017, along with the parallel ordinances for
Alderney and Sark, were brought into force on 26 June 2017 following the EU’s enactment of Regulation (EU) 2015/847 on Information Accompanying Transfers of Funds (“the EU Regulation”) on 20 May 2015. References in this Chapter to “the Transfer of Funds Ordinance” should be read as referring to the Transfer of Funds (Guernsey, Sark or Alderney) Ordinance 2017 relevant to the island within which the firm is operating.
Article 1 of the Transfer of Funds Ordinance gives the EU Regulation full force and effect in the
Bailiwick, subject to certain adaptations, exceptions and modifications as set out in Schedule 1 to the Transfer of Funds Ordinance.
The Bailiwick and the other Crown Dependencies have received a derogation enabling wire
transfers between the British Islands to contain the reduced information requirements as compared to those which apply to transfers of funds within the internal market of the EU. The derogation was issued because the EU considered that the Bailiwick and the other Crown Dependencies had transfer of funds legislation which is equivalent to the EU Regulation.
Where the firm is a PSP, it shall comply with the Transfer of Funds Ordinance and should note
that in accordance with Article 11 of the Transfer of Funds Ordinance, the court will take account of the Commission Rules and guidance issued by the Commission in considering compliance with the Transfer of Funds Ordinance and the EU Regulation. For the avoidance of doubt, the Commission Rules and guidance contained in this section have been made in accordance with
Article 11 of the Transfer of Funds Ordinance.
The FATF’s principle purposes for developing standards on the payer and payee information to
accompany wire transfers are to prevent terrorists and criminals from having unfettered access to wire transfers for moving funds and to enable the detection of the misuse of wire transfers when it occurs. Key parts of the FATF Recommendations include requiring that information about the payer and payee accompany wire transfers throughout the payment chain. This is to ensure the traceability of funds to assist in preventing, detecting and investigating ML and FT and to facilitate the effective implementation of restrictive measures against persons and entities designated under UN and EU sanctions legislation. The standards also require PSPs to have appropriate mechanisms for detecting where information is incomplete or missing for the purpose of considering whether it is suspicious and should be reported to the FIS.
The Transfer of Funds Ordinance and the EU Regulation require full customer information
details on the payer and certain identity information on the payee on all transfers of funds in any currency except where there are derogations from the requirements of the EU Regulation which allow for less information about a payer and payee to accompany a transfer. This Section explains the payer and payee information that is required and the derogations which permit PSPs to effect transfers with reduced levels of information about the payer and the payee in certain specified circumstances, including transfers between the British Islands.
The EU Regulation sets out the payer and payee information which shall accompany a transfer
and requires both the PSP of the payee and intermediary PSP to have appropriate and effective measures in place to detect when the required payer and/or payee information is missing or incomplete. The EU Regulation also requires that PSPs shall have risk-based procedures in place to assist where a transfer lacks the required information so as to enable the PSP to decide whether to execute, reject or suspend a transfer and to determine the appropriate action to take.

Chapter 14 - Page 183
8. The Transfer of Funds Ordinance and the EU Regulation also introduce increased reporting
obligations upon PSPs to identify breaches and areas of non-compliance which shall be reported to the Commission. The Transfer of Funds Ordinance prescribes the manner in which such reports shall be made.
9. Under Article 22 of the EU Regulation the Commission is responsible for monitoring compliance
with the EU Regulation. This includes implementing the measures which are necessary to ensure compliance with those requirements by PSPs established in the Bailiwick.
10. Parts of this Chapter in clear boxes summarise the requirements of the EU Regulation and the
Transfer of Funds Ordinance. Any paraphrasing of that text within this Chapter represents the Commission’s own explanation of the EU Regulation and the Transfer of Funds Ordinance and is for the purposes of information and assistance only. The Transfer of Funds Ordinance and the EU Regulation remain the definitive texts for the legal requirements upon PSPs.
11. As the Transfer of Funds Ordinance is based on the EU Regulation, PSPs may find it of benefit
when developing their policies, procedures and controls for wire transfers to review guidance issued by the ESAs on the measures PSPs should take to detect missing or incomplete information on the payer or the payee and the procedures they should put in place to manage a transfer of funds lacking the required information.
14.2. Scope
12. The requirements summarised in this Section apply to transfers of funds, in any currency, which
are sent or received by a PSP or an intermediary PSP established in the Bailiwick.
13. These requirements do not apply to the transfers set out in Part II of the Schedule to the Transfer
of Funds Ordinance regarding modification of Article 2 of the EU Regulation covering the following transfers:
transfers of funds corresponding to services referred to in points (a) to (m) and (o) of
Article 3 of Directive 2007/64/EC of the European Parliament (Directive on Payment
Services in the Internal Market). The services referred to in points (a) to (m) and (o) are set out in Paragraph 14.15. below; transfers of funds carried out using a payment card, electronic money instrument or a mobile phone, or any other digital or information technology (“IT”) prepaid or post-paid device with similar characteristics where that card, instrument or device is used exclusively to pay for goods or services and that the number of that card, instrument or device accompanies all transfers flowing from the transaction; transfers of funds involving the payer withdrawing cash from the payer’s own payment account; transfers of funds to a public authority (construed as to include any Committee of the States or Parochial officers) as payment for taxes, fines or other levies within the British Islands; transfers of funds where both the payer and the payee are PSPs acting on their own behalf; and transfers of funds carried out through cheque images exchanges, including truncated cheques.
14. It should be noted that the exemption set out in Paragraph 14.13. does not apply when the card,
instrument or device is used to effect a person-to-person transfer of funds. Therefore, when a credit, debit or prepaid card is used as a payment system to effect a person-to-person wire transfer, the transaction is included within the scope of the Transfer of Funds Ordinance.

Chapter 14 - Page 184
15. The EU Regulation does not apply to the following:
payment transactions made exclusively in cash directly from the payer to the payee, without any intermediary intervention; payment transactions from the payer to the payee through a commercial agent authorised to negotiate or conclude the sale or purchase of goods or services on behalf of the payer or the payee; professional physical transport of banknotes and coins, including their collection, processing and delivery; payment transactions consisting of the non-professional cash collection and delivery within the framework of a non-profit or charitable activity; services where cash is provided by the payee to the payer as part of a payment transaction following an explicit request by the payment service user just before the execution of the payment transaction through a payment for the purchase of goods or services; money exchange business, i.e. cash-to-cash operations, where the funds are not held on a payment account; payment transactions based on any of the following documents drawn on the PSP with a view to placing funds at the disposal of the payee:
(i) paper cheques in accordance with the Geneva Convention of 19 March 1931 providing a uniform law for cheques; (ii) paper cheques similar to those referred to in point (i) and governed by the laws of Member States which are not party to the Geneva Convention of 19 March 1931 providing a uniform law for cheques; (iii) paper-based drafts in accordance with the Geneva Convention of 7 June 1930 providing a uniform law for bills of exchange and promissory notes; (iv) paper-based drafts similar to those referred to in point (iii) and governed by the laws of Member States which are not party to the Geneva Convention of 7 June 1930 providing a uniform law for bills of exchange and promissory notes; (v) paper-based vouchers; (vi) paper-based traveller's cheques; or (vii) paper-based postal money orders as defined by the Universal Postal Union; payment transactions carried out within a payment or securities settlement system between settlement agents, central counterparties, clearing houses and/or central banks and other participants of the system, and PSPs, without prejudice to Article 28 of the EU Regulation; payment transactions related to securities asset servicing, including dividends, income or other distributions, or redemption or sale, carried out by persons referred to in point (h) or by investment firms, credit institutions, collective investment undertakings or asset management companies providing investment services and any other entities allowed to have the custody of financial instruments; services provided by technical service providers, which support the provision of payment services, without them entering at any time into possession of the funds to be transferred, including processing and storage of data, trust and privacy protection services, data and entity authentication, IT and communication network provision, provision and maintenance of terminals and devices used for payment services; services based on instruments that can be used to acquire goods or services only in the premises used by the issuer or under a commercial agreement with the issuer either within a limited network of service providers or for a limited range of goods or services; payment transactions executed by means of any telecommunication, digital or IT device, where the goods or services purchased are delivered to and are to be used through a telecommunication, digital or IT device, provided that the telecommunication, digital or IT operator does not act only as an intermediary between the payment service user and the supplier of the goods and services;

Chapter 14 - Page 185
payment transactions carried out between PSPs, their agents or branches for their own account; or services by providers to withdraw cash by means of automated teller machines acting on behalf of one or more card issuers, which are not a party to the framework contract with the customer withdrawing money from a payment account, on condition that these providers do not conduct other payment services.
14.3. Outgoing Transfers – Obligations upon the PSP of the Payer
14.3.1. Transfers for Non-Account Holders
16. In accordance with Article 4 of the EU Regulation, where a transfer of funds is not made from or
to an account the PSP shall obtain customer identification information on the payer and payee, record that information and verify the customer information on the payer.
17. Where all of the PSPs involved in the transfer are established in the British Islands and the transfer
is in excess of EUR 1,000 in a single transaction or in a linked series of transactions which together exceed EUR 1,000, the transfer shall, in accordance with Article 5(1) of the EU Regulation, include a unique transaction identifier (which can trace a transaction back to the payer and payee) for the payer and payee. If further information (for example, the name and address of the payer) is requested by the PSP of the payee or the intermediary PSP, such information shall be provided within three working days of the receipt of a request for such information.
18. Where a transfer is carried out within the British Islands which is at or below the EUR 1,000
threshold, the customer identification information on the payer and the payee shall be obtained and recorded but it is not necessary to verify the customer information on the payer unless the funds to be transferred have been received in cash or in anonymous electronic money, or the PSP has reasonable grounds for suspecting ML and/or FT.
19. Where a transfer is being made to a PSP in any other country or territory, Article 4 of the EU
Regulation requires that such a transfer include the following customer identification information (complete information):
the name of the payer; a unique transaction identifier (which can trace a transaction back to the payer); one of either the payer’s address (residential or postal), national identity number, customer identification number or date and place of birth; the name of the payee; and a unique transaction identifier which can be traced back to the payee.
20. Where the payer is an existing customer of the PSP, the PSP may deem verification to have taken
place if it is appropriate to do so taking into account the risk of ML and FT.
21. A national identity number should be any government issued personal identification number or
other government issued unique identifier. Examples of such would include a passport number, national identity card number or social security number.
22. A customer identification number may be an internal reference number that is created by a PSP
which uniquely identifies a customer (rather than an account that is operated for a payer or a transaction) and which will continue throughout a business relationship, or it may be a number that is contained within an official document.

Chapter 14 - Page 186
14.3.2. Transfers for Account Holders
23. In accordance with Article 4 of the EU Regulation, where a PSP is seeking to make a transfer from
an account, the PSP shall:
obtain customer identification information on the payer, verify that information, and record and retain that information; have undertaken CDD procedures and retained records in connection with the opening of that account in accordance with the requirements of Schedule 3 and this Handbook; and obtain information on the identity of the payee and the number of the payee’s payment account.
24. Where all of the PSPs involved in a transfer are established in the British Islands, Article 5 of the
EU Regulation requires that the transfer includes a payment account number of the payer and the payee. The account number could be, but is not required to be, expressed as the IBAN. If further information (for example, the name and address of the payer) is requested by the PSP of the payee or the Intermediary PSP, such information shall be provided by the PSP within three working days of the receipt of a request for such information.
25. Where a transfer is carried out within the British Islands which is at or below the EUR 1,000
threshold, the customer identification information on the payer and the payee shall be obtained and recorded but it is not necessary to verify the customer information on the payer unless the funds to be transferred have been received in cash or in anonymous electronic money, or the PSP has reasonable grounds for suspecting ML and FT.
26. Where the payer is an existing customer of the PSP, the PSP may deem verification to have taken
place if it is appropriate to do so taking into account the risk of ML and FT.
27. The permission for transfers, where all PSPs involved are established in the British Islands, to
only include a payment account number arises from technical limitations required to accommodate transfers by domestic systems like BACS which are currently unable to include complete information. However, where the system used for such a transfer has the functionality to carry complete information, it would be good practice to include it and thereby reduce the likelihood of inbound requests from payee PSPs for complete information.
28. Where the transfer is being made to a PSP in any other country or territory, the transfer shall
include the following customer identification information:
the name of the payer; the payer’s account number (or IBAN); one of either the payer’s address (residential or postal), national identity number, customer identification number or date and place of birth; the name of the payee; and the payee’s account number (or IBAN).
29. There may be occasions when the PSP of the payer does not know the full name of the payee.
This may arise when the payer knows only the surname and the initials of the payee’s first name(s). In such circumstances it would be acceptable for the PSP of the payer to use initials with the surname subject to consideration by the PSP that the information given by the payer on the identity of the payee is not misleading and that it is reasonable for the payer not to know the full name of the payee. The PSP of the payer should also be mindful that using the initials of the first name(s) of the payee may not be accepted by the PSP of the payee, which could revert with questions on the identity of the payee or reject the transfer. The full surname of the payee should always be obtained by the PSP of the payer.

Chapter 14 - Page 187
30. In the case of a payer that is a company, a transfer must include either the address at which the
company’s business is conducted or the customer identification number of the company.
31. Where the payer is a foreign incorporated company administered in the Bailiwick, the address
referred to in Commission Rule 14.30. would be that of its administrator.
32. In the case of a payer that is a trust, a transfer must be accompanied by the address of the trustee
or the customer identification number of the trust.
33. Where a trust has multiple co-trustees, the address referred to in Commission Rule 14.32. should
be that given to open and maintain the account. Where more than one address has been given to open and maintain that account, those addresses should be used.
34. PSPs must ensure that when messaging systems such as SWIFT MT202 (which provide for
transfers where both the payer and the payee are PSPs acting on their own behalf) are used on behalf of another FSB, the transfers are accompanied by the customer identification information necessary to meet the requirements of the Transfer of Funds Ordinance.
14.3.3. Detection of Missing or Incomplete Information
35. Under Article 4 of the EU Regulation the PSP shall ensure that no transfer is executed before
ensuring that the transfer includes the required customer identification information on the payer and the payee.
14.4. Batch Files – Transfers Inside or Outside the British Islands
36. In accordance with Article 6 of the EU Regulation, batch files from a single payer to multiple
payees shall carry the information identified in Paragraph 14.19. of this Handbook for the payer and that information shall have been verified. However, the individual transfers within the batch file need only carry the payer’s payment account number (or unique transaction identifier if there is no account number).
37. Where the transfer is at or below the EUR 1,000 threshold it need only include:
the names of the payer and or payee; and the payment account numbers of the payer and the payee or a unique transaction identifier if there is no payment account for one or both parties.
38. The information requirements of Paragraphs 14.17., 14.24., 14.37. of this Handbook are the
minimum standards. It is open to PSPs to elect to supply complete information with transfers which are eligible for a reduced information requirement and thereby limit the likely incidence of inbound requests for complete information.
14.5. Incoming Transfer – Obligations upon the PSP of the Payee
39. In accordance with Article 7 of the EU Regulation the PSP of the payee shall obtain customer
identification information on the payee, verify that information and record and retain that information, or to have applied CDD measures and retained records in connection with the opening of that account in accordance with Schedule 3 and the Commission Rules.
40. Where the payee is an existing customer of the PSP, the PSP may deem verification to have taken
place if it is appropriate to do so taking into account the risk of ML and FT.

Chapter 14 - Page 188
41. Articles 7 and 8 of the EU Regulation require PSPs to have effective policies, procedures and
controls for checking that incoming payments contain the required customer identification information (which will depend on the location of the PSPs involved in the transfer process and the value of the funds being transferred) – see Commission Rule 14.63.
14.5.1. Detection of Missing or Incomplete Information
42. PSPs will need to be able to: identify empty message fields; have procedures in place to detect
whether the required customer identification information is missing on the payer or the payee (for example, by undertaking sample testing to identify fields containing incomplete information on the payer and payee); and where information is incomplete, take specified action.
43. SWIFT payments on which mandatory information fields are not completed will automatically
fail and the payee PSP will not receive the payment. Current SWIFT validation prevents payments being received where the mandatory information on the payer and the payee is not present at all. However, it is accepted that where the information fields are completed with incorrect or meaningless information, or where there is no account number, the payment may pass through the system. Similar considerations apply to non-SWIFT messaging systems which also validate that a field is populated in accordance with the standards applicable to that system (for example, BACS).
44. Under Article 7 of the EU Regulation a PSP of a payee shall have effective policies, procedures
and controls:
to detect whether or not the information on the payer and the payee is complete in accordance with the conventions of the messaging or payment and settlement system being used; and have effective procedures in place to detect the absence of required information on the payer and payee.
45. A PSP must have in place appropriate and effective policies, procedures and controls to subject
incoming payment transfers to an appropriate level of real time and post-event monitoring in order to detect incoming transfers which are not compliant with the relevant information requirements.
46. A PSP’s policies, procedures and controls should:
take into account the ML and FT risks to which it is exposed; set out which transfers will be monitored in real time and which can be monitored ex-post and why; and set out what employees should do where required information is missing or incomplete.
47. The level of monitoring should be appropriate to the risk of the PSP being used in connection
with ML and FT, with high risk transfers monitored in real time. Consideration should be given to areas such as:
the value of the transaction; the country or territory where the PSP is established and whether that country or territory applies the FATF Recommendations, particularly Recommendations 10 (CDD); 11 (record keeping) and 16 (wire transfers); the country or territory of the payer; the history of previous transfers with the PSP of the payer, i.e. whether it has failed previously to comply with the customer identification requirement; and the complexity of the payment chain within which the PSP operates.

Chapter 14 - Page 189
48. The Commission would expect a PSP’s ex-post monitoring to include risk-based sampling of
transfers. Records should be retained and findings periodically reported to the board of the PSP.
49. Under Article 8 of the EU Regulation a PSP shall implement effective risk-based policies,
procedures and controls for determining whether to reject a transfer; or execute or suspend the transfer; and ask for complete information on the payer or payee before or after crediting the payee’s account or making funds available to the payee on a risk sensitive basis where it has identified in the course of processing a transfer that the required information on the payer or payee is missing or incomplete or if the information fields have been incorrectly filled in.
50. A PSP should take a risk-based approach when considering the most appropriate course of action
to take in order to meet the requirements of Article 8 of the EU Regulation. If a decision is made to ask for complete information on the payer, a PSP should also consider, on the basis of the perceived risk, whether to make the payment or to hold the funds until such time as complete information has been received.
51. Where a payee PSP becomes aware subsequent to processing the payment that information on the
payer or payee is missing or incomplete either as a result of random checking or other monitoring mechanisms under the PSP’s risk-based approach, it must seek the complete information on the payer and payee relevant to the type of transfer it was (either in terms of value or if it was within or outside the British Islands).
14.6. Failure to Supply Information
52. Article 8 of the EU Regulation also sets out the action required where a PSP repeatedly fails to
supply information on the payer or payee required by the EU Regulation and reporting obligations. This action may include issuing warnings and setting deadlines, prior to either refusing to accept further transfers from that PSP or deciding whether or not to restrict or terminate the business relationship.
53. A PSP must have appropriate policies, procedures and controls for determining what measures to
take when a PSP repeatedly fails to provide required information on the payer or payee.
54. Such policies, procedures and controls should take into account whether the PSP is located in a
country or territory which has been identified through mutual evaluations or other assessments by the FATF as insufficiently applying the FATF Recommendations, particularly Recommendations 10 (CDD), 11 (record keeping) and 19 (wire transfers).
55. Where the PSP has sought complete information on the payer and it has not been provided to the
PSP within a reasonable time frame, the PSP must consider, on a risk-based approach, the most appropriate course of action to be undertaken.
56. Where a PSP of a payer is identified as having regularly failed to comply with the information
requirements, then the PSP of the payee must notify the Commission of that fact and the steps it has taken to attempt to ensure that such information is supplied.
57. The report to the Commission should contain the name and address of the PSP, and a summary
of the measures taken by the PSP of the payee to obtain the missing or incomplete information from the PSP of the payer, including the issuing of warnings or deadlines up until the decision to restrict or terminate the relationship was made.

Chapter 14 - Page 190
58. This reporting requirement does not apply to instances where a request for the missing or
incomplete information which accompanied a transfer is fulfilled by the PSP of the payer. The obligation to report applies to circumstances where information requests are not fulfilled and the PSP of the payee invokes measures which restrict or terminate the business relationship with that PSP.
14.7. Obligations upon an Intermediary PSP
59. In accordance with Article 10 of the EU Regulation intermediary PSPs (for example, those acting
as agents for other PSPs or who provide correspondent banking facilities) shall, subject to technical limitations, ensure that all information received on a payer and payee which accompanies a transfer of funds is retained with the transfer.
60. Under Article 11 of the EU Regulation an intermediary PSP shall have effective policies,
procedures and controls:
to detect whether or not the information on the payer and the payee is complete in accordance with the conventions of the messaging or payment and settlement system being used; and have effective procedures in place to detect the absence of required information on the payer and payee.
61. Under Article 12 of the EU Regulation an intermediary PSP shall implement effective risk-based
policies, procedures and controls for determining whether to:
reject a transfer; or execute or suspend the transfer; and ask for complete information on the payer or payee before or after crediting the payee’s account or making funds available to the payee on a risk sensitive basis where it has identified in the course of processing a transfer that the required information on the payer or payee is missing or incomplete or if the information fields have been incorrectly filled in.
62. Article 12 of the EU Regulation prescribes the action required where a PSP repeatedly fails to
supply information on the payer or payee required by the EU Regulation and reporting obligations. This action may include issuing warnings and setting deadlines, prior to either refusing to accept further transfers from that PSP or deciding whether or not to restrict or terminate the business relationship.
63. An intermediary PSP must have appropriate policies and procedures for determining what
measures to take when a PSP repeatedly fails to provide required information on the payer or payee.
64. Such policies and procedures should take into account whether the PSP which is failing to
provide the information is located in a country or territory which has been identified through mutual evaluations or other assessments by the FATF as insufficiently applying the FATF Recommendations, particularly Recommendations 10 (CDD), 11 (record keeping) and 16 (wire transfers).
65. Where a PSP is identified as having repeatedly failed to comply with the information requirements,
then the intermediary PSP must notify the Commission of that fact and of the steps it has taken to attempt to ensure that such information is supplied.

Chapter 14 - Page 191
66. The report to the Commission should contain the name and address of the PSP and a summary of
the measures taken by the PSP of the payee to obtain the missing or incomplete information from the PSP of the payer, including the issuing of warnings or deadlines up until the decision to restrict or terminate the relationship was made.
67. This reporting requirement does not apply to instances where a request for the missing or
incomplete information which accompanied a transfer is fulfilled by the PSP of the payer. The obligation to report applies to circumstances where information requests are not fulfilled and the intermediary PSP invokes measures which restrict or terminate the business relationship with that PSP.
14.8. Reporting
68. The EU Regulation and the Transfer of Funds Ordinance contain certain reporting requirements
upon a PSP, whether acting in the capacity of PSP of the payer, PSP of the payee or an intermediary PSP. Irrespective of the capacity within which the PSP is acting there are three distinct reporting requirements which are to report:
(a) missing or incomplete information on a transfer which may give rise to a suspicion which should be reported to the FIS; (b) breaches by a PSP of the EU Regulation or the Transfer of Funds Ordinance to the Commission; and (c) repeated failure by a PSP to provide the required payer or payee information (see Articles 8(2) and 12 (2) of the EU Regulation and Commission Rules 14.56. and 14.65. above) to the Commission.
14.8.1. Reporting Suspicions
69. Articles 9 and 13 of the EU Regulation require the PSP of the payee and an intermediary PSP to
take into account as a factor missing or incomplete information on the payer or the payee in assessing whether a transfer of funds or any related transaction is suspicious and whether it should be reported to the FIS in accordance with Part I of the Disclosure Law and Part II of the Terrorism Law.
70. In this respect the Commission would expect the PSP’s internal reporting procedures to apply
where an employee of a PSP forms a suspicion that a transfer may be connected to ML and/or FT, or that funds are derived from the proceeds of crime or terrorist property. For further information on reporting suspicion reference should be made to Chapter 13 of this Handbook.
71. Employees who are involved in the handling or processing of transfers would be considered
relevant employees for training purposes and a PSP should ensure that its training programme includes training on the requirements of the EU Regulation and the Transfer of Funds Ordinance, as well asthe PSP’s policies, procedures and controls on handling transfers of funds and reporting suspicion.
14.8.2. Reporting Breaches
72. Under Article 4 of the Transfer of Funds Ordinance a PSP shall notify the Commission of breaches
of the EU Regulation and the Transfer of Funds Ordinance.
73. The board of a PSP must ensure that any failure by it (the PSP) to comply with the EU Regulation
or the Transfer of Funds Ordinance is promptly reported to the Commission. A PSP must report all material failures to comply with the Commission Rules in this Chapter and any serious breaches of the PSP’s policies, procedures and controls in respect of transfers of funds.

Chapter 14 - Page 192
74. Notifications to the Commission should be made promptly and contain the following information:
the specific provision in the EU Regulation, the Transfer of Funds Ordinance, Commission Rules and all of the PSP’s policies, procedures and controls which have been breached; the nature of the breach, including its cause; the date the breach was identified by the PSP; and where possible a summary of the measures taken by the PSP in relation to the breach and any subsequent changes to its policies, procedures and controls to mitigate against a recurrence.
75. In order to ensure that the breach is reported promptly, a PSP should consider filing an initial
report covering items (a) to (c) in Paragraph 14.74. above, together with the steps it is considering taking under (d).
76. A PSP must establish policies and procedures for the internal reporting by employees of breaches
of the EU Regulation or the Transfer of Funds Ordinance, and maintain a record of those breaches and action taken. Such policies and procedures must ensure sufficient confidentiality and protection for employees who report breaches committed within the PSP.
14.9. Record Keeping
77. Article 16 of the EU Regulations requires the PSP of the payer and of the payee to retain all records
of any information received on the payer and payee of a transfer of funds for at least five years from the date of the transfer of funds.
78. Except where the relevant derogations from the EU Regulation apply, the PSP of the payer shall
retain the following information for a period of at least five years from the date of the transfer:
the name of the payer, the payer’s payment account number and the payer’s address, national identity number, customer identification number or date and place of birth; and the name of the payee and the payee’s payment account number.
79. Except where the relevant derogations from the EU Regulations apply, the PSP of the payee shall
retain verification information on the payee for a period of at least five years from the date of the transfer.

Chapter 15
Employee Screening and Training
Contents of this Chapter
15.1. Introduction.........................................................................................................................194
15.2. Board Oversight..................................................................................................................194
15.3. Screening Requirements .....................................................................................................194
15.4. Training Requirements for Relevant Employees................................................................195
15.5. Training Requirements for Other Employees.....................................................................195
15.6. Methods of Training ...........................................................................................................196
15.7. Frequency of Training.........................................................................................................196
15.8. Content of Training.............................................................................................................197
15.9. The Board and Senior Management....................................................................................198
15.10. The Money Laundering Reporting Officer and Nominated Officer ...................................198
15.11. The Money Laundering Compliance Officer......................................................................199

Chapter 15 - Page 194
15.1. Introduction

One of the most important tools available to the firm to assist in the prevention and detection of
financial crime is to have appropriately screened employees who are alert to the potential risks of ML and FT and who are well trained in the requirements concerning CDD and the identification of unusual activity, which may prove to be suspicious.
The effective application of even the best designed systems, policies, procedures and controls
can be quickly compromised if employees lack competence or probity, are unaware of, or fail to apply, the appropriate policies, procedures and controls or are not adequately trained.
The term employee is defined in Schedule 3 as any person working for the firm and includes
individuals working under a contract of employment (including on a temporary basis), as well as those working under a contract for services or otherwise. This includes directors, both executive and non-executive, partners and persons employed by external parties fulfilling a function in relation to the firm under an outsourcing agreement or a contract for services.
15.2. Board Oversight
The board must be aware of the obligations of the firm in relation to employee screening and
training.
The firm must ensure that the training provided to relevant employees is comprehensive and
ongoing and that employees are aware of ML and FT, the risks and vulnerabilities of the firm to it, and their obligations in relation to it.
The firm must establish and maintain mechanisms to measure the effectiveness of the AML and
CFT training provided to relevant employees.
Further information on the monitoring and testing of the firm’s training policies and procedures
can be found within Section 2.4. of this Handbook.
In order to measure the effectiveness of AML and CFT training, the firm could consider it
appropriate to incorporate an exam or some form of assessment into its on-going training programme, either as part of the periodic training provided to relevant employees or during the intervening period between training.
Regardless of the methods utilised, the board should ensure that it is provided with adequate
information on a sufficiently regular basis in order to satisfy itself that the firm’s relevant employees are suitably trained to fulfil their personal and corporate responsibilities.
Where the firm outsources its MLRO and/or MLCO functions to a third party, it should also
consider the content of Section 2.5. of this Handbook, which sets out the steps the firm should take to ensure that the outsourced service provider has appropriate policies, procedures and controls surrounding the hiring and training of employees.
15.3. Screening Requirements
In accordance with Paragraph 13(1) of Schedule 3, the firm shall maintain appropriate and
effective procedures, proportionate to the nature and size of the firm and to its risks, when hiring employees or admitting any person as a partner in the firm, for the purpose of ensuring high standards of employee and partner probity and competence.

Chapter 15 - Page 195
12. In order to ensure that employees are of the required standard of competence and probity, which
will depend on the role of the employee, the firm must give consideration to the following prior to, or at the time of, recruitment:
(a) obtaining and confirming appropriate references; (b) obtaining and confirming details of any regulatory action or action by a professional body taken against the prospective employee; (c) obtaining and confirming details of any criminal convictions, including the provision of a check of the prospective employee’s criminal record (subject to the Rehabilitation of Offenders (Bailiwick of Guernsey) Law, 2002 as amended); and (d) obtaining and confirming details of employment history, qualifications and professional memberships.
13. The firm must ensure that its consideration under Commission Rule 15.12. above, together with
the results of any checks undertaken, are documented and retained.
14. In addition, the firm should give consideration to consulting the lists of specified countries and
persons against whom sanctions have been imposed by the UN and the EU to ensure that a prospective employee does not have suspected or known involvement in terrorist activity.
15.4. Training Requirements for Relevant Employees
15. In accordance with Paragraph 13(2) of Schedule 3, the firm shall ensure that relevant employees,
and any partners in the firm, receive comprehensive ongoing training (at a frequency which has regard to the ML and FT risks to the firm).
16. The requirements of Schedule 3 concerning training apply to relevant employees, being those
employees whose duties relate to actual specified business activities, including board members and senior management, and not necessarily to all employees.
17. When determining whether an employee is a relevant employee for the purposes of Schedule 3
and this Handbook, the firm should take into account the following:
(a) whether the employee is undertaking any customer facing functions or handles, or is responsible for the handling of, business relationships or occasional transactions, or transactions conducted in respect of such; (b) whether the employee is directly supporting a colleague who carries out any of the above functions; (c) whether an employee is otherwise likely to be placed in a position where they might see or hear anything which may lead to a suspicion; and (d) whether an employee’s role has changed to involve any of the functions mentioned above.
15.5. Training Requirements for Other Employees
18. There may be some employees who, by virtue of their function, fall outside of the definition of a
relevant employee, for example, receptionists, filing clerks, messengers etc. The firm should consider, on a case-by-case basis, whether an employee falls within the definition of a relevant employee, as the scope of a person’s role and the tasks undertaken will vary from person to person. The firm should also be aware that an employee’s function may change over time.
19. Where the firm has concluded that an individual’s role does not make them a relevant employee,
it should be aware that those employees will still have obligations under the Law, the Disclosure Law, the Terrorism Law and other legislation. As a consequence, all employees, regardless of

Chapter 15 - Page 196
their function, should have a basic understanding of ML and FT, together with an awareness of the firm’s internal reporting procedures and the identity of the MLRO and Nominated Officer(s).
20. In order to achieve this the firm must as a minimum:
(a) provide any employee who has not been classified as a relevant employee with a written explanation of the firm’s and the employee’s obligations and potential criminal liability under the Relevant Enactments, including the implications of failing to make an internal disclosure; and (b) require the employee to acknowledge that they understand the firm’s written explanation and the procedure for making an internal disclosure.
15.6. Methods of Training
21. While there is no single or definitive way to conduct training, the critical requirement is that
training is adequate and relevant to those being trained and that the content of the training reflects good practice.
22. The guiding principle of all AML and CFT training should be to encourage relevant employees,
irrespective of their level of seniority, to understand and accept their responsibility to contribute to the protection of the firm against the risks of ML and FT.
23. The precise approach adopted will depend upon the size, nature and complexity of the firm’s
business. Classroom training, videos and technology-based training programmes can all be used to good effect, depending on the environment and the number of relevant employees to be trained.
24. Training should highlight to relevant employees the importance of the contribution that they can
individually make to the prevention and detection of ML and FT. There is a tendency, in particular on the part of more junior employees, to mistakenly believe that the role they play is less pivotal than that of more senior colleagues. Such an attitude can lead to failures in the dissemination of important information because of mistaken assumptions that the information will have already been identified and dealt with by more senior colleagues.
15.7. Frequency of Training
25. The firm must provide the appropriate level of AML and CFT induction training, or a written
explanation, to all new relevant employees or other employees respectively, before they become actively involved in the day-to-day operations of the firm.
26. Consideration should be given by the firm to establishing an appropriate minimum period of time
by which, after the start of their employment, new employees should have completed their AML and CFT induction training. Satisfactory completion and understanding of any mandatory induction training should be a requirement of the successful completion of a relevant employee’s probationary period.
27. The firm must provide AML and CFT training to all relevant employees at least every two years.
Training will need to be more frequent to meet the requirements of Schedule 3 if new legislation or significant changes to this Handbook are introduced, or where there have been significant technological developments within the firm or the introduction of new products, services or practices.

Chapter 15 - Page 197
15.8. Content of Training
28. The firm must, in providing the training required pursuant to Schedule 3 and this Handbook:
(a) provide appropriate training to relevant employees to enable them to competently analyse information and documentation so as to enable them to form an opinion on whether a business relationship or occasional transaction is suspicious in the circumstances; (b) provide relevant employees with a document outlining their own obligations and potential criminal liability and those of the firm under Schedule 3 and the Relevant Enactments; (c) prepare and provide to relevant employees a copy, in any format, of the firm’s policies, procedures and controls manual for AML and CFT; and (d) ensure relevant employees are fully aware of all applicable legislative requirements.
29. In accordance with Paragraph 13(2) of Schedule 3, the ongoing training provided by the firm shall
cover –
(a) the Relevant Enactments, Schedule 3 and this Handbook, (b) the personal obligations of employees, and partners, and their potential criminal liability under Schedule 3 and the Relevant Enactments, (c) the implications of non-compliance by employees, and partners, with any rules (including Commission Rules), guidance, instructions, notices or other similar instruments made for the purposes of Schedule 3, and (d) the firm’s policies, procedures and controls for the purposes of forestalling, preventing and detecting ML and FT.
30. In addition to the requirements of Paragraph 15.29. above, the firm must ensure that the ongoing
training provided to relevant employees in accordance with Schedule 3 and this Handbook also covers, as a minimum:
(a) the requirements for the internal and external disclosing of suspicion; (b) the criminal and regulatory sanctions in place, both in respect of the liability of the firm and personal liability for individuals, for failing to report information in accordance with the policies, procedures and controls of the firm; (c) the identity and responsibilities of the MLRO, MLCO and Nominated Officer; (d) dealing with business relationships or occasional transactions subject to an internal disclosure, including managing the risk of tipping off and handling questions from customers; (e) those aspects of the firm’s business deemed to pose the greatest ML and FT risks, together with the principal vulnerabilities of the products and services offered by the firm, including any new products, services or delivery channels and any technological developments; (f) new developments in ML and FT, including information on current techniques, methods, trends and typologies; (g) the firm’s policies, procedures and controls surrounding risk and risk awareness, particularly in relation to the application of CDD measures and the management of high risk and existing business relationships; (h) the identification and examination of unusual transactions or activity outside of that expected for a customer; (i) the nature of terrorism funding and terrorist activity in order that employees are alert to transactions or activity that might be terrorist-related; (j) the vulnerabilities of the firm to financial misuse by PEPs, including the effective identification of PEPs and the understanding, assessing and handling of the potential risks associated with PEPs; and (k) UN, UK and other sanctions and the firm’s controls to identify and handle natural persons, legal persons and other entities subject to sanction.

Chapter 15 - Page 198
31. The list included in Commission Rule 15.30. above is not exhaustive and there may be other areas
that the firm deems it appropriate to include based on the business of the firm and the conclusions of its business risk assessments.
32. In accordance with Paragraph 13(3) of Schedule 3, the firm shall also identify relevant employees
and partners in the firm who, in view of their particular responsibilities, should receive additional and ongoing training, appropriate to their roles, in the matters set out in Paragraph 15.29. above and it shall provide such additional training.
33. Sections 15.9. – 15.11. below set out those categories of relevant employee who are to be
provided with additional training, together with the particular focus of the additional training provided. The categories below are not exhaustive and the firm may identify other relevant employees who it considers require additional training in accordance with Paragraph 15.32. above.
15.9. The Board and Senior Management
34. The board and senior management are responsible for ensuring that the firm has appropriate and
effective policies, procedures and controls to counter the risk of ML and FT. In accordance with Paragraph 13(3) of Schedule 3, the board and senior management must therefore be identified as relevant employees to whom additional training must be given in order that they remain competent to give adequate and informed consideration as to the effectiveness of those policies, procedures and controls.
35. The additional training provided to the board and senior management must include, at a minimum,
a clear explanation and understanding of:
(a) Schedule 3, this Handbook and the Relevant Enactments, including information on the offences and related penalties, including potential director and shareholder liability; (b) the conducting and recording of ML and FT business risk assessments and the formulation of a risk appetite, together the establishment of appropriate, relevant and effective policies, procedures and controls; and (c) methods to assess the effectiveness of the firm’s systems and controls and its compliance with Schedule 3, this Handbook and other Relevant Enactments.
15.10. The Money Laundering Reporting Officer and Nominated Officer
36. The MLRO and Nominated Officer are responsible for the handling of internal and external
disclosures. In accordance with Paragraph 13(3) of Schedule 3, the MLRO and Nominated Officer must be identified as relevant employees to whom additional training must be given.
37. The additional training provided to the MLRO and Nominated Officer must include, at a minimum:
(a) the handling of internal disclosures of suspicious activity; (b) the making of high quality external disclosures to the FIS; (c) the handling of production and restraining orders including, but not limited to, the requirements of the Relevant Enactments and how to respond to court orders; (d) liaising with the Commission and law enforcement agencies; and (e) the management of the risk of tipping off.

Chapter 15 - Page 199
15.11. The Money Laundering Compliance Officer
38. The MLCO is responsible for monitoring and testing the effectiveness and appropriateness of the
firm’s policies, procedures and controls to counter the risk of ML and FT. In accordance with Paragraph 13(3) of Schedule 3, the MLCO must be identified as a relevant employee to whom additional training must be given.
39. The training provided to the MLCO must address the monitoring and testing of compliance systems
and controls (including details of the firm’s policies and procedures) in place to prevent and detect ML and FT.

Chapter 16
Record Keeping
Contents of this Chapter
16.1. Introduction.........................................................................................................................202
16.2. Relationship and Customer Records...................................................................................202
16.3. Transaction Records............................................................................................................203
16.4. Wire Transfers ....................................................................................................................204
16.5. Internal and External Disclosures.......................................................................................204
16.6. Training Records.................................................................................................................204
16.7. Business Risk Assessments.................................................................................................205
16.8. Policies, Procedures, Controls and Compliance Monitoring ..............................................205
16.9. Closure or Transfer of Business..........................................................................................205
16.10. Ready Retrieval...................................................................................................................205
16.11. Manner of Storage...............................................................................................................206

Chapter 16 - Page 202
16.1. Introduction

This Chapter outlines the requirements of Schedule 3 and the Commission Rules in relation to
record keeping and provides guidance to the firm for the purpose of countering the threat of ML and FT.
Record keeping is an essential component required by Schedule 3 in order to assist in any
financial investigation and to ensure that criminal funds are kept out of the financial system, or if not, that they may be detected and confiscated by the appropriate authorities. If law enforcement agencies, either in the Bailiwick or elsewhere, are unable to trace criminal property due to inadequate record keeping, then prosecution for ML and FT and confiscation of criminal property may not be possible. Likewise, if the funds used to finance terrorist activity cannot be traced back through the financial system, then the sources and destinations of terrorist financing will not be identifiable.
Sound record keeping is also essential to facilitate effective supervision, allowing the
Commission to supervise compliance by the firm with its statutory obligations and regulatory requirements. For the firm,sound record keeping provides evidence of the work it has undertaken to comply with those statutory obligations and regulatory requirements, as well as allowing for it to make records available on a timely basis, i.e. promptly to domestic competent authorities pursuant to Schedule 3 or the Relevant Enactments and to auditors.
To ensure that the record keeping requirements of Schedule 3 and this Handbook are met, the
firm must have appropriate and effective policies, procedures and controls in place which require that records are prepared, kept for the stipulated period and in a readily retrievable form.
16.2. Relationship and Customer Records
In accordance with Paragraph 14(2) of Schedule 3, the firm shall keep:
(a) all transaction documents (as detailed in Section 16.3. below), relationship risk assessments, and any CDD information, or (b) copies thereof, for the minimum retention period.
In order to meet the requirements of Paragraph 14(2) of Schedule 3 in relation to transaction
documents, relationship risk assessments and CDD information, the firm must keep the following records:
(a) copies of the identification data obtained to verify the identity of all customers, beneficial owners and other key principals (for example, copies of records of official identification documents such as passports, identity cards, driving licences or similar); (b) copies of any relationship risk assessments carried out in accordance with Paragraph 3(4) of Schedule 3 and Chapter 3 of this Handbook; and (c) copies of any customer files, account files, business correspondence and information relating to the business relationship or occasional transaction, including the results of any analysis undertaken (for example, inquiries to establish the background and purpose of complex, unusual or large transactions); or (d) information as to where copies of the CDD information may be obtained.

Chapter 16 - Page 203
7. In accordance with Paragraph 21(1) of Schedule 3, the minimum retention period in the case of
any CDD information is:
(i) a period of five years starting from the date – (A) where the customer has established a business relationship with the firm, that relationship ceased, (B) where the customer has carried out an occasional transaction with the firm, that transaction was completed, or (ii) such other longer period as the Commission may direct.
16.3. Transaction Records
8. In accordance with Paragraph 14(1) of Schedule 3, the firm shall keep a comprehensive record
of each transaction with a customer or an introducer, including the amounts and types of currency involved in the transaction (if any); and such a record shall be referred to as a “transaction document”.
9. In order to meet the requirements of Paragraph 14(1) of Schedule 3 to keep each transaction
document, all transactions carried out on behalf of or with a customer in the course of business, both domestic and international, must be recorded by the firm. In every case sufficient information must be recorded to permit the reconstruction of individual transactions so as to provide, if necessary, evidence for prosecution of criminal activity.
10. The firm must ensure that, in order to meet the record keeping requirements for a transaction,
documentation is maintained which must include:
(a) the name and address of the customer and beneficial owner; (b) for a monetary transaction, the amounts and types of currency involved in the transaction; (c) the account name and number or other information by which it can be identified; (d) details of the counterparty, including account details; (e) the nature of the transaction; and (f) the date of the transaction.
11. Records relating to unusual and complex transactions and high risk transactions must include the
firm’s own reviews of such transactions.
12. In accordance with Paragraph 21(1) of Schedule 3, the minimum retention period is, in the case
of any transaction document –
(i) a period of five years starting from the date that the transaction and any related transaction were completed, or (ii) such other longer period as the Commission may direct.
13. In accordance with Paragraph 14(4) of Schedule 3, where the firm is required by any enactment,
rule of law or court order to provide a transaction document or any CDD information to any person before the end of the minimum retention period, the firm shall – (a) keep a copy of the transaction document or CDD information until the period has ended or the original is returned, whichever occurs first, and (b) maintain a register of transaction documents and CDD information so provided.

Chapter 16 - Page 204
16.4. Wire Transfers
14. Section 7 of the Transfer of Funds Ordinance requires the PSP of the payee to retain all records
of any information received on the payer of a transfer of funds for five years from the date of the transfer of funds.
16.5. Internal and External Disclosures
15. In accordance with Paragraph 14(5)(a) of Schedule 3, the firm shall keep records of any internal
disclosures made to the MLRO or a Nominated Officer and of any external disclosures made under Part I of the Disclosure Law or Section 15 or 15A, or Section 12 (as appropriate), of the Terrorism Law made other than by way of an internal disclosure to the MLRO.
16. In meeting the requirements of Paragraph 14(5)(a) of Schedule 3 related to disclosures, the firm
must keep:
(a) the internal disclosure and any supporting documents; (b) records of actions taken under the internal and external reporting requirements; (c) evidence of the enquiries made in relation to that internal disclosure; (d) where the MLRO (or a Nominated Officer) has considered information or other material concerning possible ML and FT, but has not made an external disclosure to the FIS, a record of the other material that was considered and the reason for the decision; and (e) where an external disclosure has been made to the FIS, evidence of the MLRO’s (or Nominated Officer’s) decision and copies of all relevant information passed to the FIS.
17. In addition to the above, the firm must maintain a register covering both internal disclosures and
external disclosures made to the FIS, and include the following as a minimum:
(a) the date the internal disclosure was received by the MLRO (or the Nominated Officer); (b) the name of the person submitting the internal disclosure; (c) the date of the disclosure to the FIS (if applicable); (d) the name of the person who submitted the disclosure to the FIS (if applicable); (e) the value of the transaction or activity subject to the disclosure (where available); (f) a reference by which supporting evidence is identifiable; and (g) the date(s) of any update(s) (additional information) submitted to the FIS.
18. In accordance with Paragraph 14(5)(a)(i)-(iii) of Schedule 3, the minimum retention period for
disclosures is five years starting from –
(a) in the case of an internal or external disclosure in relation to a business relationship, the date the business relationship ceased, (b) in the case of an internal or external disclosure in relation to an occasional transaction, the date that the transaction was completed, or (c) in any other case, the event in respect of which the internal or external disclosure was made.
16.6. Training Records
19. In accordance with Paragraph 14(5)(b) of Schedule 3, the firm shall keep records of any training
carried out under Paragraph 13 of Schedule 3 for five years starting from the date the training was carried out.
20. In order to meet the requirements of Paragraph 14(5)(b) of Schedule 3 to keep records of AML
and CFT training undertaken, the firm must record the following as a minimum:

Chapter 16 - Page 205
(a) the dates training was provided;
(b) the nature of the training; and
(c) the names of the employees who received the training.
16.7. Business Risk Assessments
21. In accordance with Paragraph 14(3) of Schedule 3, the firm shall keep copies of business risk
assessments carried out under Paragraph 3(1) of Schedule 3 until the expiry of the period of five years starting from the date on which they cease to be operative.
16.8. Policies, Procedures, Controls and Compliance Monitoring
22. In accordance with Paragraph 14(5)(c)-(d) of Schedule 3, the firm shall keep any minutes or other
documents prepared pursuant to Paragraph 15(1)(c) of Schedule 3, until – (i) the expiry of a period of five years starting from the date they were finalised, or (ii) they are superseded by later minutes or other documents prepared under that paragraph, whichever occurs later, and its policies, procedures and controls which it is required to establish and maintain pursuant to Schedule 3, until the expiry of a period of five years starting from the date that they ceased to be operative.
23. In order to meet the requirements Paragraph 14(5)(c)-(d) of Schedule 3, the firm must retain:
(a) reports made by the MLRO and MLCO to the board and senior management; (b) records or minutes of the board’s consideration of those reports and of any action taken as a consequence; and (c) any records made within the firm or by other parties in respect of the firm’s compliance with Schedule 3 and this Handbook.
16.9. Closure or Transfer of Business
24. Where the firm terminates activities or disposes of a business or a block of business relationships
(for example, by way of asset sale to another firm) the person taking on that business must ensure that the record keeping requirements of Schedule 3 and this Handbook are complied with in respect of such business.
16.10. Ready Retrieval
25. In accordance with Paragraph 14(6) of Schedule 3, documents and CDD information, including
any copies thereof, kept in accordance with Schedule 3, may be kept in any manner or form, provided they are readily retrievable.
26. Periodically the firm must review the ease of retrieval, and condition, of paper and electronically
retrievable records.
27. In accordance with Paragraph 14(6)(b) of Schedule 3, documents and CDD information,
including any copies thereof, kept in accordance with Schedule 3, shall be made available promptly:
(i) to an auditor; and

Chapter 16 - Page 206
(ii) to any police officer, the FIS, the Commission or any other person, where such documents or CDD information are requested pursuant to Schedule 3 or any of the Relevant Enactments.
28. The firm must consider the implications for meeting the requirements of Schedule 3 where
documentation, data and information is held overseas or by third parties, such as under outsourcing arrangements, or where reliance is placed upon an introducer.
29. The firm must not enter into outsourcing arrangements or place reliance on third parties to retain
records where access to those records is likely to be restricted.
30. Where the FIS or another domestic competent authority requires sight of records, either under
Schedule 3 or another of the Relevant Enactments, which according to the applicable procedures
would ordinarily have been destroyed, the firm must nonetheless conduct a search for those records and provide as much detail to the FIS or other domestic competent authority as possible.
16.11. Manner of Storage
31. The record keeping requirements are the same regardless of the format in which the records are
kept, or whether the transaction was undertaken by paper or electronic means.
32. Records may be retained:
(a) by way of original documents;
(b) by way of photocopies of original documents (certified where appropriate); (c) on microfiche; (d) in a scanned form; or (e) in a computer or electronic form (including cloud storage).
33. The use of technology to collect and/or store data and documents does not alter the obligations
and requirements described in this Handbook.
34. Where the firm utilises an electronic method of gathering identification data, for example, an
App. or other system as set out in Section 5.6. of this Handbook or a CDD Utility, the firm should include within its risk assessment of that technology an evaluation of the policy for the retention of documents. This evaluation should enable the firm to ensure that its use of the technology complies with the requirements of Schedule 3 and this Handbook and that the firm will not incur legal evidential difficulties (for example, in civil court proceedings).

Chapter 17
Transitional Provisions
Contents of this Chapter
17.1. Introduction.........................................................................................................................208
17.2. Business Risk Assessments.................................................................................................208
17.3. Policies, Procedures and Controls.......................................................................................208
17.4. Money Laundering Reporting Officer ................................................................................209
17.5. Money Laundering Compliance Officer.............................................................................210
17.6. Existing Business Relationships .........................................................................................210
17.7. Collective Investment Schemes – Nominated Firm for Investor CDD...............................211

Chapter 17 - Page 208
17.1. Introduction

This Chapter details the measures to be implemented by the firm in order to transition existing
compliance arrangements under the Criminal Justice (Proceeds of Crime) (Financial Services Business) (Bailiwick of Guernsey) Regulations, 2007 as amended (“the FSB Regulations”) and/or the Criminal Justice (Proceeds of Crime) (Legal Professionals, Accountants and Estate Agents) (Bailiwick of Guernsey) Regulations, 2008 as amended (“the PB Regulations”) to the requirements of Schedule 3 and the Commission Rules set out in this Handbook. This Chapter also provides the deadlines by which such revised controls are required to be implemented.
In accordance with Paragraph 4(1) of the Criminal Justice (Proceeds of Crime) (Bailiwick of
Guernsey) (Amendment) Ordinance, 2018 (“the Amendment Ordinance”), the requirements of
Schedule 3 shall come in to force on 31 March 2019.
In order to assist the firm in transitioning to the new regime, a tiered approach to the review of
existing business relationships has been provided, allowing the firm to update its relationship risk assessments and CDD information as part of its regular monitoring and ongoing CDD arrangements.
This Chapter covers the particular aspects of Schedule 3 and the Commission Rules where
material changes have been made to the requirements of the previous regime. There may be other changes required which are not covered in this Chapter. The firm should therefore have regard to the content of Schedule 3 and this Handbook in their entirety when considering the full scope of the changes required to be made.
17.2. Business Risk Assessments
As identified in Chapter 3 of this Handbook, a risk-based approach starts with the identification
and assessment of the risk that has to be mitigated and managed. Consideration of the information obtained as part of the firm’s ML and FT business risk assessments will enable the firm to assess the appropriate controls required to mitigate and manage any risks arising.
In accordance with Paragraphs 3(1) and 3(8) of Schedule 3, the firm shall carry out and document
a suitable and sufficient ML business risk assessment and a suitable and sufficient FT business risk assessment, which are specific to the firm, as soon as reasonably practicable after 31 March 2019 (and this shall be construed consistently with the provisions of this Handbook).
In order to meet the requirements of Paragraph 3 of Schedule 3 and Chapter 3 of this Handbook,
the firm must review its existing business risk assessment to ensure that it contains suitable, sufficient and separate assessments of the ML and FT risks to the firm.
For the purposes of Paragraph 17.6. above:
(a) the firm must have reviewed its business risk assessment and have had the revised ML and FT assessments approved by the board of the firm by no later than 30 September 2020; and (b) the conclusions of the Bailiwick’s NRA must be taken into account as part of the next review of the business risk assessment as required by Paragraph 3(1) of Schedule 3.
17.3. Policies, Procedures and Controls
As part of a risk-based approach, the policies, procedures and controls devised and utilised by
the firm will be determined by its assessment of the risks of ML and FT to its business. In this regard, the policies, procedures and controls of the firm should be reviewed in parallel with the

Chapter 17 - Page 209
business risk assessments to ensure that any changes in the perceived threats and vulnerabilities of the firm are mitigated and managed by its controls.
10. In accordance with Paragraphs 3(6) and 3(8) of Schedule 3, the firm shall review its policies,
procedures and controls as soon as reasonably practicable after 31 March 2019 to ensure that they remain appropriate and effective, in light of both the revisions to the business risk assessments of the firm in accordance with Paragraph 17.6. above and the requirements of Schedule 3, this Handbook and the risks relevant, or potentially relevant, to the firm identified in the NRA.
11. For the purposes of Paragraph 17.10.:
(a) the firm must have reviewed and revised its policies, procedures and controls, and these must have been approved by the board, by no later than 30 September 2020; and (b) the conclusions of the Bailiwick’s NRA must be taken into account as part of the next review of the firm’s policies, procedures and controls as required by Paragraph 3(6) of Schedule 3.
12. In reviewing its policies, procedures and controls, the firm should seek to ensure that they
appropriately mitigate any risks arising from the revised business risk assessments. Examples include, but are not limited to:
(a) customer take-on procedures: to ensure that any changes required to the relationship riskassessment process are taken into account, together with any changes to the CDD and CDD information required for various types of customer; (b) employee training arrangements: to ensure that any new or amended risks identified as
part of the revised business risk assessment are communicated to employees, together
with the firm’s risk appetite and tolerance; and (c) any automated screening/monitoring tools used to identify PEPs: to ensure that domestic PEPs and international organisation PEPs are flagged as appropriate.
13. In accordance with Paragraph 3(9) of Schedule 3, without prejudice to Paragraph 17.10. above,
until the firm has complied with Paragraph 3(6)(a) of Schedule 3, it shall continue to maintain the policies, procedures and controls it was required to establish and maintain under the FSB Regulations and/or the PB Regulations.
17.4. Money Laundering Reporting Officer
14. In accordance with Paragraph 12(1)(a) of Schedule 3, the firm shall appoint a person of at least
management level as the MLRO, provide the name, title and email address of that person to the Commission as soon as is reasonably practicable and, in any event, within fourteen days starting from the date of that person’s appointment, and ensure that all employees are aware of the name of that person.
15. Paragraph 12(2) of Schedule 3 provides that a person who, immediately prior to the coming into
force of Schedule 3, was the MLRO of the firm, having been appointed as such under Part III of the FSB Regulations or Part III of the PB Regulation, as the case may be, shall be deemed to have been appointed as the MLRO under Paragraph 12(1)(a) of Schedule 3 as at the date that Schedule 3 comes into force. Accordingly, Paragraph 12(4) of Schedule 3 affirms that the requirement to notify the Commission and the FIS of the name, title and email address of the MLRO does not apply to any such persons.
16. Where the firm’s MLRO appointed under the FSB Regulations and/or the PB Regulations will not
take such an appointment under Schedule 3, the firm must ensure that the Commission and the FIS are notified by 14 April 2019.

Chapter 17 - Page 210
17. Notification of any changes to the MLRO should be made via the Commission’s Online PQ Portal.
https://online.gfsc.gg
17.5. Money Laundering Compliance Officer
18. In accordance with Paragraph 15(1)(a) of Schedule 3, the firm shall, if it comprises more than one
individual, appoint a person of at least management level as the MLCO and provide the name, title and email address of that person to the Commission as soon as is reasonably practicable and, in any event, within fourteen days starting from the date of that person’s appointment.
19. Further information on the role of the MLCO, including the requirements in respect of the
individual appointed, can be found in Section 2.8.1. of this Handbook.
20. The board of the firm must ensure that a suitable MLCO is appointed by 31 March 2019 and the
Commission must be notified by 14 April 2019 of that person’s appointment
21. Notification of an individual’s appointment as MLCO should be made via the Commission’s
Online PQ Portal.
22. For the avoidance of doubt, in accordance with Paragraph 2.64. of this Handbook, the natural
person who holds the role of MLRO can also be appointed as the firm’s MLCO.
17.6. Existing Business Relationships
23. In accordance with Paragraph 4(1)(b) of Schedule 3, the firm shall ensure that the CDD measures
set out at Paragraph 4(3) of Schedule 3 are applied to all business relationships established prior to the coming in to force of Schedule 3 – (a) in respect of which there is maintained an anonymous account or an account in a fictitious name, as soon as possible after the coming in to force of Schedule 3 and in any event before such account is used again in any way, and (b) where it does not fall within (a) and to the extent that such steps have not already been carried out, at appropriate times on a risk-sensitive basis.
24. Additionally, in accordance with Paragraph 8(1)(b) of Schedule 3, the firm shall, in relation to all
customers, maintain accounts in a manner which facilitates the meeting of the requirements of
Schedule 3, and the relevant Commission Rules and guidance in this Handbook.
25. The firm should apply the relationship risk assessment and CDD requirements of Schedule 3 and
this Handbook, including the application of enhanced measures as necessary, to existing business relationships at appropriate times on the basis of materiality and risk. This provides for the firm to apply the requirements of Schedule 3 and the Commission Rules sensibly and to consider all relevant factors rather than carrying out a ‘tick box’ exercise.
26. The review of relationship risk assessments and CDD information, and the application of CDD
and enhanced measures in accordance with Schedule 3 and this Handbook, should be conducted at appropriate times, taking into account whether and when any CDD measures have previously been applied and the adequacy of the identification data held. Whilst Commission Rules 17.27. and 17.28. below, enable the firm to determine how best to manage the review within the timeframe set, the Commission would encourage the firm to take a risk based approach to ensure that current CDD measures, including ECDD and/or enhanced measures where relevant, are applied to its high risk business relationships well in advance of 31 December 2021. Setting a 30 June 2021 deadline for reviewing all high risk business relationships would be prudent.

Chapter 17 - Page 211
27. Notwithstanding the above, the board must ensure that all business relationships are reviewed by
31 December 2021.
28. In complying with Paragraph 8 of Schedule 3, as part of the reviews conducted by the firm in
accordance with Commission Rule 17.27. above, the firm must take all steps deemed necessary to ensure that relationship risk assessments are conducted and appropriate CDD measures applied, including ECDD and/or enhanced measures where relevant, in accordance with Paragraphs 2 to 8 of Schedule 3 and Chapters 3 to 9 of this Handbook.
29. Where, following a review, the firm has concluded that the overall risk of a business relationship
has not changed and it considers that the CDD information held appropriately verifies the identity of, and mitigates the specific risks associated with, that customer (and the beneficial owner and any other key principals thereof), in accordance with Paragraph 11.43. of this Handbook the firm is not required to re-verify the identity of the customer, beneficial owner and other key principals.
30. When determining whether it is necessary to gather additional CDD information, the firm should
review and research whether existing records contain the required items. The firm may have had a business relationship for many years and therefore already hold considerable information concerning the customer. In these circumstances research should be undertaken to clarify whether it is a matter of collating records before further approaching a customer or other key principal.
31. Where the firm has concluded that the CDD information held is not sufficient to enable
compliance with Schedule 3 and the Commission Rules, prior to reverting to a customer or other key principal the firm should consider the materiality of the extra information/documentation required and whether compliance could be achieved through alternate means. Such alternate means could be through the use of online databases or verification tools to provide additional identification data, or corroborate any identification data held.
32. Where the firm holds certified identification data which was obtained prior to the coming in to
force of Schedule 3 and this Handbook, provided the firm is satisfied as to the veracity of the identification data held and the certification provided in connection with that identification data, the firm is not required to re-certify (or seek newly certified) identification data.
17.7. Collective Investment Schemes – Nominated Firm for Investor CDD
33. In accordance with Paragraph 4.57. of this Handbook, each CIS authorised or registered by the
Commission must nominate a firm licensed under the POI Law to be responsible for the application of CDD measures to all investors in that CIS.
34. As required by Commission Rule 4.59., the nominated firm must treat the investors into the CIS
for which it has been nominated as if they were its customers and deal with them in accordance with the requirements of Schedule 3 and this Handbook.
35. Where a CIS already holds an authorisation or registration issued by the Commission, the
nominated firm must notify the Commission by the 31 May 2019 that it has been so nominated.
36. As an initial means of notifying the Commission of the firm’s nomination by a CIS in accordance
with Commission Rule 17.35. above, a one-off form entitled ‘Notification of the Firm’s Nomination for Investor CDD’ will be made available via the Commission’s Online Submissions Portal for all firms licensed under the POI Law. https://submit.gfsc.gg/

Lineage: No known changes

Similar documents from other regulators