Frequently asked questions: Phase 1 of Risk-Based Supervision Data collection

Frequently asked questions: Phase 1 of Risk-Based Supervision Data collection Issued: 14 March 2018 Last updated: 14 March 2018

Q1. What is the purpose of the Phase 1 Risk-Based Supervision Data collection exercise? Data collected will be used by the Jersey Financial Services Commission (JFSC) as part of its identification and assessment of money laundering (ML) and terrorist financing (TF) risks. This data collection and analysis is undertaken in accordance with the JFSC s statutory objectives and to support its risk-based approach to supervision. Data collected will assist the JFSC in forming a view of ML/TF risks within: regulated persons (see FAQ Q2.) or persons carrying on a Specified Schedule 2 Business (see FAQ Q2) collectively referred to as Reporting Entities; (ii) Industry sectors; and (iii) the Industry as a whole. Data will also be used, in aggregated form, to assess the inherent vulnerabilities of products and services in the Island s national ML and TF risk assessment (referred to as the NRA). The NRA process will in turn inform Island policy decision-making and identify any necessary remedial action such as legislative amendments or resource allocation. All of the data collected will assist the JFSC identify the potential impact should it apply the most major sanction to a Reporting Entity, e.g. registration revocation. Q2. Who is a Reporting Entity? The Supervisory Risk Data Collection is designed to collect data from: legal persons established under Jersey law; (ii) legal persons established outside Jersey who operate here through branches 1 ; and (iii) natural persons or partnerships (that are not legal persons). 1 A branch is a location from which services are provided to customers. Data should be provided by a Reporting Entity. A Reporting Entity 2 is either: a regulated person (as described below); or (ii) a person carrying on a Specified Schedule 2 Business that is registered (excluding a deemed registration) under the Proceeds of Crime (Supervisory Bodies) (Jersey) Law 2008 (Supervisory Bodies Law) (these persons have a JFSC registration number which starts SCH). For the avoidance of doubt this includes, but is not limited to: Lawyers Accountants Estate agents Casinos Lenders 2 Note: a natural person that meets the criteria of either or (ii) is a Reporting Entity and must complete the Phase 1 questionnaire. Last updated: 14 March 2018 Page 2 of 9

The following regulated persons are required to complete the questionnaire: Financial Services (Jersey) Law 1998 (Financial Services Law) A person who is registered to carry on trust company business (TCB), except a participating member of any TCB affiliation. (ii) A person who is registered to carry on TCB which is a managed entity under Class N of the Schedule to the Financial Services (Financial Service Business) (Jersey) Order 2009 (Financial Service Business Order) (a managed trust company). (iii) A person who is registered to carry on fund services business or AIF services business, except: a participating member of any TCB affiliation; and a person who is managed by a person carrying on fund services business under Class ZK of the Financial Service Business Order (FSB Managed Entity). (iv) A person who is registered to carry on investment business, except a participating member of any TCB affiliation. (v) A person who is registered to carry on money service business (MSB), except a participating member of any TCB affiliation. Banking Business (Jersey) Law 1991 (Banking Business Law) (vi) A person who is registered to carry on deposit-taking business. Collective Investment Funds (Jersey) Law 1988 (Funds Law) (vii) A person who holds a permit as a functionary to a Recognized Fund. Q3. Who is not a Reporting Entity for the purpose of Phase 1 data collection? Any person holding a registration which meets one of the criteria below is not a Reporting Entity for the purpose of Phase 1 data collection: An FSB Managed Entity (defined in FAQ Q2.). Note, it is planned to collect data similar to that requested in the Phase 1 questionnaire from FSB Managed Entities in Q3 2018. (ii) Any person who is only registered under the Financial Services Law to carry on general insurance mediation business. (iii) Any person registered to carry on TCB that is a participating member of an affiliation. See also Q13. (iv) Any person issued with a permit under the Insurance Business (Jersey) Law 1996. Data will be collected separately from these persons either through a separate questionnaire later in 2018 (footprint/organisational data) or through bilateral discussions between the JFSC and the permit holders (AML/CFT compliance related data and customer data). (v) Public funds - any scheme or arrangement defined as a collective investment fund in Article 3 of the Funds Law and unregulated funds. It is planned to collect data in respect of public funds in Q3 2018. (vi) Private funds - any scheme or arrangement falling within the definition of collective investment fund in Article 3 of the Funds Law, except that the offer of units in the scheme or arrangement is not an offer to the public within the meaning of that Article. It is planned to collect data in respect of private funds in Q3 2018. Last updated: 14 March 2018 Page 3 of 9

Persons who have notified the JFSC that they are carrying on financial services business and are relying on a registration exemption are not Reporting Entities and are not required to provide data as part of the Phase 1 Risk-Based Supervision Data collection exercise. Note: the JFSC will gather data from these persons through bilateral discussions Any person carrying on MSB with an annual turnover from their MSB business which is less than 300,000 per year. (ii) Any person carrying on TCB who is a recognized experienced personal adviser, when continuing to provide a relevant personal service that the adviser was providing immediately before the commencement of the Financial Services (Trust Company Business (Exemptions No. 2)) (Jersey) Order 2000. (iii) Any person carrying on the business of being a virtual currency exchange (VCE) with an annual turnover from their VCE business of less than 150,000 per year. Q4. What data is being collected in Phase 1? Data to be collected in Phase 1 relates to: the organisation and size of each Reporting Entity (section A) (see also Q11); (ii) elements of the Reporting Entity s AML/CFT compliance data (section B); and (iii) its application of sanctions legislation (section C). The data collected in Phase 1 should not be split by registration held. Each Reporting Entity should respond to the questionnaire just once, unless there is a need to update submitted data. The JFSC will be collecting further data in Q3 2018, which will be at a more granular level in relation to regulated activities, e.g.: deposit-taking (including lending linked to deposits); (ii) the provision of services to funds; (iii) trust company business (excluding provision of services to funds); (iv) investment business; (v) money service business; (vi) lending (outside deposit-taking); (vii) legal services; (viii) accountancy services; (ix) estate agency services; and (x) casino activities. Q5. How do I need to submit my data to the JFSC? The JFSC will be collecting data through questions presented in an Excel workbook which, once completed, will be submitted to the JFSC by uploading the Excel workbook using the JFSC portal. Q6. What should I do if I cannot provide the data in line with the guidance document? The JFSC acknowledges that this is the first time it has undertaken such a major data gathering exercise, and there are a number of different ways in which a Reporting Entity can comply with its statutory and regulatory obligations. The JFSC has identified some data items which it understands may be particularly problematic to complete in line with the guidance document. Consequently, the Excel workbook contains a sheet E- Comments which provides Reporting Entities with an opportunity to explain how they have completed the following questions: Last updated: 14 March 2018 Page 4 of 9

A9 Number of COBO Only funds that are likely to terminate by 31 December 2020 A21 A22 A23(a) A23(b) Number of PPFs that are likely to terminate by 31 December 2020 Number of VPFs that are likely to terminate by 31 December 2020 Total number of customers as at the reporting date or during the year ended on the reporting date Total number of unique beneficial owners and controllers of customers Number of unique PEPs by country, who are customers or beneficial owners and controllers of customers, where property of the PEP is handled in the business relationship or one-off transaction Number of unique PEPs by country, who are customers or beneficial owners and controllers of customers, where no property of the PEP is handled in the business relationship or one-off transaction Should a Reporting Entity identify difficulty in providing a data item in line with the guidance which is not covered in above, please contact your Supervision Manager or respective sector Supervision Team by email as soon as possible, providing an explanation of why the data cannot be submitted in line with the guidance document provided. To be clear, failure to respond to an applicable question will not be acceptable, and, instead the JFSC will accept responses derived by extrapolating data or estimates supported by specific criteria. Dependent on the reasons provided, the JFSC may contact you to discuss your response further. In certain cases, the JFSC may take the view that the inability to supply a specific data item in line with the guidance document, taking into account any reasons provided, may amount to a regulatory breach. In this situation, the issue will be taken up as part of our ongoing supervision activities. Q7. What should I do if I will not be able to meet the deadline for Phase 1 data submission? For Phase 1 the data collection period ends on 25 April 2018. Should you have any concerns in meeting this date, please contact your Supervision Manager or Supervision Team by email as soon as possible, providing an explanation of why your submission cannot be made by 25 April 2018. Q8. I have a problem using myjfsc; who do I contact for assistance? Please email myjfsc@jerseyfsc.org for any issues relating to the use of myjfsc, including: I have not used myjfsc before so how do I register for access? (ii) I have registered for access but am having difficulty logging in (iii) How do I get my password reset? (iv) The person who has access has left my organisation, how do I register a new person with the JFSC? Last updated: 14 March 2018 Page 5 of 9

Q9. Where can I get assistance with completing the Phase 1 Supervisory Risk Data questions? All queries regarding completion of the Phase 1 Risk-Based Supervision Data questions that cannot be answered by reading the guidance document (click here to access) or these FAQs should be emailed to your Supervision Manager or respective sector Supervision Team. Q10. I am in the process of ceasing to carry on a regulated activity, do I still need to complete the Phase 1 Risk-Based Supervision Data collection exercise? A Reporting Entity that is in the process of surrendering its registration (however described) must complete the Phase 1 questionnaire if it will still be registered with the JFSC at the end of the data collection period (distinct from data reporting period). For Phase 1 the data collection period ends on 25 April 2018. Q11. What is footprint data? Section A collects data about the Reporting Entity as a whole, including: its regulated activities; (ii) the extent to which it carries on its business, and is supervised from, outside the Island; (iii) the number of employees; (iv) its total income; (v) total number of customers, beneficial owners and controllers; and (vi) PEPs. All of the above data will assist the JFSC identify the potential impact should it apply the most major sanction to a Reporting Entity, e.g. registration revocation. For this reason when aggregated data is provided care should be taken to avoid duplication of data. For example in a case where the same customer is served: directly by a Reporting Entity that carries on fund services business or trust company business; and (ii) by an entity that is managed by the Reporting Entity (e.g. FSB Managed Entity), that customer (and data in respect of that customer) should be reported once only. Q12. How do I treat outsourced activities? Consistent with the JFSC s policy on outsourcing, when any aspect of a service provided by a Reporting Entity is outsourced to a third party, data must be provided in response to the Phase 1 Risk-Based Supervision Data questions about that outsourced activity. Last updated: 14 March 2018 Page 6 of 9

Q13. I am an Affiliation Leader; do I have to report information for my participating members? Yes, where a TCB is an affiliation leader 3, responses to the Phase 1 questions should cover all members of that affiliation (participating members) including any that may be separately registered by the JFSC, e.g. to carry on fund services business. The effect of this is to require a TCB that is an affiliation leader to present data requested for itself and every participating member as if it is a single Reporting Entity (except where indicated otherwise). The concept of an affiliation responds to the need for a licensing process that captures the activities of a business principal trading entity (affiliation leader) along with those of its creature companies (affiliates), e.g. those acting as corporate directors, nominee companies, corporate secretary etc. There is no similar concept for other regulated persons. Care should be taken to avoid duplication of data reported for affiliations. For example, in a case where the same customer is served by the affiliation leader and participating member, that customer (and data in respect of that customer) should be reported once only. 3 An affiliation is a group of persons carrying on trust company business, the members of which (participating members) have agreed that one member will be the affiliation leader. Q14. Why does the JFSC want to know the average number of working days it takes the MLRO to process an internal suspicious activity report (SAR)? As a result of the AML/CFT Handbooks published by the JFSC for example, section 10.4.4 of the AML/CFT Handbook for Regulated Business (AML/CFT Regulated Businesses Handbook), the majority of Reporting Entities must keep registers of internal and external SARs. The registers must be maintained in line with procedures required under sections 8.3.1 and 8.3.2 of the AML/CFT Regulated Businesses Handbook. These registers must contain specific data including the date an internal SAR is made, the decision of the MLRO (or deputy MLRO) to make or not to make an external SAR, and if an external SAR is made the date of that external SAR. The length of time it takes to process an internal SAR can be influenced by a number of factors including the: complexity of the Reporting Entity s business model; (ii) quality of the internal reports received; and (iii) complexity of the information or matter giving rise to knowledge, suspicion or reasonable grounds which has resulted in the internal SAR. Additionally, by collecting the average number of working days it takes an MLRO to process an internal SAR the JFSC will be able to consider risks associated with the timeliness of reporting, and may help to highlight a complex operating model, insufficient resourcing or competency issues. It is important to note that there is no right number of average days. Last updated: 14 March 2018 Page 7 of 9

Q15. Why does the JFSC want to know about systems used for screening customers? The JFSC is seeking to better understand the use of automated versus manual systems for screening. Data collected will allow the JFSC to consider whether there is a correlation between the system used and the regulated activities of the Reporting Entity. For example, it may be difficult for a Reporting Entity to demonstrate that it effectively manages its ML/TF risk if it uses a manual system to screen a large number of transactions with higher risk customers. Q16. Why is the financial sanctions data restricted? Section C is only designed to capture data in respect of financial sanctions. It is not seeking to collect sanctions data about customers that have a connection to a country where the sanction, is in respect of: prohibition on technical assistance, training and other assistance relating to military activities; (ii) trade embargos; (iii) import and export bans or restrictions; (iv) a ban on the provision of services; (v) a ban on certain investments; and (vi) restrictions on establishing branches and subsidiaries. Despite data on other sanctions not being collected, a Reporting Entity may consider customers with such connections to present a higher risk. Q17. Why do I have to provide an estimate of income from regulated/specified Schedule 2 business activity? Some businesses carry on other activity as well as a regulated/specified Schedule 2 Business activity, e.g. provision of mortgage advice. Question A17(a) collects information in respect of the Reporting Entity s total income from all activities, this will provide the JFSC with an indication of the total income generated by the Reporting Entity but not necessarily the value of its regulated /Specified Schedule 2 Business activity. Providing details of a Reporting Entity s income that arises solely from its regulated/specified Schedule 2 Business activity will allow the JFSC to understand the extent to which a Reporting Entity carries on activities that are not subject to regulation and supervision for AML/CFT purposes. Last updated: 14 March 2018 Page 8 of 9

Q18. The guidance to question A19 refers to second line of defence, what does this mean? The Three Lines of Defence model 4 distinguishes among three groups (or lines) involved in effective risk management: Functions that own and manage risks (ii) Functions that oversee risks (iii) Functions that provide independent assurance. The second line of defence should be understood to refer to individuals with functions that oversee, or who specialise in, compliance or the management of risk, including a Reporting Entity s money laundering reporting officer (MLRO). This second line of defence: provides the policies, frameworks, tools, techniques and support to enable risk and compliance to be managed in the first line (functions that own and manage risk); (ii) conducts monitoring to judge how effectively they are doing it; and (iii) helps ensure consistency of definitions and measurement of risk. 4 See: https://na.theiia.org/standardsguidance/public%20documents/pp%20the%20three%20lines%20of%20defense%20in%20effective %20Risk%20Management%20and%20Control.pdf Q19. Why do I need to submit an estimate of the number of legacy Private Funds that are likely to terminate by 31 December 2020? This will help to identify the number of legacy funds that may present a ML/TF risk in the short to medium term and assist in determining the extent to which it is necessary to collect data on such funds in a subsequent questionnaire. Q20. Why do you want to know about the business of my parent organisations? This data is requested in order to consider what the ML/TF risk appetite of the shareholder may be. For example, the risk appetite of a parent that is large bank may be different to that of a parent entity that is a private equity fund. Q21. Why do I have to report my employee number split in a number of ways? Questions A18 and A19 collect data on employees of the Reporting Entity split by those who spend: half or more of their average working week in Jersey; and (ii) less than half in Jersey. This split will allow the JFSC to understand the extent to which a Reporting Entity is dependent upon human resources that are outside Jersey. Last updated: 14 March 2018 Page 9 of 9