The Cyber (Sanctions) (Overseas Territories) Order 2020 (S.I. 2020 No. 281)

Summary

This Order in Council extends the UK's cyber sanctions regime (based on EU Council Decision (CFSP) 2019/797 and Council Regulation (EU) 2019/796) to the Overseas Territories, including the BVI. It imposes an asset freeze on persons designated for cyber-attacks or related support, and creates criminal offences for dealing with or making funds or economic resources available to designated persons.

• Who it applies to: Any person in the Territory, British-connected persons and bodies incorporated in the Territory, persons on Territory-registered ships or aircraft, relevant institutions (deposit-takers and similar) and a defined list of relevant businesses or professions.
• Relevant businesses or professions covered: Auditors, casinos, dealers in precious metals or stones, external accountants, independent legal professionals, real estate agents, tax advisers, and trust or company service providers operating in the Territory.
• Core prohibition: It is an offence to deal with funds or economic resources of a designated person, or to make funds or resources available (directly or indirectly) to or for the benefit of a designated person, where the person knows or has reasonable cause to suspect this.
• Reporting duty: Relevant institutions and relevant businesses/professions must inform the Governor as soon as practicable if they know or suspect a customer is a designated person or has committed an offence under the Order, providing specified identifying and transactional information.
• Licensing: The Governor, with the Secretary of State's consent, may grant, vary or revoke licences authorising otherwise-prohibited activities (e.g. basic expenses, legal fees, routine account maintenance charges).
• Enforcement: Contravention or circumvention of the sanctions is a criminal offence, with associated penalties and powers for authorised officers to enforce the regime, including in relation to ships, aircraft and vehicles.

The Order came into force on 8 April 2020 and applies to the territories listed in its Schedule 1 (excluding Bermuda and Gibraltar, which implement sanctions domestically). No fixed reporting deadline is set beyond the 'as soon as practicable' standard for suspicious activity reports to the Governor.

Key obligations

• Relevant institutions and relevant businesses or professions must not deal with funds or economic resources belonging to, owned, held or controlled by a designated person if they know or have reasonable cause to suspect this.
• Persons must not make funds or economic resources available, directly or indirectly, to a designated person or for their benefit, where they know or have reasonable cause to suspect this.
• Relevant institutions or relevant businesses/professions must inform the Governor as soon as practicable if they know or suspect a customer is a designated person or has committed an offence under article 4 or 7(10), including specified identifying and transactional details.
• A relevant institution must inform the Governor as soon as practicable if it credits a frozen account under article 5(1)(b), (c) or 5(2).
• Any activity otherwise prohibited under article 4 requires a licence granted by the Governor with the Secretary of State's consent, and licence conditions must be complied with.

Applies to

relevant institutions (deposit-taking businesses), auditors, casinos, dealers in precious metals or stones, external accountants, independent legal professionals, real estate agents, tax advisers, trust or company service providers

Deadlines

• 8th April 2020: Date the Order comes into force.
• as soon as practicable: Timeframe within which a relevant institution or relevant business/profession must inform the Governor of knowledge or suspicion that a customer is a designated person or has committed an offence under article 4 or 7(10), or that a frozen account has been credited under article 5.

Related documents

• The Sanctions (Overseas Territories) (Revocations) Order 2020 repeals this document