The Money Laundering and Terrorist Financing (Amendment) (No. 2) Regulations 2022

Proliferation financing

6.—(1) In regulation 3 (general interpretation), after the definition of “PRA-authorised person” insert ““proliferation financing” has the meaning given by regulation 16A(9);”.

(2) After regulation 16 (risk assessment by the Treasury and Home Office)(1) insert—

“Risk assessment by the Treasury

16A.— (1) The Treasury must make arrangements for a risk assessment to be undertaken to identify, assess, understand and mitigate the risks of proliferation financing affecting the United Kingdom (“the proliferation financing risk assessment”).

(2) The proliferation financing risk assessment must, among other things—

(a) identify, where appropriate, the sectors or areas of lower and greater risk of proliferation financing;

(b) provide the information and analysis necessary to enable it to be used for the purposes set out in paragraph (3).

(3) The Treasury must ensure that the proliferation financing risk assessment is used to—

(a) consider the appropriate allocation and prioritisation of resources to counter proliferation financing;

(b) consider whether the exclusions provided for in regulation 15 (exclusions) are being abused.

(4) The Treasury must prepare a report setting out, as appropriate, the findings of the proliferation financing risk assessment as soon as reasonably practicable after the proliferation financing risk assessment is completed.

(5) A copy of that report must be laid before Parliament and sent to the supervisory authorities.

(6) The Treasury must take appropriate steps to ensure that the proliferation financing risk assessment is kept up-to-date.

(7) The proliferation financing risk assessment may be included in the risk assessment made under regulation 16 (risk assessment by the Treasury and Home Office).

(8) The report referred to in paragraph (4) may be included within the joint report of the Treasury and Home Office referred to in regulation 16(6).

(9) In this regulation, “proliferation financing” means the act of providing funds or financial services for use, in whole or in part, in the manufacture, acquisition, development, export, trans-shipment, brokering, transport, transfer, stockpiling of, or otherwise in connection with the possession or use of, chemical, biological, radiological or nuclear weapons, including the provision of funds or financial services in connection with the means of delivery of such weapons and other CBRN-related goods and technology, in contravention of a relevant financial sanctions obligation.

(10) In this regulation—

“biological weapon” means a biological agent or toxin (within the meaning of section 1(1)(a) of the Biological Weapons Act 1974(2)) in a form capable of use for hostile purposes or anything to which section 1(1)(b) of that Act applies;

“chemical weapon” has the meaning given by section 1 of the Chemical Weapons Act 1996(3);

“CBRN-related goods and technology” means technology (including dual-use technology) and dual-use goods used for non-legitimate purposes in connection with the matters referred to in paragraph (9);

“dual-use goods” means (a) any thing for the time being specified in Annex I of the Dual-Use Regulation, other than any thing which is dual-use technology, and (b) any tangible storage medium on which dual use technology is recorded or from which it can be derived;

“Dual-Use Regulation” means Council Regulation (EC) No 428/2009 of 5 May 2009(4) setting up a Community regime for the control of exports, transfer, brokering and transit of dual-use items;

“dual-use technology” means any thing for the time being specified in Annex I of the Dual-Use Regulation which is described as software or technology;

“nuclear weapon” includes a nuclear explosive device that is not intended for use as a weapon;

“radiological weapon” means a device designed to cause destruction, damage or injury by means of the radiation produced by the decay of radioactive material;

“relevant financial sanctions obligation” means a prohibition or requirement in regulations made under section 1 of the Sanctions and Anti-Money Laundering Act 2018(5) and imposed for one or more of the purposes in section 3(1) or (2) of that Act so far as it relates to compliance with a relevant UN obligation;

“relevant UN obligation” means an obligation that the UK has by virtue of a resolution adopted by the Security Council of the United Nations which relates to the prevention, suppression and disruption of the proliferation of weapons of mass destruction and the financing of such;

“technology” has the meaning given by paragraph 37 of Schedule 1 to the Sanctions and Anti-Money Laundering Act 2018.”.

(3) After regulation 18 (risk assessment by relevant persons) insert—

“Risk assessment by relevant persons in relation to proliferation financing

18A.— (1) A relevant person must take appropriate steps to identify and assess the risks of proliferation financing to which its business is subject.

(2) In carrying out the risk assessment required under paragraph (1), a relevant person must take into account—

(a) information in the report referred to in regulation 16A (risk assessment by the Treasury); and

(b) risk factors including factors relating to—

(i) its customers;

(ii) the countries or geographic areas in which it operates;

(iii) its products or services;

(iv) its transactions; and

(v) its delivery channels.

(3) In deciding what steps are appropriate under paragraph (1), the relevant person must take into account the size and nature of its business.

(4) A relevant person must keep an up-to-date record in writing of all the steps it has taken under paragraph (1), unless its supervisory authority notifies it in writing that such a record is not required.

(5) A relevant person must provide the risk assessment it has prepared under paragraph (1), the information on which that risk assessment was based and any record required to be kept under paragraph (4), to its supervisory authority on request.”.

(4) After regulation 19 (policies, controls and procedures)(6) insert—

“Policies, controls and procedures in relation to proliferation financing

19A.— (1) A relevant person must—

(a) establish and maintain policies, controls and procedures to mitigate and manage effectively the risks of proliferation financing identified in any risk assessment undertaken by the relevant person under regulation 18A(1);

(b) regularly review and update the policies, controls and procedures established under sub-paragraph (a);

(c) maintain a record in writing of—

(i) the policies, controls and procedures established under sub-paragraph (a);

(ii) any changes to those policies, controls and procedures made as a result of the review and update required by sub-paragraph (b); and

(iii) the steps taken to communicate those policies, controls and procedures, or any changes to them, within the relevant person’s business.

(2) The policies, controls and procedures adopted by a relevant person under paragraph (1) must be—

(a) proportionate with regard to the size and nature of the relevant person’s business; and

(b) approved by its senior management.

(3) The policies, controls and procedures referred to in paragraph (1) must include—

(a) risk management practices;

(b) internal controls (see regulations 21 to 24)(7);

(c) the monitoring and management of compliance with, and the internal communication of, such policies, controls and procedures.

(4) The policies, controls and procedures referred to in paragraph (1) must include policies, controls and procedures—

(a) which provide for the identification and scrutiny of—

(i) any case where—

(aa) a transaction is complex or unusually large, or there is an unusual pattern of transactions; or

(bb) the transaction or transactions have no apparent economic or legal purpose, and

(ii) any other activity or situation which the relevant person regards as particularly likely by its nature to be related to proliferation financing;

(b) which specify the taking of additional measures, where appropriate, to prevent the use for proliferation financing of products and transactions which might favour anonymity;

(c) which ensure that when new products, new business practices (including new delivery mechanisms) or new technology are adopted by the relevant person, appropriate measures are taken in preparation for, and during, the adoption of such products, practices or technology to assess and if necessary mitigate any proliferation financing risks this new product, practice or technology may cause;

(d) which, in the case of a money service business that uses agents for the purpose of its business, ensure that appropriate measures are taken by the business to assess—

(i) whether an agent used by the business would satisfy the fit and proper test provided for in regulation 58(8); and

(ii) the extent of the risk that the agent may be used for proliferation financing.

(5) A relevant person must, where relevant, communicate the policies, controls and procedures which it establishes and maintains in accordance with this regulation to its branches and subsidiary undertakings which are located outside the United Kingdom.”.

(5) In regulation 20(1)(a), for “regulation 19(1)” substitute “regulations 19(1) and 19A(1)”;

(6) In regulation 21(7)—

(a) after “regulation 19(1)” insert “or 19A(1)”;

(b) in paragraph (10)(a), after “regulation 18(1)” insert “and 18A(1)”.

(7) In the following provisions, for “money laundering and terrorist financing” substitute “money laundering, terrorist financing and proliferation financing”—

(a) regulation 3 (interpretation)(9), in the definition of “senior management”;

(b) regulation 20(1)(b), (3), (4)(b) and (5) (policies, controls and procedures: group level)(10);

(c) regulation 21(2)(b)(ii)(aa) and (2)(b)(ii)(bb) (internal controls);

(d) regulation 24(1)(a)(i), (2)(b)(i), (2)(b)(ii) and (3)(a)(iii) (training).

(8) In the following provisions, for “money laundering or terrorist financing” substitute “money laundering, terrorist financing or proliferation financing”—

(a) regulation 21(7)(a);

(b) regulation 24(1)(a)(ii);

(c) regulation 41(1), (6)(a), (7) and (8) (data protection)(11);

(d) regulation 45ZB(11)(a), (11)(b) and (11)(d) (access to information on the register)(12);

(e) regulation 52A(3)(a)(i) (confidentiality)(13);

(f) regulation 74C(3)(c) (directions: cryptoasset businesses)(14).

(9) In Schedule 6 (meaning of “relevant requirement”), in paragraph 5(15)—

(a) after sub-paragraph (a)(i) insert—

“(ia) regulation 18A (risk assessment by relevant persons in relation to proliferation financing);”;

(b) after sub-paragraph (a)(ii) insert—

“(iia) regulation 19A (policies, controls and procedures in relation to proliferation financing);”.

(1)

Regulation 16 has been amended but none of the amendments are relevant.

(2)

1974 c. 6; section 1 was amended by section 43 of the Anti-terrorism, Crime and Security Act 2001 (c. 24).

(3)

1996 c. 6.

(4)

EUR 2009/428. Annexes I and IV were amended by S.I. 2019/771 and 2022/410.

(5)

2018 c. 13.

(6)

Regulation 19 has been amended but none of the amendments are relevant.

(7)

Regulation 22 was revoked by S.I. 2019/253. Regulation 24 was amended by S.I. 2019/1511.

(8)

Regulation 58 was amended by S.I. 2019/1511.

(9)

There are amendments to regulation 3 but none are relevant.

(10)

Regulation 20 has been amended by S.I. 2019/253 and 2019/1511.

(11)

Regulation 41(6) was inserted by section 211(1) of and paragraphs 410 and 415(1)(b) of Schedule 19 to the Data Protection Act 2018 (c. 12).

(12)

Regulation 45ZB was inserted by S.I. 2020/991.

(13)

Regulation 52A was inserted by S.I. 2019/1511. There are other amendments but none are relevant.

(14)

Regulation 74C was inserted by S.I. 2019/1511. There are other amendments but none are relevant.

(15)

Paragraph 5 of Schedule 6 has been amended but the amendment is not relevant.