Economic Crime and Corporate Transparency Act 2023

188 Direct disclosures of information: restrictions on civil liability U.K.

(1) The protections set out in subsection (2) apply in relation to a disclosure made by a person (“A”) to another person (“B”) if—

(a) A is carrying on business in circumstances where subsection (3) applies,

(b) B is also carrying on business in circumstances where that subsection applies,

(c) the information relates to a person who is a customer or former customer of A (“the customer”),

(d) either the request condition or the warning condition is met,

(e) A is satisfied that the disclosure of the information will or may assist B in carrying out relevant actions of B, and

(f) the disclosure is not a privileged disclosure.

(2) The protections are that, subject to subsection (11), the disclosure does not—

(a) give rise to a breach of any obligation of confidence owed by A, or

(b) give rise to any civil liability, on the part of A, to the person to whom the disclosed information relates.

(3) This subsection applies—

(a) where the business carried on is business in the regulated sector, and

(b) in circumstances prescribed, in relation to the business or the person carrying it on, by regulations made by the Secretary of State for the purposes of this paragraph.

(4) The request condition is that—

(a) the disclosure is made in response to a request made by B, and

(b) at the time the request is made, B has reason to believe that A holds information relating to the customer the disclosure of which will or may assist B in carrying out relevant actions of B.

(5) The warning condition is that A, due to concerns about risks of economic crime, has decided to take safeguarding action (or would have decided to take such action but for the customer having ceased to be a customer of A).

(6) For the purposes of subsection (5), “safeguarding action” means—

(a) terminating a business relationship with the customer,

(b) refusing the customer a product or service, or

(c) restricting the customer’s access to elements of a product or service available to other customers of A.

(7) Where a disclosure is made to which subsection (1) applies, B’s use of the disclosed information, for the purposes of any of B’s relevant actions, does not breach any obligation of confidence owed by B.

(8) The protections set out in subsection (9) apply in relation to a disclosure made by a person (“R”) who is carrying on business in circumstances where subsection (3) applies to another person for the purpose of making a disclosure request if R has reason to believe that other person—

(a) is carrying on business in circumstances where subsection (3) applies, and

(b) has in their possession information about a customer or former customer of theirs that will or may assist R to carry out any of R’s relevant actions.

(9) The protections are that, subject to subsection (11), the disclosure does not—

(a) give rise to a breach of any obligation of confidence owed by R, or

(b) give rise to any civil liability, on the part of R, to the person to whom the disclosed information relates.

(10) Where a disclosure is made to which subsection (8) applies, the use by that other person of the disclosed information, for the purposes of enabling a disclosure to be made by them to which subsection (1) applies, does not—

(a) give rise to a breach of any obligation of confidence owed by them, or

(b) give rise to any civil liability, on the part of R, to the person to whom the disclosed information relates.

This is subject to subsection (11).

(11) Nothing in this section requires or authorises a disclosure of information that would contravene, or prevents any civil liability arising under, the data protection legislation.

Commencement Information

I1 S. 188 in force at Royal Assent for specified purposes, see s. 219(1)(2)(b)

I2 S. 188 in force at 15.1.2024 in so far as not already in force by S.I. 2023/1206, reg. 3(h)