Banks and Deposit Companies Act 1999 - Code of Conduct (August 2022)

Summary

This is the Bermuda Monetary Authority's Code of Conduct issued under section 8A of the Banks and Deposit Companies Act 1999, setting out the standards, procedures and sound principles expected of institutions licensed to carry on deposit-taking business. It applies proportionately according to an institution's size, complexity and risk profile, and non-adherence is not itself an offence but is taken into account by the Authority in assessing whether business is conducted prudently and may lead to enforcement action.

• Legal compliance and AML/CFT: Institutions must comply with all applicable laws, including the Proceeds of Crime Act 1997, AML/ATF Regulations 2008 and the Anti-Terrorism Act 2004, and maintain ongoing customer due diligence, source-of-funds verification and a documented new-customer acceptance policy.
• Integrity, ethics and conflicts: Institutions must act honestly, fairly and with due care, and establish documented policies to manage or disclose conflicts of interest.
• Customer information and privacy: Confidential customer information must be protected, with staff advised in writing and reminded periodically of privacy obligations.
• Internal controls: Requirements cover outsourcing oversight, record keeping in Bermuda, adequate trained personnel, documented disaster recovery and business continuity plans tested at least annually, and systems to prevent fraud or misuse of customer assets.
• Customer dealings: Institutions must assess suitability before contracting, disclose fees, risks and obligations in plain language, remind customers of their responsibilities, provide fair terms of business, handle vulnerable customers and complaints appropriately, and give periodic and closing statements.
• Advertising and licence disclosure: Advertisements must be clear, fair and not misleading, and licensed status must be published on the institution's website and disclosed in advertisements and correspondence.
• Regulatory cooperation: Institutions must deal openly with the Authority, alert it to material changes in business scope, non-deposit-taking activities, and significant developments such as staffing, litigation or corporate structure changes.

The Code consolidates conduct-of-business expectations rather than creating new licensing criteria, but persistent failure to follow it can be treated by the Authority as evidence of imprudent conduct and may trigger formal supervisory or enforcement action.

Key obligations

• Comply with the Proceeds of Crime Act 1997, the AML/ATF Regulations 2008 and the Anti-Terrorism (Financial and Other Measures) Act 2004
• Verify customer identity on an ongoing basis and confirm the source of customer funds is not illicit
• Establish a documented policy on new customer acceptance and retain records of declined relationships
• Establish and document policies and procedures to manage or avoid conflicts of interest, keeping records of conflicts that arise
• Advise employees and other persons with access to confidential information in writing on engagement, and remind them periodically, of privacy obligations
• Establish senior management responsibility and oversight for outsourced services, retaining liability for Code compliance
• Keep required records in Bermuda, accurate and current, with adequate security, storage and timely accessibility
• Maintain a documented disaster recovery and business continuity plan, tested at least annually, with issues tracked and remediated
• Assess suitability of products/services against customer circumstances before a contract is signed
• Disclose in clear language, before providing services, the benefits, risks, obligations and any fees, charges, penalties or barriers to switching
• Remind customers in plain language of their responsibilities, including AML/ATF-related disclosure obligations
• Provide periodic written statements covering value, composition, transactions, fees and interest earned
• Provide a closing statement when a customer relationship is terminated, unless prohibited by law
• Notify customers within a reasonable time of material changes to products, services, contracts or debt transfer to a collection agency
• Ensure advertisements and promotions are clear, fair, not misleading and clearly recognisable as advertisements
• Publish licensed status and licence type on the institution's website and disclose it in advertisements and correspondence
• Alert the Authority to material extension or reduction of business, proposed non-deposit-taking activity, and significant developments such as staffing changes, material insurance claims, criminal proceedings or corporate structure changes

Applies to

institutions licensed under section 14(5) of the Banks and Deposit Companies Act 1999 (banks and deposit companies)

Deadlines

• at least annually: Disaster recovery and business continuity plans must be tested at least annually, with results documented and issues tracked and remediated

Related documents

• This document is made under Banks and Deposit Companies Act 1999