The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017

[F1 PART 5A U.K. Requests for information about accounts and safe-deposit boxes

Textual Amendments

F1 Pt. 5A inserted (10.9.2020) by The Money Laundering and Terrorist Financing (Amendment) Regulations 2019 (S.I. 2019/1511), regs. 1(4), 6

Duty to establish mechanism for requests U.K.

45A.   The Secretary of State or the Treasury must ensure that a central automated mechanism (referred to in this Part as “the central automated mechanism”) is established for making and responding to requests under this Part.

Duty to respond to requests for information U.K.

45B.— (1) Each credit institution and provider of safe custody services must establish and maintain systems which enable that institution or provider to respond, using the central automated mechanism, to a request for information made under this Part by a law enforcement authority or the Gambling Commission.

(2) A credit institution or provider of safe custody services who receives such a request must, using the central automated mechanism, provide the information requested fully and rapidly to the person who made the request.

Requests for information about accounts U.K.

45C.— (1) A law enforcement authority or the Gambling Commission may make a request, using the central automated mechanism—

(a) to a credit institution other than a credit union, for any information specified in this regulation relating to an account held with that institution;

(b) to a credit union, for any information specified in this regulation relating to an account held with that credit union which has an International Bank Account Number (“IBAN”).

(2) The following information may be requested—

(a) the name of the account holder;

(b) where the account holder is an individual, the date of birth of the account holder;

(c) where the account holder is an individual, the address of the account holder;

(d) where the account holder is a firm, the address of its registered office and, if different, its principal place of business;

(e) the name of any person purporting to act on behalf of the account holder;

(f) the name and date of birth of any individual with a beneficial interest in the account or the account holder;

(g) the address of any individual with a beneficial interest in the account or the account holder;

(h) where a beneficial interest in the account holder is held by a firm, the name of that firm, the address of its registered office and, if different, its principal place of business;

(i) the IBAN of the account;

(j) any other number by which the individual account is identified by the credit institution (for example a roll number);

(k) the date of opening of the account;

(l) if the account has been closed, the date of closing; and

(m) any other numbers which are specific to an individual who is mentioned in sub-paragraphs (a) to (c) and (e) to (g) and which may be used to verify that individual’s identity (such as a passport or driving licence number) contained within any documents or information obtained by the credit institution to satisfy the customer due diligence requirements in regulations 28, 29 and 33 to 37.

Requests for information about safe-deposit boxes U.K.

45D.— (1) A law enforcement authority or the Gambling Commission may make a request, using the central automated mechanism, to a provider of safe custody services for any of the information specified in this regulation in relation to a safe-deposit box held with that provider.

(2) The following information may be requested—

(a) the name of the customer to whom the safe-deposit box was or is made available;

(b) where the customer is an individual, their date of birth;

(c) where the customer is an individual, their address;

(d) where the customer is a firm, the address of its registered office and, if different, its principal place of business;

(e) the name of any person (except for employees of the provider of safe custody services) who the provider of safe custody services knows holds, or held, a key for the safe-deposit box, or has or has had access to the safe-deposit box in any other way;

(f) the date on which the safe-deposit box was made available to the customer and, if appropriate, ceased to be available; and

(g) any other numbers which are specific to an individual who is mentioned in sub-paragraphs (a) to (c) and (e) and which may be used to verify that individual’s identity (such as a passport or driving licence number) contained within any documents or information obtained by the provider of safe custody services to satisfy the customer due diligence requirements in regulations 28, 29 and 33 to 37.

Requirements for making a request for information U.K.

45E.— (1) The NCA, in carrying out its FIU functions, may request information under this Part for any purpose in connection with those functions.

(2) Subject to paragraph (1), a law enforcement authority may only request information under this Part for one or more of the following purposes—

(a) to investigate money laundering, terrorism (within the meaning of section 1 of the Terrorism Act 2000), or terrorist financing;

(b) to investigate whether property has been obtained through any conduct mentioned in sub-paragraph (a); or

(c) to carry out its supervisory functions (where the law enforcement authority also carries out a supervisory function).

(3) The Gambling Commission may only request information under this Part for the purpose of carrying out its supervisory functions.

(4) Only an appropriate officer of the Gambling Commission or the law enforcement authority may make a request under this Part on behalf of that authority or Commission.

(5) A request under this Part must not be made by a law enforcement authority (other than the NCA in carrying out its FIU functions) or the Gambling Commission unless the making of that request is first approved in writing by a senior officer of that authority or Commission.

(6) That senior officer must not approve the making of a request unless the officer is satisfied that the request complies with the requirements of this regulation and is proportionate to the purpose or purposes of the request.

(7) A senior officer must maintain a record in writing of any refusal to approve a request.

(8) Law enforcement authorities, and the Gambling Commission, may take into account any guidance which has been issued by the Treasury, or issued by an appropriate body or the NCA and approved by the Treasury, in relation to whom to designate as an appropriate officer or a senior officer.

Access to requests and responses, guidance and review U.K.

45F.— (1) The NCA may access, using the central automated mechanism, all information or documents relating to requests and responses to requests made under this Part and may use the information or documents—

(a) in carrying out its FIU functions;

(b) for any of the purposes listed in regulation 45E(2);

(c) to prepare guidance under this Part;

(d) to provide anonymised information to the Secretary of State or the Treasury for the purposes of issuing guidance, preparing reports and making recommendations under this Part.

(2) The NCA must on request provide all or part of the information referred to in paragraph (1)(d) to the Secretary of State, the Treasury or an appropriate body approved by the Treasury.

(3) Credit institutions, providers of safe custody services, law enforcement authorities and the Gambling Commission may take into account any guidance which has been issued by the Treasury, or issued by an appropriate body or the NCA and approved by the Treasury, in relation to this Part.

(4) The Secretary of State must from time to time—

(a) carry out a review of the central automated mechanism; and

(b) publish a report setting out the conclusions of the review.

(5) The Secretary of State must publish the first report before the end of the first calendar year after the central automated mechanism is established.

(6) Subsequent reports must be published annually.

(7) A copy of the report must be laid before Parliament, and sent to—

(a) each law enforcement authority; and

(b) the Gambling Commission.

Record keeping U.K.

45G.— (1) Each credit institution and provider of safe custody services must keep the records specified in paragraph (2) for a period of five years beginning with the date of the closure of the account or safe-deposit box.

(2) The records are a copy of any document or information needed in order to respond to a request made under this Part.

(3) Once the period referred to in paragraph (1) has expired, the credit institution or provider of safe custody services must delete any personal data retained for the purposes of these Regulations unless—

(a) the relevant person is required to retain records containing personal data—

(i) by or under any enactment, or

(ii) for the purposes of any court proceedings;

(b) the data subject has given consent to the retention of that data; or

(c) the relevant person has reasonable grounds for believing that records containing the personal data need to be retained for the purpose of legal proceedings.

Interpretation U.K.

45H.— (1) For the purposes of this Part—

(a) an “appropriate officer” is an officer who has received appropriate training and who has been authorised in writing by a law enforcement authority or the Gambling Commission to make requests under this Part;

(b) a “senior officer” is an officer who has received appropriate training, who has sufficient knowledge of money laundering and terrorist financing, and who has been authorised in writing by a law enforcement authority or the Gambling Commission to authorise or refuse the making of requests under this Part;

(c) “credit union” means—

(i) in England, Wales and Scotland, a society which is registered as a credit union under the Co-operative and Community Benefit Societies Act 2014;

(ii) in Northern Ireland, a society which—

(aa) is registered as a credit union under the Credit Unions (Northern Ireland) Order 1985 and is an authorised person; or

(ab) is registered under the Co-operative and Community Benefit Societies Act (Northern Ireland) 1969 as a credit union and is an authorised person.

(d) “FIU functions” has the same meaning as in Schedule 6A (the United Kingdom’s Financial Intelligence Unit);

(e) “provider of safe custody services” means a credit institution or financial institution which makes available, within the United Kingdom, safe-deposit boxes to customers.]