Further Guidance - CSP Gatekeeper Role (2017-06-14)

Summary

This guidance from the Bermuda Monetary Authority sets out expectations for Corporate Service Providers (CSPs) engaged in unlimited activities such as company formation, partnership establishment, and share or partnership interest transfers or issuances. It frames these expectations as a gatekeeper role aimed at protecting Bermuda's reputation, separate from but complementary to AML/CFT and sanctions obligations.

• Culture of compliance: Board and senior management must foster a culture ensuring staff adhere to policies, procedures and controls that limit risks to the jurisdiction and to the CSP's own reputation.
• Search engine vetting: Use two independent search engines for all vetting checks.
• Beneficial owner vetting: Maintain detailed vetting procedures for beneficial owners holding 10% or more in a Bermuda entity, including requiring a personal declaration from such persons.
• Fitness and propriety review: Assess beneficial owners and persons with significant control on personal conduct, previous criminal activity, prior professional or regulatory sanctions, and overall risk to the jurisdiction, with an escalation process for adverse information.
• Record keeping: Maintain records of all due diligence results, including adverse information found, at the CSP's offices for inspection or request by the BMA.
• Documentation availability: Keep documentation supporting vetting decisions and make it available to the BMA upon request.
• Outsourcing oversight: Where due diligence checks are outsourced to a third party, implement a robust oversight process.
• Independent review: Ensure all vetting checks and decisions are reviewed by a knowledgeable person as part of an oversight process, with the oversight evidenced.

The guidance notes that having policies and procedures in place is not sufficient on its own; effective implementation and a compliance culture are required. CSPs should also apply a proportionality principle when designing these policies and procedures.

Key obligations

• CSPs must develop and implement policies and procedures to mitigate reputational risks arising from company formation, partnership establishment, and share or partnership interest transfers or issuances.
• CSPs must use two independent search engines for all vetting.
• CSPs must have detailed vetting procedures for beneficial owners holding 10% or more in a Bermuda entity, including a personal declaration requirement.
• CSPs must assess fitness and propriety of beneficial owners and persons exercising significant control, covering personal conduct, criminal history, prior sanctions, and jurisdictional risk, with an escalation process for adverse findings.
• CSPs must maintain records of due diligence results, including adverse information, at their offices for BMA inspection or request.
• CSPs must maintain and make available to the BMA upon request documentation supporting vetting decisions.
• Where due diligence is outsourced to a third party, CSPs must have a robust oversight process in place.
• CSPs must ensure all vetting checks and decisions are reviewed by a knowledgeable person as part of an evidenced oversight process.

Applies to

Corporate Service Providers (CSPs)