CSP - Code of Practice (September 2019)

Summary

This is a Code of Practice issued by the Bermuda Monetary Authority under section 7 of the Corporate Service Provider Business Act 2012. It sets out the standards, procedures and sound principles that licensed corporate service providers (CSPs) must have regard to when conducting their business, and is applied by the Authority proportionately according to a firm's nature, scale and complexity.

The Code is not itself a statement of law and non-compliance is not an offence, but the Authority takes adherence into account when assessing whether a CSP is conducting business in a prudent manner, and persistent non-compliance can lead to formal regulatory action.

• Client due diligence: CSPs must have risk-based CDD procedures, comply with AML/ATF legislation, verify identities of directors, partners, officers and beneficial owners on an ongoing basis, and verify the source of client money held.
• Integrity, ethics and conflicts: CSPs must act with integrity, care and skill, deal fairly with clients, and maintain documented policies to manage or avoid conflicts of interest, keeping records of any conflicts that arise.
• Confidentiality and disclosure: CSPs must observe confidentiality obligations to clients and related parties while not misleading third parties as to beneficial ownership, and must brief staff in writing on confidentiality duties.
• Governance and physical presence: Boards of corporate CSPs must be composed solely of individuals (no corporate directors), must retain oversight of compliance and risk, and must be able to demonstrate sufficient nexus to Bermuda for physical presence purposes, including keeping minutes of board, partner and management meetings.
• Delegation: Boards or partners may delegate duties but retain ultimate responsibility and must clearly document delegated functions.
• Record keeping and systems: CSPs must keep and preserve appropriate accounting and other records in Bermuda, maintain adequate personnel, and implement adequate systems, controls and a risk management framework commensurate with their business.
• Client money, fees, agreements and complaints: CSPs must segregate client funds appropriately, document fee arrangements, use written client agreements, maintain transparent and timely complaint handling procedures, and keep written nominee shareholder agreements identifying beneficial owners where nominee services are provided.
• Advertising and disclosure of licensing: Advertisements must be clear, ethical and not breach any laws; CSPs must publicly disclose their licensed status on websites, advertisements and correspondence using suggested wording referencing the Bermuda Monetary Authority.
• Cooperation with regulators: CSPs must deal openly with the Authority and proactively report material developments such as changes in staffing, systems, insurance claims, criminal proceedings, business sales or amalgamations, cybersecurity incidents, and issues affecting compliance with licensing criteria.

Overall the Code operates as ongoing supervisory guidance rather than a source of fixed statutory deadlines, applying continuously to all holders of a corporate service provider licence granted under the Act.

Key obligations

• Licensed CSPs must carry out risk-based client due diligence before accepting any new client and maintain ongoing knowledge of the current identity of directors, partners, officers and, to the fullest extent possible, beneficial owners.
• Where holding client money, CSPs must verify the source of funds to ensure they are not of illicit origin.
• CSPs must maintain documented policies and procedures to manage or avoid conflicts of interest and keep records of any conflicts that arise.
• CSPs must observe confidentiality obligations regarding client information and advise staff in writing, with periodic reminders, of confidentiality duties.
• Corporate CSPs must ensure their board of directors consists solely of individuals, not corporate directors.
• CSPs must keep minutes of board, partner and management meetings evidencing attendance, decisions and location, to demonstrate sufficient nexus to Bermuda.
• Boards or partners delegating duties must clearly document the functions delegated while retaining ultimate responsibility.
• CSPs must keep and preserve appropriate accounting and other records in Bermuda.
• CSPs must implement a risk management framework commensurate with the scale and risk profile of their business.
• CSPs must maintain a transparent, timely complaints handling process and keep written records of complaints and responses.
• Where acting as or arranging nominee shareholders, CSPs must obtain and retain a written nominee agreement identifying the beneficial owner.
• CSPs must ensure advertisements are clear, ethical, and do not violate local or international laws or standards of prudence and fairness.
• CSPs must disclose their licensed status on their website (if any) and in all advertisements and correspondence.
• CSPs must proactively alert the Authority to material business developments including staffing changes, systems/controls changes, insurance claims, criminal proceedings, mergers/acquisitions, business sales, cybersecurity incidents, and issues affecting compliance with licensing criteria.

Applies to

corporate service providers, holders of a limited corporate service provider licence