The Money Laundering and Terrorist Financing (Amendment) Regulations 2019

Amendment of Part 6: supervision and registration

7.—(1) In regulation 46 (duties of supervisory authorities)—

(a) in paragraph (1), for “securing compliance” to the end substitute—

“—

(a) securing compliance by such persons with the requirements of these Regulations; and

(b) securing that any application for which the supervisory authority grants approval under regulation 26 meets the requirements of regulation 26(7), whether or not the person making the application, or being approved, is a relevant person.”;

(b) in paragraph (2)(e), after “report” insert “actual or potential”;

(c) after paragraph (2)(e) insert—

“(f) provide one or more secure communication channels for persons to report actual or potential breaches of these Regulations to it;

(g) take reasonable measures to ensure that the identity of the reporting person is known only to the supervisory authority.”.

(2) After regulation 46 insert—

“Annual reports by self-regulatory organisations

46A.   A self-regulatory organisation must publish or make arrangements to publish an annual report containing information about—

(a) measures taken by the self-regulatory organisation to encourage the reporting of actual or potential breaches as referred to in regulation 46(2)(e);

(b) the number of reports of actual or potential breaches received by that self-regulatory organisation as referred to in regulation 46(2)(e);

(c) the number and description of measures carried out by the self-regulatory organisation to monitor, and enforce, compliance by relevant persons with their obligations under—

(i) Part 3 (customer due diligence);

(ii) Part 3 of the Terrorism Act 2000 (terrorist property)(1) and Part 7 of the Proceeds of Crime Act 2002 (money laundering)(2);

(iii) regulation 40 (record-keeping); and

(iv) regulations 20 to 24 (policies and controls etc.).”.

(3) In regulation 49 (duties of self-regulatory organisations), after paragraph (1)(d) insert—

“(e) potential conflicts of interest within the organisation are appropriately handled.”.

(4) In regulation 50 (duty to co-operate)—

(a) in paragraph (1), for sub-paragraph (c) substitute—

“(c) to co-operate with overseas authorities—

(i) for the purposes of these Regulations, and

(ii) to ensure the effective supervision of a relevant person to which paragraph (2) applies.”;

(b) at the end of paragraph (3) insert—

“, provided that—

(a) any confidential information disclosed to the authority in question will be subject to an obligation of confidentiality equivalent to that provided for in regulation 52A;

(b) where the information disclosed has been received from an EEA state, it is only disclosed—

(i) with the express consent of the competent authority or other institution which provided the information; and

(ii) where appropriate, for the purposes for which the information was originally provided.”.

(5) In regulation 51 (regulatory information)—

(a) after paragraph (2) insert—

“(2A) The Treasury may disclose to the FCA information provided by the supervisory authorities under paragraph (2), provided that the disclosure is made for purposes connected with the effective exercise of—

(a) the functions of the Treasury under these Regulations in relation to self-regulatory organisations or under the Oversight of Professional Body Anti-Money Laundering and Counter Terrorist Financing Supervision Regulations 2017(3) (“the Professional Body Regulations”); or

(b) the functions of the FCA under the Professional Body Regulations.”;

(b) in each of paragraphs (4) and (5), after “paragraph (2)” insert “or (2A)”.

(6) In regulation 52 (disclosure by supervisory authorities), at the beginning of paragraph (1) insert “Subject to regulation 52A, ”.

(7) After regulation 52 insert—

“Obligation of confidentiality

52A.— (1) No person working for a relevant supervisory authority, or acting on behalf of a relevant supervisory authority (or who has worked or acted for a relevant supervisory authority) may, except in accordance with this regulation, disclose any confidential information received in the course of their duties under these Regulations.

(2) Information referred to in paragraph (1) may be disclosed in summary or aggregate form, provided that no credit institution or financial institution is identifiable from the information disclosed.

(3) A relevant supervisory authority may only use confidential information received pursuant to these Regulations—

(a) in the discharge of its duties under these Regulations or under other legislation relating to—

(i) money laundering or terrorist financing;

(ii) prudential regulation; or

(iii) the supervision of credit institutions and financial institutions;

(b) in an appeal against a decision of a supervisory authority;

(c) in court proceedings initiated by a relevant supervisory authority in the exercise of the duties referred to in sub-paragraph (a), or otherwise relating to the authority’s discharge of those duties.

(4) This regulation does not prevent the exchange of information between—

(a) any authority in the United Kingdom responsible for the supervision of a credit institution or a financial institution in accordance with these Regulations or other law relating to credit institutions or financial institutions (a “UK authority”) and another UK authority;

(b) a UK authority and the European Central Bank or a competent authority in an EEA state supervising any credit institution or financial institution in accordance with the fourth money laundering directive or other legislative acts relating to credit institutions or financial institutions.

(5) Confidential information may only be exchanged under paragraph (4) if the authority to which the information is provided agrees to hold it subject to an obligation of confidentiality equivalent to that set out in paragraph (1).

(6) Nothing in this regulation affects the disclosure of confidential information in accordance with regulations made under section 349 (exceptions from section 348) of FSMA(4).

(7) For the purposes of this regulation, a “relevant supervisory authority” is a supervisory authority which is responsible for the supervision of credit institutions or financial institutions.

Obligation of confidentiality: offence

52B.— (1) Any person who discloses information in contravention of regulation 52A is guilty of an offence.

(2) A person guilty of an offence under paragraph (1) is liable—

(a) on summary conviction—

(i) in England and Wales, to imprisonment for a term not exceeding three months, to a fine or to both,

(ii) in Scotland or Northern Ireland, to imprisonment for a term not exceeding three months, to a fine not exceeding the statutory maximum or to both;

(b) on conviction on indictment, to imprisonment for a term not exceeding two years or to a fine or to both.

(3) In proceedings for an offence under this regulation, it is a defence for the accused to prove—

(a) that the accused did not know and had no reason to suspect that the information was confidential information; and

(b) that the accused took all reasonable precautions and exercised all due diligence to avoid committing the offence.”.

(8) In regulation 53 (registration: interpretation), in paragraph (a)(i) of the definition of “registering authority”, after “regulation 54(1)” insert “or (1A)”.

(9) In regulation 54 (duty to maintain registers of certain relevant persons), after paragraph (1) insert—

“(1A) The FCA must maintain a register of—

(a) cryptoasset exchange providers; and

(b) custodian wallet providers.”.

(10) In regulation 55(3) (power to maintain registers)—

(a) at the end of sub-paragraph (e) omit “or”;

(b) after sub-paragraph (f) insert—

“(g) letting agents; or

(h) art market participants.”.

(11) In regulation 56 (requirement to be registered)—

(a) in paragraph (1)—

(i) after “paragraph (2)” insert “or regulation 56A (transitional provision for existing cryptoasset businesses)”;

(ii) at the end of sub-paragraph (d) omit “or”;

(iii) after sub-paragraph (e) insert—

“(f) cryptoasset exchange provider; or

(g) custodian wallet provider.”;

(b) for paragraph (2) substitute—

“(2) This paragraph applies if—

(a) the person concerned is a high value dealer, a bill payment service provider, or a telecommunications, digital and IT payment service provider and has applied for registration in the register but that application has not yet been determined; or

(b) the person concerned is a money service business or a trust or company service provider and has, before 10th January 2020, applied for registration in the register but that application has not yet been determined.”;

(c) in paragraph (5)—

(i) after “establishes a register for that purpose,” insert “or where a new description of relevant persons is required to be registered in consequence of an amendment to these Regulations,”;

(ii) after “establishes the register” insert “or (as the case may be) the date on which the amendment comes into force”.

(12) After regulation 56 insert—

“Transitional provision for existing cryptoasset businesses: requirement to register

56A.— (1) Regulation 56 does not apply to an existing cryptoasset exchange provider or existing custodian wallet provider until—

(a) the date the person is included in the register maintained under regulation 54(1A) following the determination of its application by the FCA;

(b) where the FCA gives the person notice under regulation 59(4)(b) of the FCA’s decision not to register that person—

(i) the date on which the FCA states that the decision takes effect, or

(ii) if the FCA considers that the interests of the public require its decision to have immediate effect, the date on which the FCA gives a notice to the person which includes a statement to that effect and the reasons for it; or

(c) 10th January 2021 if before that date neither of the following has occurred—

(i) the giving of notice to that person by the FCA under regulation 59(3);

(ii) the expiry of the period specified in regulation 59(3A) for the FCA to give such notice.

(2) In this regulation, “existing cryptoasset exchange provider” and “existing custodian wallet provider” mean a cryptoasset exchange provider or custodian wallet provider which was carrying on business as a cryptoasset exchange provider or custodian wallet provider (as the case may be) in the United Kingdom immediately before 10th January 2020.”.

(13) In regulation 58 (fit and proper test)—

(a) after paragraph (4)(a) omit “and”;

(b) after paragraph (4)(b) insert “and” and—

“(c) whether the applicant, and any officer, manager or beneficial owner of the applicant, has adequate skills and experience and has acted and may be expected to act with probity.”.

(14) After regulation 58 insert—

“Fit and proper test: cryptoasset businesses

58A.— (1) The FCA must refuse to register an applicant (“A”) for registration in a register maintained under regulation 54(1A) as a cryptoasset exchange provider or as a custodian wallet provider if A does not meet the requirement in paragraph (2).

(2) A, and any officer, manager or beneficial owner of A, must be a fit and proper person to carry on the business of a cryptoasset exchange provider or custodian wallet provider, as the case may be.

(3) A person who has been convicted of a criminal offence listed in Schedule 3 is to be treated as not being a fit and proper person for the purposes of this regulation.

(4) If paragraph (3) does not apply, the FCA must have regard to the following factors in determining whether the requirement in paragraph (2) is met—

(a) whether A has consistently failed to comply with the requirements of these Regulations;

(b) the risk that A’s business may be used for money laundering or terrorist financing; and

(c) whether A, and any officer, manager or beneficial owner of A, has adequate skills and experience and has acted and may be expected to act with probity.”.

(15) In regulation 59 (determination of applications for registration)—

(a) in paragraph (1), after “subject to regulation 58” insert “and regulation 58A”;

(b) in paragraph (3), for “45 days” to “regulation 57(3)” substitute “the period specified in paragraph (3A)”;

(c) after paragraph (3) insert—

“(3A) The period specified in this paragraph is—

(i) where the applicant is a cryptoasset exchange provider or custodian wallet provider, 3 months, or

(ii) in any other case, 45 days,

beginning either with the date on which it receives the application or, where applicable, with the date on which it receives any further information required under regulation 57(3).”.

(16) In regulation 60 (cancellation and suspension of registration)—

(a) after paragraph (2) insert—

“(2A) The FCA may suspend (for such period as it considers appropriate) or cancel the registration of a cryptoasset exchange provider or custodian wallet provider if, at any time after registration, the FCA is satisfied that the cryptoasset exchange provider or custodian wallet provider (as the case may be) does not meet the requirement in regulation 58A(2).”;

(b) after paragraph (10) insert—

“(11) Where the registering authority decides to suspend or cancel a person’s registration, the authority may, if it considers it proportionate to do so, publish such information about that decision as the authority considers appropriate.

(12) Where the supervisory authority publishes information under paragraph (11) and the person whose registration is suspended or cancelled refers the matter to the Upper Tribunal, the supervisory authority must, without delay, publish information about the status of the appeal and its outcome in the same manner as that in which the information was published under paragraph (11).”.

(17) After regulation 60 insert—

“CHAPTER 3 Disclosure obligation

Disclosure by cryptoasset businesses

60A.— (1) Paragraph (2) applies where—

(a) a cryptoasset exchange provider or custodian wallet provider (“cryptoasset business”) establishes a business relationship, or enters into a transaction, with a customer that arises out of any of its activities as a cryptoasset business, and

(b) the activity is not—

(i) within scope of the jurisdiction of the Financial Ombudsman Service, or

(ii) subject to protection under the Financial Services Compensation Scheme, or

(iii) within scope of the jurisdiction of, or subject to protection under, either of the schemes referred to in paragraph (i) or (ii).

(2) Before establishing the business relationship or entering into the transaction, the cryptoasset business must inform the customer of the position in paragraph (1)(b)(i), (ii) or (iii), as the case may be.

(3) In this regulation—

(a) the Financial Ombudsman Service means the scheme established under Part 16 of FSMA(5);

(b) the Financial Services Compensation Scheme means the scheme established under Part 15 of FSMA(6).”.

(1)

2000 c. 11.

(2)

2002 c. 29.

(3)

S.I. 2017/1301.

(4)

2000 c. 8. Section 349 has been amended by section 964 of the Companies Act 2006 (c.46), paragraph 19 of Schedule 12 to the Financial Services Act 2012 (c.21) and by S.I. 2006/1183 and 2007/1093.

(5)

Section 226 was amended by the Financial Services Act 2012 (c.21), section 39 and Schedule 11 and by S.I. 2009/209, 2011/99, 2017/692 and 2017/752. Section 227 was amended by the Consumer Credit Act 2006 (c.14), section 61; the Financial Services Act 2012, section 39 and Schedule 11 and by S.I. 2013/1881.

(6)

Section 212 was amended by the Financial Services Act 2012 (c.21), section 38 and Schedule 10, and by the Financial Services (Banking Reform) Act 2013 (c.33), section 16. Section 213 was amended by the Financial Services Act 2012, section 38 and Schedule 10, and by S.I. 2017/701. Section 214 was amended by the Financial Services Act 2012, section 38 and Schedule 10, and by the Banking Act 2009 (c.1), sections 169 and 174, and by S.I. 2017/701.