Enforcement Guide - 2026 Statement of Principles on the Exercise of Enforcement Powers

Summary

This is the Bermuda Monetary Authority's 2026 Statement of Principles setting out how it will use its formal enforcement powers under the various Regulatory Acts and the Proceeds of Crime (Anti-Money Laundering and Anti-Terrorist Financing Supervision and Enforcement) Act 2008 (SEA). It replaces the 2018 Statement of Principles and applies generally across all sectors the BMA regulates. It is guidance on the Authority's own decision-making and does not itself create new substantive compliance rules, but it explains the process and consequences RFIs and NLPs will face if referred to enforcement.

• Who it covers: Regulated Financial Institutions (RFIs) licensed or registered under the Regulatory Acts (banks, insurers, trust companies, investment business and investment fund entities, credit unions, corporate service providers, money service businesses, digital asset businesses, fund administration providers and digital asset issuers) and Non-Licensed Persons (NLPs) registered for AML/ATF/CPF purposes.
• Escalation from supervision: Minor issues are handled through normal supervision; matters are referred to the Enforcement Department where they are potentially serious, cannot be resolved supervisorily, or involve AML/ATF/CPF breaches, which are always treated as potentially serious.
• Decision-making process: Sets out the process of information gathering/investigation, issuance of a Warning Notice, assessment of representations, issuance of a Decision Notice, and provisions for urgent cases and delegation of powers to the Enforcement Committee.
• Enforcement options: Describes the tools available: directions/restrictions/conditions, late filing fees, civil penalties, injunctions, public censure, prohibition orders against directors/officers, objections to controllers, revocation of licence/registration or cancellation of NLP registration, winding up, and referral to police.
• Publicity policy: States it is BMA policy to publish all enforcement actions, including the name of the RFI/NLP, following a decision notice, unless exceptional reasons justify non-disclosure.
• Settlement framework: Introduces a settlement process allowing the Authority to enter settlement agreements with an RFI or NLP where there is early acknowledgement of breaches.
• Civil penalty framework: Includes an annex with a methodology and a table of discretionary civil penalty ranges per breach (minor to critical severity), differentiated between prudential breaches (up to $500,000 max) and SEA/DABA/DAIA breaches (up to $10 million max).

Overall, the document functions as a policy and procedural framework rather than a set of new standalone obligations, but it signals the Authority's expectations that RFIs and NLPs cooperate, self-report, and remediate breaches promptly, and it explains the penalty ranges and process an entity will face if enforcement action is taken.

Key obligations

• RFIs/NLPs subject to a supervisory remediation request are expected to act promptly to take agreed remedial action to address the Authority's concerns.
• Where a Warning Notice is issued, the RFI/NLP/individual must submit representations for the Authority to assess before a Decision Notice is issued.
• To access the settlement framework, an RFI (and, where applicable, an NLP) must make an early acknowledgement of breaches committed under the Regulatory Acts and SEA.
• RFIs/NLPs facing a civil penalty determination may make representations regarding their ability to pay the proposed penalty.

Applies to

Regulated Financial Institutions (RFIs), Non-Licensed Persons (NLPs) registered for AML/ATF/CPF purposes, banks and deposit companies, insurers, trust companies, investment business entities, investment funds, credit unions, corporate service providers, money service businesses, digital asset businesses, fund administration providers, digital asset issuers