2019 No. 956
The Cyber-Attacks (Asset-Freezing) Regulations 2019
Made
Laid before Parliament
Coming into force
The Treasury are designated M1 for the purposes of section 2(2) of the European Communities Act 1972 M2 in relation to restrictive measures against persons or bodies listed by an international organisation.
These Regulations make provision for a purpose mentioned in section 2(2) of that Act and it appears to the Treasury that it is expedient for any reference to Annex I to Council Regulation (EU) 2019/796 of 17th May 2019 concerning restrictive measures against cyber-attacks threatening the Union or its Member States M3 to be construed as a reference to that Annex as amended from time to time.
The Treasury, in exercise of the powers conferred by section 2(2) of, and paragraph 1A of Schedule 2 to, the European Communities Act 1972, make the following Regulations.
1972 c.68. Section 2(2) was amended by the Legislative and Regulatory Reform Act 2006 (c.51), section 27(1)(a) and the European Union (Amendment) Act 2008 (c.7), section 3(3) and Schedule, Part 1. Paragraph 1(1)(d) of Schedule 2 to the 1972 Act is modified by section 144 of the Policing and Crime Act 2017 (c.3), in relation to the exercise of the powers conferred by section 2(2) of the 1972 Act, to make provision for the purposes of implementing, or otherwise in relation to, EU obligations created or arising by or under an EU financial sanctions Regulation, as defined by section 143 of the 2017 Act. Paragraph 1A of Schedule 2 to the 1972 Act was inserted by the Legislative and Regulatory Reform Act 2006 (c.51), section 28 and amended by the European Union (Amendment) Act 2008, Schedule, Part 1, and S.I. 2007/1388.
OJ L 129 I, 17.5.2019, p.1.
PART 1General
Citation, commencement and applicationI11
1
These Regulations may be cited as the Cyber-Attacks (Asset-Freezing) Regulations 2019 and come into force on 11th June 2019.
2
An offence under these Regulations may be committed by conduct wholly or partly outside the United Kingdom by––
a
a UK national, or
b
a body incorporated or constituted under the law of any part of the United Kingdom.
3
In paragraph (2)––
“conduct” includes acts and omissions;
“UK national” means––
- a
a British citizen,
- b
a British overseas territories citizen who acquired their citizenship from a connection with Gibraltar, or
- c
a British subject under Part 4 of the British Nationality Act 1981 M4 (British subjects) with the right of abode in the United Kingdom.
- a
InterpretationI22
1
In these Regulations––
“the 2000 Act” means the Financial Services and Markets Act 2000 M5;
“the Council Regulation” means Council Regulation (EU) 2019/796 of 17th May 2019 concerning restrictive measures against cyber-attacks threatening the Union or its Member States, and a reference to Annex I to that Regulation is to be construed as a reference to that Annex as amended from time to time;
“designated person” means a person, entity or body listed in Annex I to the Council Regulation;
“document” includes information recorded in any form and, in relation to information recorded otherwise than in legible form, references to its production include producing a copy of the information in legible form;
“relevant institution” means––
- a
a person who has permission under Part 4A of the 2000 Act M6 (permission to carry on regulated activities),
- b
an EEA firm of the kind mentioned in paragraph 5(b) of Schedule 3 to the 2000 Act M7 (EEA passport rights) which has permission under paragraph 15 of that Schedule M8 (as a result of qualifying for authorisation under paragraph 12 of that Schedule M9) to accept deposits, or
- c
an undertaking which by way of business operates a currency exchange office, transmits money (or any representations of monetary value) by any means or cashes cheques which are made payable to customers.
- a
2
The definition of “relevant institution” in paragraph (1) must be read with––
a
section 22 of the 2000 Act M10 (regulated activities),
b
any relevant order under that section, and
c
Schedule 2 to the 2000 Act M11 (regulated activities).
3
Any expression used both in these Regulations and in the Council Regulation has the meaning that it bears in the Council Regulation.
PART 2Funds and economic resources
Freezing of funds and economic resourcesI33
1
A person (“P”) must not deal with funds or economic resources owned, held or controlled by a designated person if P knows, or has reasonable cause to suspect, that P is dealing with such funds or economic resources.
2
In paragraph (1), “deal with” means––
a
in relation to funds––
i
use, alter, move, allow access to or transfer,
ii
deal with the funds in any other way that would result in any change in their volume, amount, location, ownership, possession, character or destination, or
iii
make any other change that would enable use, including portfolio management, and
b
in relation to economic resources, exchange, or use in exchange, for funds, goods or services.
3
Paragraph (1) is subject to regulation 9 (licences).
Making funds available to a designated personI44
1
A person (“P”) must not make funds available, directly or indirectly, to a designated person if P knows, or has reasonable cause to suspect, that P is making the funds so available.
2
Paragraph (1) is subject to regulations 8 (credits to a frozen account) and 9.
Making funds available for the benefit of a designated personI55
1
A person (“P”) must not make funds available to any person for the benefit of a designated person if P knows, or has reasonable cause to suspect, that P is making the funds so available.
2
For the purposes of this regulation––
a
funds are made available for the benefit of a designated person only if that person thereby obtains, or is able to obtain, a significant financial benefit, and
b
“financial benefit” includes the discharge, in whole or in part, of a financial obligation for which the designated person is wholly or partly responsible.
3
Paragraph (1) is subject to regulations 8 and 9.
Making economic resources available to a designated personI66
1
A person (“P”) must not make economic resources available, directly or indirectly, to a designated person if P knows, or has reasonable cause to suspect––
a
that P is making the economic resources so available, and
b
that the designated person would be likely to exchange the economic resources, or use them in exchange, for funds, goods or services.
2
Paragraph (1) is subject to regulation 9.
Making economic resources available for the benefit of a designated personI77
1
A person (“P”) must not make economic resources available to any person for the benefit of a designated person if P knows, or has reasonable cause to suspect, that P is making the economic resources so available.
2
For the purposes of this regulation––
a
economic resources are made available for the benefit of a designated person only if that person thereby obtains, or is able to obtain, a significant financial benefit, and
b
“financial benefit” includes the discharge, in whole or in part, of a financial obligation for which the designated person is wholly or partly responsible.
3
Paragraph (1) is subject to regulation 9.
Credits to a frozen accountI88
1
The prohibitions in regulations 4 and 5 are not contravened by a person who credits a frozen account with––
a
interest or other earnings due on the account,
b
payments due under contracts, agreements or obligations that were concluded or arose before the account became a frozen account, or
c
payments due under judicial, administrative or arbitral decisions rendered in a Member State or enforceable in the UK.
2
The prohibitions in regulations 4 and 5 do not prevent a relevant institution from crediting a frozen account where it receives funds transferred to the account.
3
A relevant institution must inform the Treasury without delay if it credits a frozen account in accordance with paragraph (1)(b) or (c) or paragraph (2).
4
In this regulation, “frozen account” means an account with a relevant institution which is held or controlled (directly or indirectly) by a designated person.
LicencesI99
1
The prohibitions in regulations 3 to 7 do not apply to anything done under the authority of a licence granted by the Treasury.
2
A licence must specify the acts authorised by it and may be––
a
general or granted to a category of persons or to a particular person,
b
subject to conditions,
c
of indefinite duration or subject to an expiry date.
3
The Treasury may vary or revoke a licence at any time.
4
On the grant, variation or revocation of a licence, the Treasury must––
a
in the case of a licence granted to a particular person, give written notice of the grant, variation or revocation to that person,
b
in the case of a general licence or a licence granted to a category of persons, take such steps as the Treasury consider appropriate to publicise the grant, variation or revocation of the licence.
5
A person commits an offence who, for the purpose of obtaining a licence, knowingly or recklessly––
a
provides information that is false in a material respect, or
b
provides or produces a document that is not what it purports to be.
6
A person who purports to act under the authority of a licence but who fails to comply with any conditions included in the licence commits an offence.
PART 3Offences
Contravention and circumvention of prohibitionsI1010
1
A person who contravenes any of the prohibitions in regulations 3 to 7 commits an offence.
2
A person commits an offence who intentionally participates in activities knowing that the object or effect of them is (whether directly or indirectly)––
a
to circumvent any of the prohibitions in regulations 3 to 7, or
b
to enable or facilitate the contravention of any such prohibition.
Officers of a body corporate etcI1111
1
Where an offence under these Regulations committed by a body corporate––
a
is committed with the consent or connivance of any director, manager, secretary or other similar officer of the body corporate, or any person who was purporting to act in any such capacity, or
b
is attributable to any neglect on the part of any such person,
that person as well as the body corporate is guilty of the offence and is liable to be proceeded against and punished accordingly.
2
In paragraph (1), “director”, in relation to a body corporate whose affairs are managed by its members, means a member of the body corporate.
3
Paragraph (1) also applies in relation to a body that is not a body corporate, with the substitution for the reference to a director of the body of a reference––
a
in the case of a partnership, to a partner;
b
in the case of an unincorporated body other than a partnership––
i
where the body's affairs are managed by its members, to a member of the body;
ii
in any other case, to a member of the governing body.
PenaltiesI1212
1
A person guilty of an offence under regulation 9 or 10 is liable––
a
on conviction on indictment, to imprisonment for a term not exceeding seven years or to a fine or to both,
b
on summary conviction––
i
to imprisonment for a term not exceeding the relevant maximum; or
ii
to a fine, which in Scotland or Northern Ireland may not exceed the statutory maximum,
or to both.
2
A person guilty of an offence under paragraph 1(5) or paragraph 4(1) of the Schedule (information provisions) is liable on summary conviction—
a
to imprisonment for a term not exceeding the relevant maximum; or
b
to a fine, which in Scotland or Northern Ireland may not exceed the statutory maximum,
or to both.
3
For the purposes of this regulation, “the relevant maximum” is––
a
in England and Wales, twelve months (or, in relation to offences committed before F1paragraph 24(2) of Schedule 22 to the Sentencing Act 2020 (general limit on magistrates' court's power to impose imprisonment) comes into force, six months),
b
in Scotland, twelve months,
c
in Northern Ireland, six months.
ProceedingsI1313
1
Proceedings against any person for an offence under these Regulations may be taken before the appropriate court in the United Kingdom having jurisdiction in the place where that person is for the time being.
2
Proceedings against any person for an offence under these Regulations which cannot be taken under paragraph (1) above may be taken before any appropriate court in the United Kingdom.
3
An offence falling under these Regulations which is committed wholly or partly outside the United Kingdom may for all incidental purposes be treated as having been committed within the jurisdiction of the court where proceedings are taken.
4
In England and Wales any information relating to an offence that is triable by a magistrates' court may be so tried if it is laid––
a
at any time within three years after the commission of the offence, and
b
within twelve months after the date on which evidence sufficient in the opinion of the prosecutor to justify the proceedings comes to the knowledge of the prosecutor.
5
In Scotland––
a
summary proceedings for an offence may be commenced––
i
within twelve months after the date on which evidence sufficient in the opinion of the Lord Advocate to justify the proceedings comes to the knowledge of the Lord Advocate, and
ii
not later than three years after the commission of the offence, and
b
section 136(3) of the Criminal Procedure (Scotland) Act 1995 M12 (time limit for certain offences) applies for the purpose of this paragraph as it applies for the purpose of that section.
6
In Northern Ireland summary proceedings for an offence may be instituted––
a
at any time within three years after the commission of the offence, and
b
within twelve months after the date on which evidence sufficient in the opinion of the prosecutor to justify proceedings comes to the knowledge of the prosecutor.
7
For the purposes of this regulation a certificate of the prosecutor (or in Scotland, the Lord Advocate) as to the date on which such evidence as is referred to above came to their notice is conclusive evidence.
Consent to prosecutionI1414
1
Proceedings for an offence under these Regulations (other than for a summary offence) may not be instituted––
a
in England and Wales, except by or with the consent of the Attorney General,
b
in Northern Ireland––
i
where the offence is committed wholly or partly outside Northern Ireland, except by or with the consent of the Advocate General for Northern Ireland,
ii
for all other offences, except by or with the consent of the Director of Public Prosecutions for Northern Ireland.
2
Nothing in paragraph (1) prevents––
a
the arrest of a person in respect of an offence under these Regulations, or
b
the remand in custody or on bail of any person charged with such an offence.
PART 4Miscellaneous
Information provisionsI1515
The Schedule (information provisions) has effect.
NoticesI1616
1
This regulation has effect in relation to any notice to be given to a person by the Treasury under regulation 9 (licences).
2
Any such notice may be given––
a
by posting it to the person's last known address, or
b
where the person is a body corporate, partnership or unincorporated body other than a partnership, by posting it to the registered or principal office of the body or partnership concerned.
3
Where the Treasury do not have an address for the person, they must make arrangements for the notice to be given to the person at the first available opportunity.
The CrownI1717
1
These Regulations bind the Crown.
2
No contravention by the Crown of a provision of these Regulations makes the Crown criminally liable.
3
The High Court or, in Scotland, the Court of Session may, on the application of a person appearing to the court to have an interest, declare unlawful any act or omission of the Crown that constitutes a contravention of a provision of these Regulations.
4
Nothing in this regulation affects Her Majesty in Her private capacity.
5
Paragraph (4) is to be read as if section 38(3) of the Crown Proceedings Act 1947 M13 (meaning of Her Majesty in Her private capacity) were contained in these Regulations.
SCHEDULE
INFORMATION PROVISIONS
Reporting obligations of relevant institutions and othersI181
1
A relevant institution or relevant business or profession must inform the Treasury as soon as practicable if—
a
it knows, or has reasonable cause to suspect, that a person—
i
is a designated person, or
ii
has committed an offence under regulation 9 or 10, and
b
the information or other matter on which the knowledge or suspicion is based came to it in the course of carrying on its business.
2
Where a relevant institution or relevant business or profession informs the Treasury under sub-paragraph (1), it must state—
a
the information or other matter on which the knowledge or suspicion is based, and
b
any information it holds about the person by which the person can be identified.
3
Sub-paragraph (4) applies if—
a
a relevant institution or relevant business or profession informs the Treasury under sub-paragraph (1) that it knows, or has reasonable cause to suspect, that a person is a designated person, and
b
that person is a customer of the institution or relevant business or profession.
4
The relevant institution or relevant business or profession must also state the nature and amount or quantity of any funds or economic resources held by it for the customer.
5
A relevant institution or relevant business or profession that fails to comply with any requirement of sub-paragraph (1), (2) or (4) commits an offence.
6
In this paragraph, a “relevant business or profession” means—
a
an auditor,
b
a casino,
c
a dealer in precious metals or stones,
d
an estate agent,
e
an external accountant,
f
an independent legal professional,
g
a tax adviser, and
h
a trust or company service provider,
operating in the United Kingdom.
7
For the purpose of sub-paragraph (6)—
“auditor” means any firm or sole practitioner who is—
- a
a statutory auditor within the meaning of Part 42 of the Companies Act 2006 M14 (statutory auditors), when carrying out statutory audit work within the meaning of section 1210 of that Act (meaning of statutory auditor); or
- b
a local auditor within the meaning of section 4(1) of the Local Audit and Accountability Act 2014 M15 (general requirements for audit) when carrying out an audit required by that Act;
- a
“casino” means the holder of a casino operating licence and, for this purpose, a “casino operating licence” has the meaning given by section 65(2)(a) of the Gambling Act 2005 M16 (nature of a licence);
“dealer in precious metals or stones” means a person engaged in the business of making, supplying, selling (including selling by auction) or exchanging—
- a
articles made from gold, silver, platinum or palladium, or
- b
precious stones or pearls;
- a
“estate agent” means a firm or sole practitioner who, or whose employees, carry out estate agency work, when the work is being carried out;
“external accountant” means a firm or sole practitioner who by way of business provides accountancy services to other persons, when providing such services;
“independent legal professional” means a firm or sole practitioner who by way of business provides legal or notarial services to other persons, when providing such services;
“tax adviser” means a firm or sole practitioner who by way of business provides advice about the tax affairs of other persons, when providing such services;
“trust or company service provider” means a firm or sole practitioner who by way of business provides any of the following services to other persons, when that firm or practitioner is providing such services—
- a
forming companies or other legal persons,
- b
acting, or arranging for another person to act—
- i
as a director or secretary of a company,
- ii
as a partner of a partnership, or
- iii
in a similar capacity in relation to other legal persons,
- i
- c
providing a registered office, business address, correspondence or administrative address or other related services for a company, partnership or any other legal person or arrangement,
- d
acting, or arranging for another person to act, as—
- i
a trustee of an express trust or similar legal arrangement, or
- ii
a nominee shareholder for a person.
- i
- a
8
In sub-paragraph (7)—
a
in the definition of “estate agent”, “estate agency work” is to be read in accordance with section 1 of the Estate Agents Act 1979 (estate agency work) M17, but for those purposes references in that section to disposing of or acquiring an interest in land are (despite anything in section 2 of that Act) to be taken to include reference to disposing of or acquiring an estate or interest in land outside the United Kingdom where that estate or interest is capable of being owned or held as a separate interest,
b
“firm” means any entity that, whether or not a legal person, is not an individual and includes a body corporate and a partnership or other unincorporated association.
Powers to request informationI192
1
The Treasury may request a designated person to provide information concerning—
a
funds or economic resources owned, held or controlled by or on behalf of the designated person, or
b
any disposal of such funds or economic resources.
2
The Treasury may request a designated person to provide such information as the Treasury may reasonably require about expenditure—
a
by or on behalf of the designated person, or
b
for the benefit of the designated person.
3
The power in sub-paragraph (1) or (2) is exercisable only where the Treasury believe that it is necessary for the purpose of monitoring compliance with or detecting evasion of these Regulations.
4
The Treasury may request a person acting under a licence granted under regulation 9 to provide information concerning—
a
funds or economic resources dealt with under the licence, or
b
funds or economic resources made available under the licence.
5
The Treasury may request any person in or resident in the United Kingdom to provide such information as the Treasury may reasonably require for the purpose of—
a
establishing for the purposes of these Regulations—
i
the nature and amount or quantity of any funds or economic resources owned, held or controlled by or on behalf of a designated person,
ii
the nature and amount or quantity of any funds or economic resources made available directly or indirectly to, or for the benefit of, a designated person, or
iii
the nature of any financial transactions entered into by a designated person,
b
monitoring compliance with or detecting evasion of these Regulations, or
c
obtaining evidence of the commission of an offence under these Regulations.
6
The Treasury may specify the manner in which, and the period within which, information is to be provided.
7
If no such period is specified, the information which has been requested must be provided within a reasonable time.
8
A request may include a continuing obligation to keep the Treasury informed as circumstances change, or on such regular basis as the Treasury may specify.
9
Information requested under this paragraph may relate to any period of time during which a person is, or was, a designated person.
10
Information requested under sub-paragraph (1)(b), (2) or (5)(a)(iii) may relate to any period of time before a person became a designated person (as well as, or instead of, any subsequent period of time).
Production of documentsI203
1
A request under paragraph 2 may include a request to produce specified documents or documents of a specified description.
2
Where the Treasury request that documents be produced, they may—
a
take copies of or extracts from any document so produced,
b
request any person producing a document to give an explanation of it, and
c
where that person is a body corporate, partnership or unincorporated body other than a partnership, request any person who is—
i
in the case of a partnership, a present or past partner or employee of the partnership,
ii
in any other case, a present or past officer or employee of the body concerned,
to give such an explanation.
3
Where the Treasury request a designated person or a person acting under a licence granted under regulation 9 to produce documents, that person must—
a
take reasonable steps to obtain the documents (if not already in the person's possession or control);
b
keep the documents under the person's possession or control (except for the purpose of providing them to the Treasury or as the Treasury may otherwise permit).
Failure to comply with request for informationI214
1
A person commits an offence who—
a
without reasonable excuse, refuses or fails within the time and in the manner specified (or, if no time has been specified, within a reasonable time) to comply with any request made under this Schedule,
b
knowingly or recklessly gives any information, or produces any document, which is false in a material particular in response to such a request,
c
with intent to evade the provisions of this Schedule, destroys, mutilates, defaces, conceals or removes any document, or
d
otherwise intentionally obstructs the Treasury in the exercise of their powers under this Schedule.
2
Where a person is convicted of an offence under this paragraph, the court may make an order requiring that person, within such period as may be specified in the order, to comply with the request.
General power to disclose informationI225
1
The Treasury may disclose any information obtained by them pursuant to these Regulations to any person for the purpose of facilitating or ensuring compliance with the Council Regulation.
2
The power in sub-paragraph (1) includes but is not limited to disclosing information to the following persons––
a
a police officer,
b
any person holding or acting in any office under or in the service of—
i
the Crown in right of the Government of the United Kingdom,
ii
the Crown in right of the Scottish Government, the Northern Ireland Executive or the Welsh Government,
iii
the States of Jersey, Guernsey or Alderney or the Chief Pleas of Sark,
iv
the Government of the Isle of Man, or
v
the Government of any British overseas territory,
c
any law officer of the Crown for Jersey, Guernsey or the Isle of Man,
d
the Scottish Legal Aid Board,
e
the Financial Conduct Authority, the Prudential Regulation Authority, the Bank of England, the Jersey Financial Services Commission, the Guernsey Financial Services Commission, or the Isle of Man Financial Services Authority,
f
any other regulatory body, including those of Member States,
g
any organ of the United Nations, or
h
the Council of the European Union, the European Commission or the Government of a Member State.
3
The purpose of facilitating or ensuring compliance with the Council Regulation referred to in sub-paragraph (1) includes but is not limited to the following––
a
monitoring compliance with, or detecting evasion of, these Regulations or the Council Regulation;
b
giving assistance or co-operation, pursuant to the Council Regulation; or
c
taking any action with a view to instituting, or otherwise for the purposes of, any proceedings––
i
in the United Kingdom, for an offence under these Regulations, or
ii
in any of the Channel Islands, the Isle of Man or any British overseas territory, for an offence under a similar provision in any such jurisdiction.
4
The Treasury may disclose any information obtained by them pursuant to these Regulations to any person with the consent of a person who, in their own right, is entitled to the information or to possession of the document, copy or extract.
5
In sub-paragraph (4) “in their own right” means not merely in the capacity as a servant or agent of another person.
Application of provisionsI236
1
Nothing done under this Schedule is to be treated as a breach of any restriction imposed by statute or otherwise.
2
But nothing in this Schedule authorises a disclosure that—
a
contravenes the data protection legislation, or
b
is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016 M18.
3
Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 M19 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, sub-paragraph (2)(b) has effect as if it included a reference to that Part.
4
Nothing in this Schedule is to be read as requiring a person who has acted or is acting as counsel or solicitor for any person to disclose any privileged information in their possession in that capacity.
5
This Schedule does not limit the circumstances in which information may be disclosed apart from this Schedule.
6
This Schedule does not limit the powers of the Treasury to impose conditions in connection with the discharge of their functions under regulation 9.
7
In this paragraph—
“the data protection legislation” has the same meaning as in the Data Protection Act 2018 M20 (see section 3 of that Act);
“privileged information” means information with respect to which a claim to legal professional privilege (in Scotland, to confidentiality of communications) could be maintained in legal proceedings.
S.I. 2010/1834.