BRIEFING NOTE ON THE BAILIWICK OF GUERNSEY S NATIONAL RISK ASSESSMENT 7 July 2016

BRIEFING NOTE ON THE BAILIWICK OF GUERNSEY S NATIONAL RISK ASSESSMENT 7 July 2016 Introduction The purpose of this briefing note is to provide financial services businesses, prescribed businesses and e-gambling and e-gaming licensees (reporting entities) with information about a forthcoming initiative concerning the assessment of the money laundering (ML) and terrorist financing (TF) risks in the Bailiwick. This initiative, which will involve input from reporting entities, comprises a key part of the measures taken by the Bailiwick to combat ML and TF and, in so doing, meet the standards of the Financial Action Task Force on ML and TF (Recommendation 1) which expect each jurisdiction to identify and assess its ML and TF risks. Internationally, these assessments are known colloquially as national risk assessments or NRAs. Methodology Jurisdictions may choose their own methodology both for undertaking a NRA and how to express their findings, provided that the methodology achieves the overarching objectives of identifying and assessing ML and TF risk and enabling such risk to be understood. Some jurisdictions have chosen to adopt their own methodology while others are using a methodology established by an international body such as the World Bank or the IMF. With the support of the AML/CFT authorities, the Policy & Resources Committee has liaised with the IMF, and the authorities will be using the IMF s methodology to guide the work on Guernsey s NRA. This methodology does not replace a jurisdiction s activities in relation to risk, rather it seeks to enhance those activities and provide a skeleton based on the FATF s expectations for jurisdictions to achieve the best NRA possible. The importance of a high quality NRA is articulated below. Risk From the FATF s perspective each of ML and TF risk is a function of three factors, namely threat, vulnerability and consequence. These factors can are characterised as follows by FATF guidance: A threat is a person or group of people, object or activity with the potential to cause harm to, for example, the state, society, the economy etc. In the ML/TF context this includes criminals, terrorist groups and their facilitators, their funds, as well as past, 1

present and future ML or TF activities. Threat typically serves as an essential starting point in developing an understanding of ML and TF risk. For this reason, having an understanding of the environment in which predicate offences are committed and proceeds of crime are generated to identify their nature (and if possible the size or volume) is important. The concept of vulnerabilities as used in risk assessment comprises those things that can be exploited by the threat or that may support or facilitate its activities. In the ML/TF risk assessment context, looking at vulnerabilities as distinct from threat means focussing on, for example, the factors that represent weaknesses in AML/CFT systems or controls or certain features of a jurisdiction. They may also include the features of a particular sector, a financial product or type of service that make them attractive for ML or TF purposes. Consequence refers to the impact or harm that ML or TF may cause and includes the effect of the underlying criminal and terrorist activity on financial systems and institutions, as well as the economy and society more generally. The consequence of ML or TF may be short or long term in nature and also relate to populations, specific communities, the business environment, or national or international interests, as well as the reputation and attractiveness of a jurisdiction s financial sector. A copy of the FATF s guidance National Money Laundering and Terrorist Financing Risk Assessment (which includes the description of risk above) is available via this link. It provides further information on the FATF s expectations for a NRA and Annex IV of the document provides a link to another document which sets out the IMF s approach to assessing ML and TF risk. How a NRA should be used The FATF sees a NRA as the fundamental driver of a jurisdiction s approach to AML/CFT. Jurisdictions should apply a risk-based approach to allocating resources and implementing measures to prevent or mitigate ML and TF based on their understanding of risk as articulated in the NRA. This means that individual authorities and the authorities of a jurisdiction acting as a whole should use the NRA to prioritise their use of resources and the activities they undertake. Where jurisdictions identify higher risks, they should ensure that their AML/CFT regime addresses such risks. For example, reporting entities should be subject to AML/CFT obligations to take enhanced measures in order to manage and mitigate the identified higher risks. Jurisdictions can allow specific areas of business or activities to be subject to simplified measures by reporting entities provided that a lower risk has been identified by the jurisdiction (most usually in the NRA), and that this is consistent with the jurisdiction s assessment of its ML/TF risks. Any exemptions need to be based on proven low risk of ML/TF, occur in strictly limited and justified circumstances and relate to a particular type of reporting entity (or exemptions 2

should comprise financial activity which is carried out on an occasional or very limited basis such that there is proven low risk of ML/TF). As can be seen from the forgoing, the assessment of risks in a NRA cascades through to reporting entities. In fact, this is a consequence of the risk based approach for jurisdictions embodied in a NRA. For example, jurisdictions may only permit reporting entities to take simplified measures to manage and mitigate risks, if lower risks have been identified, and the standards specified below are met by reporting entities. Reporting entities should be required to take appropriate steps to identify, assess, and understand their ML/TF risks (for customers, countries or geographic areas; and products, services, transactions or delivery channels). This includes being required to: (a) (b) (c) (d) document their risk assessments; consider all the relevant risk factors before determining what is the level of overall risk and the appropriate level and type of mitigation to be applied; keep these assessments up to date; and have appropriate mechanisms to provide risk assessment information to competent authorities. In addition, reporting entities should be required to: (a) (b) (c) have policies, controls and procedures, which are approved by senior management, to enable them to manage and mitigate the risks that have been identified (either by the jurisdiction or by the reporting entity); monitor the implementation of those controls and to enhance them if necessary; and take enhanced measures to manage and mitigate the risks where higher risks are identified. Clearly, therefore, a NRA will inform consideration and implementation by reporting entities of their own AML/CFT frameworks Risk and the FATF standards The identification and assessment of risks, and an understanding of the risks, is expected by FATF Recommendation 1. Other Recommendations such as Recommendation 15 (new technologies) and Recommendation 24 (transparency of legal persons) also include elements to do with identifying, assessing and understanding ML and TF risk. Moreover, the identification, assessment and understanding of ML and TF risk are the foundation for considering how effectively jurisdictions meet the FATF Recommendations. Evaluations of jurisdictions in the current round of assessments consider effectiveness to a very significant degree. Each evaluation report is divided into eleven chapters (immediate outcomes) examining how the Forty Recommendations are met in practice. One of these chapters (Immediate Outcome 1) is focussed on risk and coordination of policies to address 3

risk. However, almost all of these chapters are evaluated on the basis of whether or not authorities (and reporting entities) have identified, assessed and understood risk properly and undertaking AML/CFT measures consistent with that risk. Therefore, it is important for the NRA to be of high quality and for the both the authorities and reporting entities to use it properly. What we know now The authorities already understand quite a lot about the Bailiwick s ML and TF risk profile. Several of the authorities have received substantial information from reporting entities, charities and other non-profit organisations (NPOs), and other sources for a substantial period of time. We have prepared and retain comprehensive statistics and analysis of these statistics. For many years we have articulated views on risk based on this information. Nevertheless, this combined information, while impressive in the context of the previous FATF Recommendations which were the subject of the MoneyVal evaluation report on Guernsey published recently, needs to take account of the language of the current FATF Recommendations, methodology and guidance and recently published NRAs of other jurisdictions. Guernsey s business model of cross-border customers combined with the learning which will take place internationally in relation to NRAs over the coming years suggests that our NRA will need to be particularly rigorous both to be useful and also to meet international scrutiny satisfactorily. This work on the NRA particularly needs to be undertaken in the context of ML. It also needs to be carried out in relation to TF but our work on TF is more advanced than ML in light of surveys undertaken with reporting entities and some NPOs earlier this year. The responses to the surveys, issued by the then Policy Council and the Registrar of Guernsey and Alderney NPOs, were very helpful and enabled the authorities to further their understanding of TF risk. They also enabled information on TF risk to be provided to the MoneyVal and FATF secretariats following the circulation of a questionnaire by the FATF in order for it to form a view on to what extent jurisdictions globally are addressing TF comprehensively. The information on TF risk that was provided as part of Guernsey s response to the questionnaire is set out as an appendix to this briefing paper. Next steps The authorities, with input from the IMF, will address each of the three elements of risk (threat, vulnerability and consequence) in turn. Reporting entities possess valuable information which will be of significant benefit for the authorities in completing the NRA. The next step will therefore be to ask a selection of more than 60 reporting entities (and NPOs) to complete threat perception surveys as part of the NRA process. As indicated above, identifying, assessing and understanding the threat of each of ML and TF is a key part of identifying, assessing and understanding risk. The entities selected represent a good cross 4

section of the types of business in the Bailiwick and international NPO activity funded in the Bailiwick. The surveys are completed via an online platform used by the IMF. The surveys are completed anonymously. The completed surveys will not be seen by the authorities in the Bailiwick and the authorities will not be aware of the contents of responses made by individual entities; the individual survey responses will be seen only by the IMF but these will not identify the respondent. It is patterns of results rather than individual responses which will be particularly useful for the NRA. The survey responses will allow the IMF to provide aggregated data to the authorities. It should also be noted that the authorities themselves and chosen counterparts in other jurisdictions will also complete surveys. This information will be used to write the threat aspect of the NRA. It will be tested by the IMF at a workshop with the authorities at the end of this year. Surveys on ML and TF vulnerability will be issued to selected entities (and authorities in other jurisdictions) later in the year prior to the workshop. The responses to these will enable the authorities to obtain most value from the workshop. In the months following the workshop the work on the threat and vulnerability elements of the NRA will be refined, allowing a second workshop with the IMF to be held in the Spring of next year. This workshop will include some representatives of reporting entities and NPOs as well as the authorities and enable the components of risk (threat, vulnerability and consequence) to be tied together. It is envisaged that separate NRA reports for each of ML and TF will be completed in the autumn of next year. Circulation of results In addition to ML and TF reports, other work routinely carried out by the authorities such as the preparation of an annual statistical digest will form part of the NRA. More generally, quite a lot of activity by the authorities is relevant to identifying risk, assessing risk or understanding risk and will be considered as part of the NRA. It is not the intention to publish all of this but the main results of the NRA will be circulated to all reporting entities (and registered charities and other NPOs) and published more widely (for example, the States of Guernsey website). The future Jurisdictions need to keep their assessments up to date. As stated above, ongoing work carried out after the NRA is completed will be to do with risk and, therefore, the NRA will in practice be updated by this process. In addition, it will be necessary to revisit the NRA process itself, or elements of the process, every few years and when there are trigger events. 5

APPENDIX: EXTRACT FROM THE BAILIWICK OF GUERNSEY S RESPONSE TO A 2016 FATF QUESTIONNAIRE ON TERRORIST FINANCING Response by Guernsey Please note that references to Guernsey should be read as the Bailiwick of Guernsey 1. Risk Has your country assessed your TF risks? The assessment of TF risks forms a regular part of the ongoing work of the AML/CFT authorities at a jurisdictional and sector wide level. Assessments of TF risks are also made at an entity or transaction level, for example, by the supervisory authorities during onsite inspections of individual businesses or by law enforcement in response to specific intelligence information. In addition, in response to international developments such as the rise of ISIL and the terrorist attacks in Paris, the government (the Policy Council of the States of Guernsey) has recently coordinated a jurisdictional assessment of TF risks. It follows previous jurisdictional risk assessments and forms part of Guernsey s national risk assessment to comply with Recommendation 1. The assessment was primarily based on input from the different AML/CFT authorities. These authorities are: The Policy Council (a government department that is the competent authority for the implementation of sanctions including UNSCRs 1267 and 1373) Law enforcement (the Guernsey Border Agency and the Guernsey Police); the FIU is embedded within law enforcement The Attorney General (the prosecuting authority and central authority for MLA requests) The Guernsey Financial Services Commission (the supervisory authority for financial services businesses and lawyers, accountants and estate agents) The Alderney Gambling Control Commission (the supervisory authority for online gambling) The Registrar of NPOs. Input was also obtained from the private sector (reporting entities and NPOs). The assessment draws on both quantitative and qualitative information. The quantitative information includes statistics and related analysis on: Investigations and prosecutions STRs International assistance requests Assets frozen under UNSCRs 1267 and 1373 Transfers of funds and cash withdrawals involving jurisdictions perceived as end use or transit countries for TF. 6

The qualitative information includes: Contextual information about Guernsey Intelligence briefings and alerts from the UK Findings of the supervisory authorities from onsite inspections and other supervisory engagements Aggregated information from routine engagements with and findings from industry about the proportion of business with high risk jurisdictions Information from NPOs about activities overseas. In addition, the authorities have looked at the possible TF risks arising from jurisdictions with close business or geographical links to Guernsey, together with the latest TF typologies produced by international bodies such as the FATF, Egmont and the OECD. What are the main terrorist financing risks faced by your country? Guernsey is a significant international finance centre providing wealth management services to an international client base. There is a small domestic market for retail financial services for the jurisdiction s residents. The authorities have therefore considered TF from both a domestic perspective (i.e. the possible presence in the jurisdiction of persons with links to terrorism or the likelihood of terrorism-related activity taking place within its borders) and from an international perspective (i.e. the possibility of TF or terrorist related activity taking place elsewhere that has a link to the jurisdiction). Domestic risk The widely recognized TF risk factors arising from activity within a jurisdiction (i.e. terrorist cells or organizations operating within its borders, radicalization and recruitment of its citizens and the incidence of persons departing from or travelling through it in order to act as cash couriers or terrorist fighters) are not considered to be significant risk factors for Guernsey. The following contextual factors are relevant: The jurisdiction comprises a number of politically stable small island communities with very low domestic crime rates and ethnically homogenous populations It has no historical, geographical or ethnic links to the Middle East or other parts of the world that are currently considered to present a high risk of terrorist activity It does not operate an independent foreign policy or have any military installations so is unlikely to attract the attention of terrorists International transport links to and from Guernsey are confined to the UK and France so it is unlikely to be attractive as a transit jurisdiction. On that basis the domestic risk has been assessed as very low. International risk This is considered to be the main TF risk faced by Guernsey. It arises in two ways. The first is in relation to the cross-border business carried out by the financial services sector (i.e. banking, insurance, investment, fiduciary and money services businesses) and the online gambling sector. The second is in relation to the possible misappropriation or diversion of funds distributed internationally by Guernsey NPOs. 7

There are no indicators from the information available within the jurisdiction of any TF-related activity regarding Guernsey s cross-border business. The authorities have also looked from this perspective at information from international typologies and the risk assessments carried out by jurisdictions with close ties to Guernsey and, while they recognize that there is still an incomplete understanding internationally about the full scope of TF activity, particularly with regard to the possible use of sophisticated structures and services, such information as is currently available suggests that the only significant instances of terrorists using the type of cross-border financial service or business that might be relevant to Guernsey involve the banking and money services sectors. This is either to transfer funds to end use or transit countries or to use ATMs in those countries to withdraw cash from accounts held elsewhere, and the sums involved are often small to avoid raising suspicion. The authorities have therefore looked closely at these sectors. The findings of the financial services supervisory authority are that they have robust CFT controls. In the last 18 months onsite inspections were undertaken to the jurisdiction s two non-bank money services providers, which provide bureau de change services, money transfers services and pre-paid cards. Both entities provide services to visitors to the jurisdiction and the local population. The controls in place to mitigate the risk of TF were found to be sufficiently robust. Although average transaction sizes were very low at around 300 to 400 and 400 to 600 respectively both entities undertook due diligence on all their customers including where remittance values were very low. During the same period the financial services supervisory authority engaged with 10 of the 22 banks registered as money services providers. The majority of these banks provide money transfer services to clients of their core banking activities only and with whom they have well established relationships, and robust due diligence and monitoring controls were found to be in place. These findings have been supplemented by a survey issued by the authorities to all banks and other money service providers to obtain information targeted at the specific risks identified internationally in relation to these sectors. A targeted survey has also been issued to the NPO sector. Only a very small minority of Guernsey NPOs are active internationally. As with cross-border business, there are no indicators from the information available within the jurisdiction of any TF related activity regarding the NPO sector and no concerns about compliance with risk and governance controls. Here too the authorities looked at findings from international sources, and international concern about NPOs appears to arise primarily from the fact that it can be difficult for them to establish the end use of monies that are distributed on the ground in foreign countries. The survey issued by the authorities was therefore targeted at internationally active NPOs whose activities more obviously lend them to making cash distributions of this kind, to assess the extent to which this happens in practice. The findings from the two targeted surveys and from the other information maintained or considered by the Guernsey authorities relevant to overall TF threats is summarized as follows: An extremely low proportion of cross-border business involves jurisdictions that are high risk from a TF perspective The number of transfers of funds and cash withdrawals from Guernsey accounts involving end use and transit countries is extremely low in absolute terms, and negligible when considered as a proportion of the overall number of transfers and withdrawals from Guernsey 8

Guernsey does not provide Hawala services and there are no domestic or international indicators of terrorists using other types of structures and services which Guernsey does provide (e.g. collective investment schemes, companies, trusts or online gambling services) Internationally active NPOs typically provide practical humanitarian assistance by transporting items such as food, clothing and medical supplies abroad, rather than by making distributions by way of cash on the ground to beneficiaries or affiliated support workers and organisations The STRs from all sectors related to TF and those from or related to NPOs for other reasons (mainly tax evasion) have been analyzed. The annual figure is either nil or is so low as to be statistically insignificant and it discloses no trends: most have been disseminated to various competent authorities, including the National Terrorist Financial Investigation Unit in the UK, and this did not lead to any follow-up requests for assistance To date there has been no other information that would constitute grounds for a TF investigation or prosecution To date there have been no TF-related requests for international assistance from any country in relation to TF (apart from a single instance nearly ten years ago relating to an attempted coup in an African country) There has been no indication in any UK intelligence briefings or alerts to suggest TF activity in Guernsey No assets have been frozen either under UNSCRS 1267 and 1373 or under the criminal justice system on suspicion of being terrorist property The authorities also considered the CFT controls that Guernsey has put in place. These are considered to be strong for the following reasons: Guernsey has a comprehensive legal framework that either meets or goes beyond international TF standards The findings of the supervisory authorities are that the levels of awareness and compliance with CFT obligations (including training on TF issues) among reporting entities are high The findings of the NPO Registrar are that levels of compliance with risk and governance obligations by NPOs are high There are fortnightly briefings between the FIU and Guernsey Special Branch about on-going risks of terrorism and TF, and information is passed on to other authorities as necessary using well established multilateral information sharing mechanisms to ensure that there are no gaps in the jurisdiction s awareness of these issues. On the basis of these findings the international risk has been assessed as low. 9