AuthorPeter Oakes is an experienced anti-financial crime, fintech and board director professional. Archives
April 2024
Categories
All
|
Back to Blog
Following the Permanent Representatives’ Committee meeting of 5 October 2022 which endorsed the final compromise text with a view to agreement, the Chair of the Committee (Edita Hrd) has written a letter and Proposal for a Regulation of the European Parliament and of the Council on Markets in Crypto-assets, and amending Directive (EU) 2019/1937 (MiCA) to the Chair of the Committee on Economic and Monetary Affairs (Irene TINAGLI) saying:
"that, should the European Parliament adopt its position at first reading, in accordance with Article 294 paragraph 3 of the Treaty, in the form set out in the compromise package contained in the Annex to this letter (subject to revision by the legal linguists of both institutions), the Council would, in accordance with Article 294. paragraph 4 of the Treaty, approve the European Parliament's position and the act shall be adopted in the wording which corresponds to the European Parliament's position." The full legal text of the landmark legislation known as the Markets in Crypto Assets Regulation (MiCA), alongside a further law to reveal the identity of those making crypto payments. At a Wednesday meeting (5th October 2022), diplomats representing the bloc's member governments in the EU's Council signed off on the text of laws (see link above) which were the subject of political deals struck in June. MiCA introduces the first-ever licensing regime for crypto wallets and exchanges to operate across the bloc and imposes reserve requirements on stablecoins that are intended to avoid Terra-style collapses. A separate law on funds transfers requires wallet providers to check their customer's identity, in a bid to cut money laundering. See also CoinDesk Article here
0 Comments
Read More
Back to Blog
Revolut (finally) joins the UK Registered Cryptoasset Map Version 5.0 Monday 26th September 202226/9/2022 Fintech UK is looking to partner with registered / regulated (or soon to be) cryptoasset firms on building out a cryptoasset section on our website. If you are senior executive at a UK registered cryptoasset firm, please contact us here to discuss the proposed project. Also happy to hear from senior executives at businesses which support crypto firms to support the project. See our CRYPTO page for more information If you are are crypto firm seeking regulatory advice or director services, please contact CompliReg for assistance at the details appearing here and check out its VASP registration and other authorisation services here. Hope you like the Map (Version 5.0)! Welcome to the version 5.0 of Fintech UK's and CompliReg's (a leading provider of fintech consulting services to crypto asset firms) UK FCA registered Cryptoasset Firms Map.
There are now 38 registered Cryptoasset firms appearing on the Financial Conduct Authority's (FCA) website as at Tuesday 16th August 2022. Welcome to Revolut. The FCA register records Revolut Ltd registration effective 26th September 2022. Did you know that Martin Gilbert is Chairman of Revolut Ltd. He is the Chairman of AssetCo plc which is authorised by the FCA and former Chairman of Aberdeen Standard Investments. Revolut has quite a lot of firepower on its board generally speaking. Revolut has had quite a journey to be come a FCA registered cryptoasset firm. As far as we can tell, while other smaller and less resourced crypto firms were getting through the FCA process, Revolut Ltd sat on the Temporary Permission list since at least from December 2021. But all is well that ends well, right? As we continue to Map registered Cryptoasset firms, expect to see certain logos appear more than once as several brands will be registering several Cryptoasset firms for different purposes, such as - for example - services for (1) trading and (2) custody. An example of this is in fact Zodia. While Zodia Markets (UK) Limited was registered on 27 July 2022, its affiliate Zodia Custody Limited was registered effective 15 July 2021. At the time we released Version 1, there were 218 (thereabouts) unregistered cryptoasset business listed on the UK FCA's website that appear, to the FCA, to be carrying on cryptoasset activity, that are not registered with the FCA for anti-money laundering purposes. As of today (26 September 2022), that number is steady at 246. The firms thus far registered by the FCA include: 2020: Archax Ltd, Gemini Europe Ltd, Gemini Europe Services Ltd, Ziglu Limited, Digivault Limited, 2021: Fibermode Limited, Zodia Custody Limited, Ramp Swaps Limited, Solidi Ltd, Coinpass Limited, CoinJar UK Limited, Trustology Limited, Commercial Rapid Payment Technologies Limited, Iconomi Ltd, Skrill Limited, Paysafe Financial Services Limited, Crypto Facilities Ltd, Fidelity Digital Assets LTD, Payward Limited, Galaxy Digital UK Limited, BABB Platform Ltd, BCP Technologies Limited, Zumo Financial Services Limited, Baanx.com Ltd, Bottlepay Ltd, Genesis Custody Limited, Altalix Ltd, 2022: X Capital Group Limited, Enigma Securities Ltd, Light Technology Limited, eToro (UK) Ltd, Uphold Europe Limited, Wintermute Trading LTD, Rubicon Digital UK Limited, DRW Global Markets Ltd, Zodia Markets (UK) Limited, Foris DAX UK Ltd (aka Crypto.com) and Revolut Ltd. And of course the Revolut group is still pursing its much talked about bank authorisation in the UK. We are looking forward to seeing how many more will be registered before the end of the year. See Peter Oakes Linkedin blog - https://www.linkedin.com/posts/peteroakes_cryptoasset-fca-cryptoasset-activity-6980821130584412160-_63O?utm_source=share&utm_medium=member_desktop See Fintech UK blog - https://fintechuk.com/fintech-news/revolut-finally-joins-the-uk-registered-cryptoasset-map-version-50-monday-26th-september-2022 Further Reading: Version 1 of the Map and the Blog of 20 December 2021 - located here Version 2 of the Map and the Blog of 18 July 2022 - located here Version 3 of the Map and the Blog of 28 July 2022 - located here Version 4 of the Map and the Blog of 20 September 2022 - located here List of Unregistered Cryptoasset Businesses as at 20 September 2022 - located here
Back to Blog
ComplIReg: "The action will make the directors, both executive and non-executive at the relevant time of a prescribed contravention, of foreign incorporated financial services firms which operate in Ireland on a branch passported basis sit up and pay attention."Danske Bank A/S fined €1,820,000 and reprimanded by the Central Bank of Ireland for transaction monitoring failures in respect of anti-money laundering and terrorist financing systems. The fine would have been €2,600,000, but reduced by 30% to €1,820,000. So what you might think? Another bank, another AML/CTF sanction. But in this case it isn't an Irish incorporated bank but for the first time a penalty has been imposed on a financial institution which is incorporated and supervised outside of Ireland (i.e. in Denmark). It operated in Ireland on a passported branch basis. The same outcome could happen to any other firm which operate on a passport's branch basis. The action will make the directors, both executive and non-executive at the relevant time of a prescribed contravention, of foreign incorporated financial services firms which operate in Ireland on a branch passported basis sit up and pay attention. Such a regulatory action will need to be disclosed by them to regulators elsewhere. A regulatory enforcement action on a company where the directors may not be resident could damage their standing in, and income derived from, an overseas jurisdiction. In a little bit chest-beating, the Central Bank also announced that this 150th enforcement outcome takes the total fines it has imposed to just under €300 million. Which although is less than the total of the Ireland’s Data Protection Commissioner for a fraction of the number of its enforcement outcomes – not that it is a competition nor would anyone want it to be! In probably a fairly well known rumour circulating this past while, on 13 September 2022, the Central Bank of Ireland (the Central Bank) reprimanded and fined Danske Bank A/S, trading in Ireland as Danske Bank, €1,820,000 pursuant to its Administrative Sanctions Procedure for three breaches of the Criminal Justice (Money Laundering & Terrorist Financing) Act 2010, as amended (the CJA) for three failures by Danske to ensure that its automated transaction monitoring system monitored the transactions of certain categories of customers of its Irish branch, for a period of almost nine years, between 2010 and 2019. [This included a range of customers, including those categorised by Danske as banks, insurance, stockbrokers and specialised lending customers.] The three breaches, all admitted by Danske, comprised of failures by under the CJA relating to:
What led to the failures?
Below is a copy and paste from the remainder of the Central Bank of Ireland statement The Central Bank’s Director of Enforcement and Anti-Money Laundering, Seana Cunningham, said: “The importance of transaction monitoring in the global fight against money laundering and terrorist financing cannot be overstated. It is imperative that firms implement robust transaction monitoring controls which are appropriate to the money laundering risks present and the size, activities, and complexity of their business. These controls must be applied to all customers, irrespective of their risk rating, as they enable firms to detect unusual transactions or patterns of transactions and where required apply enhanced customer due diligence to determine whether the transactions are suspicious.
The Central Bank recognises that while firms may rely on automated solutions for transaction monitoring, they must ensure that systems employed for this purpose are appropriately monitored, and calibrated correctly to take account of the actual money laundering or terrorist financing risk to which the firm is exposed. In this case, the transaction monitoring system used by the Irish branch was a Danske group wide automated system that had applied historic data filters which operated to erroneously exclude certain categories of customers from being monitored for a period of almost nine years. This led to the serious breaches in this case. This case highlights the requirement for firms, including those operating in Ireland on a branch basis, to ensure that group systems, controls, policies and procedures are compatible with Irish legal requirements and to ensure that their governance framework and risk management measures operate effectively. These should be risk-based and proportionate, informed by firms’ business risk assessment of their money laundering and terrorist financing risk exposure. Danske became aware that its automated transaction monitoring system erroneously excluded certain categories of customers in May 2015 but failed to rectify it or notify the Irish branch or the Central Bank of this issue. It was only in October 2018 when the Irish branch identified the issue that steps were taken to rectify it, which were completed in March 2019. However, the Central Bank was not informed of the issue until February 2019. The failures to rectify the issue and to notify the Central Bank promptly are aggravating factors in this case. The Central Bank expects firms to bring failures to its attention at the earliest opportunity and to act expediently to address identified errors. The Central Bank will hold firms, including those operating in Ireland on a passporting basis, fully accountable where they fail to take such actions. Anti-money laundering and countering the financing of terrorism compliance is, and will remain, a key priority for the Central Bank. This case demonstrates our willingness to pursue enforcement actions and impose sanctions where firms fail in their anti-money laundering/countering the financing of terrorism compliance.” Background Danske is a credit institution incorporated in Denmark and authorised there by the Danish Financial Supervisory Authority (the Danish FSA). It is the largest bank in Denmark serving personal, business, corporate and institutional clients and operates in a number of other countries via a branch network. Danske’s Irish branch operates on a ‘freedom of establishment’ basis i.e. because Danske is established and authorised in Denmark, it is entitled to ‘passport’ in to Ireland and establish a branch here. The Irish branch is not a separate legal entity to Danske, and it is for this reason that Danske is the named party in the enforcement action. Supervision of the Irish branch sits predominantly with the Danish FSA (as home regulator) but the Central Bank (as host country) regulates it for conduct of business rules and is responsible for supervision of compliance by Danske’s branch operations in Ireland with AML/CFT obligations under the CJA. Danske’s Irish branch predominantly provides banking services to large corporate and institutional customers including the public sector in Ireland. Consequently, transaction volumes through the Irish branch, including cross-border funds transfers, are substantial. The Irish branch utilises a group wide automated transaction monitoring system that is implemented and managed by Danske from Denmark. The Legislative Framework The CJA requires a credit and financial institution to monitor any business relationship that it has with a customer to the extent reasonably warranted by the risk of money laundering/terrorist financing (ML/TF). ‘Transaction Monitoring’ forms part of a broader system of interconnected elements that comprise a firm’s defence against ML/TF and is an important method which assists firms in identifying high risk situations which may require enhanced due diligence on a customer. Firms are also required to adopt and maintain a system of policies, procedures and controls in relation to AML/CFT, and to monitor compliance with those policies, procedures and controls. Such policies, procedures and controls include, inter alia, those dealing with the monitoring of transactions for the identification and scrutiny of any complex, large or unusual patterns of transactions. The Investigation The Central Bank’s investigation confirmed serious inadequacies within Danske’s automated transaction monitoring system. Historic filters were applied to Danske’s automated transaction monitoring system which erroneously excluded certain categories of customers from transaction monitoring. This led to Danske being in breach of certain obligations under the CJA which gave rise to the three breaches in this case (see below under Prescribed Contraventions for further detail). The investigation found that the exclusion of certain categories of customers from transaction monitoring was first identified in a May 2015 internal audit report. The May 2015 internal audit report also identified inadequacies with Danske’s transaction monitoring policies for certain categories of customers. However, these internal audit findings were not communicated by Danske to either its Irish branch or the Central Bank. Steps were only taken to monitor the transactions of these customers in October 2018 when the Irish branch became aware of the issue, which were completed by the end of March 2019. The Central Bank was not informed of this issue until February 2019. To illustrate the scale of the failure to monitor, it is estimated that, during the period from 2015 to 2019 when Danske was aware of the issue, 348,321 transactions, equating to approximately one in every forty or 2.43% of all transactions processed through the Irish branch were not monitored. Danske has confirmed to the Central Bank that by the end of March 2019 it had fully deactivated the erroneous historic filters which gave rise to the breaches in this case. Danske has also confirmed that by April 2020, it completed a third party review exercise for the period 2016 to 2019. Danske has advised that the outcome of the review showed that the risk of suspicious transactions amongst those examined was very low. Prescribed Contraventions The Central Bank's investigation identified three breaches of the CJA, as set out below. Breach by failure to conduct transaction monitoring Between 15 July 2010 and 31 March 2019 Danske breached sections 30B(1)(a), 35(3) and 36A(1) (as applicable) of the CJA by failing to monitor the transactions of certain categories of customers for money laundering and terrorist financing risk. The failure meant that the Irish branch was not in a position to:
Between 14 June 2013 and 31 March 2019 Danske breached section 39 of the CJA on the basis that by failing to conduct transaction monitoring on certain categories of customers, it did not take into consideration an important part of due diligence i.e. transaction monitoring data, which is necessary to identify and assess ML/TF risks specific to those customers and identify whether additional measures were required on these certain categories of customers. Breach in adopting ML/TF policies and procedures Between 15 July 2010 and 31 March 2019, Danske breached sections 54(1), 54(2) and 54(4) of the CJA on the basis that the policies, procedures and controls that were in place did not operate to identify the erroneous exclusion of certain categories of customers from transaction monitoring as set out above. The May 2015 internal audit report identified inadequacies with Danske’s transaction monitoring policies for certain categories of customers and Danske took some steps in 2015 to address this by introducing a new AML/CFT policy. Nonetheless, certain categories of customers continued to be excluded from transaction monitoring in the Irish branch. Penalty Decision Factors In deciding the appropriate penalty to impose, the Central Bank had regard to the Outline of the Administrative Sanctions Procedure, dated 2018 and the ASP Sanctions Guidance, dated November 2019. It considered the need to impose a level of penalty proportionate to the nature, seriousness and impact of the contraventions. The following particular factors are highlighted in this case: The Nature, Seriousness and Impact of the Contraventions Two of the breaches were ongoing for almost nine years, and the other was ongoing for almost six years. The breaches represent serious weaknesses in Danske’s internal AML/CFT controls. Monitoring transactions, ensuring that an important part of due diligence is taken into consideration to identify where additional measures are required, and having effective policies, procedure and controls are critical parts of a firm’s internal AML/CFT framework. Danske’s failures in this regard in respect of certain categories of customers that transacted through its Irish branch reveal serious weaknesses in these controls. From its May 2015 internal audit report, Danske became aware of the inadequacies in its transaction monitoring system, the nature of the ML/TF risks that they posed and that it was at risk of non-compliance with legal requirements. Despite this, Danske failed to take adequate action for almost four years or to inform the Irish branch of these internal audit findings. The breaches of the CJA after this point were reckless. The Central Bank considers that the breaches in this case represent a serious departure from the required standard. Two Aggravating Factors Failure to Report and Failure to Remediate promptly Danske was on notice of the inadequacies in its transaction monitoring system which erroneously excluded certain categories of customer from the time that they were uncovered in the May 2015 internal audit report but it did not report the matter to the Central Bank until February 2019, almost four years later. Furthermore, Danske continued to exclude certain categories of customers from transaction monitoring until March 2019. The Central Bank views both of these failures as particularly aggravating given the context of increased supervisory engagement it initiated in July 2018 with Danske following media reports of AML/CFT concerns in other jurisdictions in relation to Danske. Both of these failings are serious aggravating factors in this case. Other Considerations The following were also taken into consideration when determining the appropriate sanction:
Back to Blog
CompliReg, your first choice for regualtory authorisations, licences and registrations is proud to support Fintech UK and its endeavours to Map the FCA registered cryptoasset market in the UK. Fintech UK is looking to partner with registered / regulated (or soon to be) cryptoasset firms on building out a cryptoasset section on our website. If you are senior executive at a UK registered cryptoasset firm, please contact us here to discuss the proposed project. Also happy to hear from senior executives at businesses which support crypto firms to support the project. See our CRYPTO page for more information If you are are crypto firm seeking regulatory advice or director services, please contact CompliReg for assistance at the details appearing here and check out its VASP registration and other authorisation services here. Hope you like the Map (Version 4.0)! Welcome to the second edition (version 4.0) of Fintech UK's and CompliReg's (a leading provider of fintech consulting services to crypto asset firms) UK FCA registered Cryptoasset Firms Map.
There are now 37 registered Cryptoasset firms appearing on the Financial Conduct Authority's (FCA) website as at Tuesday 16th August 2022. Welcome to Crypto.com. The FCA register records Foris DAX UK LTD (aka Crypto.com) registration effective 16th August 2022. At the time Version 1.0 was released there were 218 (thereabouts) unregistered cryptoasset business listed on the UK FCA's website that appear, to the FCA, to be carrying on cryptoasset activity, that are not registered with the FCA for anti-money laundering purposes. As of today (20 September 2022), that number has decreased by one to 247. On both 18th and 28th July 2022 the figure was 248. Read more at Fintech UK on facts and figures about the cryptoasset firms appearing on Version 4.0.
Back to Blog
If you wish to Partner with the S.E.A.R. Hub contact us at helloATsearhubDOTcom (replace AT and DOT with @ and .) and let us know what you do and which category of service you provide i.e. RegTech, Professional Services and/or Training and details of your track record working in the field of regulated financial services.
Board directors & senior executives at regulated institutions in Ireland, big news today. 76 pages of big news! Central Bank (Individual Accountability Framework) Bill 2022 (Bill 75 of 2022) has been published - DOWNLOAD THE BILL HERE What is the Bill about? Go to read SEAR Hub's blog. Other ways to stay in contact include:
If you wish to Partner with the SEAR Hub contact us at helloATsearhubDOTcom. Let us know what you do & which category of service you provide i.e. RegTech, Professional Services and/or Training and & details of your track record working in the field of regulated financial services. Read the LinkedIN Post here
Back to Blog
Fintech UK is looking to partner with registered / regulated (or soon to be) cryptoasset firms on building out a cryptoasset section on our website. If you are senior executive at a UK registered cryptoasset firm, please contact us here to discuss the proposed project. Also happy to hear from senior executives at businesses which support crypto firms to support the project. See our CRYPTO page for more information
If you are are crypto firm seeking regulatory advice or director services, please contact CompliReg for assistance at the details appearing here and check out its VASP registration and other authorisation services here. Hope you like the Map (Version 2.0)! Don't forget to sign up to our Newsletter (we don't spam) by clicking here. We use MailChimp, which means you can unsubscribe whenever you like. Welcome to the second edition (version 2.0) of Fintech UK's and CompliReg's (a leading provider of fintech consulting services to crypto asset firms) UK FCA registered Cryptoasset Firms Map. There are now 35 registered Cryptoasset firms appearing on the Financial Conduct Authority's (FCA) website as at Monday 18th July 2022. The first 5 of these firms were registered in 2020. According to the FCA's records, the first registered Cryptoasset firm was Archax on 18 August 2020. Then in 2021, the FCA registered 22 crypto firms. Thus far in 2022, the FCA has registered 8 crypto firms. The most recent to be registered is DRW (7 June 2021). As we pointed out when we released Version 1.0 of the Map, 2021 saw a flurry of activity and especially in the last quarter of 2021 when 16 firms received their Cryptoasset registration from the FCA - that was a whopping 60% of the total pool of registered firms at that time. At the current rate, the number of firms registered in 2022 may be less than that in 2021, unless the FCA registers a large pile of crypto firms in the second half of 2022. As we continue to Map registered Cryptoasset firms, expect to see certain logos appear more than once as several brands will be registering several Cryptoasset firms for different purposes, such as - for example - services for (1) trading and (2) custody. At the time we released Version 1, there were 218 (thereabouts) unregistered cryptoasset business listed on the UK FCA's website that appear, to the FCA, to be carrying on cryptoasset activity, that are not registered with the FCA for anti-money laundering purposes. As of today, that number has increased to 248. The firms thus far registered by the FCA include: 2020: Archax Ltd, Gemini Europe Ltd, Gemini Europe Services Ltd, Ziglu Limited, Digivault Limited, 2021: Fibermode Limited, Zodia Custody Limited, Ramp Swaps Limited, Solidi Ltd, Coinpass Limited, CoinJar UK Limited, Trustology Limited, Commercial Rapid Payment Technologies Limited, Iconomi Ltd, Skrill Limited, Paysafe Financial Services Limited, Crypto Facilities Ltd, Fidelity Digital Assets LTD, Payward Limited, Galaxy Digital UK Limited, BABB Platform Ltd, BCP Technologies Limited, Zumo Financial Services Limited, Baanx.com Ltd, Bottlepay Ltd, Genesis Custody Limited, Altalix Ltd, 2022: X Capital Group Limited, Enigma Securities Ltd, Light Technology Limited, eToro (UK) Ltd, Uphold Europe Limited, Wintermute Trading LTD, Rubicon Digital UK Limited and DRW Global Markets Ltd When we released Version 1 we noted that there were 37 firms Cryptoasset firms with Temporary Registration. You will see 39 on the previous list, but two of those firms were in fact registered - thus there seemed to be a timing issue of the records at the FCA. Regardless, some of the 37 achieved FCA registration in 2022 and others have dropped of the current list. Revolut Ltd, as of today, is the only firm listed on the Temporary Registration list and it was listed on December 2021 list too. Interestingly, in addition to a cryptoasset registration, the Revolut group hasn't achieved the obtaining of its much talked about bank authorisation in the UK either. We are looking forward to seeing how many more will be registered before the end of the year. This post also appears at:
Back to Blog
Any surprises here?
In the same week that Bank of England, Deputy Governor for Financial Stability (John Cunliffe) said “Financial assets with no intrinsic value … are only worth what the next buyer will pay. They are therefore inherently volatile, very vulnerable to sentiment and prone to collapse,” we learn of yet another crypto firm filing for bankruptcy and the protection it affords.. Put another way: technology can’t remove all financial risks. Celsius Network, one of the world’s largest cryptocurrency lenders, filed for bankruptcy, following a wave of digital asset companies that have frozen assets and entered restructuring amid a sharp sell-off in cryptocurrencies thus far in 2022. Its business model was simple old-fashioned lending. Celsius took in customer deposits and lent out the funds at higher interest rates, making a profit from the difference. There is nothing innovative here, just as there is nothing innovative about Buy-Now-Pay-Later (laybuy on an app). In both cases it is simply technology putting a new spin on an old play. To lure investors, Celsius offered high-interest rates and claimed its risks were small. Yet according to a Financial Times investigation, Celsius took on increased financial risks in recent months as demand for loans from institutional investors waned. This is classic behaviour by financial firms when they finally see the writing on the wall. What do we learn from the filing?
A rather ironic outcome of the Celsius failure is that Alvarez & Marsal, a consultancy best known for unwinding failed investment bank Lehman Brothers after the 2008 financial crisis, is Celsius’s restructuring adviser. Cunliffe is also reported saying "Cryptocurrencies may not be “integrated enough” into the rest of the financial system to be an “immediate systemic risk,” but he suspects the boundaries between the crypto world and the traditional financial system will “increasingly become blurred.”. Now Celsius is not alone. We have also seen the implosion of a highly leveraged crypto hedge fund, Three Arrows Capital, which filed for bankruptcy in July 2022 too. Crypto lender Voyager Digital also filed for bankruptcy recently while other companies narrowly averted a similar fate by taking in emergency cash at fire sale prices. BlockFi agreed to a rescue deal with crypto trading exchange FTX on July 1 that valued the lender at up to $240mn, far below an earlier valuation of $4bn. What about investors? I don't mean the customers but the backers. Celsius’s failure is poised to leave venture capital backers nursing large losses. In late 2021, it raised $750mn from WestCap and Quebec-based pension fund Caisse de dépôt et placement du Québec at a valuation of more than $3bn. Ouch - especially for current and future retirees of the pension fund. Did they sign up their money for such illiquid investments? Further Reading:
Back to Blog
“All current and potential VASP applicants should review the content of the bulletin and take actions to rectify weaknesses, as relevant. Firms undertaking VASP activities are also reminded that a failure to register may result in significant criminal and/or administrative sanctions." Central Bank of Ireland If you need assistance with your Virtual Asset Service Provider registration application, or other regulatory authorisation application such as emoney, payment services or MiFID, get in touch with Peter Oakes at CompliReg by CLICKING HERE. Read more about the Virtual Asset Service Provider registration, emoney authorisation, payment institution authorisation and MiFID authorisation CLICK HERE. Today (Monday 11 July 2022) the Central Bank of Ireland issued a press release highlighting weaknesses in Virtual Asset Service Providers’ (VASP) AML/CFT Frameworks. As of today, according to the Central Bank's website, the total number of VASPs registered in Ireland is ZERO. See image below. Question: If there are no firms appearing on the register, does that mean that there are no VASPs operating lawfully in Ireland? Answer: No. VASPs established in Ireland and carrying on business as a VASP immediately prior to the Criminal Justice (Money Laundering and Terrorist Financing) (Amendment) Act 2021 coming into force, who applied to the Central Bank for registration before 23 July 2021 are permitted to continue to offer VASP services pending the outcome of their application ('transitional period'). While we have heard stories of firms operating as VASPs in Ireland in circumstances where they do not fall under the transitional period, such firms should be subject - if they came to the attention of the Central Bank - to criminal and/or regulatory investigation. Accompanying today's press release is a bulletin in relation to Virtual Asset Service Providers (VASPs), seeking to assist applicant firms to strengthen both their applications for registration and their Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) Frameworks. The Central Bank says while it seeks to anticipate and support innovation in the financial services industry, firms operating in novel areas must ensure their businesses will not be used to launder the proceeds of crime or to finance terrorism. The Central Bank issued the bulletin to VASPs to assist them in strengthening their applications and frameworks. Background: Since 23 April 2021, VASPs are required to comply with the relevant AML/CFT obligations under the Criminal Justice Act 2010 to 2021. Any firm wishing to conduct business as a VASP must apply to the Central Bank for registration. The Central Bank says it is currently progressing the assessment of registration applications, and has provided feedback to 90% of applicants on their proposed AML/CFT frameworks. Findings: The Central Bank identified, in the vast majority of applications:
See below for further details on the Central Bank's 'findings' observations. The Central Bank reported that the lack of compliance, coupled with control weaknesses, resulted in a significant number of the applicant firms not being able to demonstrate that they could meet their AML/CFT obligations. Actions: The Central Bank has reconfirmed that it will only register a firm when it is satisfied that the firm can meet its AML/CFT obligations on an ongoing basis. It has said that all current and potential VASP applicants should:
The Central Bank also too the opportunity to remind that:
Key Central Bank observations on registrations received and assessed to dateIncomplete Applications: A number of registration applications did not contain the required information and documentation and consequently such applications did not progress to the assessment phase.
Assessment Phase: In undertaking its assessment of registration applications, the Central Bank noted recurring fundamental issues preventing approving of registration applications as the applicants could not meet their AML/CFT legislative obligations or the Central Bank’s expectations. The Central Bank communicated its concerns and expectations to the applicants for further consideration. The Central Bank helpfully provided a couple of pages in its bulletin (pages 4 - 6) giving an overview of recurring issues identified during the assessment of VASP registration applications. These are repeated below. Money Laundering and Terrorist Financing (ML/TF) Risk Assessment: An effective AML/CFT control framework is built on an appropriate ML/TF risk assessment that focuses on the specific ML/TF risks arising from the firm’s business model. This risk assessment should drive the firm’s AML/CFT control framework such that it ensures there are robust controls in place to mitigate and manage the specific risks identified through the risk assessment. The Central Bank identified a significant number of issues with the ML/TF risk assessments conducted by VASP applicant firms, including:
Policies and Procedures: When developing AML/CFT policies, controls and procedures (“AML/CFT P&Ps”), firms should maintain a detailed documented suite of AML/CFT P&Ps, which are:
The Central Bank identified a number of recurring issues with the AML/CFT P&Ps submitted by applicant firms including;
Customer Due Diligence (“CDD”): CDD involves more than just verifying the identity of a customer. Firms should collect and assess all relevant information in order to ensure that the firm:
The Central Bank identified a number of recurring issues with the CDD AML/CFT P&Ps submitted by applicant firms including;
Financial Sanctions Screening: The Central Bank’s expectation is that firms have an effective screening system in place, appropriate to the nature, size and risk of their business. In addition to this, firms should have clear escalation procedures in place to be followed in the event of a positive match.
Outsourcing: A firm can outsource certain AML/CFT Functions, but are reminded that the firm remains ultimately responsible for compliance with its obligations under CJA 2010 to 2021. It is expected that, where firms outsource AML/CFT functions, a documented agreement is in place that clearly defines the obligations of the outsource service provider. Firms should also evidence that sufficient oversight is conducted on the outsourced activity. A number of VASP applicant firms outsource certain AML/CFT functions to group-related parties and/or non-group related parties.
Individual Questionnaires for proposed Pre-Approval Controlled Function role holders: A number of firms have failed to or delayed in submitting Individual Questionnaires (IQs) for each of their proposed Pre-Approval Controlled Function (PCF) role holders. IQs should be submitted for each individual proposed to hold a PCF role as soon as practical. The Central Bank’s expectation on a firm’s presence in Ireland. In line with the principle of territoriality enshrined in the EU AML Directives and Section 25 of the CJA 2010 to 2021, the Central Bank expects a physical presence located in Ireland and for there to be at least one employee in a senior management role located physically in Ireland, to act as the contact person for engagement with the Central Bank. In addition, in accordance with Section 106 H of the CJA 2010 to 20212 , the Central Bank may refuse an application where the applicant is so structured, or the business of the applicant is so organised, that the applicant is not capable of being regulated to the satisfaction of the Central Bank. Further Reading: Press Release - Central Bank highlights weaknesses in Virtual Asset Service Providers’ AML/CFT Frameworks 11 July 2022
Back to Blog
AIB fined €83.3mn and EBS fined €13,4mnJust shy of €100mn, a total amount of fines of €96.7mn, were imposed by the Central Bank of Ireland against AIB and EBS for regulatory breaches affecting tracker mortgage customers.
In the case of:
Both fines are net of of a settlement discount procedure scheme, otherwise AIB's fine would have stood at €119,000,000 and EBS's fine at €19,143,000. The Central Bank’s Director of Enforcement and Anti-Money Laundering, Seána Cunningham said:
CBI Enforcement Publicity Statements:
Back to Blog
Not often, in fact exceptionally rare, that there is news of insider dealing cases being brought in Ireland. But that is a topic for another day.
For today (1 May 2022), a Panel of Assessors has, according to reports in both the Sunday Business Post and The Sunday Times [see links #1 & #2 below] concluded that Philip Lynch had indeed traded on insider information, but that there were mitigating factors in the case. The independent and expert panel concluded that Mr Lynch should receive a public caution, a penalty of €75,000; a disqualification for five years from being involved in any financial services provider; and that he should pay the Central Bank’s legal costs of €37,500. It is reported that Mr Lynch — who has been chief executive of two publicly listed companies in Ireland, One51 and IAWS — has accepted this outcome as punishment for contravening market abuse regulations while he was a director of C&C, which makes Bulmers cider. The case relates to a ten plus year investigation / inquiry into Mr Lynch buying 200,000 shares in C&C in 2008, when it was searching for a new chief executive. John Dunsmore, who was previously the chief executive of Scottish & Newcastle, became CEO in November 2008. The news sent shares in the company up over 26 per cent to €1.45. [see link #3 below] Last week, the Central Bank lodged High Court proceedings against the businessman as part of the enforcement process of its findings. The Central Bank issued its finding on December 22 last year and told Mr Lynch it would apply to the High Court to confirm the sanctions. The case is listed for hearing on the advance warning list under Ms Justice Mary Irvine on 23 May 2022 according to court records. Before the Panel of Assessor, the Central Bank had argued that Lynch ought to face a penalty of between €250,000 and €500,000, a public reprimand, and a period of disqualification for five years, because it argued the infringement was within the moderately serious range. The Central Bank's enforcement division argued that it was “beyond a reasonable doubt” that Mr Lynch was in possession of “inside information” when he bought shares in C&C on October 21, 2008. He was aware Dunsmore’s appointment would provide a “wow” factor in relation to the company’s share price. Lynch’s lawyers argued the sanctions were disproportionate, saying while he was aware of negotiations with Dunsmore, he was not certain of his appointment when buying the shares. His lawyers argued that there was no possibility of him making a short-term gain due to a one-year embargo on directors selling shares. Back in 2013 C&C was fined € 90,000 by the Central Bank for failing to keep up-to-date records on its “insider” list, the second time the financial regulator has taken action against a non-financial services firm. Between January 2nd, 2008 and January 29th, 2009, the Dublin- and London-listed firm was found to be in breach of the insider list requirements of the Market Abuse Directive. It failed to “regularly and promptly” update its insider list with the identity of people working for C&C who had access to inside information. It also failed to state on the list the date of each and every occasion on which it was updated. [see link #4]. If you are interested in reading about insider dealing case history in Ireland, although it is seven years old, see link #5, 'Lose lips and share flips'. Links below to source material:
|