General Guidance Notes for AML/ATF Regulated Financial Institutions on AML/ATF (July 2021)

Summary

This is the Bermuda Monetary Authority's comprehensive AML/ATF Guidance Notes (July 2021), issued under Section 5(2) of the Proceeds of Crime (Anti-Money Laundering and Anti-Terrorist Financing Supervision and Enforcement) Act 2008 and approved by the Minister of Legal Affairs. It replaces the BMA's 2016 guidance and interprets how AML/ATF Regulated Financial Institutions (RFIs) should comply with Bermuda's Proceeds of Crime Act, the Anti-Terrorism (Financial and Other Measures) Act and the Proceeds of Crime (AML/ATF) Regulations 2008 (POCR).

• Who it covers: RFIs as defined in Section 42A(1) and Schedule 3 of POCA, including banks and traditional financial institutions, insurance managers and brokers, money service businesses, corporate service providers, trust businesses, operators of investment funds, licensed digital asset businesses, lending and leasing businesses, and any group designated a financial group by the Minister.
• Topics addressed: Senior management responsibilities and internal controls; the risk-based approach; standard and non-standard customer due diligence (CDD); international sanctions compliance; ongoing monitoring; wire transfer requirements; suspicious activity reporting (SAR) to the Financial Intelligence Agency (FIA); employee training and awareness; and record-keeping.
• Sector annexes: Separate annexes address trust business, insurance business, investment business, PEP risk factors, and Bermuda's regulatory/supervisory bodies; annexes for corporate service provider business, money service business and digital asset business state that sector-specific guidance is still being updated and will be issued for industry consultation.
• Legal status of the guidance: While guidance rather than law itself, courts and the BMA must consider whether an RFI has followed this guidance when assessing breaches of the underlying acts and regulations (POCA s49A, POCR reg 19(2), ATFA Schedule I para 1(6), POCA SEA s20(6)); departures from the guidance and the rationale should be documented.

The document is primarily explanatory and interpretive, restating statutory obligations (e.g. to maintain adequate AML/ATF policies, conduct CDD, report suspicions, avoid tipping off, train staff and keep records) and showing how RFIs can implement them using a proportionate, risk-based approach, rather than creating new standalone deadlines.

Key obligations

• RFIs must establish and maintain adequate, risk-sensitive policies and procedures to prevent, detect and report money laundering and terrorist financing (failure to do so is itself an offence under POCR).
• Senior management must set and oversee AML/ATF risk management policies and internal controls tailored to the institution's own risk assessment.
• RFIs must apply standard or, where warranted by risk, non-standard/enhanced customer due diligence measures on customers and beneficial owners.
• RFIs must screen against and comply with international sanctions regimes.
• RFIs must conduct ongoing monitoring of business relationships and transactions.
• RFIs must comply with wire transfer originator/beneficiary information requirements.
• Staff must promptly disclose to the Financial Intelligence Agency any knowledge, suspicion, or reasonable grounds for suspicion of ML/TF, and must not tip off persons other than the FIA about such disclosures or related investigations.
• RFIs must provide employee training and awareness programmes on AML/ATF obligations.
• RFIs must keep records in accordance with the record-keeping requirements set out in the guidance.
• RFIs should document and be able to justify any departure from the guidance.

Applies to

banks and traditional financial institutions, insurance managers and brokers, money service businesses, corporate service providers, trust businesses, operators of investment funds, licensed digital asset businesses, lending and leasing businesses, financial groups designated by the Minister of Legal Affairs