PART 2Money Laundering and Terrorist Financing
CHAPTER 2Risk assessment and controls
Policies, controls and procedures: group level20
1
A relevant parent undertaking must—
a
ensure that the policies, controls and procedures referred to in F4regulations 19(1) and 19A(1) apply—
i
to all its subsidiary undertakings, including subsidiary undertakings located outside the United Kingdom; and
ii
to any branches it has established outside the United Kingdom;
which is carrying out any activity in respect of which the relevant person is subject to these Regulations;
b
establish and maintain throughout its group the policies, controls and procedures for data protection and sharing information for the purposes of preventing F5money laundering, terrorist financing and proliferation financing with other members of the group F1, including policies on the sharing of information about customers, customer accounts and transactions;
c
regularly review and update the policies, controls and procedures applied and established under sub-paragraphs (a) and (b);
d
maintain a record in writing of—
i
the policies, controls and procedures established under sub-paragraphs (a) and (b);
ii
any changes to those policies, controls and procedures made as a result of the review and update required by sub-paragraph (c); and
iii
the steps taken to communicate those policies, controls and procedures, or any changes to them, to its subsidiary undertakings and branches.
F22
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3
If any of the subsidiary undertakings or branches of a relevant parent undertaking are established in a third country which does not impose requirements to counter F6money laundering, terrorist financing and proliferation financing as strict as those of the United Kingdom, the relevant parent undertaking must ensure that those subsidiary undertakings and branches apply measures equivalent to those required by these Regulations, as far as permitted under the law of the third country.
4
Where the law of a third country does not permit the application of such equivalent measures by the subsidiary undertaking or branch established in that country, the relevant parent undertaking must—
a
inform its supervisory authority accordingly; and
b
take additional measures to handle the risk of F7money laundering, terrorist financing and proliferation financing.
5
A relevant parent undertaking must ensure that information relevant to the prevention of F8money laundering, terrorist financing and proliferation financing is shared as appropriate between members of its group, subject to any restrictions on sharing information imposed by or under any enactment or otherwise.
F36
The FCA may make technical standards specifying—
a
what additional measures are required from credit institutions and financial institutions under paragraph (4); and
b
the minimum action to be taken by credit institutions and financial institutions where paragraph (4) applies.