• Home
  • About
    • Fintech Family
  • Authorisations
    • CASP (MiCAR)
    • Buying & Selling
    • Payments & Emoney >
      • Support Material
  • Crowdfunding
  • Services
    • Regulatory Licences
    • Interim Solutions
    • Training
  • Brexit
    • Brexit Updates
  • Blogs & Insights
  • News
  • Team
  • Contact
  • Fintech Ireland
  • Client Login
  • Home
  • About
    • Fintech Family
  • Authorisations
    • CASP (MiCAR)
    • Buying & Selling
    • Payments & Emoney >
      • Support Material
  • Crowdfunding
  • Services
    • Regulatory Licences
    • Interim Solutions
    • Training
  • Brexit
    • Brexit Updates
  • Blogs & Insights
  • News
  • Team
  • Contact
  • Fintech Ireland
  • Client Login
CompliReg
  • Home
  • About
    • Fintech Family
  • Authorisations
    • CASP (MiCAR)
    • Buying & Selling
    • Payments & Emoney >
      • Support Material
  • Crowdfunding
  • Services
    • Regulatory Licences
    • Interim Solutions
    • Training
  • Brexit
    • Brexit Updates
  • Blogs & Insights
  • News
  • Team
  • Contact
  • Fintech Ireland
  • Client Login

Blogs & Insights

    Author

    Peter Oakes is an experienced anti-financial crime, fintech and board director professional.

    He has served in senior roles at central banks (Ireland & Saudi Arabia) and financial regulators (UK and Australia).

    Peter is an experienced board director of regulated finserv & fintech firms and advisor to regtech firms.

    Archives

    January 2025
    December 2024
    July 2024
    May 2024
    April 2024
    February 2024
    October 2023
    July 2023
    June 2023
    May 2023
    March 2023
    February 2023
    January 2023
    December 2022
    November 2022
    October 2022
    September 2022
    August 2022
    July 2022
    June 2022
    May 2022
    April 2022
    March 2022
    December 2021
    November 2021
    September 2021
    July 2021
    June 2021
    May 2021
    April 2021
    February 2021
    December 2020
    November 2020
    October 2020
    September 2020
    August 2020
    July 2020
    June 2020
    May 2020
    February 2020
    January 2020
    December 2019
    June 2019

    Categories

    All
    ACAMS
    AIB
    AML
    Anti Money Laundering
    Anti-money Laundering
    AUSTRAC
    Authorisation
    Bank Of England
    Bank Of Ireland
    Bank Of Lithuania
    BIS Innovation Hub
    Bitcoin
    Blockchain
    Brexit
    Capital Requirements
    CBDC
    Central Bank Of Ireland
    Chambers And Partners
    Compliance
    Consultation
    COVID-19
    Crypto
    CRYPTOASSETS
    Culture
    Cybercrime
    Cyberfraud
    Cyberrisk
    Cyprus
    Data Protection
    Dear CEO Letter
    Digital Assets
    Digital Currencies
    Digital Euro
    EBS
    ECB
    EML
    Emoney
    Enforcement
    Equivalence
    ESMA
    FCA
    Financial Conduct Authority
    Financial Crime
    Finolita Unio
    FinTech
    FintechUK.com
    Fitness & Probity
    FIU Ireland
    FTX
    GDPR
    Individual Accountability
    Insider Dealing
    Insider Trading
    KBC Bank
    Law
    Lithuania
    Map
    MiCA
    MiFID
    Moneycorp
    Money Laundering
    Payments
    Payments System Regulator
    RegTech
    Risk Management
    Sam Bankman-Freid
    Sandbox
    SARs
    SEAR
    Square
    STRs
    Terrorist Financing
    Tracker Mortgage
    Tracker Mortgages
    VASP
    Virtual Assets
    Westpac
    Wirecard

Back to Blog

Data protection: Commission adopts adequacy decisions for the UK

28/6/2021

 
Picture
I am sure there will be opposing views, but delighted for fintech and innovative finserv in both the UK and Ireland being thrown a commonsense method to continue the transfer of personal data between the UK and Ireland with the European Commission giving the green light to data transfers between EU countries and the UK.

This happened yesterday via the European Commission adopting two adequacy decisions for the United Kingdom, one under the General Data Protection Regulation and the other under the Law Enforcement Directive.

I posted on the previous draft versions a while ago on Linkedin.

In summary, this means that personal data can now flow freely between Ireland and the UK, with the Commission guaranteeing citizens that their data in the UK has “essentially the equivalent level of protection to that guaranteed under EU law”.

As seems with everything involving dealings between the UK and Europe, the resolution was found at minutes to midnight (so to speak) with the interim bridging mechanism which permitted personal data to be transferred from the EU to the UK following the end of the Brexit transition period, expiring on 30 June 2021. Essentially the Commission has assured citizens that GDPR will be fully respected in the UK.

What does this mean for standard contractual clauses (SCCs)? The new adequacy decisions mean that personal data can continue to be transferred from the EU to the UK without additional steps such as the SCCs being put in place.
“The UK has left the EU but today its legal regime of protecting personal data is as it was. Because of this, we are adopting these adequacy decisions today. At the same time, we have listened very carefully to the concerns expressed by the Parliament, the Members States and the European Data Protection Board, in particular on the possibility of future divergence from our standards in the UK's privacy framework. We are talking here about a fundamental right of EU citizens that we have a duty to protect. This is why we have significant safeguards and if anything changes on the UK side, we will intervene”.  Věra Jourová, EC Vice-President for Values and Transparency,
Key elements of the adequacy decisions
  • The UK's data protection system continues to be based on the same rules that were applicable when the UK was a Member State of the EU. The UK has fully incorporated the principles, rights and obligations of the GDPR and the Law Enforcement Directive into its post-Brexit legal system.
  • With respect to access to personal data by public authorities in the UK, notably for national security reasons, the UK system provides for strong safeguards. In particular, the collection of data by intelligence authorities is, in principle, subject to prior authorisation by an independent judicial body. Any measure needs to be necessary and proportionate to what it intends to achieve. Any person who believes they have been the subject of unlawful surveillance may bring an action before the Investigatory Powers Tribunal. The UK is also subject to the jurisdiction of the European Court of Human Rights and it must adhere to the European Convention of Human Rights as well as to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, which is the only binding international treaty in the area of data protection. These international commitments are an essential elements of the legal framework assessed in the two adequacy decisions.
  • For the first time, the adequacy decisions include a so-called ‘sunset clause', which strictly limits their duration. This means that the decisions will automatically expire four years after their entry into force. After that period, the adequacy findings might be renewed, however, only if the UK continues to ensure an adequate level of data protection. During these four years, the Commission will continue to monitor the legal situation in the UK and could intervene at any point, if the UK deviates from the level of protection currently in place. Should the Commission decide to renew the adequacy finding, the adoption process would start again.
  • Transfers for the purposes of UK immigration control are excluded from the scope of the adequacy decision adopted under the GDPR in order to reflect a recent judgment of the England and Wales Court of Appeal on the validity and interpretation of certain restrictions of data protection rights in this area. The Commission will reassess the need for this exclusion once the situation has been remedied under UK law.

The adequacy decisions also facilitate the correct implementation of the EU-UK Trade and Cooperation Agreement, which foresees the exchange of personal information, for example for cooperation on judicial matters. Both adequacy decisions include strong safeguards in case of future divergence such as a ‘sunset clause', which limits the duration of adequacy to four years. 
“After months of careful assessments, today we can give EU citizens certainty that their personal data will be protected when it is transferred to the UK. This is an essential component of our new relationship with the UK. It is important for smooth trade and the effective fight against crime. The Commission will be closely monitoring how the UK system evolves in the future and we have reinforced our decisions to allow for this and for an intervention if needed. The EU has the highest standards when it comes to personal data protection and these must not be compromised when personal data is transferred abroad.”  Didier Reynders, Commissioner for Justice
Background

On 19 February, the Commission published two draft adequacy decisions and launched the procedure for their adoption. Over the past months, the Commission has carefully assessed the UK's law and practice on personal data protection, including the rules on access to data by public authorities in the UK. The Commission has been in close contact with the European Data Protection Board, which gave its opinion on 13 April, the European Parliament and the Member States. Following this in-depth process, the European Commission requested the green light on the adequacy decisions from Member States' representatives in the so-called comitology procedure. The adoption of the decisions today, following the agreement from Member States' representatives, is the last step in the procedure. The two adequacy decisions enter into force today (ie 28 June 2021).

The EU-UK Trade and Cooperation Agreement (TCA) includes a commitment by the EU and UK to uphold high levels of data protection standards. The TCA also provides that any transfer of data to be carried out in the context of its implementation has to comply with the data protection requirements of the transferring party (for the EU, the requirements of the GDPR and the Law Enforcement Directive). The adoption of the two unilateral and autonomous adequacy decisions is an important element to ensure the proper application and functioning of the TCA. The TCA provides for a conditional interim regime under which data can flow freely from the EU to the UK.  This interim period expires on 30 June 2021.

Read more here
0 Comments
Read More
Back to Blog

EML faces lawsuit over Irish HQ issues - Australian law firm threatens class action in bid for compensation

13/6/2021

 
Picture
How much does an #antimoneylaundering governance investigation cost a #fintech?

Previously noted that Australian EML doesn't expect a #moneylaundering compliance investigation (no allegation of money laundering) into one of its recently acquired Irish acquisitions (PFS Card Services Ireland Limited acquired in a deal worth up to €216.9m) to exceed AUD 2million / €1.27mn this Australian financial year which ends 30 June. However it cannot forecast the cost going into the next nor subsequent years. See https://lnkd.in/eg2cm82 (see previous blogs here).

Well, it looks likely the costs may go higher if a class action by Shine Lawyers begins to bite, with the Aussie law firm looking for investors who bought shares between December 19, 2020, and May 17, 2021, to join its class action.

The law firm says:  
* “EML did not request a trading halt for almost four days after learning of these concerns and then took another 48 hours to inform the market,” says Australian law firm

* “When shareholders invest their money into a company, they do so with the belief that that company will comply with its continuous disclosure obligations.

* “Our claim will allege that EML failed in its obligations, significantly impacting share prices for thousands of investors.”

Read more by Sean Pollock at https://lnkd.in/efTj2dU 

Linkedin Post - 
https://www.linkedin.com/posts/peteroakes_antimoneylaundering-fintech-moneylaundering-activity-6809752916379922432-wNal


0 Comments
Read More
Back to Blog

UK Payments System Regulator publishes proposed strategy designed to unlock the potential of UK payments

10/6/2021

 
Picture
Proposed 5 year strategy issued by Payment Systems Regulator.

The PSR's strategy  sets out  an approach that  aims to make sure payments and payment systems  work  well for everybody and that there is fair competition and access to payments for all. The approach is to protect and embrace what’s working well, change what’s not,  and lay the foundations for new products, ways to pay and new payment systems so that they develop with the needs of real people and businesses in mind. ​  
 
Key elements of the PSR Strategy   
The strategy sets out the PSR’s perspective on payment systems and the markets they support. It considers what is going well, where there is scope for improvement, and the risks and issues that need to be tackled.   

  • Priority 1: Ensure users have continued access to the payment services they rely upon and support effective choice of alternative payment options.  
  • ​Priority 2: Ensure users are sufficiently protected when using the UK's payment systems, now and in the future. 
  • Priority 3: Promote competition in markets and protect users where that competition is not sufficient, including a) between payment systems within the UK and b) in the markets supported by them.   
  • Priority 4: Ensure the renewal and future governance of the UK's interbank payment systems supports innovation and competition in payments.
​
What this looks like in practice   
In the strategy the PSR also sets out a number of actions it will take to deliver these priorities. Some of the key actions it is proposing include:   

  • Promoting  competition between payment systems  so that, for example,  in future people may  choose to use interbank payments (when a payment moves from one bank account to another, like an online transfer) to buy their groceries. Most people currently  use  card payment systems to do this.  
  • Continuing to protect access to cash for those that rely on it.  
  • Making  sure that,  as interbank payments develop (like in the example above), so do the  consumer  protections  associated with them.  
  • Supporting  developments to  Pay.UK’s  governance of the interbank rules so it has greater ability to enforce compliance with its rules and  make  changes that improve outcomes.  
  • Understanding and taking account of the perspective of vulnerable consumer groups towards new ways of paying and the choices available to them.  
 
What happens next  
This document is a proposed  strategy .  The PSR is now seeking feedback  from everyone with an interest in payment systems and how they work.  The deadline for responding is  10 September 2021.  
 
This will  help the PSR finalise its approach and ensure  it is focused on the right outcomes,  and - ultimately - have a strategy that is balanced and credible in the eyes of those its regulates and protects.   
 
As well as gathering written feedback  the PSR is  arranging a series of engagement events to listen and understand  the views of its stakeholders.  More information about these events can be found on its website.   
 
If you have any questions, please get in touch via [email protected] 

Links: 
  1. Proposed 5 year strategy 
  2. ​Linkedin Post 

0 Comments
Read More
Back to Blog

EML Payments Money Laundering Governance Investigation to cost less than $2mn this financial year

10/6/2021

 
Picture
In my previous post on EML Payments (EML) (see here) we noted that EML had advised that its Irish regulated subsidiary, PFS Card Services (Ireland) Limited ('PCSIL'), had received correspondence from the Central Bank of Ireland ('CBI'), including a letter received on Friday 14 May 2021 (Australian time) raising significant regulatory concerns ('Correspondence'). The CBI's concerns relate to PCSIL's Anti-Money Laundering / Counter Terrorism Financing ('AML/CTF'), risk and control frameworks and governance. The Correspondence states that the CBI is minded to issue directions to PCSIL pursuant to section 45 of the Central Bank (Supervision and Enforcement) Act 2013.

A few days ago, EML provided the Australian Stock Exchange with a trading update.  The trading update also included its Quarter 3 FY2021 update in which EML confirmed:

"Current Status:
 
  • EML advised the market on 19 May 2021 that it had received correspondence from the CBI raising significant regulatory concerns (‘Section 45 Letter). EMI responded to the CBI's Section 45 letter within the deadline on 27 Moy 2021. 
  • EMA remains in an ongoing dialogue with the CBI in relation to their concerns through substantial responses, data and access to our teams.  
  • There ie no statutory timeframe for the CBI to finale its consideration of the matters.
  • A project governance structure has been established to assist our local team in Ireland, including subcommittee of the EML Board, members of the EML executive team, external regulatory consultants and legal resources.

Communication:
  • We are working co-operatively with the CBI and it authorised officers.
  • Communications with the CBI are confidential and we will provide updates when appropriote, . 
  • EML is proactively communicating with, and providing information if and when requested, with other regulatory in the regions where EML operates.

Business Impact:  
  • We continue to focus on EMI's strong pipeline of new customers and support out existing customers, yet we are aware that ongoing uncertainty is a risk and a challenge.
  • Immediate one-off costs incurred for legal (Arthur Cox) and professional advisory (PriceWaterhouseCoopers) fees are expected to be less than $2 millon in FY21. In addition, we may see an impact of delayed program launches on establishment income and transaction fees which we cannot quantify at this time.
  • Financial impact for FY22 can not be fully determined at this time." 
 
Some observations:
  • This statement, and in particular the fees, relates to the current financial year for EML which ends on 30 June 2021 and a new financial year starts in Australia for the company on 1 July 2021, i.e. FY22. Thus, as we all know, CBI enquiries and investigations last for many years, so one could expect the 'less than $2 million' figure to go northwards. 
  • There will be costs in terms of management time and that of Board involvement, as EML points out.
  • Furthermore, there is a potential loss of revenue from "an impact of delayed program launches on establishment income and transaction fees which we cannot quantify at this time.

Further reading - EML Payments Q3 FY21 Trading Update June 2021 (dated 7 June 2021)
0 Comments
Read More
Back to Blog

Central Bank of Ireland's AML Risk Evaluation Questionnaire

9/6/2021

 
Picture
Received a letter from the Central Bank of Ireland's Anti-Money Laundering Division headed "AML Risk Evaluation Questionnaire (‘REQ’) Notification to [Name of Regulated Firm] (or ‘the firm’) to submit an REQ on an Annual Basis." last month with a return date this month? If so you are not alone.
The letter reminds that credit and financial institutions are required to have anti-money laundering (AML) and countering financing of terrorism (CFT) preventive measures to ensure compliance with the Criminal Justice (Money and Terrorist Financing) Acts 2010 to 2021, a well as reminding of the obligation to comply with EU Council Regulations setting out financial sanctions (‘FS’) measures.

The CBI has established the REQ to seek information regarding individual firms’ exposure to Money Laundering / Terrorist Financing risks and also the AML/CFT compliance framework.

Firms are being informed to submit the REQ in the specified format via the CBI's Online Reporting System on an ANNUAL BASIS within the time period specified on ONR.

The CBI has informed firms that "for 2021, this deadline for the submission of the REQ return is 18 June 2021".

Not only is the form detailed, and there are a few potential ways of interpreting some of the questions, or at least their interaction with other questions, but importantly for Boards of Directors note:

i) Statement of Compliance: "... the REQ includes a statement to be signed by the firm confirming compliance with the firm’s AML/CFT/FS obligations. This statement if [sic] compliance should be signed and dated by a person who is duly authorised to do so by the Board (or equivalent). Ideally this person will have responsibility for AML/CFT/FS within the firm." NB this person doesn't need to be in a PCF role, but the CBI expect them to be of sufficient seniority within the firm to provide the confirmation sought.

ii) Record Retention: "A record of the person who signed the statement of compliance must be formally noted in the Board minutes (or equivalent) when it is brought forward for consideration. The original signed and dated hard copy of the statement of compliance and the accompanying REQ is required to be kept on file and made available for review by the Central Bank on request."

Need assistance with your risk assessment?  Get in contact with us at the details here.

Further reading: 
Risk Evaluation Questionnaire ('REQ') Return

Building upon the obligations of credit and financial institutions under the CJA 2010, the Central Bank has developed a REQ in order to seek information regarding individual firms' exposure to ML / TF risks and also their AML / CFT compliance framework.

Firms selected by the Central Bank to submit an REQ are required to submit the REQ in the specified format, through the Central Bank's Online Reporting System ('ONR'), within the time period specified on ONR.

The minimum frequency that a firm will be required to submit an REQ is predicated on the level of ML/TF risk presented by the firm, either by virtue of its business model and/or the sector into which it falls (for further information on the frequency of submission please see the Table: AML/CFT Minimum Supervisory Engagement Model on the Central Bank AML / CFT Supervision Tab).
  • CBI's website - Risk-based approach to AML Supervision 
  • Risk-Evaluation-Questionnaire | xls 101 KB
  • REQ Guidance Materials | pdf 1126 KB

Linkedin Post:  
https://www.linkedin.com/posts/peteroakes_antimoney-aml-cft-activity-6808437129467756546-vRba
0 Comments
Read More
© CompliReg.com   Dublin 2, Ireland  ph +353 1 639 2971 
|  www.complireg.com  |  officeATcomplireg.com [replace AT with @]

Picture
Photo from Got Credit