Instruction Number 01/2022 for Specified Businesses - Gibraltar (2022-07-21)

Summary

This Instruction, issued by the GFSC under Section 49AA(6) of the Criminal Justice (Proceeds of Crime) (Bailiwick of Guernsey) Law, 1999, responds to Gibraltar's addition to the FATF list of jurisdictions under increased monitoring and its removal from Appendix C (Equivalent Jurisdictions) of the Handbook for Countering Financial Crime and Terrorist Financing. It requires specified businesses to review risk assessments and re-apply full customer due diligence to existing Gibraltarian business relationships where CDD concessions were previously relied upon.

• Identify affected relationships: By 31 December 2022, identify any business relationships where reliable introducer, intermediary, or Appendix C simplified CDD concessions were used because the introducer, intermediary or customer is a Gibraltarian financial services business.
• Reliable introductions: For relationships relying on an introducer under paragraph 10 of Schedule 3, ensure full CDD measures under paragraph 4 of Schedule 3 and the Handbook are met.
• Appendix C businesses: For relationships where simplified CDD under section 9.6 of the Handbook was applied to a Gibraltar-regulated customer, ensure full verification measures under paragraph 4 of Schedule 3 are met.
• Intermediary relationships: Where an intermediary was treated as the customer under paragraph 6 of Schedule 3, either meet correspondent relationship requirements (paragraph 5(1)(b) and section 8.6 of the Handbook) or apply full CDD to each of the intermediary's underlying customers.
• Relationship risk assessments: By 31 December 2022, review all business relationships where Gibraltar is a relevant risk factor, reassess risk exposure, and apply mitigating measures where risk has increased.
• Notification of non-remediation: If a business relationship cannot be remediated by 31 December 2022, notify the Commission detailing the additional risk controls applied; where CDD ultimately cannot be completed, terminate the relationship and consider a disclosure to the Financial Intelligence Service.

The Commission states it will review compliance with this Instruction through on-site inspections and other supervisory means.

Key obligations

• By 31 December 2022, identify all existing business relationships where reliable introducer, intermediary, or Appendix C concessions were used due to a Gibraltarian connection
• Apply full customer due diligence (paragraph 4, Schedule 3) to identified reliable introducer relationships
• Apply full verification measures to identified Appendix C business relationships
• For intermediary relationships, either meet correspondent relationship requirements or apply full CDD to each underlying customer of the intermediary
• Review by 31 December 2022 all business relationships where Gibraltar is a relevant risk factor and take mitigating measures where risk has increased
• Notify the Commission by 31 December 2022 if unable to remediate a relationship, detailing additional risk controls applied
• Where CDD cannot ultimately be completed, terminate the business relationship and consider making a disclosure to the Financial Intelligence Service

Applies to

specified businesses

Deadlines

• 31 December 2022: Deadline to identify affected business relationships, complete remediation (full CDD/verification measures) or notify the Commission of inability to remediate, and complete review of relationship risk assessments involving Gibraltar