The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017

Policies, controls and procedures: group level

20.—(1) A relevant parent undertaking must—

(a) ensure that the policies, controls and procedures referred to in regulation 19(1) apply—

(i) to all its subsidiary undertakings, including subsidiary undertakings located outside the United Kingdom; and

(ii) to any branches it has established outside the United Kingdom;

which is carrying out any activity in respect of which the relevant person is subject to these Regulations;

(b) establish and maintain throughout its group the policies, controls and procedures for data protection and sharing information for the purposes of preventing money laundering and terrorist financing with other members of the group;

(c) regularly review and update the policies, controls and procedures applied and established under sub-paragraphs (a) and (b);

(d) maintain a record in writing of—

(i) the policies, controls and procedures established under sub-paragraphs (a) and (b);

(ii) any changes to those policies, controls and procedures made as a result of the review and update required by sub-paragraph (c); and

(iii) the steps taken to communicate those policies, controls and procedures, or any changes to them, to its subsidiary undertakings and branches.

(2) A relevant parent undertaking must ensure that those of its subsidiary undertakings and branches which are established in an EEA state follow the law of that EEA state that implements the fourth money laundering directive.

(3) If any of the subsidiary undertakings or branches of a relevant parent undertaking are established in a third country which does not impose requirements to counter money laundering and terrorist financing as strict as those of the United Kingdom, the relevant parent undertaking must ensure that those subsidiary undertakings and branches apply measures equivalent to those required by these Regulations, as far as permitted under the law of the third country.

(4) Where the law of a third country does not permit the application of such equivalent measures by the subsidiary undertaking or branch established in that country, the relevant parent undertaking must—

(a) inform its supervisory authority accordingly; and

(b) take additional measures to handle the risk of money laundering and terrorist financing effectively.

(5) A relevant parent undertaking must ensure that information relevant to the prevention of money laundering and terrorist financing is shared as appropriate between members of its group, subject to any restrictions on sharing information imposed by or under any enactment or otherwise.