Financial Services PART 1 General Citation and commencement 1 1 These Regulations may be cited as the Money Laundering and Terrorist Financing (Amendment) (No. 2) Regulations 2022. 2 The following provisions come into force 21 days after the day on which these Regulations are made— a this regulation; b regulation 2 (amendment of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 ); c regulation 12 (changes in control of registered cryptoasset businesses). 3 Regulation 5 (cryptoasset transfers) comes into force on 1st September 2023. 4 Regulation 9 (reporting of material discrepancies) and regulations 16 and 17 (amendments to primary legislation) come into force on 1st April 2023. 5 Except as provided in paragraphs (2) to (4), these Regulations come into force on 1st September 2022. PART 2 Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 Amendment of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 2 The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 are amended in accordance with regulations 3 to 15. Removal of outdated references to the Terrorist Asset-Freezing etc. Act 2010 3 In regulation 3(1) (general interpretation) , in the definition of “terrorist financing”, omit paragraph (d). Formation of limited partnerships 4 1 For regulation 4(2) (meaning of business relationship) substitute— 2 A relationship where the relevant person is asked to provide one or more of the services described in regulation 12(2)(a), (b) or (d) is to be treated as a business relationship for the purpose of these Regulations, whether or not the relationship is otherwise expected to have an element of duration. . 2 For regulation 12(2)(a) (trust or company service providers) substitute— a forming a firm; . Cryptoasset transfers 5 1 In the definition of “relevant person” in regulation 3(1) (general interpretation), after “6” insert “, 7A” . 2 In regulation 8(1) (application) , after “6” insert “, 7A” . 3 In regulation 27 (customer due diligence) — a in paragraph (2), after “cryptoasset exchange provider of the kind referred to in paragraph (7D)” insert “or (7E), a custodian wallet provider of the kind referred to in paragraph (7E)” ; b after paragraph (7D) insert— 7E Without prejudice to paragraph (7D), a cryptoasset exchange provider and a custodian wallet provider must also apply customer due diligence measures in relation to a cryptoasset transfer which is equal to or exceeds the equivalent in cryptoassets of 1,000 euros in value (taken together with any other cryptoasset transfer which appears to be linked). ; c after paragraph (9) insert— 10 In this regulation, “cryptoasset” and “cryptoasset transfer” have the meanings given by regulation 64B (cryptoasset transfers: interpretation). . 4 In regulation 40 (record-keeping) — a in paragraph (2)(a), after “regulation 30A” insert “, and of regulations 64C and 64G(1)” ; b after paragraph (2)(b) insert— c in the case of an inter-cryptoasset business transfer, in addition to the records referred to in sub-paragraphs (a) and (b), any documents and information received by an intermediary cryptoasset business and the cryptoasset business of a beneficiary by virtue of the obligations under regulations 64C(1), (2) and (7), or received by them pursuant to a request under regulation 64D(2)(a) or 64E(2)(a); and d in the case of an unhosted wallet transfer, in addition to the records referred to in sub-paragraphs (a) and (b), any documents and information received by a cryptoasset business pursuant to a request under regulation 64G(1). ; c after paragraph (9)(d) insert— e “beneficiary”, “cryptoasset business”, “ inter-cryptoasset business transfer ”, “ intermediary cryptoasset business ” and “ unhosted wallet transfer ” have the meanings given by regulation 64B. . 5 After regulation 64 (obligations of payment service providers) insert— PART 7A Cryptoasset Transfers Chapter 1 Application and interpretation Application of this Part 64A 1 This Part applies in respect of a cryptoasset transfer which is not excluded by paragraph (2) or (3). 2 This Part does not apply in respect of a transfer of funds within the meaning of Article 3.9 of the funds transfer regulation . 3 This Part does not apply to a cryptoasset transfer where both the originator and the beneficiary is a cryptoasset business acting on its own behalf. Interpretation 64B In this Part— “ batch file transfer ” means a bundle of individual inter-cryptoasset business transfers from a single originator put together by a cryptoasset business of the originator for transmission to a cryptoasset business of a beneficiary or beneficiaries; “ beneficiary ” means the intended recipient of a cryptoasset from an originator; “ cryptoasset ” has the meaning given in regulation 14A(3)(a) (cryptoasset exchange providers and custodian wallet providers) and includes a right to, or interest in, the cryptoasset; “ cryptoasset business ” means a cryptoasset exchange provider or a custodian wallet provider; “ cryptoasset transfer ” means an inter-cryptoasset business transfer or an unhosted wallet transfer; “ inter-cryptoasset business transfer ” means a transaction carried out by two or more cryptoasset businesses which involves the making available of a cryptoasset of an originator to a beneficiary, provided that at least one of the cryptoasset businesses involved in the transaction is carrying on business in the United Kingdom in respect of the transaction (whether that is a cryptoasset business acting for the originator or a cryptoasset business acting for the beneficiary or an intermediary cryptoasset business); “ intermediary cryptoasset business ” means a cryptoasset business which, in the course of an inter-cryptoasset business transfer— is not acting for the originator or the beneficiary; and receives and transmits a cryptoasset on behalf of a cryptoasset business; “ originator ” means a person who owns a cryptoasset and allows a transfer of that cryptoasset; “ unhosted wallet ” means software or hardware that enables a person to store and transfer a cryptoasset on their own behalf, and in relation to which a private cryptographic key is administered by that person; “ unhosted wallet transfer ” means the transfer of a cryptoasset either— by an originator from an unhosted wallet to the cryptoasset business of a beneficiary, or by the cryptoasset business of the originator to the unhosted wallet of a beneficiary, with a view to making the cryptoasset available to the beneficiary; “ unique transaction identifier ” means the combination of letters, numbers or symbols determined by a cryptoasset business which permits the traceability of the transaction from the originator to the beneficiary; “ working day ” means any day other than a Saturday, a Sunday, Christmas Day, Good Friday or a day which is a bank holiday under the Banking and Financial Dealings Act 1971 in any part of the United Kingdom. Chapter 2 Inter-cryptoasset business transfers Information accompanying an inter-cryptoasset business transfer 64C 1 In respect of an inter-cryptoasset business transfer, the cryptoasset business of the originator must ensure that the cryptoasset transfer is accompanied by the information specified in paragraph (5). 2 Where paragraph (3) applies, if the cryptoasset business of the beneficiary makes a request for the information specified in paragraph (6), the cryptoasset business of the originator must, within three working days of the request, also provide the information specified in paragraph (6). 3 This paragraph applies where each of the cryptoasset businesses executing the inter-cryptoasset business transfer (including any intermediary cryptoasset business) is carrying on business in the United Kingdom in respect of the transaction. 4 Where paragraph (3) does not apply and the transfer is equal to or exceeds the equivalent in cryptoassets of 1,000 euros in value (taken together with any other cryptoasset transfer which appears to be linked), the cryptoasset business of the originator must ensure that the inter-cryptoasset business transfer is also accompanied by the information specified in paragraph (6). 5 The information specified in this paragraph is— a the name of the originator and the beneficiary; b if the originator or beneficiary is a firm, the registered name of the originator or beneficiary (as the case may be), or if there is no registered name, the trading name; and c the account number of the originator and the beneficiary, or if there is no account number, the unique transaction identifier. 6 The information specified in this paragraph is— a if the originator is a firm— i the customer identification number; or ii the address of the originator’s registered office, or, if different, or if there is none, its principal place of business; b if the originator is an individual, one of the following— i the customer identification number; ii the individual’s address; iii the individual’s birth certificate number, passport number or national identity card number; iv the individual’s date and place of birth. 7 In the case of a batch file transfer where the cryptoasset business of the beneficiary is carrying on business wholly outside the United Kingdom, paragraphs (1) and (4) do not apply to each of the individual business transfers, provided that— a the batch is accompanied by the information required by paragraphs (1) and (4); and b each individual transfer within the batch is accompanied by the account number of the originator, or if there is no account number, the unique transaction identifier. 8 Information relating to the originator required under this regulation must have been verified by the cryptoasset business of the originator on the basis of documents or information in either case obtained from a reliable source which is independent of the person whose identity is being verified. 9 A cryptoasset business of an originator must not make an inter-cryptoasset business transfer before ensuring full compliance with this regulation. Missing or non-corresponding information: the cryptoasset business of a beneficiary 64D 1 When a cryptoasset business of a beneficiary receives a cryptoasset as part of an inter-cryptoasset business transfer it must, before making the cryptoasset available to the beneficiary, check whether— a it has received the information required by regulation 64C to be provided; and b the information relating to the beneficiary corresponds with information verified by it under Part 3 (customer due diligence) . 2 Where the cryptoasset business of the beneficiary becomes aware that any information required by regulation 64C to be provided is missing or does not correspond with information verified by it under Part 3, the cryptoasset business of the beneficiary must— a request the cryptoasset business of the originator to provide the missing information; b consider whether to make enquiries as to any discrepancy between information received and information verified by it under Part 3; and c consider whether— i to delay making the cryptoasset available to the beneficiary until the information is received or any discrepancy resolved; and ii if the information is not received or discrepancy resolved within a reasonable time, to return the cryptoasset to the cryptoasset business of the originator. 3 In deciding what action to take under paragraph (2)(c) the cryptoasset business must have regard to— a the risk assessments carried out by the cryptoasset business under regulations 18(1) (risk assessment by relevant persons) and 18A(1) (risk assessment by relevant persons in relation to proliferation financing); and b its assessment of the level of risk of money laundering, terrorist financing and proliferation financing arising from the inter-cryptoasset business transfer. 4 In assessing the level of risk for the purposes of paragraph (3)(b), the cryptoasset business must take account of factors including— a the purpose and nature of its business relationship with the beneficiary and of the inter-cryptoasset business transfer; b the value of the inter-cryptoasset business transfer and any cryptoasset transfer which appears to be linked; c the frequency of cryptoasset transfers made by or to the beneficiary via the cryptoasset business of the beneficiary; and d the duration of its business relationship with the beneficiary. 5 The cryptoasset business of a beneficiary must report to the FCA repeated failure by a cryptoasset business to provide any information required by regulation 64C as well as any steps the cryptoasset business of the beneficiary has taken in respect of such failures. Missing information: intermediaries 64E 1 When an intermediary cryptoasset business receives a cryptoasset as part of an inter-cryptoasset business transfer it must, before further transferring the cryptoasset, check whether it has received the information required by regulation 64C to be provided. 2 Where an intermediary cryptoasset business becomes aware that any information required by regulation 64C to be provided is missing, the intermediary cryptoasset business must— a request the cryptoasset business from which it received the transfer to provide the missing information; and b consider whether— i to delay the onward transfer of the cryptoasset until the information is received; and ii if the information is not received within a reasonable time, to return the cryptoasset to the cryptoasset business from which it was received. 3 In deciding what action to take under paragraph (2)(b) an intermediary cryptoasset business must have regard to— a the risk assessments carried out by the intermediary cryptoasset business under regulations 18(1) and 18A(1); and b its assessment of the level of risk of money laundering, terrorist financing and proliferation financing arising from the inter-cryptoasset business transfer. 4 In assessing the level of risk under paragraph (3)(b) the intermediary cryptoasset business must take account of factors including— a the purpose and nature of the business relationship with its customer cryptoasset business, and of the inter-cryptoasset business transfer; and b the value of the inter-cryptoasset business transfer and any cryptoasset transfer which appears to be linked. 5 An intermediary cryptoasset business must report to the FCA repeated failure by a cryptoasset business to provide any information required by regulation 64C as well as any steps the intermediary cryptoasset business has taken in respect of such failures. Retention of information with an inter-cryptoasset business transfer: intermediaries 64F An intermediary cryptoasset business must— a ensure that all the information that is provided in relation to an inter-cryptoasset business transfer pursuant to regulation 64C, including any that is requested to be provided before the transfer is made under regulation 64E(2)(a), also accompanies the onward transfer (whether to another intermediary cryptoasset business or to the cryptoasset business of the beneficiary); and b send on to the relevant cryptoasset business, as soon as practicable, any information requested under regulation 64E(2)(a) which is received after it has transferred the cryptoasset to the relevant cryptoasset business. Chapter 3 Unhosted wallet transfers Requesting information: unhosted wallet transfers and cryptoasset businesses 64G 1 A cryptoasset business involved in an unhosted wallet transfer may request from its customer (whether the originator or the beneficiary)— a such information specified in regulation 64C(5) as it does not already hold; and b where the unhosted wallet transfer is equal to or exceeds the equivalent in cryptoassets of 1,000 euros in value (taken together with any other cryptoasset transfer which appears to be linked), and where its customer is the beneficiary, the information specified in regulation 64C(6) in respect of the originator. 2 In determining under paragraph (1) whether to request information from its customer, the cryptoasset business must have regard to— a the risk assessments carried out by the cryptoasset business under regulations 18(1) and 18A(1); and b its assessment of the level of risk of money laundering, terrorist financing and proliferation financing arising from the unhosted wallet transfer. 3 In assessing the level of risk under paragraph (2)(b), a cryptoasset business must take account of factors including— a the purpose and nature of— i the business relationship with its customer (whether beneficiary or originator); and ii the unhosted wallet transfer; b the value of the unhosted wallet transfer and any cryptoasset transfer which appears to be linked; c the frequency of cryptoasset transfers made by or to the customer (whether beneficiary or originator) via the cryptoasset business; and d the duration of the business relationship with its customer. 4 In the event that the cryptoasset business involved in an unhosted wallet transfer does not receive information requested under paragraph (1) it must not make the cryptoasset available to the beneficiary. Chapter 4 Provision of information to law enforcement authorities Provision of information 64H A cryptoasset business must respond fully and without delay to a request in writing from a law enforcement authority (within the meaning of regulation 44(10)) for any information held in connection with this Part which that authority reasonably requires in connection with the authority’s functions. . 6 In regulation 74A(1)(a) (reporting requirements: cryptoasset businesses) , after “Parts 2 to 6” insert “and 7A” . 7 In Schedule 6 (relevant requirements) after paragraph 11 insert— 11A The requirements specified in this paragraph are those imposed in— a regulation 64C (information accompanying an inter-cryptoasset business transfer); b regulation 64D (missing or non-corresponding information: the cryptoasset business of a beneficiary); c regulation 64E (missing information: intermediaries); d regulation 64F (retention of information with an inter-cryptoasset business transfer: intermediaries); e regulation 64G (requesting information: unhosted wallet transfers and cryptoasset businesses); f regulation 64H (provision of information). . Proliferation financing 6 1 In regulation 3 (general interpretation), after the definition of “PRA-authorised person” insert ““ proliferation financing ” has the meaning given by regulation 16A(9);” . 2 After regulation 16 (risk assessment by the Treasury and Home Office) insert— Risk assessment by the Treasury 16A 1 The Treasury must make arrangements for a risk assessment to be undertaken to identify, assess, understand and mitigate the risks of proliferation financing affecting the United Kingdom (“the proliferation financing risk assessment”). 2 The proliferation financing risk assessment must, among other things— a identify, where appropriate, the sectors or areas of lower and greater risk of proliferation financing; b provide the information and analysis necessary to enable it to be used for the purposes set out in paragraph (3). 3 The Treasury must ensure that the proliferation financing risk assessment is used to— a consider the appropriate allocation and prioritisation of resources to counter proliferation financing; b consider whether the exclusions provided for in regulation 15 (exclusions) are being abused. 4 The Treasury must prepare a report setting out, as appropriate, the findings of the proliferation financing risk assessment as soon as reasonably practicable after the proliferation financing risk assessment is completed. 5 A copy of that report must be laid before Parliament and sent to the supervisory authorities. 6 The Treasury must take appropriate steps to ensure that the proliferation financing risk assessment is kept up-to-date. 7 The proliferation financing risk assessment may be included in the risk assessment made under regulation 16 (risk assessment by the Treasury and Home Office). 8 The report referred to in paragraph (4) may be included within the joint report of the Treasury and Home Office referred to in regulation 16(6). 9 In this regulation, “ proliferation financing ” means the act of providing funds or financial services for use, in whole or in part, in the manufacture, acquisition, development, export, trans-shipment, brokering, transport, transfer, stockpiling of, or otherwise in connection with the possession or use of, chemical, biological, radiological or nuclear weapons, including the provision of funds or financial services in connection with the means of delivery of such weapons and other CBRN-related goods and technology, in contravention of a relevant financial sanctions obligation. 10 In this regulation— “ biological weapon ” means a biological agent or toxin (within the meaning of section 1(1)(a) of the Biological Weapons Act 1974 ) in a form capable of use for hostile purposes or anything to which section 1(1)(b) of that Act applies; “ chemical weapon ” has the meaning given by section 1 of the Chemical Weapons Act 1996 ; “ CBRN-related goods and technology ” means technology (including dual-use technology) and dual-use goods used for non-legitimate purposes in connection with the matters referred to in paragraph (9); “ dual-use goods ” means (a) any thing for the time being specified in Annex I of the Dual-Use Regulation, other than any thing which is dual-use technology, and (b) any tangible storage medium on which dual use technology is recorded or from which it can be derived; “ Dual-Use Regulation ” means Council Regulation (EC) No 428/2009 of 5 May 2009 setting up a Community regime for the control of exports, transfer, brokering and transit of dual-use items; “ dual-use technology ” means any thing for the time being specified in Annex I of the Dual-Use Regulation which is described as software or technology; “ nuclear weapon ” includes a nuclear explosive device that is not intended for use as a weapon; “ radiological weapon ” means a device designed to cause destruction, damage or injury by means of the radiation produced by the decay of radioactive material; “ relevant financial sanctions obligation ” means a prohibition or requirement in regulations made under section 1 of the Sanctions and Anti-Money Laundering Act 2018 and imposed for one or more of the purposes in section 3(1) or (2) of that Act so far as it relates to compliance with a relevant UN obligation; “ relevant UN obligation ” means an obligation that the UK has by virtue of a resolution adopted by the Security Council of the United Nations which relates to the prevention, suppression and disruption of the proliferation of weapons of mass destruction and the financing of such; “ technology ” has the meaning given by paragraph 37 of Schedule 1 to the Sanctions and Anti-Money Laundering Act 2018. . 3 After regulation 18 (risk assessment by relevant persons) insert— Risk assessment by relevant persons in relation to proliferation financing 18A 1 A relevant person must take appropriate steps to identify and assess the risks of proliferation financing to which its business is subject. 2 In carrying out the risk assessment required under paragraph (1), a relevant person must take into account— a information in the report referred to in regulation 16A (risk assessment by the Treasury); and b risk factors including factors relating to— i its customers; ii the countries or geographic areas in which it operates; iii its products or services; iv its transactions; and v its delivery channels. 3 In deciding what steps are appropriate under paragraph (1), the relevant person must take into account the size and nature of its business. 4 A relevant person must keep an up-to-date record in writing of all the steps it has taken under paragraph (1), unless its supervisory authority notifies it in writing that such a record is not required. 5 A relevant person must provide the risk assessment it has prepared under paragraph (1), the information on which that risk assessment was based and any record required to be kept under paragraph (4), to its supervisory authority on request. . 4 After regulation 19 (policies, controls and procedures) insert— Policies, controls and procedures in relation to proliferation financing 19A 1 A relevant person must— a establish and maintain policies, controls and procedures to mitigate and manage effectively the risks of proliferation financing identified in any risk assessment undertaken by the relevant person under regulation 18A(1); b regularly review and update the policies, controls and procedures established under sub-paragraph (a); c maintain a record in writing of— i the policies, controls and procedures established under sub-paragraph (a); ii any changes to those policies, controls and procedures made as a result of the review and update required by sub-paragraph (b); and iii the steps taken to communicate those policies, controls and procedures, or any changes to them, within the relevant person’s business. 2 The policies, controls and procedures adopted by a relevant person under paragraph (1) must be— a proportionate with regard to the size and nature of the relevant person’s business; and b approved by its senior management. 3 The policies, controls and procedures referred to in paragraph (1) must include— a risk management practices; b internal controls (see regulations 21 to 24) ; c the monitoring and management of compliance with, and the internal communication of, such policies, controls and procedures. 4 The policies, controls and procedures referred to in paragraph (1) must include policies, controls and procedures— a which provide for the identification and scrutiny of— i any case where— aa a transaction is complex or unusually large, or there is an unusual pattern of transactions; or bb the transaction or transactions have no apparent economic or legal purpose, and ii any other activity or situation which the relevant person regards as particularly likely by its nature to be related to proliferation financing; b which specify the taking of additional measures, where appropriate, to prevent the use for proliferation financing of products and transactions which might favour anonymity; c which ensure that when new products, new business practices (including new delivery mechanisms) or new technology are adopted by the relevant person, appropriate measures are taken in preparation for, and during, the adoption of such products, practices or technology to assess and if necessary mitigate any proliferation financing risks this new product, practice or technology may cause; d which, in the case of a money service business that uses agents for the purpose of its business, ensure that appropriate measures are taken by the business to assess— i whether an agent used by the business would satisfy the fit and proper test provided for in regulation 58 ; and ii the extent of the risk that the agent may be used for proliferation financing. 5 A relevant person must, where relevant, communicate the policies, controls and procedures which it establishes and maintains in accordance with this regulation to its branches and subsidiary undertakings which are located outside the United Kingdom. . 5 In regulation 20(1)(a), for “regulation 19(1)” substitute “regulations 19(1) and 19A(1)” ; 6 In regulation 21(7)— a after “regulation 19(1)” insert “or 19A(1)” ; b in paragraph (10)(a), after “regulation 18(1)” insert “and 18A(1)” . 7 In the following provisions, for “money laundering and terrorist financing” substitute “money laundering, terrorist financing and proliferation financing” — a regulation 3 (interpretation) , in the definition of “senior management”; b regulation 20(1)(b), (3), (4)(b) and (5) (policies, controls and procedures: group level) ; c regulation 21(2)(b)(ii)(aa) and (2)(b)(ii)(bb) (internal controls); d regulation 24(1)(a)(i), (2)(b)(i), (2)(b)(ii) and (3)(a)(iii) (training). 8 In the following provisions, for “money laundering or terrorist financing” substitute “money laundering, terrorist financing or proliferation financing” — a regulation 21(7)(a); b regulation 24(1)(a)(ii); c regulation 41(1), (6)(a), (7) and (8) (data protection) ; d regulation 45ZB(11)(a), (11)(b) and (11)(d) (access to information on the register) ; e regulation 52A(3)(a)(i) (confidentiality) ; f regulation 74C(3)(c) (directions: cryptoasset businesses) . 9 In Schedule 6 (meaning of “ relevant requirement ”), in paragraph 5 — a after sub-paragraph (a)(i) insert— ia regulation 18A (risk assessment by relevant persons in relation to proliferation financing); ; b after sub-paragraph (a)(ii) insert— iia regulation 19A (policies, controls and procedures in relation to proliferation financing); . Art market participants 7 In regulation 14 (art market participants) — a in paragraph (1)(d), after “means” insert “, subject to paragraph (3),” ; b after paragraph (2) insert— 3 A firm or sole practitioner is not an art market participant for the purposes of paragraph (1)(d)(i) in relation to the sale of a work of art which is created by, or is attributable to, a member of the firm or the sole practitioner. . Exceptions 8 In regulation 15(3)(f), after “or (h)” insert “to (k)” . Reporting of material discrepancies to the registrar of companies 9 In regulation 30A — a in paragraph (1)— i at the end of sub-paragraph (d), omit “or”; ii at the end of sub-paragraph (e), insert “or” ; iii after sub-paragraph (e), insert— f an overseas entity which is subject to registration under Part 1 of the Economic Crime (Transparency and Enforcement) Act 2022 , ; iv for the words after new sub-paragraph (f) substitute— a relevant person must collect an excerpt of the register which contains full details of any information specified in paragraph (1A) held on the register at the relevant time before the business relationship is established, or must establish from its inspection of the register that there is no such information held on the register at that time. ; b after paragraph (1) insert— 1A The information specified in this paragraph is as follows— a in relation to a firm of a type described in paragraphs (1)(a) to (e), information relating to beneficial owners of the customer; and b in relation to an overseas entity of a type described in paragraph (1)(f), required information relating to registrable beneficial owners specified under Schedule 1 to the Economic Crime (Transparency and Enforcement) Act 2022. ; c in paragraph (2), for “any discrepancy” substitute “any material discrepancy” ; d after paragraph (2) insert— 2A When taking measures to fulfil the duties to carry out customer due diligence and ongoing monitoring of a business relationship (including enhanced customer due diligence and enhanced ongoing monitoring) under Part 3 of these Regulations after a business relationship with a customer of a type described in paragraph (1)(a) to (f) has been established, a relevant person must also collect an excerpt of the register which contains full details of any information specified in paragraph (1A) which is held on the register at that time, or must establish from its inspection of the register that there is no such information held on the register at that time. 2B The relevant person must report to the person mentioned in paragraph (3) any material discrepancy the relevant person finds between information relating to the beneficial ownership of the customer— a which the relevant person collects under paragraph (2A), and b which otherwise becomes available to the relevant person in the course of carrying out its duties under these Regulations. ; e in paragraph (3)— i for “The discrepancy” substitute “A material discrepancy referred to in paragraphs (2) and (2B)” ; ii for “or an eligible Scottish partnership,” substitute “, an eligible Scottish partnership or an overseas entity,” ; f in paragraph (4), after “paragraph (2)” insert “or (2B)” ; g in paragraph (5), for “the discrepancy”, the first time it occurs, substitute “a material discrepancy” ; h for paragraph (6) substitute— 6 A discrepancy which is reported to the registrar under paragraph (3) is material excluded from public inspection for the purposes of— a section 1087 of the Companies Act 2006 (material not available for public inspection) , including for the purposes of that section as applied— i to unregistered companies by paragraph 20 of Schedule 1 to the Unregistered Companies Regulations 2009 ; ii to limited liability partnerships by regulation 66 of the Limited Liability Partnerships (Application of Companies Act 2006) Regulations 2009 ; and iii to eligible Scottish partnerships by regulation 61 of the Scottish Partnerships (Register of People with Significant Control) Regulations 2017 ; and b section 22 of the Economic Crime (Transparency and Enforcement) Act 2022 (material unavailable for inspection). ; i after paragraph (7) insert— 8 In this regulation, a “material discrepancy” is one described in Schedule 3AZA. ; j after Schedule 3 (relevant offences), insert— SCHEDULE 3AZA Material Discrepancies Regulation 30A A material discrepancy in this Schedule may arise, as the case may be, in relation to information about a beneficial owner within the meaning of regulation 3 of these Regulations (including about a person of significant control within the meaning of Part 21A of the Companies Act 2006 ) and in relation to information about a registrable beneficial owner within the meaning of Part 3 of Schedule 1 to the Economic Crime (Transparency and Enforcement) Act 2022. 1 A material discrepancy in this Schedule is one which satisfies the condition in paragraph 2, including one which is in a form listed in paragraph 3. 2 The condition in this paragraph is that the discrepancy, by its nature, and having regard to all the circumstances, may reasonably be considered— a to be linked to money laundering or terrorist financing; or b to conceal details of the business of the customer. 3 Discrepancies listed in this paragraph are in the form of— a a difference in name; b an incorrect entry for nature of control; c an incorrect entry for date of birth; d an incorrect entry for nationality; e an incorrect entry for correspondence address; f a missing entry for a person of significant control or a registrable beneficial owner; g an incorrect entry for the date the individual became a registrable person. . Repeal of Part 5A: Requests for information about accounts and safe-deposit boxes 10 Omit Part 5A (requests for information about accounts and safe-deposit boxes) . Information sharing and confidentiality 11 1 In regulation 52 (disclosure by supervisory authorities) — a in the heading, at the end, insert “and other relevant authorities” ; b in paragraph (1), omit “Subject to regulation 52A,”; c in paragraph (1)(a), at the end, insert “or any other functions related to money laundering, terrorist financing or the integrity of the international financial system” ; d after paragraph (1) insert— 1A A relevant authority referred to in paragraph (5)(b), (c), (e) or (f) may disclose to a supervisory authority or another relevant authority referred to in paragraph (5) information it holds, provided the disclosure is made for purposes connected with— a the effective exercise of the functions of the supervisory authority or other relevant authority under these Regulations; or b money laundering, terrorist financing or the integrity of the international financial system. 1B Nothing in paragraph (1A) affects the powers of a relevant authority referred to in paragraph (5)(b), (c), (e) or (f) to disclose information to a supervisory authority or other relevant authority apart from this regulation. ; e in paragraph (2), after “paragraph (1)”, in both places, insert “or (1A)” ; f in paragraphs (3) and (4), after “paragraph (1)” insert “or (1A)” ; g in paragraph (5), after sub-paragraph (d) insert— e the Secretary of State for purposes connected with the effective exercise of his or her functions under enactments relating to companies, audit and insolvency; f the registrar of companies within the meaning of section 1060(3) of the Companies Act 2006 . . 2 In regulation 52A (obligation of confidentiality) — a in paragraph (3), for “only use” substitute “disclose” ; b after paragraph (3)(d) insert— e in accordance with regulation 52. . Changes in control of registered cryptoasset businesses 12 1 In regulation 57 (applications for registration in a register maintained under regulation 54 or 55), at the beginning of paragraph (4) insert “Without prejudice to the application of regulation 60B,” . 2 In regulation 59 (determination of applications for registration under regulations 54 and 55) , after paragraph (5) insert— 6 Where— a the registering authority decides not to register an applicant, the authority may, if it considers it proportionate to do so, publish such information about that decision as the authority considers appropriate; b the FCA has received a notice under Part 12 of FSMA as modified by regulation 60B and Schedule 6B (changes in control of registered cryptoasset businesses) from a person who decides to acquire or increase control over a registered cryptoasset business and the FCA decides to object to the acquisition, the FCA may, if it considers it proportionate to do so, publish such information about that decision as the FCA considers appropriate. 7 Where the supervisory authority publishes information under paragraph (6) and the person whose registration is refused, or whose acquisition is the subject of objection, refers the matter to the Upper Tribunal, the supervisory authority must, without delay, publish information about the status of the appeal and its outcome in the same manner as that in which the information was published under paragraph (6). 8 In this regulation, “ registered cryptoasset business ” means a cryptoasset exchange provider or a custodian wallet provider which is included in a register maintained by the FCA under regulation 54(1A). . 3 After regulation 60A (disclosure by cryptoasset businesses) insert— Changes in control of registered cryptoasset businesses 60B Schedule 6B applies to an acquisition of or increase in control over a registered cryptoasset business (within the meaning given at regulation 59(8)). 4 After Schedule 6A (The United Kingdom’s Financial Intelligence Unit) insert— SCHEDULE 6B Changes in Control of Registered Cryptoasset Businesses Regulation 60B Modifications: Control over registered cryptoasset exchange providers and registered custodian wallet providers 1 With respect to an acquisition of or an increase in control over a cryptoasset business, Part 12 of FSMA (control over authorised persons) applies with the following modifications— a references to a “UK authorised person” are to be read as references to a registered cryptoasset exchange provider or registered custodian wallet provider to which Part 12 of FSMA does not otherwise apply; b references to “appropriate regulator” and “each regulator” are to be read as references to the FCA; c section 178 (obligation to notify the appropriate regulator: acquisitions of control) is to be read as if— i subsection (2ZA) were omitted; ii subsection (2A) were omitted; d section 181 (acquiring control) is to be read as if— i for the heading there were substituted “Acquiring or increasing control” ; ii for subsections (1) and (2) there were substituted— For the purposes of this Part, a person (“ A ”) acquires or increases control over a UK authorised person (“ B ”) or a parent undertaking of B (“ P ”) if A would become a beneficial owner of B or P within the meaning of regulations 5 or 6 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 if the acquisition were to proceed. ; e section 182 (increasing control) and section 183 (reducing or ceasing to have control) are to be disregarded; f section 184 (disregarded holdings) is to be read as if— i in subsection (1), for “For the purposes of sections 181 to 183” there were substituted “For the purposes of section 181” ; ii subsections (4) to (10) were omitted; g section 185 (assessment: general) is to be read as if— i in subsection (2)(a), “and the financial soundness of the acquisition” were omitted; ii in subsection (3)(a), for “matters” there were substituted “matter” ; h section 186 (assessment criteria) is to be read as if it said— Assessment criteria 186 The matter specified in section 185(3)(a) is whether the section 178 notice-giver is a fit and proper person within the meaning of regulation 58A of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (fit and proper test: cryptoasset businesses). ; i section 187 (approval with conditions) is to be read as if subsection (2)(b) were omitted; j section 187A (assessment: consultation by PRA with FCA) is to be disregarded; k section 187B (assessment: consultation by FCA with PRA) is to be disregarded; l section 187C (variation etc of conditions) is to be disregarded; m section 189 (assessment: procedure) is to be read as if— i subsections (1A), (1ZB) and (1B) were omitted; ii in subsection (6), “Unless section 190A applies” were omitted; n section 190 (requests for further information) is to be read as if subsections (1A) and (4)(b) were omitted; o section 190A (assessment and resolution) is to be disregarded; p section 191A (objection by the appropriate regulator) is to be read as if— i in subsection (2)(c), for “matters in” there were substituted “matter specified in” ; ii subsection (4A) were omitted; iii after subsection (7) there were inserted— 8 A person (“ A ”) acquires or increases control for the purposes of this section if it acquires or increases control over a UK authorised person (“ B ”) or a parent undertaking of B (“ P ”) by becoming a beneficial owner of B or P within the meaning of regulations 5 or 6 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 . ; q section 191B (restriction notices) is to be read as if— i in subsection (2)(a), after “voting power” there were inserted “or otherwise being a beneficial owner (within the meaning of regulations 5 or 6 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017) of the UK authorised person (“ B ”) or a parent undertaking of B” ; ii in subsection (2)(b), “in relation to the shares or voting power,” were omitted; iii subsection (2A) were omitted; iv after subsection (3) there were inserted— 3ZA In a restriction notice, the appropriate regulator may direct that, in respect of a beneficial owner of a UK authorised person (“ B ”) or a parent undertaking of B, until further notice, no influence over the management or activities of B is to be exercisable by the beneficial owner. ; v subsection (3A) were omitted; vi in subsection (6)(b), after “held in” there were inserted “, or beneficial ownership of,” ; r section 191C (orders for sale of shares) is to be read as if subsections (2A), (7) and (8) were omitted; s section 191D (obligation to notify the appropriate regulator: dispositions of control) is to be read as if— i subsection (1A) were omitted; ii after subsection (2) there were inserted— 3 For the purposes of this section, a person (“ A ”) reduces or ceases to have control over a UK authorised person (“ B ”) or a parent undertaking of B (“ P ”) if A would cease to be a beneficial owner of B or P within the meaning of regulations 5 or 6 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 if the disposition were to proceed. ; t section 191F (offences under this Part) is to be read as if— i in subsection (2), “or section 190A applies” were omitted; ii subsection (4A) were omitted; iii for subsections (8) and (9) there were substituted— 8 A person guilty of an offence under subsection (1) to (3) or (5) to (7) is liable— a on summary conviction— i in England and Wales, to a fine; ii in Scotland or Northern Ireland, to a fine not exceeding the statutory maximum; b on conviction on indictment, to a fine. 9 A person guilty of an offence under subsection (4) is liable— a on summary conviction— i in England and Wales, to a fine; ii in Scotland or Northern Ireland, to a fine not exceeding the statutory maximum; b on conviction on indictment, to imprisonment for a term not exceeding two years or a fine, or both. ; iv after subsection (9) there were inserted— 10 A person is not guilty of an offence under this section if that person took all reasonable steps and exercised all due diligence to avoid committing the offence. ; u section 191G (interpretation) is to be read as if the definitions of “the appropriate regulator”, “qualifying credit institution” and “UK authorised person” were omitted. Interpretation 2 In this Schedule— “ cryptoasset business ” means a cryptoasset exchange provider or a custodian wallet provider; “ cryptoasset exchange provider ” has the meaning given by regulation 14A(1) ; “ custodian wallet provider ” has the meaning given by regulation 14A(2); “ parent undertaking ” has the meaning given by section 420 of the Financial Services and Markets Act 2000 “ registered cryptoasset exchange provider ” means a cryptoasset exchange provider which is included in the register maintained by the FCA under regulation 54(1A) (duty to maintain registers of certain relevant persons) ; “ registered custodian wallet provider ” means a custodian wallet provider which is included in the register maintained by the FCA under regulation 54(1A). . Suspicious activity reports 13 1 In regulation 66 (power to require information)— a after paragraph (1) insert— 1A The power in paragraph (1) includes power to require P to provide a copy of any suspicious activity disclosure made to the NCA. ; b after paragraph (8) insert— 9 In this regulation, “ suspicious activity disclosure ” has the meaning given in regulation 104(4). . 2 After paragraph 15 of Schedule 4 (supervisory information) insert— 15A A copy of any suspicious activity disclosure (within the meaning given in regulation 104(4)) the supervisory authority or any of its supervised persons has made to the NCA. . Modifications to regulations 74A to 74C: reporting requirements etc. for Annex 1 financial institutions 14 Regulations 74A to 74C apply to Annex 1 financial institutions as they do to cryptoasset businesses but with the following modifications— a regulation 74A (reporting requirements: cryptoasset businesses) is to be read as if— i in the heading, for “cryptoasset businesses” there were substituted “Annex 1 financial institutions” ; ii in paragraph (1), for “cryptoasset exchange provider and custodian wallet provider (“cryptoasset business”)” there were substituted “Annex 1 financial institution” ; iii in paragraph (1)(a)— aa for “cryptoasset business” there were substituted “Annex 1 financial institution” ; bb “and 7A” were omitted; b regulation 74B (report by a skilled person: cryptoasset businesses) is to be read as if— i in the heading, for “cryptoasset businesses” there were substituted “Annex 1 financial institutions” ; ii in paragraph (1), for “a relevant person who is a cryptoasset exchange provider or custodian wallet provider” there were substituted “a relevant person who is an Annex 1 financial institution” ; c regulation 74C (directions: cryptoasset businesses) is to be read as if— i in the heading, for “cryptoasset businesses” there were substituted “Annex 1 financial institutions” ; ii in paragraph (1), for “a cryptoasset exchange provider or custodian wallet provider (“cryptoasset business”)” there were substituted “an Annex 1 financial institution” ; iii in paragraph (3)(c), for “cryptoasset business” there were substituted “Annex 1 financial institution” ; iv in paragraph (6), for “a cryptoasset business” there were substituted “an Annex 1 financial institution” ; v in paragraph (9), for “cryptoasset business” there were substituted “Annex 1 financial institution” ; vi in paragraph (10)— aa in sub-paragraph (c), in both places, for “cryptoasset business” there were substituted “Annex 1 financial institution” ; bb in sub-paragraphs (d) and (e), for “cryptoasset business” there were substituted “Annex 1 financial institution” ; vii in paragraph (12), in both places, for “cryptoasset business” there were substituted “Annex 1 financial institution” ; viii in paragraph (13), in both places, for “cryptoasset business” there were substituted “Annex 1 financial institution” ; ix in paragraph (14), for “cryptoasset business” there were substituted “Annex 1 financial institution” ; x in paragraph (16), for “cryptoasset business” there were substituted “Annex 1 financial institution” ; xi in paragraph (17), for “cryptoasset business” there were substituted “Annex 1 financial institution” ; xii in paragraph (18)(c), for “cryptoasset business” there were substituted “Annex 1 financial institution” ; xiii in paragraph (19), for “cryptoasset business” there were substituted “Annex 1 financial institution” . Amendment of Schedule 2: account information service providers 15 For paragraph 4 of Schedule 2 (listed activities) substitute— 4 Payment services as defined in regulation 2(1) of the Payment Services Regulations 2017 , other than an account information service (within the meaning of that term in regulation 2(1) of those Regulations). PART 3 Amendments of primary legislation Amendment of the Companies Act 2006 16 In section 1095A of the Companies Act 2006 (rectification of register to resolve a discrepancy) — a in subsection (1)(a)— i for “a discrepancy” substitute “a material discrepancy” ; ii after “30A(2)” insert “or (2B)” ; b in subsection (1)(b)— i omit “the discrepancy”; ii for “a discrepancy” substitute “a material discrepancy” . Amendment of the Economic Crime (Transparency and Enforcement) Act 2022 17 After section 29 (application to rectify register) of the Economic Crime (Transparency and Enforcement) Act 2022 insert— 29A 1 This section applies where— a a material discrepancy in information relating to any registrable beneficial owner is reported to the registrar under regulation 30A(2) or (2B) of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (requirement to report discrepancies in information about beneficial ownership) , and b the registrar determines, having investigated under regulation 30A(5) of those Regulations, that there is a material discrepancy. 2 The registrar may remove material from the register if doing so is necessary to resolve the discrepancy. . Alan Mak Michael Tomlinson Two of the Lords Commissioners of Her Majesty’s Treasury 21st July 2022