AML/ATF Guidance Notes Consultation - Comment and Resolution (Updated August 2016)

Summary

This document is the Bermuda Monetary Authority's consolidated table of stakeholder comments on the draft AML/ATF Guidance Notes (issued for consultation in February 2016) together with the Authority's resolutions and actions, updated in August 2016. It works through the draft Guidance Notes chapter by chapter, recording industry feedback and the Authority's response, including several points where the Authority agrees to amend the forthcoming final Guidance Notes.

• Suspicious activity reporting: The Authority confirms Bermuda RFIs must file suspicious activity reports (SARs) with the Financial Intelligence Agency (FIA), and that overseas operations of a Bermuda RFI must file SARs with the local FIU of that jurisdiction; the draft's three pronged suspicion test is to be removed pending legislative change to POCA.
• Compliance and reporting officer roles: The compliance officer appointment will be revised to require managerial level (not senior executive/board level) reporting to senior management; qualification standards for compliance/reporting officers are left to each RFI's fit and proper assessment.
• Periodic compliance reporting: The periodic compliance report to senior management must be produced at least once a year (more frequently if the RFI's risk profile warrants), and exception reporting forms part of this standard report.
• Independent internal audit: RFIs must conduct an independent AML/ATF audit at least once a year, kept separate from the general operational audit, though it may be staggered into smaller reviews across the year provided all required areas are covered within the year.
• Risk assessment approach: The Authority clarifies that inherent/residual risk assessment under the new Guidance Notes should be applied at the customer level rather than solely at the account/portfolio level.
• Group and overseas operations reliance: Where Bermuda is the host jurisdiction and a parent's home jurisdiction AML/ATF standards meet or exceed Bermuda's, the Authority may allow use of the parent's group AML/ATF programme, subject to the Bermuda RFI demonstrating equivalence.

The document notes the final AML/ATF Guidance Notes will take effect once published, with the Authority working with stakeholders during on-site reviews in the interim; sector specific annexes (e.g. for insurance) remain subject to further consultation.

Key obligations

• Bermuda RFIs must file suspicious activity reports with the Financial Intelligence Agency (FIA)
• A Bermuda RFI must ensure its overseas operations file suspicious activity reports with the local FIU/FIA of the jurisdiction where they operate
• RFIs must appoint a compliance officer at managerial level who reports to senior management
• RFIs must provide a periodic AML/ATF compliance report to senior management at least once a year
• RFIs must conduct an independent internal audit of their AML/ATF programme at least once a year, separate from the general operational audit
• RFIs relying on a parent group's AML/ATF programme must be able to demonstrate that the home jurisdiction's standards meet or exceed Bermuda's requirements before doing so

Applies to

AML/ATF Regulated Financial Institutions (RFIs), banks, insurers

Deadlines

• at least once a year: RFIs must conduct an independent internal audit of their AML/ATF programme
• at least once a year: RFIs must provide a periodic compliance report to senior management (minimum annual frequency)