PS21/4: Extension of Annual Financial Crime Reporting Obligation

Extension of Annual Financial Crime
Reporting Obligation
Policy Statement
PS21/4
March 2021

PS21/4 Financial Conduct Authority
Extension of Annual Financial Crime Reporting Obligation This relates to Consultation Paper 20/17 which is available on our website at www.fca.org.uk/publications Sign up for our news and publications alerts See all our latest press releases, consultations and speeches. Contents 1 Summary 3 2 Consultation responses 7
Annex 1
List of non-confidential respondents 11
Annex 2
Abbreviations used in this paper 12
Appendix 1
Made rules (legal instrument)

PS21/4
Chapter 1
Financial Conduct Authority
Extension of Annual Financial Crime Reporting Obligation 1 Summary
1.1 In July 2016, we introduced an annual financial crime reporting obligation for certain
firms1
, which we refer to throughout this document as ‘REP-CRIM’. In August 2020, we consulted on increasing2 the number of firms that were required to submit the return. We proposed that cryptoasset businesses, and many firms that were not previously included, be brought into scope of the return based on their business activities and the potential money laundering risks. Following consultation, we are now publishing our final policy and requirements. Who this affects
1.2 Firms we supervise under the Money Laundering Regulations (MLRs). MLRs cover a
variety of firms such as banks, building societies and cryptoasset businesses. The wider context of this policy statement Our consultation
1.3 Approximately 2,500 out of the approximate 22,000 firms we supervise under The
Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs) currently submit REP-CRIM return. This return helps us supervise firms subject to these regulations by providing a range of indicators that reflects the inherent money laundering risk of a firm. In our 2020/21 Business Plan, we said we would consider extending the the REP-CRIM reporting obligation to more firms. Reviewing our policy allows us to keep up to date with changes in legislation such as cryptoasset businesses now falling within the scope of the MLRs. How it links to our objectives
1.4 We have statutory objectives under the Financial Services and Markets Act that
include protecting and enhancing the integrity of the UK financial system. The integrity of the UK financial system includes it not being used for a purpose connected with financial crime. What we are changing
1.5 We are extending the scope of firms which are required to submit a REP-CRIM return
from approximately 2,500 to approximately 7,000 firms. We based our assessment of which firms this extension will apply on our understanding of the potential money laundering risks. 1 The obligation to provide this financial crime information is set out in our Handbook: see SUP 16.23 Annual Financial Crime Report (REP-CRIM) 2 www.fca.org.uk/publications/consultation-papers/cp20-17-extension-annual-financial-crime-reporting-obligation

PS21/4
Chapter 1
Financial Conduct Authority
Extension of Annual Financial Crime Reporting Obligation
1.6 In summary, the following additional firms will be required to provide us with REP-CRIM
information irrespective of their total annual revenue. Appendix 1 sets out the rules.

• Certain FSMA authorised firms falling within the scope of the MLRs which either:
  – hold client money or assets (ie holding under FCA Handbook CASS 5, 6 or 7); or – carry on an activity that we consider poses higher money laundering risk. (for eg dealings in investments as agents and managing investments). These are set out in the table under 16.23 in the Appendix 1.
• all payments institutions except for payment institutions that:
  – only carry on at least one of the following payment services:
  – Money remittance (these firms are supervised by HMRC for anti-money laundering (AML) purposes); – Account information services and/or payment initiation services. These firms do not receive or hold clients’ money and do not carry out payment transactions, and so pose a lower AML risk; – A person with temporary PI authorisation that immediately before IP completion day was providing payment services other than through a branch in the UK or a UK-based agent (as defined in the FCA handbook), as per revision to instrument.
• All electronic money institutions.
• All Multilateral Trading Facilities (MTFs).
• All Organised Trading Facilities (OTFs). OTFs are a type of firm introduced by MiFID
  II, and therefore we are bringing them with the scope of the REP-CRIM obligations and updating our rules.
• All cryptoasset exchange providers and custodian wallet providers.
  1.7 We have removed two activities from the REP-CRIM reporting obligation which
  we consider are outside of the scope of the MLRs. These activities are ‘home finance mediation activity’ and ‘making arrangements with a view to transactions in investments’, as defined in the FCA Handbook Glossary.
  1.8 We are further clarifying that a cryptoasset business is not required to submit the
  information set out in sections 4 (Sanctions-specific information), However, a cryptoasset business may choose to do so voluntarily. Section 5 (Fraud) questions remain voluntary as it does for all firms submitting REP-CRIM.
  1.9 Based on the consultation responses, the final rules have been drafted to better clarify
  the requirements setting out which firms must complete REP-CRIM (see Chapter 2).
  1.10 The consultation proposed that cryptoasset firms would have to submit their first
  REP-CRIM from their next accounting reference date after 10 January 2022. The 10 January 2022 date was chosen because that was 12 months from the date by which cryptoasset firms carrying on business before 10 January 2020 had to be registered with the FCA. However, on 16 December 2020 the FCA established a Temporary Registration Regime to allow existing cryptoasset firms, who had applied to be registered with the FCA, to continue trading. This was to enable those existing businesses to continue to trade after 9 January 2021 until 9 July 2021, pending the FCA’s determination of their application. We have, therefore, aligned the coming into force date of the new rules for all firms to 30 March 2022. This still allows cryptoasset

PS21/4
Chapter 1
Financial Conduct Authority
Extension of Annual Financial Crime Reporting Obligation firms at least 12 months from the date they had been registered by the FCA (ie by 10 January 2021). The new requirements do not affect the reporting timelines for firms that are already required to submit REP-CRIM on an annual basis. Outcome we are seeking
1.11 These changes will give us firm-specific information about financial crime from a
wider set of firms, across an increased variety of sectors and firm sizes. This additional information will allow our supervisory approach to be more data-led, and broaden our understanding of firms that may have inherent money laundering risks due to their activities. This information will help us improve the focus and effectiveness of our risk-based supervisory approach and allow us to continue to focus our supervisory tools. This means our resources are targeted at firms that carry on activities that pose potentially higher money laundering risks. This approach will result in continued improvement of firms’ money laundering systems and controls, reduce the risk of money laundering and help improve the overall integrity of the UK financial system. It is also in line with, and builds upon, our data strategy, announced last year, to use data and data analytics to transform the way we regulate. Measuring success
1.12 Key indicators of success will be:

• receiving financial crime related information from a wider set of firms,
• greater supervisory engagement with firms previously not subject to the REP￾CRIM reporting obligation,
• the more effective and efficient use of FCA resources through better targeting of firms
  for supervisory visits and conducting more focused and proportionate visits, and
• benefits to the industry through use of aggregate information related to money
  laundering to inform firms and the UK’s national risk assessment. Summary of feedback and our response
  1.13 The consultation received 23 responses.
  1.14 Many respondents were unclear whether we were proposing to require general
  insurance firms to begin completing the form. We can confirm that the changes will not require firms that only carry out general insurance to complete REP-CRIM.
  1.15 Respondents’ views are set out in Chapter 2.
  Equality and diversity considerations
  1.16 We have considered the equality and diversity issues that may arise from the policy set
  out in this Statement. Overall, we do not consider that the changes materially impact any of the groups with protected characteristics under the Equality Act 2010.

PS21/4
Chapter 1
Financial Conduct Authority
Extension of Annual Financial Crime Reporting Obligation What you need to do next
1.17 Firms that will be brought into the scope of REP-CRIM for the first time will need to be
prepared to submit the return when it is due.

PS21/4
Chapter 2
Financial Conduct Authority
Extension of Annual Financial Crime Reporting Obligation 2 Consultation responses
2.1 The consultation received 23 responses, from a mixture of trade bodies, firms and
consultants.
Scope
2.2 Six respondents found the proposals to be unclear as to whether general insurance
firms would need to complete the form. It was suggested the rules, including the table, be reworded to remove the scope for confusion.
2.3 Several respondents welcomed the extension to cryptoasset businesses, although
one respondent thought this was unduly burdensome on the sector, and inconsistent, given that cryptoasset businesses are only registered by the FCA under the Money Laundering Regulations, and are not regulated under the Financial Services and Markets Act like all other submitters.
2.4 Several respondents welcomed the fact that home finance mediation firms would not
need to complete the form, although one respondent suggested these firms should be included because of the dangers of mortgage fraud. Our response a. General insurers and general insurance intermediaries will not need to submit REP-CRIM (unless they also offer other services that fall within the scope of the REP-CRIM rules). General insurers and general insurance intermediaries are not subject to the MLRs and the relevant reporting rules (contained in SUP 16.23) have been drafted to apply only to firms that are subject to the MLRs. b. We consider it appropriate to include cryptoasset businesses irrespective of their total annual revenue because they pose a higher inherent money laundering and terrorist financing risk.
c. REP-CRIM applies to firms which are subject to the MLRs; we are not
requiring home finance mediation firms to complete the REP-CRIM return because this activity does not fall within the MLRs. Firm size thresholds
2.5 Three respondents expressed views about the size thresholds for REP-CRIM
submissions. Whilst one supported our proposal, the other two said existing thresholds, or smaller thresholds, should apply to avoid placing new burdens on small firms. It was also suggested smaller firms could complete a shorter return or do so less often.

PS21/4
Chapter 2
Financial Conduct Authority
Extension of Annual Financial Crime Reporting Obligation Our response We haven’t changed our proposal from consultation. As we proposed we have removed the annual revenue threshold (below which submission was not necessary previously) for some firms carrying on activities that we consider pose higher money laundering risks (for example firms undertaking the activity of 'dealing in investments as agent' or 'dealing in investments as principal'). All cryptoasset businesses will need to submit the return, regardless of their size. This will ensure that firms maintain high compliance standards and improve transparency and enable better supervision of such firms by the FCA. Cost-benefit analysis
2.6 Two respondents felt our cost-benefit analysis underestimated the costs: one
suggesting the one-off costs for each firm affected could be twice what we estimated it to be (in cases where firms have no existing infrastructure to report the data), and over time, these costs should balance against enhanced firm capability to assess and manage financial crime risks. Another suggested the costs on industry could be lowered by maintaining the existing size threshold when exempting small businesses. A respondent felt we did not recognise that firms may ultimately pass implementation costs on to consumers. Our response Our cost estimates are based on the surveyed sample of firms across the sectors and revenue thresholds that would be affected by the proposal. We consider that there will be indirect benefit to consumers, including having more confidence in the market. The requirement to collect this data, for those firms which do not already do so, will enable them to have a better understanding of their money laundering risks and, therefore, be in a better position to mitigate those risks. Implementation
2.7 Two respondents asked the FCA to ensure that firms newly-caught by the new rules
would be given enough time to implement them, with those with year-end reporting dates soon after the revised rules come into effect potentially being most affected if they are not given time.

PS21/4
Chapter 2
Financial Conduct Authority
Extension of Annual Financial Crime Reporting Obligation Our response Whilst we are conscious of the need to allow firms that have been brought into scope of the new reporting requirements the time to have the correct systems in place we also believe that the data covered by REP-CRIM should already be held by firms in order for them to be able to effectively manage their financial crime risks. We believe 12 months is a proportionate amount of time to allow firms to prepare for their first submissions. Firms being brought into scope are required to submit their first REP-CRIM within 60 business days after their first Accounting Reference Date falling after 30 March 2022. The REP-CRIM form
2.8 Respondents sought clarity on the following aspects of the form:

• Can the FCA get data about suspicious activity reports (SARs) from the National
  Crime Agency (NCA)?
• Fuller fraud data is submitted in the FCA’s 'REP017' return. Isn’t asking further fraud
  questions in REP-CRIM duplicative?
  Our response
  REP-CRIM asks for data about both external SARs filed with the NCA and internal reports made within the firm, the NCA does not have data about the latter, and by asking for both figures to be submitted covering the same time period, and legal entity, we can be sure of receiving consistent data. The REP017 return is only completed by payment service providers and the questions on REP017 are different to the fraud questions (which are voluntary) in REP-CRIM. Other
  2.9 Respondents also made these comments:
  a. Why does the FCA not use sample surveys instead? b. Was the activity 'agreeing to carry on regulated activities' included in the table at
  16.23.2 in error, because the respondent believes this is a generic permission held by
  all firms?
  c. A trade body was concerned some of its members had previously been asked to
  submit REP-CRIM wrongly.

PS21/4
Chapter 2
Financial Conduct Authority
Extension of Annual Financial Crime Reporting Obligation d. One respondent asked if the form would be applied to 'Annex I Financial Institutions' in future. Our response a. Sample surveys are a good way of seeing what is typical in a broader population but is not the best approach to detect 'outlier' firms that may pose a higher intrinsic money laundering risk. In addition, this allows us to monitor firms on an ongoing basis. We believe only a comprehensive data-gathering exercise can do this. b. We note that a firm would not usually have 'agreeing to carry on regulated activities' as a standalone permission without the relevant permissions for the corresponding regulated activity and therefore have removed it from the table.
c. In exceptional cases, some firms may receive a prompt to complete
REP-CRIM when they need not submit. In such cases, firms should notify the FCA through their usual supervisory contact and they can be removed from the list of submitters. d. At this time, we have decided not to extend REP-CRIM beyond that set out in the new rules, but it is something we will keep under review.

PS21/4
Annex 1
Financial Conduct Authority
Extension of Annual Financial Crime Reporting Obligation
Annex 1
List of non-confidential respondents
Association of British Insurers
Association of Mortgage Intermediaries
Association of Professional Compliance Consultants Bittylicious Ltd British Insurance Brokers Association Coinpass Credit Services Association Electronic Money Association Elucidate GmbH ICE Koine Money Ltd London and International Insurance Brokers Association Sesame Bankhall Group Tesco Bank Wirex Ltd Xafinity SIPP Services Ltd Xreg Consulting Ltd

PS21/4
Annex 2
Financial Conduct Authority
Extension of Annual Financial Crime Reporting Obligation
Annex 2
Abbreviations used in this paper
Abbreviation Description
AML Anti-money laundering
FSMA The Financial Services and Markets Act 2000 MLR The Money Laundering Regulations 2017 ('The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017') NCA National Crime Agency REP-CRIM The FCA’s Annual Financial Crime Report that many firms are required to submit REP017 The FCA’s Payments Fraud Report that payment service providers are required to submit SAR Suspicious Activity Report All our publications are available to download from www.fca.org.uk. If you would like to receive this paper in an alternative format, please call 020 7066 7948 or email: publications_graphics@fca.org.uk or write to:
Editorial and Digital team, Financial Conduct Authority, 12 Endeavour Square, London, E20 1JN Sign up for our news and publications alerts

PS21/4
Appendix 1
Financial Conduct Authority
Extension of Annual Financial Crime Reporting Obligation
Appendix 1
Made rules (legal instrument)

FCA 2021/13
SUPERVISION MANUAL (FINANCIAL CRIME REPORT) (AMENDMENT No 2) INSTRUMENT 2021 Powers exercised A. The Financial Conduct Authority (“the FCA”) makes this instrument in the exercise of:
(1) the powers and related provisions in the Financial Services and Markets Act 2000 (“the Act”):
(a) section 137A (The FCA’s general rules); (b) section 137T (General supplementary powers); (c) section 139A (Power of the FCA to give guidance); (2) the following provisions of the Electronic Money Regulations 2011 (SI 2011/99):
(a) regulation 49 (Reporting Requirements); (b) regulation 60 (Guidance); and (3) the following provisions of the Payment Services Regulations 2017 (SI 2017/752):
(a) regulation 109 (Reporting Requirements); and (b) regulation 120 (Guidance). B. The rule-making powers listed above are specified for the purpose of section 138G(2) (Rule-making instruments) of the Act. Commencement
C. This instrument comes into force on 30 March 2022.
Amendments to the Handbook
D. The General Provisions (GEN) is amended in accordance with Annex A to this instrument. E. The Supervision manual (SUP) is amended in accordance with Annex B to this instrument. Citation F. This instrument may be cited as the Supervision Manual (Financial Crime Report) (Amendment No 2) Instrument 2021. By order of the Board 25 March 2021

FCA 2021/13
Annex A
Amendments to the General Provisions (GEN) In this Annex, underlining indicates new text. Sch 4 Powers exercised … Sch 4.8G The following additional powers and related provisions have been exercised by the FCA in GEN to direct, require or specify:
Regulation 74A (Reporting Requirements) of the Money Laundering Regulations Regulation 49 (Reporting requirements) of the Electronic Money Regulations …

FCA 2021/13
Annex B
Amendments to the Supervision manual (SUP) In this Annex, underlining indicates new text and striking through indicates deleted text. 16 Reporting requirements …
16.13 Reporting under the Payment Services Regulations
…
Purpose
16.13.2 G …
(5) give directions to payment service providers referred to at SUP 16.13.3-BD under regulation 109(1) (Reporting requirements) of the Payment Services Regulations in relation to annual financial crime reporting to the FCA. … Reporting requirement … 16.13.3- AA D SUP 16.23.4R to SUP 16.23.7R (Annual Financial Crime Report) apply to a payment institution as if a reference to firm in these rules and guidance were a reference to a payment institution and the reference to group is read accordingly, other than:
(1) a payment institution where its authorisation or registration permits it to provide only one or more of the following payment services and it is not permitted to carry on any regulated activities:
(a) account information services;
(b) payment initiation services; or
(c) money remittance, or
(2) a person with temporary PI authorisation that immediately before IP completion day was providing payment services other than through a branch in the UK or a UK-based agent. …

FCA 2021/13
16.15 Reporting under the Electronic Money Regulations
…
Reporting requirement
…
16.15.5A D SUP 16.23.4R to SUP 16.23.7R (Annual Financial Crime Report) apply to an electronic money institution that has reported total revenue of £5 million or more as at its last accounting reference date as if a reference to firm in these rules and guidance were a reference to an electronic money institution and the reference to group is read accordingly. …
16.23 Annual Financial Crime Report
Application
16.23.1 R This section applies to all firms (a) subject to the Money Laundering
Regulations, other than and (b) listed in the table below, except for:
(1) a credit union;
(2) a P2P platform operator;
(3) an authorised professional firm; or
(4) a firm with limited permissions only; or.
(5) a firm excluded under SUP 16.23.2R. [deleted]
16.23.2 R Unless a firm is listed in the table below, this section does not apply to it
where both of the following conditions are satisfied:
(1) the firm has reported total revenue of less than £5 million as at its last accounting reference date; and (2) the firm only has permission to carry on one or more of the following activities:
(a) advising on investments;
(b) dealing in investments as agent;
(c) dealing in investments as principal;
(d) arranging (bringing about deals) in investments; (e) making arrangements with a view to transactions in investments;

FCA 2021/13
(f) assisting in the administration and performance of a contract of insurance in relation to non-investment insurance contracts; (g) agreeing to carry on a regulated activity; (h) advising on pension transfers and pension opt-outs; (i) credit-related regulated activity; (j) home finance mediation activity; (k) managing investments; (l) establishing, operating or winding up a collective investment scheme; (m) establishing, operating or winding up a personal pension scheme; (n) establishing, operating or winding up a stakeholder pension scheme; (o) managing a UK UCITS; (p) managing an AIF; (q) safeguarding and administering investments; (r) acting as trustee or depositary of a UK UCITS; (s) acting as trustee or depositary of an AIF; and/or (t) operating a multilateral trading facility.
Table: Firms to which the exclusion in SUP 16.23.2R does not apply SUP 16.23.1R
applies(subject to the exclusions in SUP 16.23.1R). a UK bank; a building society; a non-UK bank a mortgage lender; a mortgage administrator; or a firm offering life and annuity insurance products.

FCA 2021/13 a firm that has permission to carry on one or more of the following activities:
advising on investments, provided that during the relevant financial year the firm:
(i) held client money under CASS 5 (Client money: insurance distribution activity) and/or CASS 7 (Client money rules); and/or (ii) held safe custody assets under CASS 6 (Custody rules); arranging (bringing about deals) in investments, provided that during the relevant financial year the firm:
(i) held client money under CASS 5 (Client money: insurance distribution activity) or CASS 7 (Client money rules); and/or (ii) held safe custody assets under CASS 6 (Custody rules); dealing in investments as agent; dealing in investments as principal; assisting in the administration and performance of a contract of insurance in relation to non-investment insurance contracts; managing investments; establishing, operating or winding up a collective investment scheme; establishing, operating or winding up a personal pension scheme; establishing, operating or winding up a stakeholder pension scheme; managing a UK UCITS; managing an AIF; safeguarding and administering investments; acting as trustee or depositary of a UK UCITS; acting as trustee or depositary of an AIF; operating a multilateral trading facility; and/or operating an organised trading facility. a firm that has reported total revenue of £5 million or more as at its last accounting reference date and has permission to carry on one or more of the following activities:
advising on investments; arranging (bringing about deals) in investments;

FCA 2021/13 advising on pension transfers and pension opt-outs; and credit-related regulated activity. … 16 Annex 42BG Guidance notes for completion of the Annual Financial Crime Report The form in SUP 16 Annex 42AR should only be completed by firms, and electronic money institutions and payment institutions subject to the reporting requirements in SUP 16.23.4R and SUP 16.15.5AD of the FCA Handbook. General Notes This data item is reported on a single unit basis and in integers, except where a full-time equivalent (FTE) figure is requested. Where an FTE figure is requested, this should be reported to two decimal places where available. If the figure to be reported is a whole number, this should be reported as [n].00. For the purposes of this data item and guidance notes, any references to firm or firms should be read as also applying to electronic money institutions and payment institutions. … Data Elements …
Section 5: Fraud
30-35A-D Please indicate the firm’s view of the top three most prevalent frauds which the FCA should be aware of and whether they are increasing, decreasing or unchanged. NB. This question is not mandatory. This question is designed to obtain the firm’s view on the most prevalent frauds relevant to the firm’s business and will be used by the FCA to understand whether the organisation is aware of the fraud risks identified by the broader industry. The fraud typologies available in the dropdown list are a subset taken from the Action Fraud A-Z of fraud types and are specified below. Please refer to the Action Fraud definitions in answering this question. The identified fraud typologies may or may not be those by which the firm has been specifically impacted, but should be

FCA 2021/13 those that the firm considers most prevalent as at the end of the reporting period. Fraud typologies 419 emails and letters Abuse of position of trust Account takeover Advance fee fraud Application fraud Asset misappropriation fraud Bond fraud Carbon credits fraud Cashpoint fraud Cheque fraud Companies – fraudulent Computer hacking Credit card fraud Debit card fraud Expenses fraud Exploiting assets and information Exploiting assets and information Fraud recovery fraud Hedge fund fraud Identity fraud and identity theft Insurance fraud Landbanking fraud Loan repayment fraud Short and long firm fraud Malware-enabled fraud Mandate fraud Mortgage fraud Other (to be used where the specified typologies are not applicable). Please provide the fraud type in the free text box. Other investment fraud

FCA 2021/13
Pension liberation fraud
Phishing
Ponzi schemes
Procurement fraud
Pyramid schemes
Share sale fraud
Smishing
Vishing
Suspected perpetrators
Customer
Internal employee
Organised crime group
Other (to be used where the suspected perpetrator typologies are not applicable). Please provide the perpetrator type in the free text box. Third party contractor Third party professional Third party supplier Unknown third party Primary Victim Customer Other (to be used where the suspected perpetrator is neither a customer nor a regulated firm/electronic money institution/payment institution). Please provide the primary victim type in the free text box. Regulated firm/electronic money institution/payment institution (all jurisdictions). Incidence Decreasing Emerging risk Increasing Stable

© Financial Conduct Authority 2021
12 Endeavour Square London E20 1JN
Telephone: +44 (0)20 7066 1000
Website: www.fca.org.uk
All rights reserved
Pub ref: 007567