administrative fines

Who is caught

The instruments indexed here span two separate administrative fine regimes in Jersey: the civil financial penalties regime operated by the Jersey Financial Services Commission (JFSC), and the administrative fines regime operated by the Jersey Office of the Information Commissioner (JOIC) acting as the Data Protection Authority. The two regimes rest on different statutes and reach different populations.

JFSC civil penalties

• Entities and individuals: Under the Financial Services Commission (Jersey) Law 1998, penalties may be imposed on registered persons, principal persons and key persons (including money laundering reporting officers), and the Financial Services Commission (Financial Penalties) (Jersey) Order 2015 sets a separate maximum for each category.
• Regulated sectors: Supervision covers banks under the Banking Business (Jersey) Law 1991, insurance permit holders under the Insurance Business (Jersey) Law 1996, registered persons under the Financial Services (Jersey) Law 1998, collective investment fund functionaries under the Collective Investment Funds (Jersey) Law 1988, alternative investment fund service providers under the Alternative Investment Funds (Jersey) Regulations 2012, and supervised persons under the Proceeds of Crime (Supervisory Bodies) (Jersey) Law 2008.
• Senior management functions: The Commission may designate senior management functions by published notice; a January 2023 Notice set four such categories that fall within the penalties regime.
• Extensions by amendment: Confirmed policy positions extend the regime to significant and material contraventions of the Money Laundering (Jersey) Order 2008, to designated non-financial businesses and professions (casinos, real estate agents, accountants, lawyers), and to persons who ought to have been registered but were not.

Data protection fines

• Controllers and processors: Administrative fines under the Data Protection Authority (Jersey) Law 2018 apply to data controllers and processors subject to the Data Protection (Jersey) Law 2018.
• Businesses and sole traders: Enforcement action confirms the regime reaches all businesses in Jersey, including sole traders.

Sources: Financial Services Commission (Jersey) Law 1998 · Financial Services Commission (Financial Penalties) (Jersey) Order 2015 · Feedback on Consultation No. 3 2022: Senior Management Functions · Consultation on Jersey Financial Services Commission Civil Penalties Extension (2021-07-07) · Response Paper: Consultation on amendments under the Financial Services Commission (Jersey) Law 1998 regarding the civil financial penalties regime (2021-12-03) · Data Protection Authority (Jersey) Law 2018 · What does Enforcement look like? Procedures, Powers and Penalties, Criminal and Civil · Public Statement - Star Delta Electrical Services Fine (2025-03-25) · Regulatory Action and Enforcement Policy

Key duties

The indexed instruments are largely institutional and enforcement-focused, but they identify the duties whose breach exposes a firm or individual to an administrative fine. These are the recurring obligations.

JFSC-supervised firms

• Code notifications: Registered persons must make notifications required by a Code of Practice, and within the timeframe the Code requires; repeated failure after written warning exposes them to Band 1 penalties.
• Rectify contraventions: Registered persons must rectify a contravention within the timeframe the Commission sets to avoid a Band 2 penalty.
• Supervisory data filings: Reporting entities must complete and return supervisory risk data collection requests by the JFSC deadline; failure is a Code of Practice breach that may trigger a late filing fee under the fees notices.
• Registry filings: Under the Financial Services (Disclosure and Provision of Information) (Jersey) Law 2020, entities must meet statutory deadlines for filings such as beneficial owner or nominated person changes (within 21 days) or incur escalating late fees rising to £484.
• Cooperation with investigations: Firms and individuals must produce documents, attend to answer questions, and comply with directions when the JFSC exercises its investigative powers, and must deal with the Commission openly and co-operatively.

Data controllers and processors

• Registration and charges: Controllers and processors must register with the Authority and pay the prescribed charges; failure to register or pay the registration fee has itself grounded enforcement action.
• Breach notification: Controllers must notify JOIC without undue delay and, where feasible, within 72 hours of becoming aware of a breach that could risk individuals' rights and freedoms; processors must notify the controller without undue delay.
• Breach log: Controllers must keep a detailed log of all breaches, reportable or not, available for JOIC inspection.
• Information notices: A person served with an information notice must respond within 28 days (or a shorter period, generally not less than 7 days, in urgent cases); a materially false response may be a criminal offence.
• Subject access requests: Controllers must respond to subject access requests within the statutory period and apply reasonable redactions.

Sources: Financial Services Commission (Financial Penalties) (Jersey) Order 2015 · Our approach to enforcement · Updates to our 2024 supervisory risk data collection (2024-09-27) · Feedback on Consultation Paper No.11 2021: Registry Late Fees · Data Protection Authority (Jersey) Law 2018 · Data Breaches - What they are and how to deal with them · What does Enforcement look like? Procedures, Powers and Penalties, Criminal and Civil · Public Statement - The Office of the Financial Services Ombudsman (2025-10-28) · Public Statement - Star Delta Electrical Services Fine (2025-03-25) · Public Statement - JRSY Laser Limited (2023-12-05) · Public Statement - Children's Services (2022-02-22) · Regulatory Action and Enforcement Policy

Exemptions and carve-outs

The instruments provide a small number of carve-outs relevant to administrative fines.

• Public authorities: Administrative fines cannot be levied against public authorities under the data protection regime; in several cases against Government of Jersey departments the Authority issued reprimands and orders instead, and in one noted it would likely have imposed a significant fine but was legally barred from doing so.
• Not-for-profit public-interest processing: JOIC's enforcement policy notes a reduced statutory cap of £10,000 for not-for-profit public-interest processing.
• Transitional registration: Under Schedule 2 of the Data Protection Authority (Jersey) Law 2018, controllers already registered under the 2005 Law, and all processors, are exempt from re-registering until the end of a defined registration period.
• Insurance workbook: Category A insurance permit holders that do not meet the 'in or from within' test are excused from the insurance business workbook, though they must still complete the Section I footprint workbook.

Sources: Updates to our 2024 supervisory risk data collection (2024-09-27) · Data Protection Authority (Jersey) Law 2018 · Public Statement - Government of Jersey Customer & Local Services (2023-10-14) · Public Statement - Children's Services (2022-02-22) · Public Statement - Children's Services (2021-10-21) · Public Statement - Planning & Building Control (2020-10-19) · Regulatory Action and Enforcement Policy

Enforcement and penalties

Both regimes provide for financial penalties calculated under published methodologies, backed by appeal rights to the Royal Court of Jersey. The two sets of amounts and powers come from different instruments and should not be read across.

JFSC penalty bands

• Registered persons: Under the Financial Services Commission (Financial Penalties) (Jersey) Order 2015, maximums run from Band 1 (the lower of 4% of average annual turnover or £100,000) up to Band 3 (intentional or reckless contravention) at 8% of average annual turnover, with intermediate bands 2 and 2A. An Amendment Order effective 2026 reintroduced monetary caps for Bands 1, 2 and 2A.
• Natural persons: The JFSC methodology for natural persons sets maximums of £10,000 (Band 1), £200,000 (Band 2), £300,000 (Band 2A) and £400,000 (Band 3) for principal persons, key persons and senior management function holders.
• Calculation: Penalties are calculated through a structured multi-step methodology (14 steps for registered persons) scoring seriousness against the JFSC's Guiding Principles, adjusting for aggravating and mitigating factors, disgorging profit, capping at the statutory maximum, and applying any settlement discount.
• Settlement discounts: Early settlement attracts graduated discounts of up to 50% before conclusion of Stage 1, up to 25% before Stage 2, and up to 5% before Stage 3; a 50% Stage One discount recurs across the published enforcement statements.
• Payment and appeal: A late payment surcharge and enforcement action apply under Article 21E of the Commission Law to unpaid penalties, and a penalised person may appeal to the Royal Court under Article 21F on the ground the decision was unreasonable.

JFSC enforcement examples

• Imposed penalties: Recorded civil financial penalties include £803,661.17 (IQ EQ), £510,599.67, £155,476.54 and £53,375.00 (the SGKH entities), £498,000 (LBCM Jersey Branch), £381,010 (Sanne Fiduciary Services), £115,575 (Equity Trust), £86,803.19 (Garfield Bennett) and £19,211.73 (Belasko), most after a 50% early-settlement discount.
• Other sanctions: The JFSC may also issue public statements and censure, restrict or remove individuals, issue directions under Article 23 of the Financial Services (Jersey) Law 1998, and revoke licences; in one case (Jersey Post) it found a Band 2A penalty warranted but exercised discretion to impose a zero penalty.

Data protection fines

• Maximum amounts: JOIC's enforcement policy describes statutory caps of up to £5,000,000, £10,000,000, or £300,000 / 10% of global turnover depending on the contravention, and £10,000 for not-for-profit public-interest processing; guidance states failure to notify a breach when required can attract a fine of up to £5,000,000, and other guidance cites a maximum of £10 million.
• Fine orders: A fine order must specify a payment date (and may allow instalments) and must be effective, proportionate and dissuasive; aggregate fines for related contraventions must not exceed the applicable statutory cap.
• Imposed fines: Actual fines have been modest in the cases indexed: £4,000 against a sole trader (Star-Delta Electrical Services) and £500 against JRSY Laser Limited, each with a reprimand and orders.
• Non-payment and appeal: Failure to pay an administrative fine can lead to civil debt recovery through the Petty Debts or Royal Court, including wage arrest or distraint of goods; controllers, processors and individuals may appeal to the Royal Court within 28 days on the ground the decision was unreasonable.
• Criminal offences: Separately, failing to comply with an Authority order, obstructing investigators, or giving false information are criminal offences prosecutable in the Royal Court, punishable by fines and/or up to two years' imprisonment.

Sources: Financial Services Commission (Jersey) Law 1998 · Financial Services Commission (Financial Penalties) (Jersey) Order 2015 · Civil Financial Penalties on Natural Persons: Methodology for Determining the Amount · Civil Financial Penalties on Registered Persons: Methodology for determining the amount · Decision-Making Process (JFSC Policy) · Our approach to enforcement · Regulatory Settlements (Issued 2022-02-10) · Feedback on consultation No. 3 2026 – amendments to the Civil Financial Penalties Methodology for Registered Persons · Garfield Bennett Trust Company Limited (2025-08-06) · Jersey Post Limited (2024-11-08) · Belasko Jersey Limited (2024-10-11) · Lloyds Bank Corporate Markets Plc, Jersey Branch (LBCM, Jersey Branch) (2022-08-12) · IQ EQ (Jersey) Limited (formerly, First Names (Jersey) Limited) (2022-07-01) · SGKH Entities (2021-02-16) · Equity Trust (Jersey) Limited (Equity) (2020-06-01) · Sanne Fiduciary Services Limited (SFSL) (2019-07-17) · Data Breaches - What they are and how to deal with them · What does Enforcement look like? Procedures, Powers and Penalties, Criminal and Civil · How We Deal with Complaints · Public Statement - Star Delta Electrical Services Fine (2025-03-25) · Public Statement - JRSY Laser Limited Fine (2025-03-18) · Regulatory Action and Enforcement Policy