Feedback on Consultation on Amendments to Schedule 3 re Independent Audit, Business Risk Assessments and VASPs (2023-07-10)

Summary

This document combines the Guernsey Financial Services Commission's 10 July 2023 feedback statement with the underlying 28 March 2023 consultation paper on amendments to Schedule 3 of the Proceeds of Crime Law and the associated Handbook on Countering Financial Crime and Terrorist Financing. It covers four linked reform areas: an independent audit function, enhanced business risk assessments, new rules for virtual asset service providers (VASPs), and additional disclosure duties for licensed trustees and partners.

• Independent audit function: Every financial services firm and prescribed business without a qualifying audit arrangement must consider annually whether to establish an independent audit function to test AML/CFT controls, document its reasoning if it decides not to, and ensure independence of any audit function it establishes. It is not mandatory for any sector as a whole.
• Business risk assessments: Firms' business risk assessments must now expressly consider the implications and risks of the main predicate offences identified in the Bailiwick's National Risk Assessment (including bribery, corruption, fraud and tax evasion), and reviews of the business risk assessment must be recorded.
• Virtual asset service providers: A new Handbook chapter 18 sets out rules and guidance for VASPs on information that must accompany virtual asset transfers (the 'travel rule'), alongside legislative changes introducing a £1,000 threshold above which customer due diligence is required for virtual asset transactions and clarifying that 'funds' and 'property' include virtual assets.
• Trustees and partners: Licensed trustees of relevant trusts and partners of relevant partnerships must hold information on the identity of other regulated agents and service providers to the trust or partnership and disclose their own status as trustee or partner, to support beneficial ownership transparency in line with FATF standards.

The Commission received 16 responses, mostly supportive, and made targeted clarifications to the Handbook text rather than substantive changes to the proposals. There are no transitional provisions: the amendments to Schedule 3 and the Handbook take effect immediately, though firms are expected to fold the new risk-assessment and audit-function requirements into their next scheduled annual review processes.

Key obligations

• Firms and prescribed businesses without an existing qualifying audit arrangement must consider annually whether to establish an independent audit function to evaluate AML/CFT controls, and document their reasoning if they decide not to (Handbook rule 2.28)
• Firms must ensure independence within any independent audit function they establish (Handbook rule 2.23)
• Firms must consider the specified factors in determining whether to have an independent audit function (Handbook rule 2.24)
• Firms' business risk assessments must include consideration of the implications and risks of the predicate offences identified as high or higher risk in the National Risk Assessment (Schedule 3 paragraph 3(3))
• Firms must record their reviews of their business risk assessment (Handbook rule 3.53)
• Firms must ensure their compliance review policy sets out how they will monitor compliance with Schedule 3 and the Handbook
• VASPs must comply with the new Handbook chapter 18 rules on information accompanying virtual asset transfers
• Specified businesses must apply customer due diligence to virtual asset transactions where the value exceeds the £1,000 occasional transaction threshold
• Licensed trustees and partners must hold accurate information on the identity of other regulated agents and service providers to the trust or partnership and disclose their own status as trustee or partner
• Persons carrying on virtual asset services or activities from the Bailiwick must be licensed under the Lending, Credit and Finance (Bailiwick of Guernsey) Law, 2022 from 1 July 2023

Applies to

financial services businesses, prescribed businesses, virtual asset service providers (VASPs), licensed trustees of relevant trusts, partners of relevant partnerships

Deadlines

• 25 April 2023: Deadline for responses to the 28 March 2023 consultation paper
• 1 July 2023: Persons carrying on virtual asset services or activities in or from the Bailiwick must be licensed under the Lending, Credit and Finance (Bailiwick of Guernsey) Law, 2022
• 5 July 2023: Commencement date of the Criminal Justice (Proceeds of Crime) (Bailiwick of Guernsey) (Amendment) Ordinance, 2023
• immediately (no transitional period): Amendments to Schedule 3 and the Handbook (independent audit function, business risk assessment changes, VASP rules, trustee/partner disclosure requirements) take effect with no transitional deadline
• before the end of 2023: Licensees are expected to have met the independent audit function requirement when their Board next considers AML/CFT matters, and to have addressed the new NRA risk consideration at their next mandatory annual business risk assessment review