AuthorPeter Oakes is an experienced anti-financial crime, fintech and board director professional. Archives
January 2025
Categories
All
|
Back to Blog
I am sure there will be opposing views, but delighted for fintech and innovative finserv in both the UK and Ireland being thrown a commonsense method to continue the transfer of personal data between the UK and Ireland with the European Commission giving the green light to data transfers between EU countries and the UK. This happened yesterday via the European Commission adopting two adequacy decisions for the United Kingdom, one under the General Data Protection Regulation and the other under the Law Enforcement Directive. I posted on the previous draft versions a while ago on Linkedin. In summary, this means that personal data can now flow freely between Ireland and the UK, with the Commission guaranteeing citizens that their data in the UK has “essentially the equivalent level of protection to that guaranteed under EU law”. As seems with everything involving dealings between the UK and Europe, the resolution was found at minutes to midnight (so to speak) with the interim bridging mechanism which permitted personal data to be transferred from the EU to the UK following the end of the Brexit transition period, expiring on 30 June 2021. Essentially the Commission has assured citizens that GDPR will be fully respected in the UK. What does this mean for standard contractual clauses (SCCs)? The new adequacy decisions mean that personal data can continue to be transferred from the EU to the UK without additional steps such as the SCCs being put in place. “The UK has left the EU but today its legal regime of protecting personal data is as it was. Because of this, we are adopting these adequacy decisions today. At the same time, we have listened very carefully to the concerns expressed by the Parliament, the Members States and the European Data Protection Board, in particular on the possibility of future divergence from our standards in the UK's privacy framework. We are talking here about a fundamental right of EU citizens that we have a duty to protect. This is why we have significant safeguards and if anything changes on the UK side, we will intervene”. Věra Jourová, EC Vice-President for Values and Transparency, Key elements of the adequacy decisions
The adequacy decisions also facilitate the correct implementation of the EU-UK Trade and Cooperation Agreement, which foresees the exchange of personal information, for example for cooperation on judicial matters. Both adequacy decisions include strong safeguards in case of future divergence such as a ‘sunset clause', which limits the duration of adequacy to four years. “After months of careful assessments, today we can give EU citizens certainty that their personal data will be protected when it is transferred to the UK. This is an essential component of our new relationship with the UK. It is important for smooth trade and the effective fight against crime. The Commission will be closely monitoring how the UK system evolves in the future and we have reinforced our decisions to allow for this and for an intervention if needed. The EU has the highest standards when it comes to personal data protection and these must not be compromised when personal data is transferred abroad.” Didier Reynders, Commissioner for Justice Background
On 19 February, the Commission published two draft adequacy decisions and launched the procedure for their adoption. Over the past months, the Commission has carefully assessed the UK's law and practice on personal data protection, including the rules on access to data by public authorities in the UK. The Commission has been in close contact with the European Data Protection Board, which gave its opinion on 13 April, the European Parliament and the Member States. Following this in-depth process, the European Commission requested the green light on the adequacy decisions from Member States' representatives in the so-called comitology procedure. The adoption of the decisions today, following the agreement from Member States' representatives, is the last step in the procedure. The two adequacy decisions enter into force today (ie 28 June 2021). The EU-UK Trade and Cooperation Agreement (TCA) includes a commitment by the EU and UK to uphold high levels of data protection standards. The TCA also provides that any transfer of data to be carried out in the context of its implementation has to comply with the data protection requirements of the transferring party (for the EU, the requirements of the GDPR and the Law Enforcement Directive). The adoption of the two unilateral and autonomous adequacy decisions is an important element to ensure the proper application and functioning of the TCA. The TCA provides for a conditional interim regime under which data can flow freely from the EU to the UK. This interim period expires on 30 June 2021. Read more here
0 Comments
Read More
Back to Blog
How much does an #antimoneylaundering governance investigation cost a #fintech?
Previously noted that Australian EML doesn't expect a #moneylaundering compliance investigation (no allegation of money laundering) into one of its recently acquired Irish acquisitions (PFS Card Services Ireland Limited acquired in a deal worth up to €216.9m) to exceed AUD 2million / €1.27mn this Australian financial year which ends 30 June. However it cannot forecast the cost going into the next nor subsequent years. See https://lnkd.in/eg2cm82 (see previous blogs here). Well, it looks likely the costs may go higher if a class action by Shine Lawyers begins to bite, with the Aussie law firm looking for investors who bought shares between December 19, 2020, and May 17, 2021, to join its class action. The law firm says: * “EML did not request a trading halt for almost four days after learning of these concerns and then took another 48 hours to inform the market,” says Australian law firm * “When shareholders invest their money into a company, they do so with the belief that that company will comply with its continuous disclosure obligations. * “Our claim will allege that EML failed in its obligations, significantly impacting share prices for thousands of investors.” Read more by Sean Pollock at https://lnkd.in/efTj2dU Linkedin Post - https://www.linkedin.com/posts/peteroakes_antimoneylaundering-fintech-moneylaundering-activity-6809752916379922432-wNal
Back to Blog
Proposed 5 year strategy issued by Payment Systems Regulator.
The PSR's strategy sets out an approach that aims to make sure payments and payment systems work well for everybody and that there is fair competition and access to payments for all. The approach is to protect and embrace what’s working well, change what’s not, and lay the foundations for new products, ways to pay and new payment systems so that they develop with the needs of real people and businesses in mind. Key elements of the PSR Strategy The strategy sets out the PSR’s perspective on payment systems and the markets they support. It considers what is going well, where there is scope for improvement, and the risks and issues that need to be tackled.
What this looks like in practice In the strategy the PSR also sets out a number of actions it will take to deliver these priorities. Some of the key actions it is proposing include:
What happens next This document is a proposed strategy . The PSR is now seeking feedback from everyone with an interest in payment systems and how they work. The deadline for responding is 10 September 2021. This will help the PSR finalise its approach and ensure it is focused on the right outcomes, and - ultimately - have a strategy that is balanced and credible in the eyes of those its regulates and protects. As well as gathering written feedback the PSR is arranging a series of engagement events to listen and understand the views of its stakeholders. More information about these events can be found on its website. If you have any questions, please get in touch via [email protected] Links:
Back to Blog
EML Payments Money Laundering Governance Investigation to cost less than $2mn this financial year10/6/2021 In my previous post on EML Payments (EML) (see here) we noted that EML had advised that its Irish regulated subsidiary, PFS Card Services (Ireland) Limited ('PCSIL'), had received correspondence from the Central Bank of Ireland ('CBI'), including a letter received on Friday 14 May 2021 (Australian time) raising significant regulatory concerns ('Correspondence'). The CBI's concerns relate to PCSIL's Anti-Money Laundering / Counter Terrorism Financing ('AML/CTF'), risk and control frameworks and governance. The Correspondence states that the CBI is minded to issue directions to PCSIL pursuant to section 45 of the Central Bank (Supervision and Enforcement) Act 2013.
A few days ago, EML provided the Australian Stock Exchange with a trading update. The trading update also included its Quarter 3 FY2021 update in which EML confirmed: "Current Status:
Communication:
Business Impact:
Some observations:
Further reading - EML Payments Q3 FY21 Trading Update June 2021 (dated 7 June 2021)
Back to Blog
Received a letter from the Central Bank of Ireland's Anti-Money Laundering Division headed "AML Risk Evaluation Questionnaire (‘REQ’) Notification to [Name of Regulated Firm] (or ‘the firm’) to submit an REQ on an Annual Basis." last month with a return date this month? If so you are not alone.
The letter reminds that credit and financial institutions are required to have anti-money laundering (AML) and countering financing of terrorism (CFT) preventive measures to ensure compliance with the Criminal Justice (Money and Terrorist Financing) Acts 2010 to 2021, a well as reminding of the obligation to comply with EU Council Regulations setting out financial sanctions (‘FS’) measures. The CBI has established the REQ to seek information regarding individual firms’ exposure to Money Laundering / Terrorist Financing risks and also the AML/CFT compliance framework. Firms are being informed to submit the REQ in the specified format via the CBI's Online Reporting System on an ANNUAL BASIS within the time period specified on ONR. The CBI has informed firms that "for 2021, this deadline for the submission of the REQ return is 18 June 2021". Not only is the form detailed, and there are a few potential ways of interpreting some of the questions, or at least their interaction with other questions, but importantly for Boards of Directors note: i) Statement of Compliance: "... the REQ includes a statement to be signed by the firm confirming compliance with the firm’s AML/CFT/FS obligations. This statement if [sic] compliance should be signed and dated by a person who is duly authorised to do so by the Board (or equivalent). Ideally this person will have responsibility for AML/CFT/FS within the firm." NB this person doesn't need to be in a PCF role, but the CBI expect them to be of sufficient seniority within the firm to provide the confirmation sought. ii) Record Retention: "A record of the person who signed the statement of compliance must be formally noted in the Board minutes (or equivalent) when it is brought forward for consideration. The original signed and dated hard copy of the statement of compliance and the accompanying REQ is required to be kept on file and made available for review by the Central Bank on request." Need assistance with your risk assessment? Get in contact with us at the details here. Further reading: Risk Evaluation Questionnaire ('REQ') Return Building upon the obligations of credit and financial institutions under the CJA 2010, the Central Bank has developed a REQ in order to seek information regarding individual firms' exposure to ML / TF risks and also their AML / CFT compliance framework. Firms selected by the Central Bank to submit an REQ are required to submit the REQ in the specified format, through the Central Bank's Online Reporting System ('ONR'), within the time period specified on ONR. The minimum frequency that a firm will be required to submit an REQ is predicated on the level of ML/TF risk presented by the firm, either by virtue of its business model and/or the sector into which it falls (for further information on the frequency of submission please see the Table: AML/CFT Minimum Supervisory Engagement Model on the Central Bank AML / CFT Supervision Tab).
Linkedin Post: https://www.linkedin.com/posts/peteroakes_antimoney-aml-cft-activity-6808437129467756546-vRba |