Financial Crime Guide:A firm’s guide tocountering financial
crime risks (FCG)

FCG Contents

Financial Crime Guide: A firm’s guide to countering
financial crime risks (FCG)

FCG 1
1.1
1.2
1.3
1.4

FCG 2
2.1
2.2
2.3

FCG 3
3.1
3.2
3.3
3.4

FCG 4
4.1
4.2
4.3
4.4

FCG 5
5.1
5.2
5.3
5.4

FCG 6
6.1
6.2
6.3
FCG–i

Introduction
What is the FCG?
How to use the FCG
Format of the FCG
Further ﬁnancial crime information

Financial crime systems and controls
Introduction
ThemesFurther guidance

Money laundering and terrorist ﬁnancing
Introduction
ThemesFurther guidanceSources of further information

Fraud
Introduction
ThemesFurther guidanceSources of further information

Data security
Introduction
ThemesFurther guidanceSources of further information

Bribery and corruption
Introduction
ThemesFurther guidance
www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG Contents

6.4

Sources of further information

FCG 7

Sanctions and asset freezes

7.1
7.2
7.3
7.4

Introduction
ThemesFurther guidanceSources of further information

FCG 8

Insider dealing and market manipulation

8.1
8.2

Introduction
ThemesFCG Annex
1■ Release 39

Common terms
Common terms● Aug 2024

www.handbook.fca.org.uk

FCG–iiFCG Contents

FCG–iii

www.handbook.fca.org.uk■ Release 39● Aug 2024

Financial Crime Guide: A firm’s guide to countering financial crime risks (FCG)

Chapter 1
Introduction■ Release 39● Aug 2024

www.handbook.fca.org.uk

FCG 1/1

FCG 1 : Introduction

Section 1.1 : What is the FCG?

1
1.1

What is the FCG?

1.1.1

G

FCG provides practical assistance and information for firms of all sizes andacross all FCA-supervised sectors on actions they can take to counter the riskthat they might be used to further financial crime. Its contents are drawn
primarily from FCA and FSA thematic reviews, with some additional material
included to reflect other aspects of our financial crime remit.

1.1.2

G

Effective systems and controls can help firms to detect, prevent and deter
financial crime.FCG provides guidance on financial crime systems andcontrols, both generally and in relation to specific risks such as money
laundering, bribery and corruption and fraud. Annexed to FCG is a list ofcommon and useful terms. ■ FCG Annex 1 is provided for reference purposes
only and is not a list of ‘defined terms’. Where a word or phrase is in italics,
its definition will be the one used for that word or phrase in the Glossary to
the FCA Handbook.

1.1.3

G

FCTR provides summaries of, and links to, FSA (now the FCA) thematic
reviews of various financial crime risks and sets out the full examples of goodand poor practice that were included with the reviews’ findings.

1.1.4

G

We will keep FCG under review and will continue to update it to reflect thefindings of future thematic reviews, enforcement actions and other FCA
publications and to cover emerging risks and concerns.

1.1.5

G

The material in FCG does not form part of the Handbook, but it does containguidance on Handbook rules and principles, particularly:•■ SYSC 3.2.6R and ■ SYSC 6.1.1R, which require firms to establish andmaintain effective systems and controls to counter the risk that theymight be used to further financial crime;•Principles 1 (integrity), 2 (skill, care and diligence), 3 (management
and control) and 11 (relations with regulators) of our Principles for
Businesses, which are set out in ■ PRIN 2.1.1R;•the Statements of Principle for Approved Persons set out in■ APER 2.1A.3R and the conduct rules set out in ■ COCON 2.1 and ■ 2.2;
and•in relation to guidance on money laundering, the rules in■ SYSC 3.2.6 to ■ SYSC 3.2.6 IR and ■ SYSC 6.3 (Financial crime).

FCG 1/2

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 1 : Introduction

Section 1.1 : What is the FCG?

Where FCG refers to guidance in relation to SYSC requirements, this may also
be relevant to compliance with the corresponding Principle in our Principles
for Businesses and corresponding requirements in the Payment Services
Regulations and the Electronic Money Regulations.

1.1.6

G

Direct references in FCG to requirements set out in our rules or other legal
provisions include a cross reference to the relevant provision.

1.1.7

G

FCG contains ‘general guidance’ as defined in section 139B of the Financial
Services and Markets Act 2000 (FSMA). The guidance is not binding and wewill not presume that a firm’s departure from our guidance indicates that it
has breached our rules.

1.1.8

G

Our focus, when supervising firms, is on whether they are complying with
our rules and their other legal obligations. Firms can comply with theirfinancial crime obligations in ways other than following the good practice
set out in FCG. But we expect firms to be aware of what we say where it
applies to them and to consider applicable guidance when establishing,implementing and maintaining their anti-financial crime systems andcontrols. More information about FCA guidance and its status can be foundin our Reader’s Guide: an introduction to the Handbook; ■ DEPP 6.2.1G(4) and■ EG 2.9.1G – ■ 2.9.6G.

1.1.9

G

FCG also contains guidance on how firms can meet the requirements of the
Money Laundering Regulations and the EU Funds Transfer Regulation. While
the relevant parts of the guide that refer to the Money Laundering
Regulations may be ‘relevant guidance’ under these regulations, it is not
approved by HM Treasury.

1.1.10GThe Joint Money Laundering Steering Group’s (JMLSG) guidance for the UK
financial sector on the prevention of money laundering and combating
terrorist financing is ‘relevant guidance’ and is approved by HM Treasury
under the Money Laundering Regulations. As confirmed in ■ DEPP 6.2.3G,■ EG 12.1.2G and ■ EG 19.15.5G, the FCA will continue to have regard towhether firms have followed the relevant provisions of JMLSG’s guidance
when deciding whether conduct amounts to a breach of relevant
requirements.

1.1.11G

FCG is not a standalone document; it does not attempt to set out all
applicable requirements and should be read in conjunction with existinglaws, rules and guidance on financial crime. If there is a discrepancy between
FCG and any applicable legal requirements, the provisions of the relevant
requirement prevail. If firms have any doubt about a legal or other provisionor their responsibilities under FSMA or other relevant legislation or
requirements, they should seek appropriate professional advice.

■ Release 39● Aug 2024

www.handbook.fca.org.uk

1

FCG 1/3

FCG 1 : Introduction

Section 1.2 : How to use the FCG

1
1.2

How to use the FCG

1.2.1.

G

Who should read this chapter? This paragraph indicates the types of firm towhich the material applies. A reference to ‘all firms’ in the body of thechapter means all firms to which the chapter is applied at the start of thechapter.

1.2.2

GEach section discusses how firms tackle a different type of financial crime.
Sections open with a short passage giving context to what follows. In FCG
we use:•‘must’ where provisions are mandatory because they are required bylegislation or our rules•‘should’ to describe how we would normally expect a firm to meetits financial crime obligations while acknowledging that firms may beable to meet their obligations in other ways, and•‘may’ to describe examples of good practice that go beyond basic
compliance.

1.2.3

G

Firms should apply the guidance in a risk-based, proportionate way taking
into account such factors as the nature, size and complexity of the firm. For
example:•We say in ■ FCG 2.2.1G (Governance) that senior management should
actively engage in a firm’s approach to addressing financial crimerisk. The level of seniority and degree of engagement that is
appropriate will differ based on a variety of factors, including themanagement structure of the firm and the seriousness of the risk.
•We ask in ■ FCG 3.2.5G (Ongoing monitoring) how a firm monitorstransactions to spot potential money laundering. While we expectthat a global retail bank that carries out a large number of customertransactions would need to include automated systems in its
processes if it is to monitor effectively, a small firm with lowtransaction volumes could do so manually.
•We say in ■ FCG 4.2.1G (General – preventing losses from fraud) that
it is good practice for firms to engage with relevant cross-industry
efforts to combat fraud. A national retail bank is likely to have agreater exposure to fraud, and therefore to have more information
to contribute to such efforts, than a small local building society, andwe would expect this to be reflected in their levels of engagement.

FCG 1/4

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 1 : Introduction

Section 1.3 : Format of the FCG

1
1.3

Format of the FCG

Financialcrime: a guide for firms.....................................................................................................
1.3.1

G

FCG looks at key aspects of firms’ efforts to counter different types of crime.
It is aimed at firms big and small; material will not necessarily apply to all
situations. If guidance is specific to certain types of firm, this is indicated byitalics.
Self-assessment questions:•These questions will help you to consider whether your firm’s
approach is appropriate. (Text in brackets expands on this.)•The FCA may follow similar lines of inquiry when discussing
financial crime issues with firms.
•The questions draw attention to some of the key points firms
should consider when deciding how to address a financial crime issue
or comply with a financial crime requirement.
Examples of good practice

Examples of poor practice•This list provides illustrative
examples of good practices.

•

This list provides illustrative
examples of poor practices.

•

Good practice examples are
drawn from conduct seen infirms during thematic work in
relation to financial crime.

•

Poor practice examples arealso drawn from conduct seen
during thematic work.

•

We would draw comfort fromseeing evidence that thesepractices take place.

•Some show a lack of commitment, others fall short of our
expectations; some, as indicated in the text, may breachregulatory requirements or be
criminal offences.

•

Note that if these practices•
are lacking it may not be a
problem. The FCA would consider whether a firm hastaken other measures to meetits obligations.

These do not identify all cases
where conduct may give rise
to regulatory breaches or criminal offences.

Case
studies and other information.....................................................................................................
1.3.2

G

■ Release 39

Most sections contain case studies outlining occasions when a person’s
conduct fell short of the regulatory expectations, and enforcement action
followed; or information on topics relevant to the section.

● Aug 2024

www.handbook.fca.org.uk

FCG 1/5

FCG 1 : Introduction

Section 1.4 : Further financial crime
information

1
1.4

1.4.1

G

Further financial crime information

Where to find out more:•Most sections close with some sources of further information..
•This includes cross-references to relevant guidance in FCTR.
•It also includes links to external websites and materials. Although
the external links are included to assist readers of FCG, we are notresponsible for the content of these, as we neither produce nor
maintain them

FCG 1/6

www.handbook.fca.org.uk■ Release 39● Aug 2024

Financial crime systems and controls

Chapter 2
Financial crime systems andcontrols■ Release 39● Aug 2024

www.handbook.fca.org.uk

FCG 2/1

FCG 2 : Financial crime systems
and controls

2.1

Section 2.1 : Introduction

Introduction

2

FCG 2/2

2.1.1

G

Who should read this chapter? This chapter applies to all firms subject to thefinancial crime rules in ■ SYSC 3.2.6R or ■ SYSC 6.1.1R. It also applies to emoney institutions and payment institutions within our supervisory scope.

2.1.2

G

The Annex I financial institutions which we supervise for compliance with
their obligations under the Money Laundering Regulations are not subject tothe financial crime rules in SYSC. But the guidance in this chapter applies tothem as it can assist them to comply with their obligations under the
Regulations.

2.1.3

G

All firms must take steps to defend themselves against financial crime, but avariety of approaches is possible. This chapter provides guidance on themesthat should form the basis of managing financial crime risk. The general
topics outlined here are also relevant in the context of the specific financial
crime risks detailed in subsequent chapters. See ■ SYSC 6.1.1R and■ SYSC 3.2.6R.

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 2 : Financial crime systems
and controls

2.2

Section 2.2 : Themes

Themes2

Governance.....................................................................................................
2.2.1

G

We expect senior management to take clear responsibility for managing
financial crime risks, which should be treated in the same manner as otherrisks faced by the business. There should be evidence that senior
management are actively engaged in the firm’s approach to addressing therisks. In considering senior management arrangements in the Guide, firms
should consider their arrangements to comply with the Senior Managers andCertification Regime (SM&CR).
[Editor’s note: see https://www.fca.org.uk/firms/senior-managers-certificationregime]
Self-assessment questions:•When did senior management, including the board or appropriate
sub-committees, last consider financial crime issues? What action
followed discussions?
•How are senior management kept up to date on financial crimeissues? (This may include receiving reports on the firm’s performancein this area as well as ad hoc briefings on individual cases or
emerging threats.)•Is there evidence that issues have been escalated where warranted?

■ Release 39

Examples of good practice

Examples of poor practice•Senior management set theright tone and demonstrateleadership on financial crimeissues.

•There is little evidence ofsenior staff involvement andchallenge in practice.

•

A firm takes active steps toprevent criminals taking advantage of its services.

•A firm concentrates on narrow compliance with minimum regulatory standards
and has little engagementwith the issues.

•

We would draw comfort fromseeing evidence that thesepractices take place.

•

Financial crime issues aredealt with on a purely reactive basis.

•

A firm has a strategy for selfimprovement on financial
crime.

•

There is no meaningful recordor evidence of senior management considering financial
crime risks.

•

There are clear criteria for escalating financial crime issues.

● Aug 2024

www.handbook.fca.org.uk

FCG 2/3

FCG 2 : Financial crime systems
and controls

Section 2.2 : Themes

Management
information (MI).....................................................................................................
2.2.2

G

2

MI should provide senior management with sufficient information tounderstand the financial crime risks to which their firm is exposed. This will
help senior management effectively manage those risks and adhere to thefirm’s own risk appetite. MI should be provided regularly and ad hoc, as risk
dictates.
Examples of financial crime MI include:•an overview of the financial crime risks to which the firm is
exposed, including information about emerging risks and anychanges to the firm’s risk assessment•legal and regulatory developments and the impact these have on
the firm’s approach•an overview of the effectiveness of the firm’s financial crime systems
and controls•an overview of staff expenses, gifts and hospitality and charitable
donations, including claims that were rejected, and•relevant information about individual business relationships, forexample:the number and nature of new business relationships, inparticular those that are high risk
the number and nature of business relationships that were
terminated due to financial crime concerns
the number of transaction monitoring alerts
details of any true sanction hits, andinformation about suspicious activity reports considered or
submitted, where this is relevant.
MI may come from more than one source, for example the compliancedepartment, internal audit, the MLRO or the nominated officer.

Structure.....................................................................................................
2.2.3

G

Firms’ organisational structures to combat financial crime may differ. Somelarge firms will have a single unit that coordinates efforts and which mayreport to the head of risk, the head of compliance or directly to the CEO.
Other firms may spread responsibilities more widely. There is no one ‘rightanswer’ but the firm’s structure should promote coordination andinformation sharing across the business.
Self-assessment questions:•Who has ultimate responsibility for financial crime matters,
particularly: a) anti-money laundering; b) fraud prevention; c) data
security; d) countering terrorist financing; e) anti-bribery andcorruption and f) financial sanctions?
•Do staff have appropriate seniority and experience, along with clear
reporting lines?

FCG 2/4

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 2 : Financial crime systems
and controls

Section 2.2 : Themes•Does the structure promote a coordinated approach andaccountability?
•Are the firm’s financial crime teams adequately resourced to carryout their functions effectively? What are the annual budgets for
dealing with financial crime, and are they proportionate to the risks?

2•In smaller firms: do those with financial crime responsibilities haveother roles? (It is reasonable for staff to have more than one role,
but consider whether they are spread too thinly and whether thismay give rise to conflicts of interest.)
Examples of good practice

Examples of poor practice•Financial crime risks are ad•dressed in a coordinated manner across the business and information is shared readily.

The firm makes no effort tounderstand or address gaps inits financial crime defences.

•

Management responsible for•financial crime are sufficiently
senior as well as being credible, independent, and experienced.

Financial crime officers are
relatively junior and lack access to senior management.
They are often overruled without documented justification.

•

A firm has considered how•
counter-fraud and anti-money
laundering efforts cancomplement each other.

Financial crime departments
are under-resourced andsenior management are reluctant to address this.

•A firm has a strategy for selfimprovement on financial
crime.

•

The firm bolsters insufficient
in-house knowledge or resource with external expertise, for example in relation toassessing financial crime risk
or monitoring compliancewith standards.

Risk
assessment.....................................................................................................
2.2.4

G

A thorough understanding of its financial crime risks is key if a firm is to
apply proportionate and effective systems and controls.
A firm should identify and assess the financial crime risks to which it is
exposed as a result of, for example, the products and services it offers, thejurisdictions it operates in, the types of customer it attracts, the complexityand volume of transactions, and the distribution channels it uses to service its
customers. Firms can then target their financial crime resources on the areasof greatest risk.
A business-wide risk assessment – or risk assessments – should:•be comprehensive and consider a wide range of factors – it is notnormally enough to consider just one factor•draw on a wide range of relevant information – it is not normallyenough to consider just one source, and■ Release 39● Aug 2024

www.handbook.fca.org.uk

FCG 2/5

FCG 2 : Financial crime systems
and controls

Section 2.2 : Themes•be proportionate to the nature, scale and complexity of the firm’s
activities.
Firms should build on their business-wide risk assessment or risk assessments
to determine the level of risk associated with individual relationships. Thisshould:2•enable the firm to take a holistic view of the risk associated withthe relationship, considering all relevant risk factors, and•enable the firm to apply the appropriate level of due diligence tomanage the risks identified.
The assessment of risk associated with individual relationships can inform,
but is not a substitute for, business-wide risk assessments.
Firms should regularly review both their business-wide and individual risk
assessments to ensure they remain current.
Self-assessment questions:•What are the main financial crime risks to the business?
•How does your firm seek to understand the financial crime risks it
faces?
•When did the firm last update its risk assessment?
•How do you identify new or emerging financial crime risks?
•Is there evidence that risk is considered and recorded systematically,assessments are updated and sign-off is appropriate?
•Who challenges risk assessments and how? Is this process sufficiently
rigorous and well-documented?
•How do procedures on the ground adapt to emerging risks? (Forexample, how quickly are policy manuals updated and procedures
amended?)FCG 2/6

Examples of good practice

Examples of poor practice•

The firm’s risk assessment iscomprehensive.

••

Risk assessment is a continu•
ous process based on the best
information available from internal and external sources.

Efforts to understand risk arepiecemeal and lack coordination.

•

The firm assesses where risks
are greater and concentrates
its resources accordingly.

Risk assessments are incomplete.

•

The firm actively considers the •impact of crime on customers.

www.handbook.fca.org.uk•

Risk assessment is a one-off
exercise.

The firm targets financial
crimes that affect the bottom
line (e.g. fraud against thefirm) but neglects those■ Release 39● Aug 2024

FCG 2 : Financial crime systems
and controls

Examples of good practiceSection 2.2 : Themes

Examples of poor practicewhere third parties suffer(e.g. fraud against customers).

•

2

The firm considers financial
crime risk when designing
new products and services.

Policiesand procedures.....................................................................................................
2.2.5

G

A firm must have in place up-to-date policies and procedures appropriate toits business. These should be readily accessible, effective and understood by
all relevant staff.
Self-assessment questions:•How often are your firm’s policies and procedures reviewed, and at
what level of seniority?
•How does it mitigate the financial crime risks it identifies?
•What steps does the firm take to ensure that relevant policies andprocedures reflect new risks or external events? How quickly are anynecessary changes made?
•What steps does the firm take to ensure that staff understand its
policies and procedures?
•For larger groups, how does your firm ensure that policies andprocedures are disseminated and applied throughout the business?
Examples of good practice

Examples of poor practice•There is clear documentation•of a firm’s approach to complying with its legal and regulatory requirements in relation to financial crime.

A firm has no written policies
and procedures.

•

Policies and procedures are
regularly reviewed andupdated.

The firm does not tailor externally produced policies andprocedures to suit its business.

•

Internal audit or another inde- •pendent party monitors the effectiveness of policies, procedures, systems and controls.

The firm fails to review policies and procedures in lightof events.

•

The firm fails to check
whether policies and procedures are applied consistently
and effectively.

•

A firm has not considered
whether its policies and procedures are consistent with its
obligations under legislationthat forbids discrimination.

•

See ■ SYSC 3.2.6R and ■ SYSC 6.1.1R.

■ Release 39● Aug 2024

www.handbook.fca.org.uk

FCG 2/7

FCG 2 : Financial crime systems
and controls

Section 2.2 : Themes

Staff recruitment, vetting, training, awareness andremuneration.....................................................................................................
2.2.6

2

G

Firms must employ staff who possess the skills, knowledge and expertise to
carry out their functions effectively. They should review employees’
competence and take appropriate action to ensure they remain competentfor their role. Vetting and training should be appropriate to employees’roles.
Firms should manage the risk of staff being rewarded for taking
unacceptable financial crime risks. In this context, Remuneration Principle
12(h), as set out in ■ SYSC 19A.3.51R and ■ 19A.3.52E, may be relevant to firms
subject to the Remuneration Code.
Self-assessment questions:•What is your approach to vetting staff? Do vetting andmanagement of different staff reflect the financial crime risks towhich they are exposed?
•How does your firm ensure that its employees are aware of financial
crime risks and of their obligations in relation to those risks?
•Do staff have access to training on an appropriate range of financial
crime risks?
•How does the firm ensure that training is of consistent quality andis kept up to date?
•Is training tailored to particular roles?
•How do you assess the effectiveness of your training on topics
related to financial crime?
•Is training material relevant and up to date? When was it last
reviewed?

FCG 2/8

Examples of good practice

Examples of poor practice

•

•

•

Staff in higher risk roles are
subject to more thoroughvetting.

•

Staff are not competent tocarry out preventative functions effectively, exposing thefirm to financial crime risk.

•

Temporary staff in higher riskroles are subject to the samelevel of vetting as permanent
members of staff in similarroles.

•

Staff vetting is a one-off
exercise.

•

Where employment agencies
are used, the firm periodicallysatisfies itself that the agency
is adhering to the agreed vetting standard.

•

The firm fails to identify
changes that could affect anindividual’s integrity andsuitability.

•

Tailored training is in place toensure staff knowledge is adequate and up to date.

•

The firm limits enhanced vetting to senior management
roles and fails to vet staff
whose roles expose them tohigher financial crime risk.

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 2 : Financial crime systems
and controls

Section 2.2 : Themes

Examples of good practice

Examples of poor practice•New staff in customer-facing
positions receive financial
crime training tailored totheir role before being able
to interact with customers.

••

Training has a strong practicaldimension (e.g. case studies)and some form of testing.

•

Poor compliance records are
not reflected in staff appraisals and remuneration.

•

The firm satisfies itself that•
staff understand their responsibilities (e.g. computerised
training contains a test).

Training dwells unduly on legislation and regulations rather than practical examples.

•

Whistleblowing procedures
are clear and accessible, andrespect staff confidentiality.

•

Training material is not kept
up to date.

•

The firm fails to identify training needs.

•

There are no training logs or
tracking of employees’ training history.

•

Training content lacks management sign-off.

•Training does not coverwhistleblowing and escalation procedures.

The firm fails to identify
whether staff whose roles expose them to bribery and corruption risk have links to relevant political or administrative decision-makers.

2

See ■ SYSC 3.1.6R and ■ SYSC 5.1.1R.

Qualityof oversight.....................................................................................................
2.2.7

G

A firm’s efforts to combat financial crime should be subject to challenge. We
expect senior management to ensure that policies and procedures areappropriate and followed.
Self-assessment questions:•How does your firm ensure that its approach to reviewing theeffectiveness of financial crime systems controls is comprehensive?
•What are the findings of recent internal audits and compliancereviews on topics related to financial crime?
•How has the firm progressed remedial measures?

■ Release 39

Examples of good practice

Examples of poor practice••Internal audit and complianceroutinely test the firm’s defences against financial crime,
including specific financial
crime threats.

● Aug 2024

Compliance unit and audit teams lack experience in financial crime matters.

www.handbook.fca.org.uk

FCG 2/9

FCG 2 : Financial crime systems
and controls

Examples of good practice

Examples of poor practice•Decisions on allocation of com- •pliance and audit resource arerisk-based.

•

Management engage constructively with processes ofoversight and challenge.

•

Smaller firms seek external
help if needed.

2

FCG 2/10

Section 2.2 : Themeswww.handbook.fca.org.uk

Audit findings and compliance conclusions are notshared between business units. Lessons are not spread
more widely.

■ Release 39● Aug 2024

FCG 2 : Financial crime systems
and controls

2.3

Section 2.3 : Further guidance

Further guidance
2

2.3.1

G

FCTR contains the following additional guidance on governance:• ■ FCTR 6.3.1G (Governance), from the FSA’s thematic review Data
security in Financial Services• ■ FCTR 8.3.1G (Senior management responsibility) from the FSA’s
thematic review Financial services firms’ approach to UK financial
sanctions• ■ FCTR 9.3.1G (Governance and management information) from the
FSA’s thematic review Anti-bribery and corruption in commercial
insurance broking• ■ FCTR 11.3.1G (Governance, culture and information sharing) fromthe FSA’s thematic review Mortgage fraud against lenders

2.3.2

G

FCTR contains the following additional guidance on risk assessment:• ■ FCTR 8.3.2G (Risk assessment) from the FSA’s thematic review
Financial services firms’ approach to UK financial sanctions• ■ FCTR 9.3.2G (Risk assessment and responses to significant bribery
and corruption events) from the FSA’s thematic review Anti-bribery
and corruption in commercial insurance broking• ■ FCTR 10.3.7G (Responsibilities and risk assessments) from the FSA’s
thematic review The Small Firms Financial Crime Review• ■ FCTR 12.3.3G (High risk customers and PEPs – Risk assessment) and(Correspondent banking – Risk assessment of respondent banks) fromthe FSA’s thematic review Banks’ management of high money
laundering risk situations

2.3.3

G

FCTR contains the following additional guidance on policies and procedures:• ■ FCTR 8.3.3G (Policies and procedures) from the FSA’s thematic
review Financial services firms’ approach to UK financial sanctions• ■ FCTR 10.3.1G (Regulatory/Legal obligations) from the FSA’s
thematic review The Small Firms Financial Crime Review■ Release 39● Aug 2024

www.handbook.fca.org.uk

FCG 2/11

FCG 2 : Financial crime systems
and controls

Section 2.3 : Further guidance• ■ FCTR 12.3.2G (High risk customers and PEPs – AML policies andprocedures) from the FSA’s thematic review Banks’ management ofhigh money laundering risk situations

2
2.3.4

G

FCTR contains the following additional guidance on staff recruitment,
vetting, training and awareness:• ■ FCTR 6.3.2G (Training and awareness) and ■ FCTR 6.3.3G (Staff
recruitment and vetting) from the FSA’s thematic review Data
security in Financial Services• ■ FCTR 8.3.4G (Staff training and awareness) from the FSA’s thematic
review Financial services firms’ approach to UK financial sanctions• ■ FCTR 9.3.5G (Staff recruitment and vetting) and ■ FCTR 9.3.6G(Training and awareness) from the FSA’s thematic review Anti-bribery
and corruption in commercial insurance broking• ■ FCTR 10.3.6G (Training) from the FSA’s thematic review The Small
Firms Financial Crime Review• ■ FCTR 11.3.6G (Staff recruitment and vetting) and ■ FCTR 11.3.8G(Staff training and awareness) from the FSA’s thematic review
Mortgage fraud against lenders laundering risk situations

2.3.5

G

FCTR contains the following additional guidance on quality of oversight:• ■ FCTR 6.3.15G (Internal audit and compliance monitoring) from the
FSA’s thematic review Data security in Financial Services• ■ FCTR 9.3.9G (The role of compliance and internal audit) from the
FSA’s thematic review Anti-bribery and corruption in commercial
insurance broking• ■ FCTR 11.3.5G (Compliance and internal audit) from the FSA’s
thematic review Mortgage fraud against lenders

2.3.6

FCG 2/12

G

For firms’ obligations in relation to whistleblowers see the Public Interest
Disclosure Act 1998: www.legislation.gov.uk/ukpga/1998/23/contents

www.handbook.fca.org.uk■ Release 39● Aug 2024

Money laundering and terrorist financing

Chapter 3
Money laundering andterrorist financing■ Release 39● Aug 2024

www.handbook.fca.org.uk

FCG 3/1

FCG 3 : Money laundering andterrorist financing

3.1

Section 3.1 : Introduction

Introduction

3

3.1.1

G

Who should read this chapter? This section applies to all firms who aresubject to the money laundering provisions in ■ SYSC 3.2.6A – J or ■ SYSC 6.3. It
also applies to Annex I financial institutions and e-money institutions forwhom we are the supervisory authority under the Money Laundering
Regulations.

3.1.2

G

This guidance does not apply to payment institutions, which are supervisedfor compliance with the Money Laundering Regulations by HM Revenue andCustoms. But it may be of interest to them, to the extent that we may refuse
to authorise them, or remove their authorisation, if they do not satisfy usthat they comply with the Money Laundering Regulations.

3.1.3

G

This guidance is less relevant for those who have more limited anti-money
laundering (AML) responsibilities, such as mortgage brokers, general insurers
and general insurance intermediaries. But it may still be of use, for example,
to assist them in establishing and maintaining systems and controls to reduce
the risk that they may be used to handle the proceeds from crime; and tomeet the requirements of the Proceeds of Crime Act 2002 to which they are
subject.

3.1.4

G■ FCG 3.2.2G (The Money Laundering Reporting Officer (MLRO)) applies only

to firms who are subject to the money laundering provisions in■ SYSC 3.2.6A – J or ■ SYSC 6.3, except it does not apply to sole traders who
have no employees.

FCG 3/2

3.1.5

G■ FCG 3.2.13G (Customer payments) applies to banks subject to ■ SYSC 6.3.

3.1.6

G

The guidance in this chapter relates both to our interpretation ofrequirements of the Money Laundering Regulations and to the financial
crime and money laundering provisions of ■ SYSC 3.2.6R – ■ 3.2.6JG,■ SYSC 6.1.1R and ■ SYSC 6.3.

3.1.7

G

The Joint Money Laundering Steering Group (JMLSG) produces detailed
guidance for firms in the UK financial sector on how to comply with theirlegal and regulatory obligations related to money laundering and terrorist
financing. FCG is not intended to replace, compete or conflict with the
JMLSG’s guidance, which should remain a key resource for firms.

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 3 : Money laundering andterrorist financing

3.1.7AG

Section 3.1 : Introduction

The European Supervisory Authorities (ESAs) have produced guidelines thatfirms should consider when assessing the ML/TF risk associated with abusiness relationship or occasional transaction. The Money Laundering
Regulations require firms subject to the regulations to take account of theseguidelines when complying with the customer due diligence requirements inRegulations 33 and 37.

3
3.1.8

G

■ Release 39

When considering a firm’s systems and controls against money launderingand terrorist financing, we will consider whether the firm has followed
relevant provisions of the JMLSG’s guidance, guidance issued by the FCA or
taken account of the ESA guidelines.

● Aug 2024

www.handbook.fca.org.uk

FCG 3/3

FCG 3 : Money laundering andterrorist financing

3.2

Section 3.2 : Themes

Themes3

Governance.....................................................................................................
3.2.1

G

The guidance in ■ FCG 2.2.1G on governance in relation to financial crime also
applies to money laundering. We expect senior management to takeresponsibility for the firm’s anti-money laundering (AML) measures. This
includes knowing about the money laundering risks to which the firm is
exposed and ensuring that steps are taken to mitigate those risks effectively.
Regulation 21(1)(a) of the Money Laundering Regulations requires that
where appropriate with regard to the size and nature of its business, firms
subject to the regulations must appoint one individual who is a member of
its board of directors (or if there is no board, of its equivalent managementbody) or of its senior management as the officer responsible for compliancewith the regulations. Regulation 21(3) also requires the appointment of anominated officer. Regulation 21(4) requires a firm to inform theirsupervisory authority of the identity of the individual appointed (including
any subsequent appointments) within 14 days of such appointment.
As ■ SYSC 6.3.9R and ■ SYSC 3.2.6IR also require firms subject to those
provisions to have an MLRO, the FCA expects that this individual can be thesame individual appointed under Regulation 21(1)(a) and/or 21(3) of the
Money Laundering Regulations and so firms do not need to make a separate
notification to the FCA.
Self-assessment questions:•Who has overall responsibility for establishing and maintaining
effective AML controls? Are they sufficiently senior?
•What are the reporting lines?
•Do senior management receive informative, objective informationthat is sufficient to enable them to meet their AML obligations?
•How regularly do senior management commission reports from the
MLRO? (This should be at least annually.) What do they do with thereports they receive? What follow-up is there on any
recommendations the MLRO makes?
•How are senior management involved in approving relationships
with high risk customers, including politically exposed persons (PEPs)?

FCG 3/4

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 3 : Money laundering andterrorist financing

Section 3.2 : Themes

Examples of good practice

Examples of poor practice••

Reward structures take account of any failings related
to AML compliance.

There is little evidence thatAML is taken seriously by
senior management. It is seen
as a legal or regulatory necessity rather than a matter oftrue concern for the business.

•

Decisions on accepting or•maintaining high money laundering risk relationships are reviewed and challenged independently of the business relationship and escalated tosenior management orcommittees.

Senior management attach
greater importance to the riskthat a customer might be involved in a public scandal,
than to the risk that the customer might be corrupt orotherwise engaged in financial crime.

•

Documentation provided to•senior management to inform
decisions about entering ormaintaining a business relationship provides an accurate
picture of the risk to which
the firm would be exposed if
the business relationship were
established or maintained.

The board never considers
MLRO reports.

•

A UK parent undertaking•
meets the obligations under
Regulation 20 of the Money
Laundering Regulations including ensuring that AML policies, controls and procedures
apply to all its branches andsubsidiaries outside the UK.

A UK branch or subsidiaryuses group policies which do
not comply fully with UK AML
legislation and regulatory requirements.

3

The
Money Laundering Reporting Officer (MLRO).....................................................................................................
3.2.2

G

This section applies to firms who are subject to the money laundering
provisions in ■ SYSC 3.2.6A – J or ■ SYSC 6.3, except it does not apply to sole
traders who have no employees.
Firms to which this section applies must appoint an individual as MLRO. The
MLRO is responsible for oversight of the firm’s compliance with its antimoney laundering obligations and should act as a focal point for the firm’s
AML activity.
Self-assessment questions:•Does the MLRO have sufficient resources, experience, access andseniority to carry out their role effectively?
•Do the firm’s staff, including its senior management, consult the
MLRO on matters relating to money-laundering?
•Does the MLRO escalate relevant matters to senior management
and, where appropriate, the board?
•What awareness and oversight does the MLRO have of the highest
risk relationships?

■ Release 39● Aug 2024

www.handbook.fca.org.uk

FCG 3/5

FCG 3 : Money laundering andterrorist financing

3

Section 3.2 : Themes

Examples of good practice

Examples of poor practice•

The MLRO is independent,
knowledgeable, robust andwell-resourced, and poses effective challenge to the business where warranted.

••

The MLRO has a direct re•
porting line to executive management or the board.

The MLRO does not understand the policies they are supposed to oversee or the rationale behind them.

•

The MLRO of a firm which is amember of a group has notconsidered whether group
policy adequately addresses
UK AML obligations.

•

The MLRO is unable to retrieve information about thefirm’s high-risk customers onrequest and without delay
and plays no role in monitoring such relationships.

The MLRO lacks credibility
and authority, whether because of inexperience or lackof seniority.

See ■ SYSC 3.2.6IR and ■ SYSC 6.3.9R.

Risk
assessment.....................................................................................................
3.2.3

G

The guidance in ■ FCG 2.2.4G on risk assessment in relation to financial crimealso applies to AML.
The assessment of money laundering risk is at the core of the firm’s AML
effort and is essential to the development of effective AML policies andprocedures. A firm is required by Regulation 18 of the Money Laundering
Regulations to undertake a risk assessment.
Firms must therefore put in place systems and controls to identify, assess,monitor and manage money laundering risk. These systems and controls
must be comprehensive and proportionate to the nature, scale andcomplexity of a firm’s activities. Firms must regularly review their risk
assessment to ensure it remains current.
Self-assessment questions:•Which parts of the business present greater risks of money
laundering? (Has your firm identified the risks associated withdifferent types of customer or beneficial owner, product,transactions, business line, geographical location and delivery
channel (e.g. internet, telephone, branches)? Has it assessed theextent to which these risks are likely to be an issue for the firm?)•How does the risk assessment inform your day-to-day operations?
(For example, is there evidence that it informs the level of customer
due diligence you apply or your decisions about accepting ormaintaining relationships?)

FCG 3/6

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 3 : Money laundering andterrorist financing

Examples of good practice•Section 3.2 : Themes

Examples of poor practiceThere is evidence that the firm’s risk•
assessment informs the design of antimoney laundering controls.

An inappropriate risk
classification system
makes it almost impossible for a relationship to
be classified as ‘highrisk’.

•

The firm has identified good sources•of information on money launderingrisks, such as National Risk Assessments, ESA Guidelines, FATF mutual
evaluations and typology reports,
NCA alerts, press reports, court judgements, reports by non-governmentalorganisations and commercial due diligence providers.

Higher risk countries areallocated low-risk scoresto avoid enhanced due
diligence measures.

•

Consideration of money laundering•risk associated with individual business relationships takes account of factors such as:

Relationship managers
are able to override customer risk scores without sufficient evidence
to support theirdecision.

company structures;

3

political connections;country risk;
the customer’s or beneficial
owner’s reputation;
source of wealth;source of funds;
expected account activity;
sector risk; andinvolvement in public contracts.
•

The firm identifies where there is a•risk that a relationship manager
might become too close to customers
to identify and take an objective viewof the money laundering risk. It manages that risk effectively.

Risk assessments onmoney laundering are
unduly influenced by
the potential profitability of new or existing relationships.

•

The firm cannot evidence why customers are
rated as high, medium
or low risk.

•

A UK branch or subsidiary relies on group risk
assessments without assessing their compliancewith UK AML requirements.

See regulation 18 of the Money Laundering Regulations, ■ SYSC 3.2.6AR,■ SYSC 3.2.6CR, ■ SYSC 6.3.1R and ■ SYSC 6.3.3R.

Customerdue diligence (CDD) checks.....................................................................................................
3.2.4

G

■ Release 39

Firms must identify their customers and, where applicable, their beneficial
owners, and then verify their identities. Firms must also understand the
purpose and intended nature of the customer’s relationship with the firm
● Aug 2024

www.handbook.fca.org.uk

FCG 3/7

FCG 3 : Money laundering andterrorist financing

Section 3.2 : Themes

and collect information about the customer and, where relevant, beneficial
owner. This should be sufficient to obtain a complete picture of the risk
associated with the business relationship and provide a meaningful basis for
subsequent monitoring.
Firms should note that CDD measures also apply when contacting an existingcustomer as part of any legal duty in the course of a calendar year for the
purpose of reviewing information which is relevant to the risk assessment of
the customer, and relates to beneficial ownership of the customer.

3

Firms should also note that CDD measures must also be applied when therelevant person has to contact an existing customer in order to fulfil any
duty under the International Tax Compliance Regulations 2015.
CDD measures must also include taking reasonable steps to understand theownership and control structure of a customer where the customer is a legal
person, trust, company, foundation or similar legal arrangement.
Firms are required to keep written records in circumstances where all
possible means of identifying the beneficial owner of a body corporate havebeen taken and the beneficial cannot be identified satisfactorily or at all. In
circumstances where the beneficial owner of a body corporate cannot be
identified, reasonable measures must be taken to verify the identity of thesenior person in the body corporate responsible for managing it. In doing so,
firms should keep written records made of the actions taken and any
difficulties encountered.
Firms are required to collect proof of company registration (or an excerpt
from the register) before establishing a business relationship with certain
legal entities including a company subject to the requirements of Part 21A of
the Companies Act 2006, a limited liability partnership or an eligible Scottish
partnership. Firms are required to report to Companies House discrepancies
between this information and information which otherwise becomes
available to them in the course of complying with the Money Laundering
Regulations. Firms may wish to refer to further guidance from theCompanies House.
In situations where the money laundering risk associated with the business
relationship is increased, banks must carry out additional, enhanced due
diligence (EDD). ■ FCG 3.2.8G below considers enhanced due diligence.
Where a firm cannot apply customer due diligence measures, including
where a firm cannot be satisfied that it knows who the beneficial owner is, it
must not enter into, or continue, the business relationship.
Firms should note that an electronic identification process may be regarded
as a reliable source for the purposes of CDD verification where that process is
independent of the person whose identity is being verified, secure fromfraud and misuse and capable of providing an appropriate level of assurance
that the person claiming a particular identity is in fact that person with that
identity.
Self-assessment questions:•Does your firm apply customer due diligence procedures in a risksensitive way?
•Do your CDD processes provide you with a comprehensive
understanding of the risk associated with individual business
relationships?

FCG 3/8

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 3 : Money laundering andterrorist financing

Section 3.2 : Themes•How does the firm identify the customer’s beneficial owner(s)? Are
you satisfied that your firm takes risk-based and adequate steps toverify the beneficial owner’s identity in all cases? Do you understandthe rationale for beneficial owners using complex corporate
structures?
•Are procedures sufficiently flexible to cope with customers who
cannot provide more common forms of identification (ID)?
Examples of good practice

Examples of poor practice•

A firm which uses e.g.
electronic verification
checks or PEPs databases understands
their capabilities andlimitations.

•

Procedures are not risk-based: the firm
applies the same CDD measures to products and customers of varying risk.

•

The firm can cater forcustomers who lackcommon forms of ID(such as the socially excluded, those in care,
etc).

•

The firm has no method for tracking
whether checks on customers arecomplete.

•

The firm understands•
and documents theownership and control
structures (including
the reasons for any
complex or opaque corporate structures) ofcustomers and their beneficial owners.

The firm allows language difficulties orcustomer objections to get in the wayof proper questioning to obtain necessary CDD information.

•

The firm obtains in•formation about the
purpose and nature of
the business relationship sufficient to be satisfied that it understands the associatedmoney laundering risk.

Staff do less CDD because a customer isreferred by senior executives or influential people.

•

Staff who approve new •or ongoing business relationships satisfy
themselves that thefirm has obtained adequate CDD information before doing so.

The firm has no procedures for dealing
with situations requiring enhanced due
diligence. This breaches the Money
Laundering Regulations.

•3

The firm fails to consider:any individuals who ultimately
control more than 25% of sharesor voting rights of a corporate
customer;any individuals who exercise control over the management of acorporate customer; andany individuals who control the
body corporate
when identifying and verifying the cus-

■ Release 39● Aug 2024

www.handbook.fca.org.uk

FCG 3/9

FCG 3 : Money laundering andterrorist financing

Examples of good practiceSection 3.2 : Themes

Examples of poor practice
tomer’s beneficial owners. Thisbreaches the Money Laundering Regulations.

See regulations 5, 6, 27, 28, 30A, 31, 33, 34 and 35 of the Money Laundering
Regulations.

3

Ongoing
monitoring.....................................................................................................
3.2.5

G

A firm must conduct ongoing monitoring of its business relationships on arisk-sensitive basis. Ongoing monitoring means scrutinising transactions toensure that they are consistent with what the firm knows about thecustomer, and taking steps to ensure that the firm’s knowledge about thebusiness relationship remains current. As part of this, firms must keep
documents, data and information obtained in the CDD context (including
information about the purpose and intended nature of the business
relationship) up to date. It must apply CDD measures where it doubts thetruth or adequacy of previously obtained documents, data or information(see ■ FCG 3.2.4G).
Where the risk associated with the business relationship is increased, firms
must carry out enhanced ongoing monitoring of the business relationship.
■ FCG 3.2.9G provides guidance on enhanced ongoing monitoring.
Self-assessment questions:•How are transactions monitored to spot potential money
laundering? Are you satisfied that your monitoring (whether
automatic, manual or both) is adequate and effective consideringsuch factors as the size, nature and complexity of your business?
•Does the firm challenge unusual activity and explanations provided
by the customer where appropriate?
•How are unusual transactions reviewed? (Many alerts will be false
alarms, particularly when generated by automated systems. How
does your firm decide whether behaviour really is suspicious?)•How do you feed the findings from monitoring back into thecustomer’s risk profile?
Examples of good practice

FCG 3/10

Examples of poor practice•

A large retail firm•complements its other efforts
to spot potential money laundering by using an automatedsystem to monitor
transactions

The firm fails to take adequate measures to understand the risk associated withthe business relationship andis therefore unable to conduct
meaningful monitoring.

•

Where a firm uses automated •transaction monitoring systems, it understands their capabilities and limitations.

The MLRO can provide little
evidence that unusual transactions are brought to theirattention.

•

Small firms are able to apply•
credible manual procedures to

Staff always accept a customer’s explanation for un-

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 3 : Money laundering andterrorist financing

Examples of good practice•Section 3.2 : Themes

Examples of poor practice

scrutinise customers’
behaviour.

usual transactions at facevalue and do not probe
further.

The ‘rules’ underpinning mon- •itoring systems are understood by the relevant staff
and updated to reflect new
trends.

The firm does not take risksensitive measures to ensure
CDD information is up to
date. This is a breach of the
Money Laundering Regulations.

•

The firm uses monitoring results to review whether CDD
remains adequate.

•

The firm takes advantage ofcustomer contact as an opportunity to update due diligence
information.

•

Customer-facing staff are engaged with, but do not control, the ongoing monitoringof relationships.

•

The firm updates CDD information and reassesses therisk associated with the business relationship where monitoring indicates materialchanges to a customer’s
profile.

3

See regulations 27, 28(11), 33, 34 of the Money Laundering Regulations.

Sourceof wealth and source of funds.....................................................................................................
3.2.6

G

Establishing the source of funds and the source of wealth can be useful for
ongoing monitoring and due diligence purposes because it can help firms
ascertain whether the level and type of transaction is consistent with thefirm’s knowledge of the customer. It is a requirement where the customer isa PEP.
‘Source of wealth’ describes how a customer or beneficial owner acquired
their total wealth.
‘Source of funds’ refers to the origin of the funds involved in the business
relationship or occasional transaction. It refers to the activity that generated
the funds, for example salary payments or sale proceeds, as well as themeans through which the customer’s or beneficial owner’s funds weretransferred.
The JMLSG’s guidance provides that, in situations where the risk of money
laundering/terrorist financing is very low and subject to certain conditions,firms may assume that a payment drawn on an account in the customer’sname with a UK, EU or equivalent regulated credit institution satisfied thestandard CDD requirements. This is sometimes referred to as ‘source of funds
as evidence’ and is distinct from ‘source of funds’ in the context ofRegulation 28(11) and Regulations 33 and 35 of the Money Laundering
Regulations and of FCG. Nothing in FCG prevents the use of ‘source of funds
as evidence’ in situations where this is appropriate.

■ Release 39● Aug 2024

www.handbook.fca.org.uk

FCG 3/11

FCG 3 : Money laundering andterrorist financing

Section 3.2 : Themes

Where the customer is either a PEP, a family member of a PEP or known
close associate of a PEP, a firm may have regard to guidance issued by the
FCA on the treatment of PEPs.
[Editor’s Note: see https://www.fca.org.uk/publications/finalised-guidance/
fg17-6-treatment-politically-exposed-persons-peps-money-laundering.]

3

Handling
higher risk situations.....................................................................................................
3.2.7

G

The law requires that firms’ anti-money laundering policies and procedures
are sensitive to risks. This means that in higher risk situations, firms must
apply enhanced due diligence and ongoing monitoring. Situations that
present a higher money laundering risk might include, but are not restricted
to: customers linked to higher risk countries or business sectors; or who haveunnecessarily complex or opaque beneficial ownership structures; andtransactions which are unusual, lack an obvious economic or lawful purpose,are complex or large or might lend themselves to anonymity.
Firms must take account of risk factors set out under regulation 33(6) which
relate to customer risk, product risk and geographical risk when assessing
whether there is a high risk of money laundering or terrorist financing in aparticular situation and the extent of measures which should be taken to
manage and mitigate that risk.
The Money Laundering Regulations also set out some scenarios in which
specific enhanced due diligence measures have to be applied:•Correspondent relationships: where a correspondent credit
institution or financial institution is outside the EEA, the UK credit or
financial institution should apply EDD measures commensurate to therisk of the relationship. This can include in higher risk situations
thoroughly understanding its correspondent’s business, reputation,and the quality of its defences against money laundering andterrorist financing. Senior management must also give approval
before establishing a new correspondent relationship. JMLSG
guidance sets out how firms should apply EDD in differingcorrespondent trading relationships.
•Politically exposed persons (PEPs), family members and known
close associates of a PEP: a PEP is a person entrusted with aprominent public function, other than as a middle-ranking or morejunior official. PEPs (as well as their family members and known close
associates) must be subject to enhanced scrutiny. A senior manager at
an appropriate level of authority must also approve the initiation ofa business relationship with a PEP (or with a family member, or
known close associate, of a PEP). This includes approving a
relationship continuing with an existing customer who became a PEP
after the relationship begun. In meeting these obligations firms may
have regard to the FCA’s guidance on a risk-based approach to PEPs.

•Business relationships or a ‘relevant transaction’ where either party
is established in a high risk third country: the Money Laundering
Regulations defines:(a)a high-risk third country as being one identified by the EU
Commission by a delegated act. See EU Regulation 2016/1675 (asamended from time to time);

FCG 3/12

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 3 : Money laundering andterrorist financing

Section 3.2 : Themes(b)a relevant transaction as being a transaction in relation towhich the relevant person is required to apply customer due
diligence under Regulation 27;(c)established in a country in the case of a legal person as being
the country of incorporation or principal place of business, or, inthe case of a financial institution or credit institution, where its
principal regulatory authority is.

3

In these scenarios, EDD must include specified measures which
include obtaining additional information on the customer, thebeneficial owner, the intended nature of the business relationship,
source of funds and wealth, reasons for the transactions and senior
management approval for the business relationship. Conducting
enhanced monitoring is also a requirement.
•Other transactions: EDD must be performed:() in any case where a transaction is complex or unusually large, orthere is an unusual pattern of transactions, or the transaction ortransactions have no apparent economic or legal purpose. In this
scenario, there are specified EDD measures which must include, as
far as reasonably possible, examining the background andpurpose of the transaction and increasing the degree and natureof monitoring of the business relationship in which thetransaction is made to determine whether that transaction orthat relationship appears to be suspicious;() in any other case which by its nature can present a higher risk ofmoney laundering or terrorist financing.
Where the customer is the beneficiary of a life insurance policy, is alegal person or a legal arrangement, and presents a high risk ofmoney laundering or terrorist financing for any other reason, credit
and financial institutions must take reasonable measures to identify
and verify the identity of the beneficial owners of that beneficiary
before making a payment under the life insurance policy.
The extent of enhanced due diligence measures that a firm undertakes canbe determined on a risk-sensitive basis. The firm must be able todemonstrate that the extent of the enhanced due diligence measures it
applies is commensurate with the money laundering and terrorist financing
risks.
See regulations 19, 20, 21, 28(16), 33 and 34 of the Money Laundering
Regulations.

Handling
higher risk situations – enhanced due diligence (EDD).....................................................................................................
3.2.8

G

Firms must apply EDD measures in situations that present a higher risk ofmoney laundering.
EDD should give firms a greater understanding of the customer and theirassociated risk than standard due diligence. It should provide more certainty
that the customer and/or beneficial owner is who they say they are and thatthe purposes of the business relationship are legitimate; as well as increasing
opportunities to identify and deal with concerns that they are not.
■ FCG 3.2.3G considers risk assessment.
The extent of EDD must be commensurate to the risk associated with thebusiness relationship or occasional transaction but firms can decide, in mostcases, which aspects of CDD they should enhance. This will depend on the■ Release 39● Aug 2024

www.handbook.fca.org.uk

FCG 3/13

FCG 3 : Money laundering andterrorist financing

Section 3.2 : Themes

reason why a relationship or occasional transaction was classified as highrisk.
Examples of EDD include:•obtaining more information about the customer’s or beneficial
owner’s business3•obtaining more robust verification of the beneficial owner’s identity
based on information from a reliable and independent source•gaining a better understanding of the customer’s or beneficial
owner’s reputation and/or role in public life and assessing how thisaffects the level of risk associated with the business relationship•carrying out searches on a corporate customer’s directors or otherindividuals exercising control to understand whether their business or
integrity affects the level of risk associated with the business
relationship•establishing how the customer or beneficial owner acquired theirwealth to be satisfied that it is legitimate•establishing the source of the customer’s or beneficial owner’s funds
to be satisfied that they do not constitute the proceeds from crime.
Self-assessment questions:•How does EDD differ from standard CDD? How are issues that are
flagged during the due diligence process followed up and resolved?
Is this adequately documented?
•How is EDD information gathered, analysed, used and stored?
•What involvement do senior management or committees have inapproving high risk customers? What information do they receive to
inform any decision-making in which they are involved?

FCG 3/14

Examples of good practice

Examples of poor practice•

The MLRO (and their team)have adequate oversight ofall high risk relationships.

••

The firm establishes the legit- •imacy of, and documents, thesource of wealth and sourceof funds used in high risk business relationships.

[deleted]•

Where money laundering risk
is very high, the firm obtains
independent internal or external intelligence reports.

•

The firm does not distinguishbetween the customer’ssource of funds and theirsource of wealth.

•

When assessing EDD, the firm •complements staff knowledge

The firm relies entirely on asingle source of informationwww.handbook.fca.org.uk

Senior management do notgive approval for taking onhigh risk customers. If the customer is a PEP or a non-EEA
correspondent , this breaches
the Money Laundering Regulations.

■ Release 39● Aug 2024

FCG 3 : Money laundering andterrorist financing

Examples of good practiceSection 3.2 : Themes

Examples of poor practiceof the customer or beneficial
owner with more objective information.
•

The firm is able to provide
evidence that relevant information staff have about
customers or beneficial
owners is documented andchallenged during the CDD
process.

for its enhanced due
diligence.
•

A firm relies on intra-group introductions where overseas
standards are not UK-equivalent or where due diligencedata is inaccessible because oflegal constraints.

•

A member of a group satisfies •
itself that it is appropriate torely on due diligence performed by other entities inthe same group.

The firm considers the credit
risk posed by the customer,
but not the money laundering risk.

•

The firm proactively follows
up gaps in, and updates, CDD
of higher risk customers.

•

The firm disregards allegations of the customer’s or beneficial owner’s criminal activity from reputable sources repeated over a sustained
period of time.

•

A correspondent bank seeks
to identify PEPs associatedwith their respondents•

The firm ignores adverse allegations simply because customers hold a UK investment
visa.

•

. A correspondent bank takes •a view on the strength of the
AML regime in a respondentbank’s home country, drawing
on discussions with the respondent, overseas regulatorsand other relevant bodies.

A firm grants waivers from establishing source of funds,
source of wealth or other due
diligence without goodreason.

•A correspondent bank gathers •information about respondentbanks’ procedures for sanctions screening, PEP identification and management, account monitoring and suspicious activity reporting.

A correspondent bank conducts inadequate due diligence on parents and affiliates of respondents.

•

A correspondent bank relies
exclusively on the Wolfsberg
Group AML questionnaire.

3

See regulations 33, 34, 34(1)(d), 35 and 35(5)(a) of the Money Laundering
Regulations.

Handling
higher risk situations – enhanced ongoing monitoring.....................................................................................................
3.2.9

G

Firms must enhance their ongoing monitoring in higher risk situations.
Self-assessment questions:•How does your firm monitor its high risk business relationships?
How does enhanced ongoing monitoring differ from ongoing
monitoring of other business relationships?
•Are reviews carried out independently of relationship managers?

■ Release 39● Aug 2024

www.handbook.fca.org.uk

FCG 3/15

FCG 3 : Money laundering andterrorist financing

Section 3.2 : Themes•What information do you store in the files of high risk customers? Is
it useful? (Does it include risk assessment, verification evidence,
expected account activity, profile of customer or business relationshipand, where applicable, information about the ultimate beneficial
owner?)
Examples of good practice3

Examples of poor practice•

Key AML staff have a good un- •derstanding of, and easy access to, information about abank’s highest risk customers.

The firm treats annual reviews
as a tick-box exercise and copies information from previous
reviews without thought.

•

New higher risk clients are•
more closely monitored to confirm or amend expected account activity.

A firm in a group relies onothers in the group to carryout monitoring without understanding what they did
and what they found.

•

Alert thresholds on auto•mated monitoring systems arelower for PEPs and otherhigher risk customers. Exceptions are escalated to moresenior staff.

There is insufficient challenge
to explanations from relationship managers and customers
about unusual transactions.

•

Decisions across a group onwhether to keep or exit highrisk relationships are consistent and in line with the firm’s
overall risk appetite or assessment.

•

The firm focuses too much on
reputational or businessissues when deciding whether
to exit relationships with ahigh money laundering risk.

•

The firm makes no enquiries
when accounts are used for
purposes inconsistent with expected activity (e.g. personalaccounts being used forbusiness).

See regulation 33(1) of the Money Laundering Regulations.

Liaisonwith law enforcement.....................................................................................................
3.2.10G

Firms must have a nominated officer. The nominated officer has a legal
obligation to report any knowledge or suspicions of money laundering to
the National Crime Agency (NCA) through a ‘Suspicious Activity Report’, also
known as a ‘SAR’. (See ■ FCG Annex 1 list of common terms for more
information about nominated officers and Suspicious Activity Reports.)
Staff must report their concerns and may do so to the firm’s nominatedofficer, who must then consider whether a report to NCA is necessary basedon all the information at their disposal. Law enforcement agencies may seek
information from the firm about a customer, often through the use of
Production Orders (see ■ FCG Annex 1).
Self-assessment questions:•Is it clear who is responsible for different types of liaison with theauthorities?
•How does the decision-making process related to SARs work in thefirm?

FCG 3/16

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 3 : Money laundering andterrorist financing

Section 3.2 : Themes•Are procedures clear to staff?
•Do staff report suspicions to the nominated officer? If not, does thenominated officer take steps to identify why reports are not being
made? How does the nominated officer deal with reports received?
•What evidence is there of the rationale underpinning decisions
about whether a SAR is justified?

3•Is there a documented process for responding to Production Orders,with clear timetables?
Examples of good practice

Examples of poor practice•All staff understand procedures for escalating suspicions
and follow them as required.

•

The nominated officer passes
all internal reports to NCA
without considering whether
they truly are suspicious.
These ‘defensive’ reports arelikely to be of little value.

•

The firm’s SARs set out a clear •narrative of events and include detail that law enforcement authorities can use (e.g.
names, addresses, passportnumbers, phone numbers, email addresses).

The nominated officer dismisses concerns escalated bystaff without reasons being
documented.

•

SARs set out the reasons for
suspicion in plain English.
They include some context on
any previous related SARs rather than just a crossreference.

•

The firm does not train staff
to make internal reports,
thereby exposing them to personal legal liability and increasing the risk that suspicious activity goes unreported.

•

There is a clear process for
documenting decisions.

•

The nominated officer turns ablind eye where a SAR might
harm the business. This could
be a criminal offence.

•

A firm’s processes for dealing
with suspicions reported to it
by third party administrators
are clear and effective.

•

A firm provides extraneousand irrelevant detail in response to a Production Order.

See regulation 21 of the Money Laundering Regulations and s.330 POCA ands.331 POCA and s.21A of the Terrorism Act 2000.

Recordkeeping and reliance on others.....................................................................................................
3.2.11G■ Release 39

Firms must keep copies of any documents and information obtained to meet
CDD requirements and sufficient supporting records for transactions for five
years after the business relationship ends or five years after an occasionaltransaction. However, records relating to transactions occurring in a business
relationship need not be kept beyond 10 years. Where a firm is relied on byothers to do due diligence checks, it must keep its records of those checks
for the same time period. Firms must keep records sufficient to demonstrate
to us that their CDD measures are appropriate in view of the risk of money
laundering and terrorist financing. Regulation 40(5) requires that any datacollected is deleted after these periods. Regulation 41 also sets out that
personal data collected under the Money Laundering Regulations should● Aug 2024

www.handbook.fca.org.uk

FCG 3/17

FCG 3 : Money laundering andterrorist financing

Section 3.2 : Themes

only be processed for the purposes of preventing money laundering or
terrorist financing.
Self-assessment questions:•Can your firm retrieve records promptly in response to a Production
Order?

3•If the firm relies on others to carry out AML checks (see ‘Reliance’ in■ FCG Annex 1), is this within the limits permitted by the Money
Laundering Regulations? How does it satisfy itself that it can rely onthese firms?
Examples of good practice

Examples of poor practice•

Records of customer ID andtransaction data can be retrieved quickly and without
delay.

•

The firm keeps customer records and related information
in a way that restricts thefirm’s access to these records
or their timely sharing withauthorities.

•

Where the firm routinely re•lies on checks done by a third
party (for example, a fund provider relies on an IFA’s
checks), it requests sample
documents to test their reliability.

A firm cannot access CDD andrelated records for which it
has relied on a third party.
This breaches the Money
Laundering Regulations.

•

Significant proportions of
CDD records cannot be retrieved in good time.

•

The firm has not considered
whether a third party consents to being relied upon.

•

There are gaps in customer records, which cannot be
explained.

See regulations 28(16), 40 and 40(7) of the Money Laundering Regulations.

Countering
the finance of terrorism.....................................................................................................
3.2.12G

Firms have an important role to play in providing information that can assist
the authorities with counter-terrorism investigations. Many of the controls
firms have in place in relation to terrorism will overlap with their anti-money
laundering measures, covering, for example, risk assessment, customer due
diligence checks, transaction monitoring, escalation of suspicions and liaison
with the authorities.
Self-assessment questions:•How have risks associated with terrorist finance been assessed? Did
assessments consider, for example, risks associated with the customer
base, geographical locations, product types, distribution channels,
etc.?
•Is it clear who is responsible for liaison with the authorities onmatters related to countering the finance of terrorism? (See■ FCG 3.2.10G)

FCG 3/18

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 3 : Money laundering andterrorist financing

Examples of good practiceSection 3.2 : Themes

Examples of poor practice•

The firm has and uses an ef•
fective process for liaison withthe authorities.

Financial crime training does
not mention terrorist
financing.

•

A firm identifies sources of in- •formation on terrorist financing risks: e.g. press reports,
NCA alerts, Financial Action
Task Force typologies, court
judgements, etc.

A firm doing cross-border business has not assessed terrorism-related risks in countries
in which it has a presence ordoes business.

•

This information informs thedesign of transaction monitoring systems.

A firm has not considered if
its approach to customer due
diligence is able to capture information relevant to therisks of terrorist finance.

•

Suspicions raised within thefirm inform its own typologies.

•

3

Customerpayments.....................................................................................................
3.2.13GThis section applies to banks subject to ■ SYSC 6.3.
Interbank payments can be abused by criminals. International policymakers
have taken steps intended to increase the transparency of interbank
payments, allowing law enforcement agencies to more easily trace payments
related to, for example, drug trafficking or terrorism. The Funds Transfer
Regulation requires banks to collect and attach information about payers
and payees of wire transfers (such as names and addresses, or, if a payment
moves within the EU, a unique identifier like an account number) to
payment messages. Banks are also required to check this information ispresent on inbound payments, and chase missing data. The FCA has a legal
responsibility to supervise banks’ compliance with these requirements.
Concerns have also been raised about interbank transfers known as “cover
payments” (see ■ FCG Annex 1) that can be abused to disguise funds’ origins.
To address these concerns, the SWIFT payment messaging system now allows
originator and beneficiary information to accompany these payments.
Self-assessment questions:•How does your firm ensure that customer payment instructions
contain complete payer and payee information? (For example, doesit have appropriate procedures in place for checking payments it hasreceived?)•Does the firm review its respondent banks’ track record on
providing payer data and using appropriate SWIFT messages forcover payments?
•Does the firm use guidance issued by the ESAs? [Editor’s Note: see
http://www.eba.europa.eu/-/esas-provide-guidance-to-preventterrorist-financing-and-money-laundering-in-electronic-fundtransfers.].

■ Release 39● Aug 2024

www.handbook.fca.org.uk

FCG 3/19

FCG 3 : Money laundering andterrorist financing

Section 3.2 : Themes

Examples of good practice

Examples of poor practice•

Following processing,banks conduct riskbased sampling for inward payments to
identify inadequate
payer and payee information.

•

A bank fails to make use of the correct
SWIFT message type for cover
payments.

•

An intermediary bankchases up missing information.

•

Compliance with regulations related tointernational customer payments has
not been reviewed by the firm’s internal audit or compliance departments.

3

The following practices breach theFunds Transfer Regulation:•

A bank sends dummy
messages to test theeffectiveness of filters.

International customer payment
instructions sent by the payer’sbank lack meaningful payer andpayee information.

•

A bank is aware of
guidance from the Basel Committee and theWolfsberg Group on
the use of cover payments, and has considered how this should
apply to its own operations.

An intermediary bank strips
payee or payer information frompayment instructions before passing the payment on.

•

The quality of payer
and payee informationin payment instructions from respondentbanks is taken into account in the bank’s ongoing review of correspondent banking relationships.

The payee bank does not checkany incoming payments to see ifthey include complete and meaningful data.

•

The firm actively engages in peer discussions about taking appropriate action
against banks which
persistently fail to provide complete payer information.

Casestudy – poor AML controls.....................................................................................................
3.2.14GThe FSA fined Alpari (UK) Ltd, an online provider of foreign exchange
services, £140,000 in May 2010 for poor anti-money laundering controls.
•Alpari failed to carry out satisfactory customer due diligenceprocedures at the account opening stage and failed to monitor
accounts adequately.

FCG 3/20

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 3 : Money laundering andterrorist financing

Section 3.2 : Themes•These failings were particularly serious given that the firm didbusiness over the internet and had customers from higher risk
jurisdictions.
•The firm failed to ensure that resources in its compliance and antimoney laundering areas kept pace with the firm’s significant growth.

3

Alpari’s former money laundering reporting officer was also fined £14,000
for failing to fulfil his duties.
See the FSA’s press release for more information: www.fsa.gov.uk/pages/
Library/Communication/PR/2010/077.shtml

Casestudies – wire transfer failures.....................................................................................................
3.2.15G

A UK bank that falls short of our expectations when using payment messages
does not just risk FCA enforcement action or prosecution; it can also facecriminal sanctions abroad.
In January 2009, Lloyds TSB agreed to pay US$350m to US authorities after
Lloyds offices in Britain and Dubai were discovered to be deliberately
removing customer names and addresses from US wire transfers connected
to countries or persons on US sanctions lists. The US Department of Justiceconcluded that Lloyds TSB staff removed this information to ensure
payments would pass undetected through automatic filters at American
financial institutions. See its press release: www.usdoj.gov/opa/pr/2009/
January/09-crm-023.html.
In August 2010, Barclays Bank PLC agreed to pay US$298m to US authorities
after it was found to have implemented practices designed to evade US
sanctions for the benefit of sanctioned countries and persons, including bystripping information from payment messages that would have alerted US
financial institutions about the true origins of the funds. The bank selfreported the breaches, which took place over a decade-long period from asearly as the mid-1990s to September 2006. See the US Department ofJustice’s press release: www.justice.gov/opa/pr/2010/August/10-crm-933.html.

Casestudy – poor AML controls: PEPs and high risk customers.....................................................................................................
3.2.16GThe FSA fined Coutts & Company £8.75 million in March 2012 for poor AML
systems and controls. Coutts failed to take reasonable care to establish andmaintain effective anti-money laundering systems and controls in relation totheir high risk customers, including in relation to customers who are
Politically Exposed Persons.
•Coutts failed adequately to assess the level of money laundering risk
posed by prospective and existing high risk customers.
•The firm failed to gather sufficient information to establish theirhigh risk customers’ source of funds and source of wealth, and to
scrutinise appropriately the transactions of PEPs and other high risk
accounts.
•The firm failed to ensure that resources in its compliance and antimoney laundering areas kept pace with the firm’s significant growth.
These failings were serious, systemic and were allowed to persist for almost
three years. They were particularly serious because Coutts is a high profile■ Release 39● Aug 2024

www.handbook.fca.org.uk

FCG 3/21

FCG 3 : Money laundering andterrorist financing

Section 3.2 : Themesbank with a leading position in the private banking market, and because theweaknesses resulted in an unacceptable risk of handling the proceeds ofcrime.
This was the largest fine yet levied by the FSA for failures related to financial
crime.
See the FSA’s press release for more information: www.fsa.gov.uk/library/communication/pr/2012/032.shtml

3

Poor
AML controls: risk assessment.....................................................................................................
3.2.17GThe FSA fined Habib Bank AG Zurich £525,000, and its MLRO £17,500, in May
2012 for poor AML systems and controls.
Habib Bank AG Zurich failed adequately to assess the level of money
laundering risk associated with its business relationships. For example, thefirm excluded higher risk jurisdictions from its list of high risk jurisdictions on
the basis that it had group offices in them.
•Habib Bank AG Zurich failed to conduct timely and adequate
enhanced due diligence on higher risk customers by failing to gather
sufficient information and supporting evidence•The firm also failed to carry out adequate reviews of its AML
systems and controls.
•The MLRO failed properly to ensure the establishment andmaintenance of adequate and effective anti- money laundering risk
management systems and controls.
See the FSA’s press release for more information: www.fsa.gov.uk/library/communication/pr/2012/055.shtml

FCG 3/22

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 3 : Money laundering andterrorist financing

3.3

Section 3.3 : Further guidance

Further guidance

3

3.3.1

G

FCTR contains the following additional AML guidance:• ■ FCTR 4 summarises the findings of, and consolidates good andpoor practice from, the FSA’s thematic review of Automated AntiMoney Laundering Transaction Monitoring Systems• ■ FCTR 5 summarises the findings of, and consolidates good andpoor practice from, the FSA’s Review of firms’ implementation of arisk-based approach to anti-money laundering (AML)• ■ FCTR 10 summarises the findings of the Small Firms Financial Crime
Review. It contains guidance directed at small firms on:
Regulatory/Legal obligations (■ FCTR 10.3.1G)
Account opening procedures (■ FCTR 10.3.2G)
Monitoring activity (■ FCTR 10.3.3G)
Suspicious activity reporting (■ FCTR 10.3.4G)
Records (■ FCTR 10.3.5G)
Responsibilities and risk assessments (■ FCTR 10.3.7G)• ■ FCTR 12 summarises the findings of the FSA’s thematic review ofBanks’ management of high money laundering risk situations. It
includes guidance on:
High risk customers and PEPs – AML policies and procedures(■ FCTR 12.3.2G)
High risk customers and PEPs – Risk assessment (■ FCTR 12.3.3G)
High risk customers and PEPs – Customer take-on (■ FCTR 12.3.4G)
High risk customers and PEPs – Enhanced monitoring of high risk
relationships (■ FCTR 12.3.5G)
Correspondent banking – Risk assessment of respondent banks(■ FCTR 12.3.6G)
Correspondent banking – Customer take-on (■ FCTR 12.3.7G)
Correspondent banking – Ongoing monitoring of respondentaccounts (■ FCTR 12.3.8G)
Wire transfers – Paying banks (■ FCTR 12.3.9G)
Wire transfers – Intermediary banks (■ FCTR 12.3.10G)
Wire transfers – Beneficiary banks (■ FCTR 12.3.11G)■ Release 39● Aug 2024

www.handbook.fca.org.uk

FCG 3/23

FCG 3 : Money laundering andterrorist financing

Section 3.3 : Further guidance

Wire transfers – Implementation of SWIFT MT202COV(■ FCTR 12.3.12G)

3.3.2

G

FCTR also summarises the findings of the following thematic reviews:• ■ FCTR 3: Review of private banks’ anti-money laundering systems
and controls3• ■ FCTR 7: Review of financial crime controls in offshore centres• ■ FCTR 15: Banks’ control of financial crime risks in trade finance(2013)FCG 3/24

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 3 : Money laundering andterrorist financing

3.4

Section 3.4 : Sources of further information

Sources of further information

3

3.4.1

G

To find out more on anti-money laundering, see:
• The Money Laundering Regulations
The NCA’s website, which contains information on how to reportsuspicions of money laundering:www.nationalcrimeagency.gov.uk•The UK National risk assessment of money laundering andterrorist financing 2017- https://www.gov.uk/government/
publications/national-risk-assessment-of-money-laundering-andterrorist-financing-2017•The JMLSG’s guidance on measures firms can take to meet theiranti-money laundering obligations, which is available from its
website:www.jmlsg.org.uk .

3.4.2

G

To find out more on countering terrorist finance, see:
•Material relevant to terrorist financing that can be foundthroughout the JMLSG guidance: www.jmlsg.org.uk•The European Supervisory Authorities (ESAs) have published risk
factors guidelines under Articles 17 and 18(4) of Directive (EU) 2015/849- https://www.eba.europa.eu/-/esas-publish-aml-cft-guidelines•FATF’s work on terrorist financing: http://www.fatf-gafi.org/
publications/fatfgeneral/documents/terroristfinancing.html

3.4.3

G

To find out more on customer payments, see:
•Chapter 1 of Part III (Transparency in electronic payments (Wiretransfers)) of the JMLSG’s guidance, which will be banks’ chief sourceof guidance on this topic: www.jmlsg.org.uk•The Basel Committee’s May 2009 paper on due diligence for cover
payment messages: www.bis.org/publ/bcbs154.pdf•The Wolfsberg Group’s statement on payment standards: https://www.wolfsberg-principles.com/sites/default/files/wb/pdfs/wolfsbergstandards/1.%20Wolfsberg-Payment-Transparency-Standards-October2017.pdf■ Release 39● Aug 2024

www.handbook.fca.org.uk

FCG 3/25

FCG 3 : Money laundering andterrorist financing

Section 3.4 : Sources of further information•Joint Guidelines to prevent terrorist financing and money
laundering in electronic fund transfers- http://www.eba.europa.eu/-/
esas-provide-guidance-to-prevent-terrorist-financing-and-moneylaundering-in-electronic-fund-transfers•The Funds Transfer Regulation (EU Regulation 847/2015 on
information on the payer accompanying transfers of funds): http://
data.europa.eu/eli/reg/2015/847/oj

3
3.4.4

G

To find out more on correspondent banking relationships see:
•FATF Guidance on correspondent banking services (October 2016)http://www.fatf-gafi.org/media/fatf/documents/reports/GuidanceCorrespondent-Banking-Services.pdf•Basel Committee on Banking Supervision guidance “Sound
management of risks related to money laundering and financing ofterrorism: revisions” (updated July 2017) https://www.bis.org/bcbs/
publ/d405.htm

FCG 3/26

www.handbook.fca.org.uk■ Release 39● Aug 2024

FraudChapter 4
Fraud■ Release 39● Aug 2024

www.handbook.fca.org.uk

FCG 4/1

FCG 4 : Fraud

Section 4.1 : Introduction

4.1

Introduction

4
4.1.1

G

Who should read this chapter? This chapter applies to all firms subject to thefinancial crime rules in ■ SYSC 3.2.6R or ■ SYSC 6.1.1R and to e-money
institutions and payment institutions within our supervisory scope, with thefollowing exceptions:1 • ■ FCG 4.2.2 applies only to mortgage lenders within our
supervisory scope;2 • ■ FCG 4.2.3 applies to mortgage intermediaries only; and3 • ■ FCG 4.2.5 applies to retail deposit takers only.

FCG 4/2

4.1.2

G

All firms must take steps to defend themselves against financial crime, but avariety of approaches is possible. This chapter provides guidance on themesthat should form the basis of managing financial crime risk. The general
topics outlined here are also relevant in the context of the specific financial
crime risks detailed in subsequent chapters.

4.1.3

G

The contents of FCG’s fraud chapter reflect the FSA’s previous thematic workin this area. This means it does not specifically address such topics as plastic
card, cheque or insurance fraud. This is not because the FCA regards fraud
prevention as unimportant. Rather it reflects our view that our limited
resources are better directed elsewhere, given the strong incentive firms
should have to protect themselves from fraud; and the number of otherbodies active in fraud prevention. Links to some of these other bodies areprovided in ■ FCG 4.4.

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 4 : Fraud

Section 4.2 : Themes

4.2

Themes4
Preventing
losses from fraud.....................................................................................................
4.2.1

G

All firms will wish to protect themselves and their customers from fraud.
Management oversight, risk assessment and fraud data will aid this, as will
tailored controls on the ground. We expect a firm to consider the full
implications of the breadth of fraud risks it faces, which may have wider
effects on its reputation, its customers and the markets in which it operates.
The general guidance in ■ FCG 2 also applies in relation to fraud.
Self-assessment questions:•What information do senior management receive about fraud
trends? Are fraud losses accounted for clearly and separately to otherlosses?
•Does the firm have a clear picture of what parts of the business aretargeted by fraudsters? Which products, services and distribution
channels are vulnerable?
•How does the firm respond when reported fraud increases?
•Does the firm’s investment in anti-fraud systems reflect fraud
trends?
Examples of good practice■ Release 39

Examples of poor practice•

The firm takes a view on what •areas of the firm are most vulnerable to fraudsters, andtailors defences accordingly.

Senior management appear
unaware of fraud incidents
and trends. No management
information is produced.

•

Controls adapt to new fraud
threats.

•

Fraud losses are buried in bad
debts or other losses.

•

The firm engages with relevant cross-industry efforts tocombat fraud (e.g. data-sharing initiatives like CIFAS andthe Insurance Fraud Bureau,collaboration to strengthen
payment systems, etc.) in relation to both internal and external fraud.

•

There is no clear and consistent definition of fraud acrossthe business, so reporting ishaphazard.

•

Fraud response plans and in•vestigation procedures set out
how the firm will respond toincidents of fraud.

Fraud risks are not exploredwhen new products and delivery channels are developed.

● Aug 2024

www.handbook.fca.org.uk

FCG 4/3

FCG 4 : Fraud

Section 4.2 : Themes

Examples of good practice

Examples of poor practice•Lessons are learnt from incidents of fraud.

•

Staff lack awareness of what
constitutes fraudulent behaviour (e.g. for a salesman to misreport a customer’s salary tosecure a loan would be
fraud).

•

Anti-fraud good practice is•shared widely within the firm.

Sales incentives act to encourage staff or management toturn a blind eye to potential
fraud.

•

To guard against insider•
fraud, staff in high risk positions (e.g. finance department, trading floor) are subject to enhanced vetting andcloser scrutiny. ‘Four eyes’ procedures (see FCG Annex 1 forcommon terms) are in place.

Banks fail to implement therequirements of the Payment
Services Regulations andBanking Conduct of Businessrules, leaving customers outof pocket after fraudulent
transactions are made.

•Enhanced due diligence is per- •formed on higher risk customers (e.g. commercial customers with limited financial
history. See ‘long firm fraud’in FCG Annex 1).

Remuneration structures may
incentivise behaviour that increases the risk of mortgage
fraud.

4

Mortgagefraud – lenders.....................................................................................................
4.2.2

G

This section applies to mortgage lenders within the supervisory scope of theappropriate regulator.
Self-assessment questions:•Are systems and controls to detect and prevent mortgage fraud
coordinated across the firm, with resources allocated on the basis ofan assessment of where they can be used to best effect?
•How does your firm contain the fraud risks posed by corrupt
conveyancers, brokers and valuers?
•How and when does your firm engage with cross-industry
information-sharing exercises?

FCG 4/4

Examples of good practice

Examples of poor practice•

A firm’s underwriting process
can identify applications thatmay present a higher risk ofmortgage fraud.

•

A lender fails to report relevant information to the FCA’s
Information from Lenders(IFL) scheme as per FCA guidance on IFL referrals.

•

Membership of a lender’spanels of brokers, conveyancers and valuers is subject toongoing review. Dormant
third parties are identified.

•A lender lacks a clear definition of mortgage fraud, undermining data collection andtrend analysis.

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 4 : Fraud

Section 4.2 : Themes

Examples of good practice

Examples of poor practice•

A lender reviews existing
mortgage books to identify
and assess mortgage fraud indicators.

•

A lender’s panels of conveyancers, brokers and valuers are
too large to be manageable.

•

A lender verifies that funds
are being dispersed in linewith instructions before it releases them.

•

The lender does no work to
identify dormant parties.

•

A lender promptly discharges
mortgages that have been redeemed and checks whether
conveyancers register charges
with the Land Registry ingood time.

•

A lender relies solely on the
Financial Services Registerwhen vetting brokers.

•

Underwriters’ demanding
work targets undermine efforts to contain mortgage
fraud.

4

Mortgagefraud – intermediaries.....................................................................................................
4.2.3

G

This section applies to mortgage intermediaries.
Self-assessment questions:•does your firm satisfy itself that it is able to recognise mortgage
fraud?
•When processing applications, does your firm consider whether the
information the applicant provides is consistent? (For example, isdeclared income believable compared with stated employment? Is
the value of the requested mortgage comparable with what yourfirm knows about the location of the property to be purchased?)•What due diligence does your firm undertake on introducers?
Examples of good practice

Examples of poor practice•

Asking to see original docu•
mentation whether or not thisis required by lenders.

Failing to undertake due diligence on introducers.

•

Using the FCA’s Informationfrom Brokers scheme to report intermediaries it suspects
of involvement in mortgage
fraud.

•

Accepting all applicant information at face value.

•

Treating due diligence as thelender’s responsibility.

Enforcement
action against mortgage brokers.....................................................................................................
4.2.4

G

■ Release 39

Since the FSA began regulating mortgage brokers in October 2004, the FSA
have banned over 100 mortgage brokers. Breaches have included:● Aug 2024

www.handbook.fca.org.uk

FCG 4/5

FCG 4 : Fraud

Section 4.2 : Themes•deliberately submitting to lenders applications containing false or
misleading information; and•failing to have adequate systems and controls in place to deal withthe risk of mortgage fraud.
The FSA have referred numerous cases to law enforcement, a number ofwhich have resulted in criminal convictions.

4

Investment
fraud.....................................................................................................
4.2.5

G

UK consumers are targeted by share-sale frauds and other scams including
land-banking frauds, unauthorised collective investment schemes and Ponzi
schemes. Customers of UK deposit-takers may fall victim to these frauds, orbe complicit in them. We expect these risks to be considered as part ofdeposit-takers’ risk assessments, and for this to inform management’s
decisions about the allocation of resources to a) the detection of fraudsters
among the customer base and b) the protection of potential victims.
Self-assessment questions:•Have the risks of investment fraud (and other frauds where
customers and third parties suffer losses) been considered by thefirm?
•Are resources allocated to mitigating these risks as the result of
purposive decisions by management?
•Are the firm’s anti-money laundering controls able to identify
customers who are complicit in investment fraud?
Examples of good practice

FCG 4/6

Examples of poor practice•

A bank regularly assesses the•risk to itself and its customersof losses from fraud, including
investment fraud, in accordance with their establishedrisk management framework.
The risk assessment does not
only cover situations where
the bank could cover losses,
but also where customers
could lose and not be reimbursed by the bank. Resource
allocation and mitigation
measures are informed by thisassessment.

A bank has performed no risk
assessment that considers therisk to customers from investment fraud.

•

A bank contacts customers if
it suspects a payment is being
made to an investment
fraudster.

•

A bank fails to use actionable,credible information it has
about known or suspected
perpetrators of investment
fraud in its financial crime prevention systems.

•

A bank has transaction monitoring rules designed to detect specific types of invest-•

Ongoing monitoring of commercial accounts is allocatedto customer-facing staff incen-

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 4 : Fraud

Section 4.2 : Themes

Examples of good practice

Examples of poor practicement fraud. Investment fraud
subject matter experts help
set these rules.

tivised to bring in or retain
business.
•

A bank allocates excessive
numbers of commercial accounts to a staff member tomonitor.

4■ Release 39● Aug 2024

www.handbook.fca.org.uk

FCG 4/7

FCG 4 : Fraud

Section 4.3 : Further guidance

4.3

Further guidance

4
4.3.1

G

FCTR contains the following additional material on fraud:•■ FCTR 10 summarises the findings of the Small Firms Financial Crime
Review. It contains guidance directed at small firms on:
Monitoring activity (■ FCTR 10.3.3G)
Responsibilities and risk assessments (■ FCTR 10.3.7G)
General fraud (■ FCTR 10.3.13G)
Insurance fraud (■ FCTR 10.3.14G)
Investment fraud (■ FCTR 10.3.15G)
Mortgage fraud (■ FCTR 10.3.16G)
Staff/Internal fraud (■ FCTR 10.3.17G)• ■ FCTR 11 summarises the findings of the FSA’s thematic review
Mortgage fraud against lenders. It contains guidance on:
Governance, culture and information sharing (■ FCTR 11.3.1G)
Applications processing and underwriting (■ FCTR 11.3.2G)
Mortgage fraud prevention, investigations, and recoveries(■ FCTR 11.3.3G)
Managing relationships with conveyancers, brokers and valuers(■ FCTR 11.3.4G)
Compliance and internal audit (■ FCTR 11.3.5G)
Staff recruitment and vetting (■ FCTR 11.3.6G)
Remuneration structures (■ FCTR 11.3.7G)
Staff training and awareness (■ FCTR 11.3.8G)• ■ FCTR 14 summarises the findings of the FSA’s thematic review
Banks’ defences against investment fraud. It contains guidance
directed at deposit-takers with retail customers on:
Governance (■ FCTR 14.3.2G)
Risk assessment (■ FCTR 14.3.3G)
Detecting perpetrators (■ FCTR 14.3.4G)
Automated monitoring (■ FCTR 14.3.5G)
Protecting victims (■ FCTR 14.3.6G)

FCG 4/8

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 4 : Fraud

Section 4.3 : Further guidanceManagement reporting and escalation of suspicions(■ FCTR 14.3.7G)
Staff awareness (■ FCTR 14.3.8G)
Use of industry intelligence (■ FCTR 14.3.9G)

4.3.2

G

■ FCTR 2 summarises the FSA’s thematic review Firms’ high-level managementof fraud risk.

4■ Release 39● Aug 2024

www.handbook.fca.org.uk

FCG 4/9

FCG 4 : Fraud

Section 4.4 : Sources of further information

4.4

Sources of further information

4
4.4.1

G

To find out more about what FCA is doing about fraud, see:
•Details of the FCA’s Information from Lenders scheme: https://www.fca.org.uk/firms/fraud/report-mortgage-fraud-lenders•Details of the FCA’s Information from Brokers scheme: https://www.fca.org.uk/firms/fraud/report-mortgage-fraud-advisers

4.4.2

G

The list of other bodies engaged in counter-fraud activities is long, but more
information is available from:•Action Fraud, which is the UK’s national fraud reporting centre:
www.actionfraud.police.uk•Fighting Fraud Action (FFA-UK) is responsible for leading thecollective fight against financial fraud on behalf of the UK payments
industry, https://www.financialfraudaction.org.uk/.
•The City of London Police, which has ‘lead authority’ status in the
UK for the investigation of economic crime, including fraud https://www.cityoflondon.police.uk/advice-and-support/fraud-and-economiccrime/Pages/default.aspx•The Fraud Advisory Panel, which acts as an independent voice andsupporter of the counter fraud community:
www.fraudadvisorypanel.org/

FCG 4/10

www.handbook.fca.org.uk■ Release 39● Aug 2024

Data security

Chapter 5
Data security■ Release 39● Aug 2024

www.handbook.fca.org.uk

FCG 5/1

FCG 5 : Data security

Section 5.1 : Introduction

5.1

5

FCG 5/2

Introduction

5.1.1

G

Who should read this chapter? This chapter applies to all firms subject to thefinancial crime rules in ■ SYSC 3.2.6R or ■ SYSC 6.1.1R and to e-money
institutions and payment institutions within our supervisory scope.

5.1.2

G

Customers routinely entrust firms with important personal data; if this falls
into criminal hands, fraudsters can attempt to undertake transactions in thecustomer’s name. Firms must take special care of their customers’ personaldata, and comply with the data protection principles set out in Schedule 1 tothe Data Protection Act 1998. The Information Commissioner’s Officeprovides guidance on the Data Protection Act and the responsibilities it
imposes on data controllers and processors. See section 4 and schedule 1
Data Protection Act 1998.

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 5 : Data security

Section 5.2 : Themes

5.2

Themes5

Governance.....................................................................................................
5.2.1

G

The guidance in ■ FCG 2.2.1G on governance in relation to financial crime also
applies to data security.
Firms should be alert to the financial crime risks associated with holding
customer data and have written data security policies and procedures which
are proportionate, accurate, up to date and relevant to the day-to-day workof staff.
Self-assessment questions:•How is responsibility for data security apportioned?
•Has the firm ever lost customer data? If so, what remedial actions
did it take? Did it contact customers? Did it review its systems?
•How does the firm monitor that suppliers of outsourced services
treat customer data appropriately?
•Are data security standards set in outsourcing agreements, with
suppliers’ performance subject to monitoring?

■ Release 39

Examples of good practice

Examples of poor practice•There is a clear figureheadchampioning the issue ofdata security.

•

The firm does not contact
customers after their data
is lost or compromised.

•

Work, including by internal audit and compliance, is coordinated acrossthe firm, with compliance,
audit, HR, security and IT
all playing a role.

•

Data security is treated asan IT or privacy issue, without also recognising thefinancial crime risk.

•

A firm’s plans to respond•to data loss incidents areclear and include notifying
customers affected by data
loss and offering advice tothose customers about protective measures.

A ‘blame culture’ discourages staff from reporting
data losses.

•

A firm monitors accounts
following a data loss tospot unusual transactions.

The firm is unsure how its
third parties, such as suppliers, protect customer
data.

•

The firm looks at outsourcers’ data security
practices before doing● Aug 2024•

www.handbook.fca.org.uk

FCG 5/3

FCG 5 : Data security

Section 5.2 : Themes

Examples of good practice

Examples of poor practicebusiness, and monitors
compliance.

Five
fallacies of data loss and identity fraud.....................................................................................................
5.2.2

G

5

1. ‘The customer data we hold is too limited or too piecemeal to beof value to fraudsters.’ This is misconceived: skilled fraudsters can
supplement a small core of data by accessing several different public
sources and use impersonation to encourage victims to reveal more.
Ultimately, they build up enough information to pose successfully as
their victim.
2. ‘Only individuals with a high net worth are attractive targets for
identity fraudsters.’ In fact, people of all ages, in all occupations andin all income groups are vulnerable if their data is lost.
3. ‘Only large firms with millions of customers are likely to betargeted.’ Wrong. Even a small firm’s customer database might besold and re-sold for a substantial sum.
4. ‘The threat to data security is external.’ This is not always the case.
Insiders have more opportunity to steal customer data and may do soeither to commit fraud themselves, or to pass it on to organised
criminals.
5. ‘No customer has ever notified us that their identity has beenstolen, so our firm must be impervious to data breaches.’ The truth
may be closer to the opposite: firms that successfully detect data loss
do so because they have effective risk-management systems. Firms
with weak controls or monitoring are likely to be oblivious to any
loss. Furthermore, when fraud does occur, a victim rarely has themeans to identify where their data was lost because data is held inso many places.

Controls.....................................................................................................
5.2.3

G

We expect firms to put in place systems and controls to minimise the riskthat their operation and information assets might be exploited by thieves
and fraudsters. Internal procedures such as IT controls and physical security
measures should be designed to protect against unauthorised access tocustomer data.
Firms should note that we support the Information Commissioner’s position
that it is not appropriate for customer data to be taken off-site on laptops orother portable devices which are not encrypted.
Self-assessment questions:•Is your firm’s customer data taken off-site, whether by staff (sales
people, those working from home) or third parties (suppliers,
consultants, IT contractors etc)?
•If so, what levels of security exist? (For example, does the firm
require automatic encryption of laptops that leave the premises, ormeasures to ensure no sensitive data is taken off-site? If customer

FCG 5/4

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 5 : Data security

Section 5.2 : Themes

data is transferred electronically, does the firm use secure internet
links?)•How does the firm keep track of its digital assets?
•How does it dispose of documents, computers, and imaging
equipment such as photocopiers that retain records of copies? Are
accredited suppliers used to, for example, destroy documents andhard disks? How does the firm satisfy itself that data is disposed ofcompetently?
•How are access to the premises and sensitive areas of the business
controlled?

5•When are staff access rights reviewed? (It is good practice to review
them at least on recruitment, when staff change roles, and when
they leave the firm.)•Is there enhanced vetting of staff with access to lots of data?
•How are staff made aware of data security risks?

■ Release 39

Examples of good practice

Examples of poor practice•Access to sensitive areas (callcentres, server rooms, filingrooms) is restricted.

•

Staff and third party suppliers
can access data they do notneed for their role.

•

The firm has individual user
accounts for all systems containing customer data.

•

Files are not locked away.

•

The firm conducts risk-based,proactive monitoring to ensure employees’ access to customer data is for a genuine
business reason.

•

Password standards are not robust and individuals sharepasswords.

•

IT equipment is disposed of re- •sponsibly, e.g. by using a contractor accredited by the British Security Industry Association.

The firm fails to monitor superusers or other staff with access to large amounts of customer data.

•

Customer data in electronic
form (e.g. on USB sticks, CDs,
hard disks etc) is always
encrypted when taken offsite.

•

Computers are disposed of ortransferred to new users without data being wiped.

•

The firm understands what
checks are done by employment agencies it uses.

•

Staff working remotely do
not dispose of customer data
securely.

•

Staff handling large volumesof data also have access tointernet email.

•Managers assume staff understand data security risks andprovide no training.

•

Unencrypted electronic data is
distributed by post or courier.

● Aug 2024

www.handbook.fca.org.uk

FCG 5/5

FCG 5 : Data security

Section 5.2 : Themes

Case
study – protecting customers’ accounts from criminals.....................................................................................................
5.2.4

G

In December 2007, the FSA fined Norwich Union Life £1.26m for failings in its
anti-fraud systems and controls.
Firms should note that we support the Information Commissioner’s position
that it is not appropriate for customer data to be taken off-site on laptops orother portable devices which are not encrypted.
•Callers to Norwich Union Life call centres were able to satisfy thefirm’s caller identification procedures by providing public information
to impersonate customers.
•Callers obtained access to customer information, including policy
numbers and bank details and, using this information, were able torequest amendments to Norwich Union Life records, includingchanging the addresses and bank account details recorded for thosecustomers.

5•The frauds were committed through a series of calls, often carriedout in quick succession.
•Callers subsequently requested the surrender of customers’ policies. •Over the course of 2006, 74 policies totalling £3.3m were
fraudulently surrendered.
•The firm failed to address issues highlighted by the frauds in an
appropriate and timely manner even after they were identified by its
own compliance department.
•Norwich Union Life’s procedures were insufficiently clear as to who
was responsible for the management of its response to these actualand attempted frauds. As a result, the firm did not give appropriate
priority to the financial crime risks when considering those risks
against competing priorities such as customer service.
For more, see the FSA’s press release: www.fsa.gov.uk/pages/Library/Communication/PR/2007/130.shtml

Casestudy – data security failings.....................................................................................................
5.2.5

G

In August 2010, the FSA fined Zurich Insurance plc, UK branch £2,275,000
following the loss of 46,000 policyholders’ personal details.
•The firm failed to take reasonable care to ensure that it had
effective systems and controls to manage the risks relating to thesecurity of confidential customer information arising out of its
outsourcing arrangement with another Zurich company in South
Africa.
•It failed to carry out adequate due diligence on the data security
procedures used by the South African company and its
subcontractors.
•It relied on group policies without considering whether this was
sufficient and did not determine for itself whether appropriate data

FCG 5/6

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 5 : Data security

Section 5.2 : Themes

security policies had been adequately implemented by the South
African company.
•The firm failed to put in place proper reporting lines. While various
members of senior management had responsibility for data security
issues, there was no single data security manager with overall
responsibility.
•The firm did not discover that the South African entity had lost an
unencrypted back-up tape until a year after it happened.
The FSA’s press release has more details: www.fsa.gov.uk/pages/Library/Communication/PR/2010/134.shtml■ Release 39● Aug 2024

www.handbook.fca.org.uk

5

FCG 5/7

FCG 5 : Data security

Section 5.3 : Further guidance

5.3

5

5.3.1

G

Further guidance

FCTR contains the following additional material on data security:• ■ FCTR 6 summarises the findings of the FSA’s thematic review ofData security in Financial Services and includes guidance on:
Governance (■ FCTR 6.3.1G)
Training and awareness (■ FCTR 6.3.2G)
Staff recruitment and vetting (■ FCTR 6.3.3G)
Controls – access rights (■ FCTR 6.3.4G)
Controls – passwords and user accounts (■ FCTR 6.3.5G)
Controls – monitoring access to customer data (■ FCTR 6.3.6G)
Controls – data back-up (■ FCTR 6.3.7G)
Controls – access to the internet and email (■ FCTR 6.3.8G)
Controls – key-logging devices (■ FCTR 6.3.9G)
Controls – laptop (■ FCTR 6.3.10G)
Controls – portable media including USB devices and CDs(■ FCTR 6.3.11G)
Physical security (■ FCTR 6.3.12G)
Disposal of customer data (■ FCTR 6.3.13G)
Managing third party suppliers (■ FCTR 6.3.14G)
Internal audit and compliance monitoring (■ FCTR 6.3.15G)• ■ FCTR 10 summarises the findings of the Small Firms Financial Crime
Review, and contains guidance directed at small firms on:
Records (■ FCTR 10.3.5G)
Responsibilities and risk assessments (■ FCTR 10.3.7G)
Access to systems (■ FCTR 10.3.8G)
Outsourcing (■ FCTR 10.3.9G)
Physical controls (■ FCTR 10.3.10G)
Data disposal (■ FCTR 10.3.11G)
Data compromise incidents (■ FCTR 10.3.12G)

FCG 5/8

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 5 : Data security

5.4

5.4.1

G

Section 5.4 : Sources of further information

Sources of further information5

To find out more, see•the website of the Information Commissioner’s Office:www.ico.org.uk.

■ Release 39● Aug 2024

www.handbook.fca.org.uk

FCG 5/9

FCG 5 : Data security

Section 5.4 : Sources of further information5

FCG 5/10

www.handbook.fca.org.uk■ Release 39● Aug 2024

Bribery and corruption

Chapter 6
Bribery and corruption■ Release 39● Aug 2024

www.handbook.fca.org.uk

FCG 6/1

FCG 6 : Bribery and corruption

6.1

Section 6.1 : Introduction

Introduction

6.1.1

G

Who should read this chapter? This chapter applies to all firms subject to thefinancial crime rules in ■ SYSC 3.2.6R or ■ SYSC 6.1.1R and to e-money
institutions and payment institutions within our supervisory scope.

6.1.2

G

Bribery, whether committed in the UK or abroad, is a criminal offence underthe Bribery Act 2010, which consolidates and replaces previous anti-bribery
and corruption legislation. The Act introduces a new offence for commercialorganisations of failing to prevent bribery. It is a defence for firms charged
with this offence to show that they had adequate bribery-prevention
procedures in place. The Ministry of Justice has published guidance on
adequate anti-bribery procedures.

6.1.3

G

The FCA does not enforce or give guidance on the Bribery Act. But:

6

•firms which are subject to our rules ■ SYSC 3.2.6R and ■ SYSC 6.1.1R
are under a separate, regulatory obligation to establish and maintaineffective systems and controls to mitigate financial crime risk; and•e-money institutions and payment institutions must satisfy us thatthey have robust governance, effective risk procedures and adequate
internal control mechanisms. See E-Money Reg 6 and Payment Service
Reg 6.

FCG 6/2

6.1.4

GFinancial crime risk includes the risk of corruption as well as bribery, and so is
wider than the Bribery Act’s scope. And we may take action against a firmwith deficient anti-bribery and corruption systems and controls regardless ofwhether or not bribery or corruption has taken place. Principle 1 of ourPrinciples for Business also requires authorised firms to conduct their businesswith integrity. See ■ PRIN 2.1.1R: Principle 1.

6.1.5

G

So while we do not prosecute breaches of the Bribery Act, we have a strong
interest in the anti-corruption systems and controls of firms we supervise,
which is distinct from the Bribery Act’s provisions. Firms should take this into
account when considering the adequacy of their anti-bribery and corruption
systems and controls.

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 6 : Bribery and corruption

6.2

Section 6.2 : Themes

ThemesGovernance.....................................................................................................
6.2.1

G

A firm’s senior management are responsible for ensuring that the firm
conducts its business with integrity and tackles the risk that the firm, or
anyone acting on its behalf, engages in bribery and corruption. A firm’s
senior management should therefore be kept up-to-date with, and stay fully
abreast of, bribery and corruption issues.

6

Self-assessment questions:•What role do senior management play in the firm’s anti-bribery andcorruption effort? Do they approve and periodically review thestrategies and policies for managing, monitoring and mitigating thisrisk? What steps do they take to ensure staff are aware of theirinterest in this area?
•Can your firm’s board and senior management demonstrate a goodunderstanding of the bribery and corruption risks faced by the firm,
the materiality to its business and how to apply a risk-based
approach to anti-bribery and corruption?
•How are integrity and compliance with relevant anti-corruption
legislation considered when discussing business opportunities?
•What information do senior management receive in relation tobribery and corruption, and how frequently? Is it sufficient for senior
management effectively to fulfil their functions in relation to antibribery and corruption?
Examples of good practice■ Release 39

Examples of poor practice•

The firm is committed to carry- •ing out business fairly, honestly and openly.

There is a lack of awarenessof, or engagement in, antibribery and corruption atsenior management or board
level.

•

Senior management lead byexample in complying withthe firm’s anti-corruption policies and procedures.

•An ‘ask no questions’ culture
sees management turn a blindeye to how new business isgenerated.

•

Responsibility for anti-bribery •and corruption systems andcontrols is clearly documented
and apportioned to a single
senior manager or a committee with appropriate terms ofLittle or no management information is sent to the board
about existing and emerging
bribery and corruption risks
faced by the business, including: higher risk third-party re-● Aug 2024

www.handbook.fca.org.uk

FCG 6/3

FCG 6 : Bribery and corruption

Examples of good practiceSection 6.2 : Themes

Examples of poor practicereference and senior management membership who reports ultimately to the board.

•

Anti-bribery systems and controls are subject to audit.

•

Management information submitted to the board ensuresthey are adequately informedof internal and external developments relevant to bribery
and corruption and respondto these swiftly and effectively.

6

lationships or payments; thesystems and controls to mitigate those risks; the effectiveness of these systems andcontrols; and legal and regulatory developments.

Risk
assessment.....................................................................................................
6.2.2

G

The guidance in ■ FCG 2.2.4G on risk assessment in relation to financial crimealso applies to bribery and corruption.
We expect firms to identify, assess and regularly review and update theirbribery and corruption risks. Corruption risk is the risk of a firm, or anyone
acting on the firm’s behalf, engaging in corruption.
Self-assessment questions:•How do you define bribery and corruption? Does your definition
cover all forms of bribery and corrupt behaviour falling within thedefinition of ‘financial crime’ referred to in ■ SYSC 3.2.6R and■ SYSC 6.1.1R or is it limited to ‘bribery’ as that term is defined in the
Bribery Act 2010?
•Where is your firm exposed to bribery and corruption risk? (Haveyou considered risk associated with the products and services you
offer, the customers and jurisdictions with which you do business,
your exposure to public officials and public office holders and yourown business practices, for example your approach to providing
corporate hospitality, charitable and political donations and your useof third parties?)•Has the risk of staff or third parties acting on the firm’s behalf
offering or receiving bribes or other corrupt advantage beenassessed across the business?
•Who is responsible for carrying out a bribery and corruption risk
assessment and keeping it up to date? Do they have sufficient levelsof expertise and seniority?

FCG 6/4

Examples of good practice

Examples of poor practice••Corruption risks are assessedin all jurisdictions where thefirm operates and across all
business channels.

www.handbook.fca.org.uk

Departments responsible for
identifying and assessing
bribery and corruption risk
are ill equipped to do so.

■ Release 39● Aug 2024

FCG 6 : Bribery and corruption

Examples of good practice•Section 6.2 : Themes

Examples of poor practice

The firm considers factors that •might lead business units to
downplay the level of bribery
and corruption risk to which
they are exposed, such as lackof expertise or awareness, or
potential conflicts of interest.
•

For fear of harming the business, the firm classifies as low
risk a jurisdiction generally associated with high risk.

The risk assessment is only
based on generic, externalsources.

Policiesand procedures.....................................................................................................
6.2.3

G

6

The guidance in ■ FCG 2.2.5G on policies and procedures in relation tofinancial crime and in ■ FCG 2.2.6G on staff recruitment, vetting, training,awareness and remuneration also applies to bribery and corruption.
Firms’ policies and procedures to reduce their financial crime risk must covercorruption and bribery.
Self-assessment questions:•Do your anti-bribery and corruption policies adequately address allareas of bribery and corruption risk to which your firm is exposed,
either in a stand-alone document or as part of separate policies? (forexample, do your policies and procedures cover: expected standardsof behaviour; escalation processes; conflicts of interest; expenses,
gifts and hospitality; the use of third parties to win business;
whistleblowing; monitoring and review mechanisms; and disciplinary
sanctions for breaches?)•Have you considered the extent to which corporate hospitality
might influence, or be perceived to influence, a business decision? Do
you impose and enforce limits that are appropriate to your businessand proportionate to the bribery and corruption risk associated withyour business relationships?
•How do you satisfy yourself that your anti-corruption policies andprocedures are applied effectively?
•How do your firm’s policies and procedures help it to identify
whether someone acting on behalf of the firm is corrupt?
•How does your firm react to suspicions or allegations of bribery or
corruption involving people with whom the firm is connected?
Examples of good practice■ Release 39

Examples of poor practice•

The firm clearly sets out beha- •viour expected of those acting
on its behalf.

The firm does not assess theextent to which staff comply
with its anti-corruption policies and procedures.

•

There are unambiguous consequences for breaches of thefirm’s anti-corruption policy.

The firm’s anti-corruption policies and procedures are outof date.

● Aug 2024•

www.handbook.fca.org.uk

FCG 6/5

FCG 6 : Bribery and corruption

Examples of good practiceSection 6.2 : Themes

Examples of poor practice•

Risk-based, appropriate addi- •tional monitoring and due diligence are undertaken for jurisdictions, sectors and business
relationships identified as
higher risk.

A firm relies on passages inthe staff code of conduct thatprohibit improper payments,
but has no other controls.

•

Staff responsible for implementing and monitoring antibribery and corruption policies and procedures have adequate levels of anti-corruption expertise.

•

The firm does not record corporate hospitality given or
received.

•

Where appropriate, the firm•refers to existing sources of information, such as expense registers, policy queries andwhistleblowing and complaints hotlines, to monitor
the effectiveness of its antibribery and corruption policies and procedures.

The firm does not respond toexternal events that may highlight weaknesses in its anticorruption systems andcontrols.

•

Political and charitable dona- •tions are subject to appropriate due diligence and are approved at an appropriate management level, with compliance input.

The firm fails to consider
whether clients or charities
who stand to benefit from corporate hospitality or donations have links to relevant political or administrative decision-makers.

•

Firms who do not provide•
staff with access towhistleblowing hotlines haveprocesses in place to allow
staff to raise concerns in confidence or, where possible, anonymously, with adequatelevels of protection.

The firm fails to maintain records of incidents andcomplaints.

6

See ■ SYSC 3.2.6R and ■ SYSC 6.1.1R.

Dealingwith third parties.....................................................................................................
6.2.4

G

We expect firms to take adequate and risk-sensitive measures to address therisk that a third party acting on behalf of the firm may engage in corruption.
Self-assessment questions:•Do your firm’s policies and procedures clearly define ‘third party’?
•Do you know your third party?
•What is your firm’s policy on selecting third parties? How do you
check whether it is being followed?
•To what extent are third-party relationships monitored andreviewed? Is the frequency and depth of the monitoring and review
commensurate to the risk associated with the relationship?

FCG 6/6

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 6 : Bribery and corruption

Section 6.2 : Themes•Is the extent of due diligence on third parties determined on a risksensitive basis? Do you seek to identify any bribery and corruption
issues as part of your due diligence work, e.g. negative allegations
against the third party or any political connections? Is due diligence
applied consistently when establishing and reviewing third-party
relationships?
•Is the risk assessment and due diligence information kept up to
date? How?
•Do you have effective systems and controls in place to ensure
payments to third parties are in line with what is both expected andapproved?

■ Release 39

Examples of good practice

Examples of poor practice•

Where a firm uses third parties to generate business,these relationships are subject
to thorough due diligenceand management oversight.

•

A firm using intermediaries
fails to satisfy itself that thosebusinesses have adequate controls to detect and prevent
where staff have used bribery
to generate business.

•

The firm reviews in sufficientdetail its relationships withthird parties on a regular basis to confirm that it is stillnecessary and appropriate tocontinue with the relationship.

•

The firm fails to establish andrecord an adequate commercial rationale to support its
payments to overseas third
parties. For example, why it isnecessary to use a third party
to win business and what services would the third party
provide to the firm?

•

Third parties are paid directly
for their work.

•

The firm is unable to produce
a list of approved third parties, associated due diligenceand details of payments madeto them.

•

The firm includes specific anti- •bribery and corruption clauses
in contracts with third parties.

The firm does not discourage
the giving or receipt of cash
gifts.

•

The firm provides anti-bribery
and corruption training tothird parties where appropriate.

•

There is no checking of compliance’s operational role inapproving new third-party relationships and accounts.

•

The firm reviews and monitors payments to third parties. It records the purpose ofthird-party payments.

•

A firm assumes that longstanding third-party relationships present no bribery or
corruption risk.

•

There are higher or extra•
levels of due diligence and ap-

A firm relies exclusively on informal means to assess the● Aug 2024

www.handbook.fca.org.uk

6

FCG 6/7

FCG 6 : Bribery and corruption

Examples of good practiceproval for high risk thirdparty relationships.

6•

There is appropriate scrutinyof and approval for relationships with third parties that introduce business to the firm.

•

The firm’s compliance function has oversight of all thirdparty relationships and monitors this list to identify risk indicators, for example a third
party’s political or public service connections.

Section 6.2 : Themes

Examples of poor practicebribery and corruption risks associated with third parties,
such as staff’s personal knowledge of the relationship withthe overseas third parties.

Case
study – corruption risk.....................................................................................................
6.2.5

G

In January 2009, Aon Limited, an insurance intermediary based in the UK,
was fined £5.25m for failures in its anti-bribery systems and controls.
The firm made suspicious payments totalling $7m to overseas firms andindividuals who helped generate business in higher risk jurisdictions. Weakcontrols surrounding these payments to third parties meant the firm failed
to question their nature and purpose when it ought to have been reasonably
obvious to it that there was a significant corruption risk.
•Aon Limited failed properly to assess the risks involved in its
dealings with overseas third parties and implement effective controls
to mitigate those risks.
•Its payment procedures did not require adequate levels of due
diligence to be carried out.
•Its authorisation process did not take into account the higher levelsof risk to which certain parts of its business were exposed in the
countries in which they operated.
•After establishment, neither relationships nor payments wereroutinely reviewed or monitored.
•Aon Limited did not provide relevant staff with sufficient guidanceor training on the bribery and corruption risks involved in dealings
with overseas third parties.
•It failed to ensure that the committees it appointed to oversee
these risks received relevant management information or routinely
assessed whether bribery and corruption risks were being managed
effectively.
See the FSA’s press release:www.fsa.gov.uk/pages/Library/Communication/PR/
2009/004.shtml

FCG 6/8

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 6 : Bribery and corruption

Section 6.2 : Themes

Case study – inadequate anti-bribery and corruption systems
andcontrols.....................................................................................................
6.2.6

G

In July 2011, the FSA fined Willis Limited, an insurance intermediary, £6.9m
for failing to take appropriate steps to ensure that payments made tooverseas third parties were not used for corrupt purposes. Between January2005 and December 2009, Willis Limited made payments totalling £27m tooverseas third parties who helped win and retain business from overseas
clients, particularly in high risk jurisdictions.
Willis had introduced anti-bribery and corruption policies in 2008, reviewed
how its new policies were operating in practice and revised its guidance as aresult in May 2009. But it should have taken additional steps to ensure they
were adequately implemented.
•Willis failed to ensure that it established and recorded an adequate
commercial rationale to support its payments to overseas third
parties.

6•It did not ensure that adequate due diligence was carried out on
overseas third parties to evaluate the risk involved in doing businesswith them.
•It failed to review in sufficient detail its relationships with overseas
third parties on a regular basis to confirm whether it was necessary
and appropriate to continue with the relationship.
•It did not adequately monitor its staff to ensure that each time it
engaged an overseas third party an adequate commercial rationale
had been recorded and that sufficient due diligence had been carriedout.
See the FSA’s press release: www.fsa.gov.uk/pages/Library/Communication/PR/
2011/066.shtml.

■ Release 39● Aug 2024

www.handbook.fca.org.uk

FCG 6/9

FCG 6 : Bribery and corruption

6.3

6.3.1

G

Section 6.3 : Further guidance

Further guidance

FCTR contains the following additional material on bribery and corruption:• ■ FCTR 9 summarises the findings of the FSA’s thematic review Antibribery and corruption in commercial insurance broking and includes
guidance on:

6

Governance and management information (■ FCTR 9.3.1G)
Risk assessment and responses to significant bribery andcorruption events (■ FCTR 9.3.2G)
Due diligence on third-party relationships (■ FCTR 9.3.3G)
Payment controls (■ FCTR 9.3.4G)
Staff recruitment and vetting (■ FCTR 9.3.5G)
Training and awareness (■ FCTR 9.3.6G)
Risk arising from remuneration structures (■ FCTR 9.3.7G)
Incident reporting (■ FCTR 9.3.8G)
The role of compliance and internal audit (■ FCTR 9.3.9G)• ■ FCTR 13 summarises the findings of the FSA’s thematic review on
Anti-bribery and corruption systems and controls in investment banks
and includes guidance on:
Governance and management information (■ FCTR 13.3.2G)
Assessing bribery and corruption risk (■ FCTR 13.3.3G)
Policies and procedures (■ FCTR 13.3.4G)
Third party relationships and due diligence (■ FCTR 13.3.5G)
Payment controls (■ FCTR 13.3.6G)
Gifts and hospitality (■ FCTR 13.3.7G)
Staff recruitment and vetting (■ FCTR 13.3.8G)
Training and awareness (■ FCTR 13.3.9G)
Remuneration structures (■ FCTR 13.3.10G)
Incident reporting and management (■ FCTR 13.3.11G)

FCG 6/10

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 6 : Bribery and corruption

6.4

6.4.1

G

Section 6.4 : Sources of further information

Sources of further information

To find out more, see:
•The Bribery Act 2010: www.legislation.gov.uk/ukpga/2010/23/
contents

6•The Ministry of Justice’s guidance about procedures which relevant
commercial organisations can put into place to prevent persons
associated with them from bribing: https://www.justice.gov.uk/
downloads/legislation/bribery-act-2010-guidance.pdf (full version)
https://www.justice.gov.uk/downloads/legislation/bribery-act-2010quick-start-guide.pdf (quick start guide)•Our one-minute guide for smaller firms on anti-bribery andcorruption: https://www.fca.org.uk/firms/financial-crime/briberycorruption■ Release 39● Aug 2024

www.handbook.fca.org.uk

FCG 6/11

FCG 6 : Bribery and corruption

Section 6.4 : Sources of further information

6

FCG 6/12

www.handbook.fca.org.uk■ Release 39● Aug 2024

Sanctions and asset freezes

Chapter 7
Sanctions and asset freezes■ Release 39● Aug 2024

www.handbook.fca.org.uk

FCG 7/1

FCG 7 : Sanctions and asset
freezes

7.1

Introduction

7.1.1

G

Who should read this chapter? All firms are required to comply with the UK’s
financial sanctions regime. The FCA’s role is to ensure that the firms it
supervises have adequate systems and controls to do so. As such, this chapter
applies to all firms subject to the financial crime rules in ■ SYSC 3.2.6R or■ SYSC 6.1.1R. It also applies to e-money institutions and payment institutions
within our supervisory scope.

7.1.2

G

Firms’ systems and controls should also address, where relevant, the risks
they face from weapons proliferators, although these risks will be very low
for the majority of FSA-supervised firms. ■ FCG 7.2.5G, which looks at
weapons proliferation, applies to banks carrying out trade finance businessand those engaged in other activities, such as project finance and insurance,
for whom the risks are greatest.

7.1.3

G

[deleted]

7.1.4

G

Financial sanctions are restrictions put in place by the UK government or themultilateral organisations that limit the provision of certain financial services
or restrict access to financial markets, funds and economic resources in orderto achieve a specific foreign policy or national security objective.

7.1.5

G

All individuals and legal entities who are within or undertake activities
within the UK’s territory must comply with the EU and UK financial sanctions
that are in force. All UK nationals and UK legal entities established under UK
law, including their branches, must also comply with UK financial sanctions
that are in force, irrespective of where their activities take place.

7.1.5AGThe Office of Financial Sanctions (OFSI) within the Treasury maintains a
Consolidated List of financial sanctions targets designated by the United
Nations, the European Union and the United Kingdom, which is available
from its website. If firms become aware of a breach, they must notify OFSI in
accordance with the relevant provisions. OFSI have published guidance oncomplying with UK obligations and this is available on their website. See
https://www.gov.uk/government/publications/financial-sanctions-faqs.

7.1.6

G

Alongside financial sanctions, the government imposes controls on certain
types of trade. As part of this, the export of goods and services for use innuclear, radiological, chemical or biological weapons programmes is subject
to strict controls. Proliferators seek to gain access to this technology illegally:7

FCG 7/2

Section 7.1 : Introductionwww.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 7 : Sanctions and asset
freezes

Section 7.1 : Introduction

aiding them is an offence under the Anti-Terrorism, Crime and Security Act
2001. Note that the Treasury can also use powers under the Counter
Terrorism Act 2008 (see ■ FCG Annex 1) to direct financial firms to, say, ceasebusiness with certain customers involved in proliferation activity.

7■ Release 39● Aug 2024

www.handbook.fca.org.uk

FCG 7/3

FCG 7 : Sanctions and asset
freezes

7.2

Section 7.2 : Themes

ThemesGovernance.....................................................................................................
7.2.1

G

The guidance in ■ FCG 2.2.1G on governance in relation to financial crime also
applies to sanctions.
Senior management should be sufficiently aware of the firm’s obligations
regarding financial sanctions to enable them to discharge their functions
effectively.

7

Self-assessment questions:•Has your firm clearly allocated responsibility for adherence to the
sanctions regime? To whom?
•How does the firm monitor performance? (For example, statistical or
narrative reports on matches or breaches.)
Examples of good practice

Examples of poor practice•

An individual of sufficient au- •thority is responsible for overseeing the firm’s adherence tothe sanctions regime.

The firm believes payments tosanctioned individuals and entities are permitted when thesums are small. Without a licence from the Asset Freezing
Unit, this could be a criminal
offence.

•

It is clear at what stage customers are screened in different situations (e.g. when customers are passed fromagents or other companies in
the group).

•

No internal audit resource isallocated to monitoring sanctions compliance.

•

There is appropriate escalation of actual target matches
and breaches of UK sanctions.
Notifications are timely.

•

Some business units in a largeorganisation think they are
exempt.

The offence will depend on the sanctions provisions breached.

Risk
assessment.....................................................................................................
7.2.2

G

The guidance in ■ FCG 2.2.4G on risk assessment in relation to financial crimealso applies to sanctions.
A firm should consider which areas of its business are most likely to provide
services or resources to individuals or entities on the Consolidated List.
Self-assessment questions:

FCG 7/4

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 7 : Sanctions and asset
freezes

Section 7.2 : Themes•Does your firm have a clear view on where within the firm breaches
are most likely to occur? (This may cover different business lines,
sales channels, customer types, geographical locations, etc.)•How is the risk assessment kept up to date, particularly after thefirm enters a new jurisdiction or introduces a new product?
Examples of good practice

Examples of poor practice•

A firm with international op- •erations, or that deals in currencies other than sterling, understands the requirements ofrelevant local financial sanctions regimes.

There is no process for updating the risk assessment.

•

A small firm is aware of the•
sanctions regime and where it
is most vulnerable, even if risk
assessment is only informal.

The firm assumes financial
sanctions only apply tomoney transfers and so has
not assessed its risks.

7
Screeningcustomers against sanctions lists.....................................................................................................
7.2.3

G

A firm should have effective, up-to-date screening systems appropriate to
the nature, size and risk of its business. Although screening itself is not alegal requirement, screening new customers and payments against theConsolidated List, and screening existing customers when new names areadded to the list, helps to ensure that firms will not breach the sanctions
regime. (Some firms may knowingly continue to retain customers who arelisted under UK sanctions: this is permitted if OFSI has granted a licence.)
Self-assessment questions:•When are customers screened against lists, whether theConsolidated List, internal watchlists maintained by the firm, or lists
from commercial providers? (Screening should take place at the timeof customer take-on. Good reasons are needed to justify the risk
posed by retrospective screening, such as the existence of generallicences.)•If a customer was referred to the firm, how does the firm ensure
the person is not listed? (Does the firm screen the customer against
the list itself, or does it seek assurances from the referring party?)•How does the firm become aware of changes to the Consolidated
List? (Are there manual or automated systems? Are customer lists
rescreened after each update is issued?)■ Release 39

Examples of good practice

Examples of poor practice•

The firm has considered what
mixture of manual and automated screening is most appropriate.

•

The firm assumes that an intermediary has screened a customer, but does not check
this.

•

There are quality control•
checks over manual screening.

Where a firm uses automatedsystems, it does not understand how to calibrate themand does not check whether● Aug 2024

www.handbook.fca.org.uk

FCG 7/5

FCG 7 : Sanctions and asset
freezes

Examples of good practiceSection 7.2 : Themes

Examples of poor practicethe number of hits is unexpectedly high or low.

7•

Where a firm uses automated •systems these can make ‘fuzzy
matches’ (e.g. able to identify
similar or variant spellings ofnames, name reversal, digit rotation, character manipulation, etc.).

An insurance company only
screens when claims are madeon a policy.

•

The firm screens customers’
directors and known beneficial owners on a risk-sensitive
basis.

Screening of customer databases is a one-off exercise.

•

Where the firm maintains an•account for a listed individual,
the status of this account isclearly flagged to staff.

Updating from the Consolidated List is haphazard. Somebusiness units use out-of-datelists.

•

A firm only places faith in•other firms’ screening (such as
outsourcers or intermediaries)
after taking steps to satisfy
themselves this is appropriate.

The firm has no means ofmonitoring payment instructions.

•

Matchesand escalation.....................................................................................................
7.2.4

G

When a customer’s name matches a person on the Consolidated List it willoften be a ‘false positive’ (e.g. a customer has the same or similar name but
is not the same person). Firms should have procedures for identifying wherename matches are real and for freezing assets where this is appropriate.
Self-assessment questions:•What steps does your firm take to identify whether a name match isreal? (For example, does the firm look at a range of identifier
information such as name, date of birth, address or other customer
data?)•Is there a clear procedure if there is a breach? (This might cover, forexample, alerting senior management, the Treasury and the FCA, andgiving consideration to a Suspicious Activity Report.)

FCG 7/6

Examples of good practice

Examples of poor practice•

Sufficient resources are available to identify ‘false
positives’.

•

The firm does not report a
breach of the financial sanctions regime to OFSI: this
could be a criminal offence.

•

After a breach, as well as
meeting its formal obligation
to notify OFSI, the firm considers whether it should report the breach to the FCA.
SUP 15.3 contains general notification requirements. Firms•

An account is not frozen
when a match with the Consolidated List is identified. If,
as a consequence, funds held,
owned or controlled by a designated person are dealt withor made available to the des-www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 7 : Sanctions and asset
freezes

Examples of good practiceSection 7.2 : Themes

Examples of poor practice

are required to tell us, for example, about significant rulebreaches (see SUP 15.3.11R(1)).
Firms should therefore consider whether the breach is
the result of any matterwithin the scope of SUP 15.3,
for example a significant failure in their financial crime systems and controls.

ignated person, this could bea criminal offence.

•

A lack of resources prevents a
firm from adequately analysing matches.

•

No audit trail of decisions
where potential target
matches are judged to befalse positives.

7

The offence will depend on the sanctions provisions breached.

Weapons
proliferation.....................................................................................................
7.2.5

G

Alongside financial sanctions, the government imposes controls on certain
types of trade in order to achieve foreign policy objectives. The export ofgoods and services for use in nuclear, radiological, chemical or biologicalweapons programmes is subject to strict controls. Firms’ systems and controls
should address the proliferation risks they face.
Self-assessment questions:•Does your firm finance trade with high risk countries? If so, isenhanced due diligence carried out on counterparties and goods?
Where doubt remains, is evidence sought from exporters that thetrade is legitimate?
•Does your firm have customers from high risk countries, or with ahistory of dealing with individuals and entities from such places? If
so, has the firm reviewed how the sanctions situation could affectsuch counterparties, and discussed with them how they may beaffected by relevant regulations?
•What other business takes place with high risk jurisdictions, andwhat measures are in place to contain the risks of transactions being
related to proliferation?
Examples of good practice•■ Release 39

Examples of poor practice

A bank has identified if its cus- •tomers export goods to highrisk jurisdictions, and subjects
transactions to enhanced
scrutiny by identifying, for example, whether goods may besubject to export restrictions,or end-users may be ofconcern.

● Aug 2024

The firm assumes customers
selling goods to countries ofconcern will have checked theexports are legitimate, anddoes not ask for evidence of
this from customers.

www.handbook.fca.org.uk

FCG 7/7

FCG 7 : Sanctions and asset
freezes

Section 7.2 : Themes

Examples of good practice

Examples of poor practice•

Where doubt exists, the bankasks the customer to demonstrate that appropriate assurances have been gained fromrelevant government authorities.

•

A firm knows that its customers deal with individuals
and entities from high risk jurisdictions but does not communicate with those customers about relevant regulations in place and how they affect them.

•

The firm has considered how
to respond if the government
takes action under the Counter-Terrorism Act 2008 against
one of its customers.

•[deleted]Casestudy – deficient sanctions systems and controls.....................................................................................................
7.2.6

7

G

In August 2010, the FSA fined Royal Bank of Scotland (RBS) £5.6m for
deficiencies in its systems and controls to prevent breaches of UK financial
sanctions.
•RBS failed adequately to screen its customers – and the payments
they made and received – against the sanctions list, thereby running
the risk that it could have facilitated payments to or from sanctioned
people and organisations.
•The bank did not, for example, screen cross-border payments madeby its customers in sterling or euros.
•It also failed to ensure its ‘fuzzy matching’ software remained
effective, and, in many cases, did not screen the names of directors
and beneficial owners of customer companies.
The failings led the FSA to conclude that RBS had breached the Money
Laundering Regulations 2007, and our penalty was imposed under thatlegislation – a first for the FSA.
For more information see the FSA’s press release: www.fsa.gov.uk/pages/
Library/Communication/PR/2010/130.shtml

FCG 7/8

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 7 : Sanctions and asset
freezes

7.3

7.3.1

G

Section 7.3 : Further guidance

Further guidance

FCTR contains the following additional material on sanctions and assets
freezes:• ■ FCTR 8 summarises the findings of the FSA’s thematic review
Financial services firms’ approach to UK financial sanctions andincludes guidance on:

7

Senior management responsibility (■ FCTR 8.3.1G)
Risk assessment (■ FCTR 8.3.2G)
Policies and procedures (■ FCTR 8.3.3G)
Staff training and awareness (■ FCTR 8.3.4G)
Screening during client take-on (■ FCTR 8.3.5G)
Ongoing screening (■ FCTR 8.3.6G)
Treatment of potential target matches (■ FCTR 8.3.7G)• ■ FCTR 15 summarises the findings of the FCA’s thematic review
Banks’ management of financial crime risk in trade finance andincludes guidance on:
Sanctions Procedures (■ FCTR 15.3.7G)
Dual-Use Goods (■ FCTR 15.3.8G)■ Release 39● Aug 2024

www.handbook.fca.org.uk

FCG 7/9

FCG 7 : Sanctions and asset
freezes

7.4

7.4.1

G

Section 7.4 : Sources of further information

Sources of further information

To find out more on financial sanctions, see:
•OFSI’s website: https://www.gov.uk/government/organisations/officeof-financial-sanctions-implementation•OFSI provides FAQs on financial sanctions- https://www.gov.uk/
government/publications/financial-sanctions-faqs

7•Part III of the Joint Money Laundering Steering Group’s guidance,
which is a chief source of guidance for firms on this topic:
www.jmlsg.org.uk

7.4.2

G

To find out more on trade sanctions and proliferation, see:•Part III of the Joint Money Laundering Steering Group’s guidance on
the prevention of money laundering and terrorist financing, whichcontains a chapter on proliferation financing that should be firms’
chief source of guidance on this topic: www.jmlsg.org.uk•The website of the UK’s Export Control Organisation, which contains
much useful information, including lists of equipment requiring alicence to be exported to any destination, because they are either
military items or ‘dual use’ https://www.gov.uk/government/
organisations/export-control-organisation•The NCA’s website, which contains guidelines on how to reportsuspicions related to weapons proliferation:http://
www.nationalcrimeagency.gov.uk/publications/suspicious-activityreports-sars/57-sar-guidance-notes•The FATF website. In June 2008, FATF launched a ‘Proliferation
Financing Report’ that includes case studies of past proliferation
cases, including some involving UK banks. This was followed up witha report in February 2010:https://www.fatf-gafi.org/media/fatf/
documents/reports/
Typologies%20Report%20on%20Proliferation%20Financing.pdf .
http://www.fatf-gafi.org/media/fatf/documents/reports/Status-reportproliferation-financing.pdf.

FCG 7/10

www.handbook.fca.org.uk■ Release 39● Aug 2024

Insider dealing and market manipulation

Chapter 8
Insider dealing and market
manipulation■ Release 39● Aug 2024

www.handbook.fca.org.uk

FCG 8/1

FCG 8 : Insider dealing andmarket manipulation

Section 8.1 : Introduction

8.1

Introduction

8.1.1

G

Who should read this chapter? This chapter applies to firms subject to■ SYSC 6.1.1R.

8.1.2

G

Insider dealing is a criminal offence under section 52 of the Criminal Justice
Act 1993. Sections 89-91 of the Financial Services Act 2012 set out a range of
behaviours which amount to criminal offences, which are together referred
to in this guide as market manipulation.

8.1.3

G

Section 1H(3) of the Act defines financial crime to include ‘any offence
involving:

8(a) fraud or dishonesty,(b) misconduct in, or misuse of information relating to, a financial
market,(c) handling the proceeds of crime, or(d) the financing of terrorism’.
Insider dealing and market manipulation both meet this definition, inparticular because they involve misconduct in a financial market.

FCG 8/2

8.1.4

G

To avoid doubt, all references to insider dealing and market manipulation inthis chapter refer to the criminal offences set out above. This chapter does
not seek to reproduce a list of those markets, particularly because that list
may change over time. Therefore, all references to ‘financial markets’ and‘markets’ in this chapter refer to the markets to which the criminal regimesof insider dealing and market manipulation apply, unless the context
specifies otherwise. The civil offences of insider dealing, unlawful disclosureof inside information and market manipulation set out in the Market Abuse
Regulation are referred to collectively herein as market abuse.

8.1.5

G

We recognise that many firms will not distinguish between the criminal orcivil regimes for the purposes of conducting surveillance and monitoring of
their clients’ and employees’ activities. As such, firms may find it simpler toconsider this guidance as applying to all instruments to which both theMarket Abuse Regulation and the criminal regimes set out in ■ FCG 8.1.2G
apply. Note though that the FCA cannot and does not mandate that thisguidance applies to those financial instruments which are captured by theMarket Abuse Regulation, but not by the criminal regimes set out above.
www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 8 : Insider dealing andmarket manipulation

8.1.6

G

Section 8.1 : Introduction

To commit insider dealing, as well as certain forms of market manipulation,
the perpetrator must typically engage with, or work within, a firm able toaccess the relevant financial markets on their behalf. It is critical that firmsthat offer access to relevant financial markets have adequate policies andprocedures to counter the risk that the firm might be used to further
financial crime, in accordance with ■ SYSC 6.1.1R.
FCG is not intended to be prescriptive to every business model type. It is
incumbent upon a firm to ensure that its policies, procedures and risk
framework are tailored and appropriate to the nature of its business, egclient type(s), product type(s), means of order transmission and execution,risks posed by employees, etc.

8.1.7

G

On 3 July 2016, Market Abuse Regulation came into force. The Market Abuse
Regulation sets out the civil offences of market abuse. Article 16 of theMarket Abuse Regulation also imposes specific requirements on:•Market operators and investment firms that operate a trading
venue to establish and maintain effective arrangements, systems andprocedures aimed at detecting and preventing insider dealing,
market manipulation and attempted insider dealing and market
manipulation. Such persons shall report orders and transactions that
could constitute insider dealing or market manipulation (or attempts
at such) to the competent authority of the trading venue. This is
imposed under article 16(1).

8•Any person professionally arranging or executing transactions toestablish and maintain effective arrangements, systems andprocedures to detect and report suspicious orders and transactions.
This is imposed under article 16(2).

8.1.8

G

There is a key distinction between the obligations under article 16(2) of theMarket Abuse Regulation and the requirements of ■ SYSC 6.1.1R. Article 16(2)of the Market Abuse Regulation requires persons professionally arranging or
executing transactions to establish arrangements, systems and procedures todetect and report potential market abuse, whereas ■ SYSC 6.1.1R requires
firms to have policies and procedures for countering the risk that the firmmight be used to further financial crime. (As noted above, article 16(1) of theMarket Abuse Regulation obliges market operators and investment firmsthat operate a trading venue to have systems aimed at preventing as well as
detecting potential market abuse). This document does not provide any FCA
guidance in relation to the Market Abuse Regulation article 16.

8.1.9

G

Appropriate policies and procedures for countering the risk that the firmmight be used to further financial crime are likely to fall into two distinct
categories:(1) Identification of, and taking steps to counter financial crime pretrade, and(2) Mitigation of future risks posed by clients or employees who havebeen identified as having already traded suspiciously.

■ Release 39● Aug 2024

www.handbook.fca.org.uk

FCG 8/3

FCG 8 : Insider dealing andmarket manipulation

8.1.10G

Section 8.1 : Introduction

Firms which have identified activity they suspect may amount to insider
dealing or market manipulation should consider their further obligations inrelation to countering the risk of financial crime should the relevant client
seek to transfer or use the proceeds of that suspicious activity (see ■ FCG 3).
This includes, where appropriate, seeking consent from the National Crime
Agency.

8

FCG 8/4

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 8 : Insider dealing andmarket manipulation

8.2

Section 8.2 : Themes

ThemesGovernance.....................................................................................................
8.2.1

G

The guidance in ■ FCG 2.2.1G above on governance in relation to financial
crime also applies to insider dealing and market manipulation.
We expect senior management to take responsibility for the firm’s measuresin relation to insider dealing and market manipulation. This includes:•Understanding the risks of insider dealing or market manipulationthat their firm is exposed to (both through employee and client
activity).

8•Establishing adequate policies and procedures to counter the riskthat their firm is used to further these offences in accordance with
■ SYSC 6.1.1R.
Senior management should also be aware and manage the potential conflictof interest which may arise from the firm’s focus on revenue generation
versus its obligation to counter the risk of the firm being used to further
financial crime.
Self-assessment questions:•Does the firm’s senior management team understand the legal
definitions of insider dealing and market manipulation, and the ways
in which the firm may be exposed to the risk of these crimes?
•Does the firm’s senior management team regularly receive
management information in relation to suspected insider dealing or
market manipulation?
•How does senior management make sure that the firm’s systems
and controls for detecting insider dealing and market manipulation
are robust? How do they set the tone from the top?
•How does the firm’s MLRO interact with the individual/departments
responsible for order and trade surveillance/monitoring?
•How does senior management make decisions in relation toconcerns about potential insider dealing or market manipulation
raised to them by Compliance or another function? Do they act
appropriately to mitigate these risks?
•How does senior management make sure that its employees havethe appropriate training to identify potential insider dealing andmarket manipulation?

■ Release 39● Aug 2024

www.handbook.fca.org.uk

FCG 8/5

FCG 8 : Insider dealing andmarket manipulation

Section 8.2 : Themes

Examples of good practice

Examples of poor practice•Senior management are able•
to recognise and articulate
the warning signs that insider
dealing and market manipulation might be taking place.

There is little evidence thatpossible insider dealing or
market manipulation is taken
seriously by senior management. Addressing these risks isseen as a legal or regulatory
necessity rather than a matterof true concern for thebusiness.

•

Senior management regularly •receive management information in relation to any possible insider dealing or market
manipulation that occurs.

Senior management considers
revenue above obligations tocounter financial crime.

•

The individual(s) responsible•
for overseeing the firm’s monitoring for suspected insider
dealing and market manipulation has regular interaction
and shares relevant information with the MLRO.

Senior management considers
the firm’s financial crime obligations are fulfilled solely bysubmitting a STOR and/or
SAR.

•

Senior management appropriately supports decisions proposed by Compliance.

The Compliance function has
limited independence and thefirst line can block concerns
from being escalated.

8

•

Risk
assessment.....................................................................................................
8.2.2

G

The guidance in ■ FCG 2.2.4G above on risk assessment in relation to financial
crime also applies to insider dealing and market manipulation.
Firms should assess and regularly review the risk that they may be used tofacilitate insider dealing or market manipulation. A number of factors should
be incorporated into this assessment, including the client types, products,
instruments and services offered/ provided by the firm. Firms’ assessments
should also consider the risk which employees may pose too.
Firms should consider how their policies and procedures seek to mitigate thefinancial crime risks they have identified. This could include, but is not
limited to:•undertaking enhanced order and transaction monitoring on clientsor employees,•setting client specific pre-trade limits, and•ultimately declining business or terminating client or employee
relationships if appropriate (see ■ FCG 8.2.3 for more detail).
Self-assessment questions:•Has the firm considered whether any of the products/services it
offers, or the clients it has, pose a greater risk that the firm might beused to facilitate insider dealing or market manipulation? How has
the firm determined this?

FCG 8/6

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 8 : Insider dealing andmarket manipulation

Section 8.2 : Themes•Who is responsible for carrying out the risk assessment and keeping
it up to date? Do they have sufficient levels of expertise (including
markets and financial crime knowledge) and seniority?
What framework does the firm have in place for assessing the risk ofinsider dealing and market manipulation being committed by its
employees?
•How does the firm use its risk assessment when deciding whichbusiness to accept?
•How often is the risk framework reviewed and who approves it? •How does the firm’s risk framework for countering the risk of insider
dealing and market manipulation interact with the firm’s AML risk
framework? Are the risk assessments aligned?
Examples of good practice

Examples of poor practice•Insider dealing and market
manipulation risks are assessed across every asset class
to which the criminal regimesof insider dealing and market
manipulation apply, andacross all client types withwhich the firm operates.

••

There is evidence that thefirm’s risk assessment informs
the design of its surveillance
controls.

•

An inappropriate risk classification system makes it almost impossible for a client relationship to be considered‘high risk’.

•

The firm identifies and uses
all information at its disposal
to make informed judgments
about the level of financial
crime risk posed to its
business.

•

The firm fails to consider therisks associated with employees using discretionary accounts to commit insider trading or market manipulation.

•

The firm’s risk framework is•regularly tested and reviewed.

Risk assessments are inappropriately influenced by profitability of new or existing relationships.

•

Where a firm identifies a riskthat it may be used to facilitate insider dealing or market
manipulation, it takes appropriate steps to mitigate that
risk.

•

The firm submits a significant
number of SARs and/or STORs
on a particular client, but continues to service that client
without considering its obligation to counter the risk of furthering financial crime.

•

The firm considers where rela- •tionship managers might become too close to customers
to take an objective view ofrisk, and manages that risk effectively.

The firm fails to consider additional account information it
has access to, such as Powerof Attorney arrangements,
when designing its surveillance controls.

Risk assessments are generic,and not based upon the firm’s
own observations.

8

Policiesand procedures.....................................................................................................
8.2.3

G

■ Release 39

The guidance in ■ FCG 2.2.5G above on policies and procedures in relation tofinancial crime also apply.
● Aug 2024

www.handbook.fca.org.uk

FCG 8/7

FCG 8 : Insider dealing andmarket manipulation

Section 8.2 : Themes

Firms’ policies and procedures should include steps designed to counter therisk of insider dealing and market manipulation occurring through the firm.
Policies and procedures should be aligned and make reference to the firm’s
insider dealing and market manipulation risk assessment.
Firms should ensure that their policies and procedures cover both:(1) identifying and taking steps to counter the risk of financial crime
before any trade is executed, and(2) mitigating future risks posed by clients or employees who havealready been identified as having traded suspiciously.
Firms should make sure that front office employees are aware of the firm’s
policies and procedures with regard to countering the risk that the firm isused to further financial crime. Among other things, these should reflect the
FCA’s expectation that market participants do not knowingly or intentionallyaid, abet, counsel or procure the commission of a criminal offence (insider
dealing or market manipulation). Therefore, where the firm holds
information which leads to the conclusion that its employee or client isseeking to trade either manipulatively or on the basis of inside information,
it should refuse to execute the trade where it is able to do so.

8

Firms’ policies and procedures should state clearly how they identify andmonitor employees’ trading, in addition to their clients’ trading. ■ COBS 11.7
requires firms that conduct designated investment business to have apersonal account dealing (PAD) policy. Appropriately designed PAD policies
can:•counter the risk that employees of the firm commit financial crime
themselves,•make sure that conflicts of interest that might result in employees
not escalating suspicious activity are avoided. For example, if
employees are allowed to copy clients’ trades on their own accounts,
they may be less inclined to escalate financial crime concerns that
only become apparent post-trade, as, by reporting the client theywould, by implication, be reporting their own trading as suspicious.
Policies and procedures relevant to each business area, including front office
functions, should be communicated and embedded.
Self-assessment questions:•Does the policy define how the firm will counter the risk of being
used to facilitate insider dealing and market manipulation? For
example, in what circumstances would the firm conduct enhanced
monitoring or stop providing trading access to a particular client or
employee?
•Does the firm have established procedures for following up andreviewing possibly suspicious behaviour?
•Do front office staff understand how insider dealing and market
manipulation might be committed through the firm, to escalate
potentially suspicious activity when appropriate, and challenge clientor employee orders (where relevant), if they believe the activity willamount to financial crime? Does the firm have effective

FCG 8/8

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 8 : Insider dealing andmarket manipulation

Section 8.2 : Themes

whistleblowing arrangements in place to support appropriate
financial crime detection and reporting?
Examples of good practice

Examples of poor practice•

The firm has clear and unambiguous expectations for its
employees and anyone acting
on its behalf, such as introducing brokers.

••

Employees in dealing roles un- •derstand and are able toidentify potentially illegal conduct, and their trading is regularly monitored byCompliance.

Policies and procedures are
generic and don’t consider
the specific processes or risksof the firm.

•

The policies and procedures
make adequate reference tothe firm’s risk assessment.

•

Policies and procedures cover
only post-trade identification
and reporting of suspicious activity and do not cover countering the risk of financial
crime.

•

Policies and procedures makesure that the risk of financial
crime is considered throughout the lifecycle of a security
transaction, including before
the order has been executed.

•

The firm sets apparently robust procedures for assessing
and mitigating identified financial crime risk, but sets
thresholds for engaging thesemeasures which mean thatthey are almost impossible totrigger.

•

Where the financial intermedi- •ary is aware that a client is intending to trade on the basisof inside information or manipulate the market, the firm
refuses to execute theorder(s).

The firm doesn’t have policies
detailing the circumstances
when it will consider rejecting
a prospective client or terminating an existing client relationship.

•

The firm takes swift, robust ac- •tion for breaches of its policies and procedures.

The firm doesn’t have appropriate policies or proceduresin place regarding personal account dealing, so that staff
are able to deal in a manner
which creates conflict in escalating suspected market abuse.

•

The firm’s policies and procedures include controls designed
to counter the risk of financial
crime being committed by employees, for example wall crossings, restricted lists and personal account dealing restrictions.

The firm’s policies and procedures aren’t updated for legal
or regulatory changes.

8

Ongoing
monitoring.....................................................................................................
8.2.4

G

■ Release 39

We recognise that the Market Abuse Regulation already imposes monitoring
requirements on persons professionally arranging or executing transactions,in order to detect and report suspicious orders and transactions in the formof STORs (as well as imposing similar monitoring obligations on market● Aug 2024

www.handbook.fca.org.uk

FCG 8/9

FCG 8 : Insider dealing andmarket manipulation

Section 8.2 : Themes

operators and investment firms that operate a trading venue). It may beappropriate to use the results of this monitoring for the purpose ofcountering financial crime.
Firms should note that the markets and instruments to which the criminal
offences of insider dealing and market manipulation apply are different tothose covered by the Market Abuse Regulation. Firms should therefore assess
whether their arrangements to detect and report market abuse can beappropriately relied on to monitor for potential insider dealing and market
manipulation.
For their risk assessments, firms should regularly take steps to consider
whether their employees and/or clients may be conducting insider dealing or
market manipulation. This could be achieved by transaction, order andcommunications surveillance, with consideration given to the employee’s orclient’s usual trading behaviour and/or strategies, and in respect of clients:
initial on-boarding checks and ongoing due diligence, or other methods.
Firms should consider the risks that arise in scenarios whereby their client is
not the decision maker behind the activity taking place, with orders andtrades being instructed by an underlying client. In this scenario, where a firm
is concerned either about a particular client or trade, firms should consider
the steps they could take to gain further information, or an understanding,of the client, underlying client and/or activity. The firm may wish to engage
with its client to obtain further information about the trading in question
and/or the nature of the underlying client(s).

8

If a firm is, based on their understanding of a client and monitoring of thatclient’s transactions, suspicious that a client might have committed or
attempted to commit insider dealing or market manipulation, the firmshould comply with its obligations to report those suspicions via a STOR and/or SAR (where appropriate). In addition, it may be appropriate for the firm
to document the options available to it to counter the risk of any ongoing
financial crime posed by its ongoing relationship with that client, and whenthese options should be considered.
In addition, a firm must also submit a STOR where it identifies suspicious
trading by an employee. The nominated officer of the firm would also be
required to report any knowledge or suspicions of money laundering or
terrorist financing arising from trade by submitting a SAR to the NCA. Again,
the firm’s policies and procedures should document the options available to
it to counter the risk of any ongoing financial crime related to employee
trading activity, and when these options should be considered.
Options available to firms to counter the risk of being used to further
financial crime by its clients and/or employees could include:•Carrying out enhanced due diligence on a client and enhanced
monitoring of a client’s or employee’s trading activity.
•Restricting the client’s access to particular markets or instruments.
•Restricting services provided to the client (eg direct market access).
•Restricting the amount of leverage the firm is willing to provide to
the client.
•Taking disciplinary action against an employee.
•Ultimately terminating the client or employee relationship. The
appropriate response will depend on the outcome of the firm’s
FCG 8/10

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG 8 : Insider dealing andmarket manipulation

Section 8.2 : Themes

monitoring procedures and the extent and nature of any suspicious
activity identified.
Self-assessment questions:•Does the firm consider its obligations to counter financial crime
when a client’s or employee’s activity is determined as suspicious via
surveillance systems and subsequent investigation?
•How do the firm’s monitoring arrangements interact with the clienton-boarding process / AML framework?
•Does the firm undertake enhanced monitoring for high risk clients?
•Does the firm’s monitoring cover the activity of any employee
trading?
•In instances where a firm is concerned about a client which is not
the individual or entity who is making the decision to trade, has thefirm considered information it has access to, or ways it can gain
information, to allow it to counter the risk of being used to further
financial crime?
Examples of good practice■ Release 39

Examples of poor practice•

The firm’s monitoring seeks to •identify trends in clients’ or
employee’s behaviour, in addition to one off events.

The firm believes that its obligations cease when it reports the suspicious transactions and orders.

•

The firm undertakes enhanced •monitoring of clients it has determined are high risk.

Suspicious transactions and orders are identified but not investigated further.

•

The firm conducts regular, tar- •geted monitoring of voice
and electronic communications.

Monitoring identifies individual suspicious events but
does not attempt to identify
patterns of suspicious behaviour by the same client or agroup of clients, using, for example, historical assessmentsof potentially suspicious activity or STORs submitted.

•

Front office employees escalate suspicious activity
promptly to Compliance.

•

The firm does not consider engaging with its clients,
whether to understand theirtrading activity or the activityof their underlying client(s).

•The firm takes additional•
steps to understand and ensure it is comfortable with therationale behind the trading
strategies employed by its client(s) and/or staff.

The firm does not use information obtained via monitoringand subsequent investigation
to consider the suitability ofretaining a client relationship.

•

The firm conducts regularmonitoring of its employee
trading activity, whether personal account dealing or trad-

In instances when a client is
placing orders on behalf of its
underlying clients, the firm
fails to make use of informa-● Aug 20248•

www.handbook.fca.org.uk

FCG 8/11

FCG 8 : Insider dealing andmarket manipulation

Section 8.2 : Themes

Examples of good practiceing on behalf of the firm or
clients.

8

FCG 8/12•

In instances when a client is
placing orders on behalf of its
underlying clients, the firm engages with their client to establish whether they maintainappropriate systems and controls for countering the risk ofbeing used to further financial crime.

•

The firm considers a client or
employee’s ongoing risk ofcommitting insider dealing or
market manipulation following the submission of a STOR
and/or SAR.

www.handbook.fca.org.uk

Examples of poor practicetion which could allow it tounderstand the nature and potential risk of their client (forexample, number of underlying clients, trading strategies,
the nature of their business).

■ Release 39● Aug 2024

Common terms

Chapter Annex
Common terms■ Release 39● Aug 2024

www.handbook.fca.org.uk

FCG Annex/1

■ Release 39● Aug 2024

www.handbook.fca.org.uk

FCG Annex/2

FCG Annex : Common terms

Common terms

Annex

This annex provides a list of common and useful terms related to financial crime. It also includes
references to some key legal provisions. It is for reference purposes and is not a list of ‘defined terms’
used in FCG. This annex does not provide guidance on rules or amend corresponding references in the
Handbook’s Glossary.
Term

Meaning

Action Fraud

The UK’s national fraud reporting centre. See: www.actionfraud.police.uk

advance fee fraud

A fraud where people are persuaded to hand over money, typically characterised as a ‘fee’, in the expectation that they will thenbe able to gain access to a much larger sum which does not actually exist.

AML

Anti-money laundering. See ‘money laundering’.

Annex I financial institution

The Money Laundering Regulations give the FCA responsibility forsupervising the anti-money laundering controls of ‘Annex I financial institutions’ (a reference to Annex I to the Capital Requirements Directive, where they are listed). In practice, this includes
businesses that offer finance leases, commercial lenders and providers of safe deposit boxes.
Where an authorised firm offers such services, we are responsible
for overseeing whether these activities are performed in a mannerthat complies with the requirements of the Money Laundering Regulations. Authorised firms are not formally required to inform usthat they perform these activities, although some may choose to
do so for the sake of transparency.
Where these businesses are not authorised, we are responsible forsupervising their activities. For more information on this, see the
FCA’s website: https://www.fca.org.uk/firms/money-laundering-terrorist-financing/registration

beneficial owner

The natural person who ultimately owns or controls the customer.
An entity may have more than one beneficial owner. ‘Beneficial
owner’ is defined in Regulations 5 and 6 of the Money Laundering Regulations.

boiler room

See ‘share sale fraud’.

bribery

Bribery is the offering or acceptance of an undue advantage in exchange for the improper performance of a function or activity.
Statutory offences of bribery are set out more fully in the Bribery
Act 2010.

Bribery Act 2010

The Bribery Act came into force in July 2011. It outlaws offeringand receiving bribes, at home and abroad, as well as creating a
corporate offence of failure to prevent bribery. The Ministry ofJustice has issued guidance about procedures which firms can put
in place to prevent bribery: https://www.justice.gov.uk/downloads/
legislation/bribery-act-2010-guidance.pdf

business-wide risk assessment

A business-wide risk assessment means the identification and assessment of the financial crime risks to which a firm is exposed asa result of, for example, the products and services it offers, the jurisdictions it operates in, the types of customer it attracts, the com-

■ Release 39● Aug 2024

www.handbook.fca.org.uk

Annex 1/1

FCG Annex : Common terms

Term

Annex

Meaning
plexity and volume of transactions, and the distribution channels
it uses to service its customers.

carbon credit scams

Firms may sell carbon credit certificates or seek investment directly
in a ‘green’ project that generates carbon credits as a return. Carbon credits can be sold and traded legitimately and there aremany reputable firms operating in the sector. We are, however,concerned an increasing number of firms are using dubious, highpressure sales tactics and targeting vulnerable consumers. See:
https://www.fca.org.uk/scamsmart/carbon-credit-scams

CDD

See ‘customer due diligence’.

CIFAS

CIFAS is the UK’s fraud prevention service with over 250 members
across the financial industry and other sectors. See CIFAS’s website
for more information: www.cifas.org.uk

Defence against Money
Laundering

A ‘Defence Against Money Laundering (DAML)’ can be requested
from the NCA where a firm has a suspicion that property they intend to deal with is in some way criminal, and that by dealing
with it they risk committing one of the principal money laundering offences under the Proceeds of Crime Act 2002 (POCA).
A person does not commit one of those offences if they have received ‘appropriate consent’ (aka a “DAML”) from the NCA. The
NCA is empowered to provide these criminal defences in law under s335 of POCA.
More information is available from the NCA,
http://www.nationalcrimeagency.gov.uk/publications/902-defenceagainst-money-laundering-faq-may-2018/file

Consolidated List

OFSI maintains a Consolidated List of financial sanctions targets
designated by the United Nations, the European Union and theUnited Kingdom. It is available from the Treasury’s website:www.hm-treasury.gov.uk/fin_sanctions_index.htm

corruption

Corruption is the abuse of public or private office to obtain an undue advantage. Corruption includes not only bribery but also
other forms of misconduct or improper behaviour. This behaviour
may or may not be induced by the prospect of obtaining an undue advantage from another person.

Counter-Terrorism Act 2008

The Treasury has powers under Schedule 7 to the Counter-Terrorism Act 2008 to require financial firms to take specified actions inrelation to a country of concern, or counterparties based in thatcountry. Use of this power can be triggered if a) the risk of money
laundering or terrorist financing activities is identified in a country, or b) the government believes a country has a nuclear, chemical, radiological or biological weapons programme that threatens
the UK. The directions can require enhanced due diligence and ongoing monitoring, the systematic reporting of transactions, or the
cessation of business. This offers the government flexibility thatwas not available in the traditional financial sanctions regime. We
are responsible for monitoring authorised firms’ and certain financial institutions’ compliance with these directions.

cover payment

Where payments between customers of two banks in different
countries and currencies require settlement by means of matchinginter-bank payments, those matching payments are known as‘cover payments’. International policymakers have expressed concern that cover payments can be abused to hide the origins offlows of funds. In response to this, changes to the SWIFT payment
messaging system now allow originator and beneficiary information to accompany cover payments.

CPS

See ‘Crown Prosecution Service’

Annex 1/2

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG Annex : Common terms

Term

Meaning

Crown Prosecution Service (CPS)The Crown Prosecution Service prosecutes crime, money laundering and terrorism offences in England and Wales. The Procurator Fiscal and Public Prosecution Service of Northern Ireland play
similar roles in Scotland and Northern Ireland respectively. See the
CPS website for more information: www.cps.gov.uk

CTF

Combating terrorist financing/countering the finance of terrorism.

customer due diligence (CDD)‘

Customer due diligence’ describes measures firms have to take toidentify, and verify the identity of, customers and their beneficial
owners. Customer due diligence also includes measures to obtain
information on the purpose and intended nature of the business
relationship. See Regulation 7 of the Money Laundering Regulations. ‘Customer due diligence’ and ‘Know Your Customer’ (KYC)
are sometimes used interchangeably.

dual use goods

Items that can have legitimate commercial uses, while also having
applications in programmes to develop weapons of mass destruction. Examples may be alloys constructed to tolerances and thresholds sufficiently high for them to be suitable for use in nuclear reactors. Many such goods are listed in EU regulations which also restrict their unlicensed export.

Data Protection Act 1998 (DPA)The DPA imposes legal obligations on those who handle individuals’ personal information. Authorised firms are required totake appropriate security measures against the loss, destruction ordamage of personal data. Firms also retain responsibility whendata is passed to a third party for processing.

economic sanctions

Restrictions on trade or financial flows imposed by the government in order to achieve foreign policy goals. See: ‘financial sanctions regime’, ‘trade sanctions’, and ‘proliferation finance’.

EEA firms

Firms from the European Economic Area (EEA) which passport
into the UK are authorised persons. This means, generally
speaking, EEA firms who carry on relevant business from a UK
branch will be subject to the requirements of the Handbook andof the Money Laundering Regulations. However, an EEA firm that
only provides services on a cross-border basis (and so does nothave a UK branch) will not be subject to the Money Laundering
Regulations, unless it carries on its business through representatives who are temporarily located in the UK.

Egmont GroupA forum for financial intelligence units from across the world. See
the Egmont Group’s website for more information: www.egmontgroup.org

embargosSee ‘trade sanctions’.

e-money

The Electronic Money Regulations 2011 (SI 2011/99) define electronic money as electronically (including magnetically) stored monetary value, represented by a claim on the issuer, which is issued
on receipt of funds for the purpose of making payment transactions, and which is accepted by a person other than the electronicmoney issuer. The E-money Regulations specify who can issue emoney; this includes credit institutions and e-money institutions.

e-money institutions (EMIs)

E-money institutions are a specific category of financial institutions authorised or registered to issue e-money under the Electronic Money Regulations 2011, rather than FSMA. The FCA’s financial crime Handbook provisions do not apply to e-money institutions, but the FCA supervises e-money institutions for compliancewith their obligations under the Money Laundering Regulations.
They must also satisfy us that they have robust governance, effective risk procedures and adequate internal control mechanisms.
This incorporates their financial crime systems and controls. For
more information, see our payment services and e-money ap-■ Release 39● Aug 2024

www.handbook.fca.org.uk

Annex 1/3

Annex

FCG Annex : Common terms

Term

Annex

Meaning
proach document: https://www.fca.org.uk/publication/finalisedguidance/fca-approach-payment-services-electronic-money2017.pdf

enhanced due diligence (EDD)

Regulations 33-35 of the Money Laundering Regulations require
firms to apply additional, ‘enhanced’ customer due diligence measures in higher risk situations (see FCG 3.2.7G to FCG 3.2.9G).

equivalent jurisdiction

A jurisdiction (other than an EEA state) whose law contains
equivalent provisions to those contained in the Fourth Money
Laundering Directive. The JMLSG has prepared guidance for firms
on how to identify which jurisdictions are equivalent. Equivalentjurisdictions are significant because it is a factor that a firm may
consider when deciding whether to apply ‘simplified due diligence’ to financial institutions from these places. Firms can also
rely on the customer due diligence checks undertaken by certain
introducers from these jurisdictions (see ‘reliance’).

export controls

UK exporters must obtain a licence from the government before
exporting certain types of goods, primarily those with military applications. Exporting these goods without a licence is prohibitedby the Export Control Order 2008 (SI 2008/3231). If an authorised
financial firm were to finance or insure these illegal exports, itwould arguably have been used to further financial crime.

family member of a PEP

Regulation 35(12)(b) of the Money Laundering Regulations defines a family member of a PEP as including a spouse or civil partner of a PEP; children of the PEP and the spouses or civil partnersof the PEP’s children; and the parents of a PEP. The FCA’s Finalised
Guidance ‘FG17/16: The treatment of politically exposed persons
for anti-money laundering purposes’ provides further guidance on
this definition.

FATF

See ‘Financial Action Task Force’.

FATF Recommendations

Forty Recommendations issued by the FATF on the structural, supervisory and operational procedures that countries should havein place to combat money laundering. These were revised in February 2012, and now incorporate the nine Special Recommendations on the prevention of terrorist financing that were previously
listed separately. The Forty Recommendations can be downloaded
from the FATF’s website: http://www.fatf-gafi.org/publications/fatfrecommendations/documents/fatf-recommendations.html

FATF-style regional bodies

Regional international bodies such as Moneyval and the Asia-Pacific Group which have a similar form and functions to those of the
FATF. The FATF seeks to work closely with such bodies.

FI

See ‘Financial Investigator’.

Financial Action Task Force(FATF)

An intergovernmental body that develops and promotes antimoney laundering and counter terrorist financing standards
worldwide. Further information is available on its website:www.fatf-gafi.org

Financial Conduct Authority(FCA)

The Financial Conduct Authority has statutory objectives under
FSMA that include protecting and enhancing the integrity of theUK financial system. The integrity of the UK financial system includes its not being used for a purpose connected with financial
crime. We have supervisory responsibilities under the Money Laundering Regulations for authorised firms and businesses such asleasing companies and providers of safe deposit boxes. We also
have functions under other legislation such as Schedule 7 to theCounter-Terrorism Act 2008.

Annex 1/4

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG Annex : Common terms

Term

Meaningfinancial crime

Financial crime is any crime involving money. More formally, theFinancial Services and Markets Act 2000 defines financial crime ‘toinclude any offence involving (a) fraud or dishonesty; (b) misconduct in, or misuse of information relating to, a financial market;or (c) handling the proceeds of crime’. The use of the term ‘to include’ means financial crime can be interpreted widely to include,for example, corruption or funding terrorism.

financial intelligence unit (FIU)

The IMF uses the following definition: ‘a central national agency
responsible for receiving, analyzing, and transmitting disclosureson suspicious transactions to the competent authorities.’ The NCA
has this role in the UK.

Financial Investigator (FI)Financial Investigators are accredited people able under the relevant legislation to investigate financial offences and recover theproceeds of crime.

financial sanctions regime

This prohibits firms from providing funds and other economic resources (and, in the case of designated terrorists, financial services) to individuals and entities on a Consolidated List maintained
OFSI. OFSI is responsible for ensuring compliance with the UK’s financial sanctions regime; our role is to ensure firms have appropriate systems and controls to enable compliance.

Financial Services and Markets
Act 2000 (FSMA)

The Financial Services and Markets Act 2000 sets out the objectives, duties and powers of the Financial Conduct Authority and
the Prudential Regulation Authority.

Financial Services Authority(FSA)

The Financial Services Authority was the previous financial services
regulator. It had statutory objectives under FSMA that included
the reduction of financial crime. The FSA had supervisory responsibilities under the Money Laundering Regulations for authorised
firms and businesses such as leasing companies and providers ofsafe deposit boxes. It also had functions under other legislationsuch as the Transfer of Funds (Information on the Payer) Regulations 2007, in relation to the EU Wire Transfer Regulation, andschedule 7 to the Counter-Terrorism Act 2008.

FIU

See ‘financial intelligence unit’.

four-eyes procedures

Procedures that require the oversight of two people, to lessen therisk of fraudulent behaviour, financial mismanagement or incompetence going unchecked.

Fourth Money Laundering Directive (4MLD)

The Fourth Money Laundering Directive (2015/849/EC). The UK has
implemented this Directive mainly through the Money Laundering
Regulations.

fraud (types of)

Fraud can affect firms and their customers in many ways. The following are examples of fraud:■ Release 39● Aug 2024•

a firm is defrauded by customers (e.g. mortgage fraud);•

a firm is defrauded by employees or contractors (‘insiders’) (e.g. a staff member steals from his employer andamends records to cover-up the theft);•a firm’s customers are defrauded by an insider (e.g. a staff
member steals customers’ money);•a firm’s customers are defrauded after a third party misleads the firm (e.g. criminals evade security measures togain access to a customer’s account);•a firm’s customers are defrauded by a third party becauseof the firm’s actions (e.g. the firm loses sensitive personal
data allowing the customer’s identity to be stolen);www.handbook.fca.org.uk

Annex 1/5

Annex

FCG Annex : Common terms

Term

Annex

Meaning•a customer is defrauded, with a firm executing payments
connected to this fraud on the customer’s instruction (e.g.
a customer asks his bank to transfer funds to what turns
out to be a share sale scam).

See also: ‘advance fee fraud’, ‘boiler room’, ‘carbon credit scams’,‘investment fraud’, ‘land banking scams’, ‘long firm fraud’, ‘massmarketing fraud’, ‘Missing Trader Inter-Community fraud’, ‘Ponzi
and pyramid schemes’, ‘share sale fraud’.
Fraud Act 2006

The Fraud Act 2006 sets out a series of fraud offences such as
fraud by false representation, fraud by failing to disclose information and fraud by abuse of position.

FSA

See ‘Financial Services Authority’.

FSMA

See ‘Financial Services and Markets Act 2000’.

FSRB

See ‘FATF-style regional bodies’.

fuzzy matching

The JMLSG suggests the term ‘fuzzy matching’ ‘describes any process that identifies non-exact matches. Fuzzy matching software
solutions identify possible matches where data – whether in official lists or in firms’ internal records – is misspelled, incomplete, or
missing. They are often tolerant of multinational and linguistic differences in spelling, formats for dates of birth, and similar data. A
sophisticated system will have a variety of settings, enabling
greater or less fuzziness in the matching process’. See Part III of
the JMLSG’s guidance: http://www.jmlsg.org.uk/download/10007

Funds Transfer Regulation

This EU Regulation is formally titled ‘Regulation (EU) 2015/847 of
the European Parliament and of the Council of 20 May 2015 on information accompanying transfers of funds’. It implements FATF’s
Recommendation 16 in the EU and requires firms to accompany
the transfer of funds with specified information identifying thepayer and the payee. We are given supervisory and enforcement
powers for compliance with this regulation by the Money Laundering Regulations.

high-value dealer

A firm trading in goods (e.g. cars, jewellery and antiques) that accepts cash of €10,000 or more in payment (whether in one go or
in several payments that appear to be linked). HMRC is the supervisory authority for high value dealers. A full definition is set out
in Regulation 14(1)(a) of the Money Laundering Regulations.

HM Revenue and Customs(HMRC)HM Revenue and Customs has supervisory responsibilities under
the Money Laundering Regulations. It oversees money service businesses, dealers in high value goods, estate agents and trust orcompany service providers, amongst others. See HMRC’s website
for more information: https://www.gov.uk/topic/business-tax/
money-laundering-regulations

HMRC

See ‘HM Revenue and Customs’.

HMT

See ‘Treasury’.

ICO

See ‘Information Commissioner’s Office’.

ID

Identification (or Identity Documents).

identification

The JMLSG’s definition is: ‘ascertaining the name of, and other relevant information about, a customer or beneficial owner’.

IFB

Insurance Fraud Bureau.

Information Commissioner’s Office (ICO)

The Information Commissioner’s Office is tasked with protecting
the public’s personal information. See the ICO’s website for further information: www.ico.org.uk

Annex 1/6

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG Annex : Common terms

Term

Meaning

Information From Lenders (IFL)The Information From Lenders scheme enables mortgage lenders
to inform the FCA of suspected fraud by mortgage brokers. Details are here: https://www.fca.org.uk/firms/fraud/report-mortgagefraud-advisers

insider fraud

Fraud against a firm committed by an employee or group of employees. This can range from junior staff to senior management,
directors, etc. Insiders seeking to defraud their employer may
work alone, or with others outside the firm, including organised
criminals.

Institute of Chartered Accountants in England and Wales(ICAEW)

The Institute of Chartered Accountants in England and Wales has
supervisory responsibility for its members under the Money Laundering Regulations, as do other professional bodies for accountants and book-keepers. See the ICAEW’s website for further information:www.icaew.com

integrationSee ‘placement, layering, integration’.

investment fraud

UK-based investors lose money every year to share sale frauds andother scams including, but not limited to, land-banking frauds,
Ponzi schemes, and rogue carbon credit schemes. See FCA’s
scamsmart, http://scamsmart.fca.org.uk/

JMLSG

See ‘Joint Money Laundering Steering Group’.

Joint Money Laundering Steering Group (JMLSG)

This industry body is made up of financial sector trade bodies. It
produces guidance on compliance with legal and regulatory requirements related to money laundering. See the JMLSG’s website
for more information: www.jmlsg.org.uk

Know Your Customer (KYC)

This term is often used as a synonym for ‘customer due diligence’checks. The term can also refer to suitability checks related to theregulated sales of financial products. The Money Laundering Regulations refer to ‘customer due diligence’ and not to KYC.

known close associate of a PEP

Regulation 35(12)(c) of the Money Laundering Regulations defines
a known close associate of a PEP as being either an individual
known to have joint beneficial ownership of a legal entity or alegal arrangement or any other close business relations with a PEP
or an individual who has sole beneficial ownership of a legal entity or a legal arrangement which is known to have been set up
for the benefit of a PEP.

KYC

See ‘Know Your Customer’.

land banking scams

Land banking companies divide land into smaller plots to sell it toinvestors on the basis that once it is available for development it
will soar in value. However, the land is often in rural areas, withlittle chance of planning permission being granted. See: https://www.fca.org.uk/consumers/land-banking-investment-schemes

layering

See ‘placement, layering, integration’.

long firm fraud

A fraud where an apparently legitimate company is establishedand, over a period of time, builds up a good credit record withwholesalers, paying promptly for modest transactions. Correspondence from bankers may be used by them as evidence of goodstanding. The company then places a large order, takes delivery,
but disappears without paying. This type of fraud is not limited towholesalers of physical goods: financial firms have been victim tovariants of this scam.

MLRO

See ‘Money Laundering Reporting Officer’.

mass-marketing fraud

Action Fraud (the UK’s national fraud reporting centre) says “Massmarketing fraud is when you receive an uninvited contact by email, letter, phone or adverts, making false promises to con you outof money.” Share sale fraud is a type of mass marketing fraud.

■ Release 39● Aug 2024

www.handbook.fca.org.uk

Annex 1/7

Annex

FCG Annex : Common terms

Term

Annex

Meaning
See: www.actionfraud.police.uk/types-of-fraud/mass-marketingfraud

Missing Trader Inter-Community(MTIC) fraudThis fraud exploits the EU system for rebating Value Added Tax
payments in situations where goods have moved across borders
within the EU. National authorities are misled into giving rebates
to import-export companies that are not entitled to them.

money laundering

The process by which the proceeds of crime are converted into assets which appear to have a legitimate origin, so that they can beretained permanently, or recycled to fund further crime.

Money Laundering Directive

See ‘Fourth Money Laundering Directive’.

Money Laundering Reporting
Officer (MLRO)

The MLRO is responsible for ensuring that measures to combat
money laundering within the firm are effective. The MLRO is also
usually the ‘nominated officer’ under the Proceeds of Crime Act(POCA).
The MLRO is a ‘controlled function’ under the Approved Persons
Regime and a ‘senior management function’ under the Senior
Managers and Certification Regime.

Market Abuse Regulation(MAR)

MAR, short for Market Abuse Regulation (EU No.596/2014),
entered into force on 3 July 2016. It contains the civil offences of
insider dealing, unlawful disclosure of inside information and market manipulation, in addition to provisions to prevent and detect
these offences.

Money Laundering Regulations

The Money Laundering Regulations 2007 (SI 2007/2157) transposed the Third Money Laundering Directive into UK law. The Regulations require firms to take specified steps to detect and prevent both money laundering and terrorist financing. The Money
Laundering Regulations 2007 were revoked and replaced by the
Money Laundering Regulations 2017.

Money Laundering Regulations
2017

The Money Laundering Regulations 2017 (SI 2017/692) transpose
the requirements of the Third Fourth Money Laundering Directive
into UK law. The Regulations require firms to take specified steps
to detect and prevent both money laundering and terrorist
financing.
The Regulations identify the firms we supervise and impose on us
a duty to take measures to secure those firms’ compliance with
the Regulations’ requirements.

Money Laundering Reporting
Officer (MLRO)

The MLRO is responsible for ensuring that measures to combat
money laundering within the firm are effective. The MLRO is also
usually the ‘nominated officer’ under the Proceeds of Crime Act(POCA).
The MLRO is a ‘controlled function’ under the Approved Persons
Regime and a ‘senior management function’ under the Senior
Managers and Certification Regime.

money service business (MSB)

Annex 1/8

An undertaking that by way of business operates a currency exchange office, transmits money (or any representations of monetary value) by any means or which cashes cheques which are madepayable to customers. (See Regulation 3(1) of the Money Laundering Regulations.) Firms authorised under FSMA must inform us
if they provide MSB services. For more information about this, see:https://www.fca.org.uk/firms/money-laundering-terrorist-financing/
reporting HM Revenue and Customs supervises the AML controlsof money service businesses that are not authorised under FSMA.
More information about registration with HMRC can be found on
its website:https://www.gov.uk/topic/business-tax/money-laundering-regulations

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG Annex : Common terms

Term

Meaning

mortgage brokers, general insurers and general insurance intermediaries

Mortgage brokers, general insurers (including managing agentsand the Society of Lloyd’s) and general insurance intermediaries
are subject to the high-level regulatory requirement to counter
financial crime set out in SYSC 3.2.6R. However, they are not subject to the Money Laundering Regulations or the provisions of the
Handbook that specifically relate to money laundering (SYSC
3.2.6AR –SYSC 3.2.6JG).
Firms offering these services alongside other products that are subject to the Money Laundering Regulations (such as banking andstock broking services) can therefore apply different customer due
diligence checks in both situations. But in practice, many will
choose to apply a consistent approach for the sake of operational
convenience.

MSB

See ‘money service business’.

MTIC

See ‘Missing Trader Inter-Community Fraud’.

National Crime Agency (NCA)

The NCA leads the UK’s fight against serious and organised crime.
It became operational, replacing the Serious Organised Crime
Agency, in October 2013. For more information see the NCA’s website:http://www.nationalcrimeagency.gov.uk/ .

NCA

See ‘National Crime Agency’.

NCCT

See ‘non-cooperative countries or territories’.

nominated officer

Regulation 3(1) of the Money Laundering Regulations defines thisas “a person who is nominated to receive disclosures under Part 3(terrorist property) of the Terrorism Act 2000 or Part 7 (money
laundering) of the Proceeds of Crime Act 2002”. See section 330
of POCA, Part 3 of the Terrorism Act 2000, and Regulation 21(3)of the Money Laundering Regulations which requires all firms toappoint a nominated officer.

non-cooperative countries andterritories

FATF can designate certain countries and territories as being noncooperative. This indicates severe weaknesses in anti-money laundering arrangements in those jurisdictions. An up-to-date statement can be found on the FATF website. The JMLSG has preparedguidance for firms on how to judge the risks of conducting business in different countries.

occasional transaction

Any transaction (carried out other than as part of a business relationship) amounting to €15,000 or more, whether the transaction
is carried out in a single operation or several operations which appear to be linked. (See Regulation 27(2) of the Money Laundering
Regulations.)
Any transaction that amounts to a transfer of funds within themeaning of article 3(9) of the Funds Transfer Regulation exceeding €1,000.

Office of Financial Sanctions Implementation (OFSI)The Office of Financial Sanctions Implementation within HM Treasury is responsible for the implementation and administration of
the UK sanctions regime. See: https://www.gov.uk/government/organisations/office-of-financial-sanctions-implementation for more.

ongoing monitoring

The Money Laundering Regulations require ongoing monitoringof business relationships. This means that the transactions performed by a customer, and other aspects of their behaviour, arescrutinised throughout the course of their relationship with thefirm. The intention is to spot where a customer’s actions are inconsistent with what might be expected of a customer of that type,given what is known about their business, risk profile etc. Where
the risk associated with the business relationship is increased,
firms must enhance their ongoing monitoring on a risk-sensitive■ Release 39● Aug 2024

www.handbook.fca.org.uk

Annex 1/9

Annex

FCG Annex : Common terms

Term

Annex

Meaningbasis. Firms must also update the information they hold on customers for anti-money laundering purposes.

payment institutions

A ‘payment institution’ is a UK firm which is required under the
Payment Services Regulations 2017 (SI 2017/752) to be authorised
or registered in order to provide payment services in the UK. This
term is not used to describe payment service providers that are already authorised by us because they carry out regulated activities(such as banks and e-money institutions) or that are exempt under
the Payment Services Regulations (such as credit unions). For more
information, see our publication. For the FCA’s approach to Payment institutions and e-money institutions under the Payment Services Regulations and the Electronic Money Regulations, see
https://www.fca.org.uk/publication/finalised-guidance/fca-approach-payment-services-electronic-money-2017.pdf.

PEP

See ‘politically exposed person’.

placement, layering, integration

The three stages in a common model of money laundering. In theplacement stage, money generated from criminal activity (e.g.
funds from the illegal import of narcotics) is first introduced to
the financial system. The layering phase sees the launderer entering into a series of transactions (e.g. buying, and then cancelling, an insurance policy) designed to conceal the illicit origins of
the funds. Once the funds are so far removed from their criminal
source that it is not feasible for the authorities to trace their origins, the integration stage allows the funds to be treated as ostensibly ‘clean’ money.

POCA

See ‘Proceeds of Crime Act 2002’.

politically exposed person (PEP)

A person entrusted with a prominent public function. See Regulation 35 of the Money Laundering Regulations and Finalised Guidance ‘FG17/16: The treatment of politically exposed persons foranti-money laundering purposes’ https://www.fca.org.uk/publications/finalised-guidance/fg17-6-treatment-politically-exposed-persons-peps-money-laundering.

Ponzi and pyramid schemes

Ponzi and pyramid schemes promise investors high returns or dividends not usually available through traditional investments. Whilethey may meet this promise to early investors, people who invest
in the scheme later usually lose their money; these schemes collapse when the unsustainable supply of new investors dries up. Investors usually find most or all of their money is gone, and thefraudsters who set up the scheme have disappeared.

Proceeds of Crime Act 2002
(POCA)

POCA criminalises all forms of money laundering and creates
other offences such as failing to report a suspicion of money laundering and ‘tipping off’.

Production Order

The Proceeds of Crime Act 2002 allows Financial Investigators to
use production orders to obtain information from financial firms
about an individual’s financial affairs.

Proliferation financeFunding the proliferation of weapons of mass destruction in contravention of international law.

pyramid schemes

See ‘Ponzi and pyramid schemes’.

Recognised investment exchanges, and recognised clearing houses

To be recognised under FSMA, exchanges and clearing houses
must, among other things, adopt appropriate measures to:

Annex 1/10•

reduce the extent to which their facilities can be used fora purpose connected with market abuse or financial
crime; and•monitor the incidence of market abuse or financial crime,and facilitate its detection.

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG Annex : Common terms

Term

Meaning
Measures should include the monitoring of transactions. This is set
out REC, which contains our guidance on our interpretation of
the recognition requirements. It also explains the factors we may
consider when assessing a recognised body’s compliance with therequirements. Regulation 7(1)(a)(vii) of the Money Laundering Regulations confers supervisory functions on the FCA to oversee recognised investment exchanges’ compliance with requirements imposed on them by those regulations.

reliance

The Money Laundering Regulations allow a firm to rely on customer due diligence checks performed by others. However, there
are many limitations on how this can be done. First, the relying
firm remains liable for any failure to apply these checks. Second,
the firm being relied upon must give its consent. Third, the law
sets out exactly what kinds of firms may be relied upon. See Regulation 39 of the Money Laundering Regulations and the JMLSG
guidance for more detail.

safe deposit boxes

The FCA is responsible for supervising anti-money laundering controls of safe custody services; this includes the provision of safe deposit boxes.

sanctionsSee ‘financial sanctions regime’.

SAR

See ‘Suspicious Activity Report’.

Senior Management Arrangements, Systems and Controls
sourcebook

See ‘SYSC’.

share sale fraud

Share scams are often run from ‘boiler rooms’ where fraudsters
cold-call investors offering them often worthless, overpriced oreven non-existent shares. While they promise high returns, those
who invest usually end up losing their money. We have found victims of boiler rooms lose an average of £20,000 to these scams,with as much as £200m lost in the UK each year. Even seasoned investors have been caught out, with the biggest individual loss recorded by the police being £6m. We receive almost 5,000 calls
each year from people who think they are victims of boiler room
fraud. See: http://scamsmart.fca.org.uk

simplified due diligence (SDD)

Regulation 37 of the Money Laundering Regulations allows firms,
where they assess that a business relationship or transaction presents a low degree of risk of money laundering or terrorist financing. This regulation sets out a series of factors firms should consider when determining this risk.
SDD does not exempt firms from applying CDD measures but permits them to adjust the extent, timing or type of the measures it
undertakes to reflect the lower risk it has assessed. A firm is required to carry out sufficient monitoring of any business relationships or transactions which are subject to those measures to enable it to detect any unusual or suspicious transactions.

Solicitors Regulation Authority(SRA)

The Solicitors Regulation Authority has supervisory responsibility
for solicitors under the Money Laundering Regulations. The Bar
Council and other professional bodies for the legal sector performa similar role for their members. See www.sra.org.uk for more information.

Special Recommendations

See ‘FATF Special Recommendations’.

source of funds and source ofwealth‘Source of wealth’ describes how a customer or beneficial owneracquired their total wealth.
‘Source of funds’ refers to the origin of the funds involved in thebusiness relationship or occasional transaction. It refers to the activity that generated the funds, for example salary payments or■ Release 39● Aug 2024

www.handbook.fca.org.uk

Annex 1/11

Annex

FCG Annex : Common terms

Term

Annex

Meaningsale proceeds, as well as the means through which the customer’sor beneficial owner’s funds were transferred.

SRA

See ‘Solicitors Regulation Authority’.

STOR

See ‘Suspicious Transaction and Order Report’.

Suspicious Activity Report (SAR)

A report made to the NCA about suspicions of money launderingor terrorist financing. This is commonly known as a ‘SAR’. See also
‘Suspicious Transaction Report’.

Suspicious Transaction and Order Report (STOR)

A report made to the FCA in accordance with articles 16(1) and16(2) of the Market Abuse Regulation about any suspicious order
or transaction. For more see: https://www.fca.org.uk/markets/market-abuse/suspicious-transaction-order-reports/stor-supervisorypriorities

SWIFT

SWIFT (the Society for Worldwide Interbank Financial Telecommunication) provides the international system used by banks to send
the messages that effect interbank payments.

SYSC

SYSC is the Senior Management Arrangements, Systems and Controls sourcebook of the Handbook. It sets out the responsibilities
of directors and senior management. SYSC includes rules and guidance about firms’ anti-financial crime systems and controls. These
impose obligations to establish and maintain effective systems
and controls for countering the risk that the firm might be used
to further financial crime’ (see SYSC 6.1.1R, or for insurers, managing agents and Lloyd’s, SYSC 3.2.6R).
SYSC 6.3 contains anti-money laundering specific rules and guidance. These provisions are also set out in SYSC 3.2.6AR to SYSC
3.2.6JG as they apply to certain insurers, managing agents and

Lloyd’s. These money laundering specific provisions of SYSC do not
apply to mortgage brokers, general insurers and general insurance intermediaries.
terrorist finance

The provision of funds or other assets to support a terrorist ideology, a terrorist infrastructure or individual operations. It applies
to domestic and international terrorism.

TF

Terrorist financing (also ‘CTF’).

third party‘Third party’ is a term often used to refer to entities that are involved in a business or other transaction but are neither the firm
nor its customer. Where a third party acts on a firm’s behalf, it
might expose the firm to financial crime risk.

tipping off

The offence of tipping off is committed where a person discloses
that:•

any person has made a report under the Proceeds ofCrime Act 2002 to the Police, HM Revenue and Customs
or the NCA concerning money laundering, where that disclosure is likely to prejudice any investigation into the report; or•an investigation into allegations that an offence ofmoney laundering has been committed, is being contemplated or is being carried out.

See section 333A of the Proceeds of Crime Act 2002. A similar offence exists in relation to terrorism (including terrorism financing)by virtue of section 21D of the Terrorism Act 2000.
trade sanctions

Annex 1/12

Government restrictions on the import or export of certain goods
and services, often to or from specific countries, to advance foreign policy objectives. See ‘economic sanctions’.

www.handbook.fca.org.uk■ Release 39● Aug 2024

FCG Annex : Common terms

Term

Meaning

Treasury

The Treasury is the UK government’s AML policy lead. It also implements the UK’s financial sanctions regime through OFSI.

trust or company service
provision

A formal legal definition of ‘trust or company service provider’ isgiven in Regulation 12(2) of the Money Laundering Regulations. A
simple definition might be ‘an enterprise whose business creates,or enables the creation of, trusts and companies on behalf ofothers for a fee’. International standard setters have judged thatsuch services can be abused by those seeking to set up corporate
entities designed to disguise the true origins of illicit funds.
The firms we authorise must inform us if they provide trust orcompany services. For more information about this, see: https://www.fca.org.uk/firms/money-laundering-terrorist-financing/
reporting
Trust or company service providers that are not authorised by us
have their anti-money laundering controls supervised by HM Revenue and Customs. More information can be found at its website:
https://www.gov.uk/topic/business-tax/money-laundering-regulations

verification

Making sure the customer or beneficial owner is who they claim
to be. Regulation 28 of the Money Laundering Regulations requires the customer’s identity to be verified on the basis of documents or information in either case obtained from a reliable
source which is independent of the person whose identity is being
verified. This includes documents issued or made available by an
official body even if they are provided or made available to thefirm by or on behalf of the customer. It also refers to checking any
beneficial owner in a way that the firm is satisfied that it knows
who the beneficial owner is; see Regulation 5 of the Money Laundering Regulations.

Wolfsberg GroupAn association of global banks, including UK institutions, whichaims to ‘develop financial services industry standards, and related
products, for Know Your Customer, Anti-Money Laundering andCounter Terrorist Financing policies’. See its website for more:
www.wolfsberg-principles.com■ Release 39● Aug 2024

www.handbook.fca.org.uk

Annex 1/13

Annex

FCG Annex : Common terms

Annex

Annex 1/14

www.handbook.fca.org.uk■ Release 39● Aug 2024