ECSH72000 - Regulations 67 and 68 - Requests for support to and from foreign authorities
Source: gov.uk (2025-01-20)


Introduction

The Money Laundering, Terrorist Financing and Transfer of Funds (information on the Payer) Regulations 2017 (MLR 2017) contain powers known as ‘information sharing gateways’ that allow us to share information that the duty of confidentiality under Commissioners for Revenue and Customs Act 2005 (https://www.legislation.gov.uk/ukpga/2005/11/contents) (CRCA 2005), or data protection legislation, would normally prohibit us from sharing.

Regulation 67 MLR 2017 and regulation 68 MLR 2017 are part of the information gathering powers and provide the following:
- Regulation 67 MLR 2017 allows HMRC to exercise its powers under regulation 66 to give effect to a request made by a foreign authority if they meet the definition in the section below ‘What is a foreign authority?’.
- Regulation 68 MLR 2017 allows HMRC to make a request for assistance from a foreign authority in obtaining specified information or documents, if two conditions are met. Those conditions are:
- The documents or information are reasonably required in connection with our supervisory function under MLR 2017 and are not available in the UK.
- We have reason to believe such documents or information may be held by a person who is within the jurisdiction of that foreign authority.
Regulations 67 and 68 MLR 2017 only relate to using information notice powers under regulation 66 MLR 2017. Other gateways exist for sharing information and intelligence with foreign authorities and you should consult the EC-S information gateway team if you need to do so.

The sharing of information that we hold or information that we have received from a foreign authority, is subject to wider data protection law and all such requests must be routed through the EC-S information gateway team to ensure full compliance with the law and HMRC policies further outlined in the Information Disclosure Guide. (https://www.gov.uk/hmrc-internal-manuals/information-disclosure-guide)

What is a 'foreign authority' for the purposes of regulations 67 and 68 MLR 2017?

Requests under these regulations can only be made by, or to, a foreign authority that is an authority in a territory which is not part of the United Kingdom and which exercises functions provided for in:
- The fourth money laundering directive;
- The Funds Transfer Regulations; or
- The law of a third country equivalent to those provided for in the fourth money laundering directive or the Funds Transfer Regulations.
Sharing information with a foreign authority

Any disclosure of information to, or from, a foreign authority must be dealt with in accordance with UK data protection law. It must be proportionate to the request, suitably specific and limited to the precise requirement.

Handling requests from foreign authorities under regulation 67 MLR 2017

Any such request must be handled by the EC-S information gateway team.

The information EC-S can supply in response to a request under this regulation is restricted to the powers HMRC has under regulation 66 ‘Power to require information, access or documents’. See ECSH71500 (https://www.gov.uk/hmrc-internal-manuals/economic-crime-supervision-handbook/ecsh71500). For other ways of exchanging information see ECSH120000 (https://www.gov.uk/hmrc-internal-manuals/economic-crime-supervision-handbook/ecsh12000).

For HMRC to accept any request made under regulation 67 from a foreign authority it must:
- Be for a person who is or was a relevant person, payment service provider or connected person.
- From a foreign authority (as defined above).
- Provide us with the details we would need to follow our own guidance in issuing a regulation 66 MLR 2017 information notice.
- Explain why the documents or information are reasonably required and how they are available in the UK; and
- Show why it is believed that such documents or information may be held by a person who is in the UK.
An examination of the request should take the following considerations into account. These are either allowed by regulation 68 MLR 2017 to be taken into account, or a policy decision:
- Must be for a sector HMRC supervises.
- Whether an equivalent level of assistance from the foreign authority requesting support would be given.
- Whether the request concerns laws and requirements that are existent and aligned with the UK.
- The seriousness of the case and its impact on persons in the UK.
- Be from a country that the UK recognises.
- Be from a country that to release such information to would not endanger the human rights of an individual.
Human rights obligations mean that we should not provide information which might lead to the death penalty or torture in another country. The EC-S information gateway team have the expertise, including ensuring that relevant data protection points are considered and addressed.

HMRC is not legally bound to execute the request when it is received from the foreign authority and can politely reject it. HMRC may decide not to exercise its powers unless the foreign authority undertakes to:
- Contribute towards the cost.
- Comply with conditions set out in relation to the information and documents provided.
Making requests to a foreign authority under regulation 68 MLR 2017

We should not seek to make multiple minor requests unnecessarily or where outcomes will not be significant. However, we should consider making requests where the importance and potential outcomes of a response could be significant in exercise of our functions as a supervisory authority.

A request must only be made through the EC-S information disclosure gateway in accordance with HMRC Security and Information management guidelines.

Furthermore, a request to other authorities can only be made when the following conditions have been met:
- The documents or information reasonably required by EC-S, are not available in the United Kingdom; and
- EC-S has reason to believe that such documents or information may be held by a person who is in the jurisdiction of the foreign authority.
Requests must only be made where it is proportionate, we use the same criteria for requests under regulation 68 MLR 2017 as we do in regulation 66 MLR 2017.

As not all countries have an equivalent regime to the UK, in particular not all countries supervise the same sectors or supervise them in the same way as in the UK. This should be considered when deciding whether to make a request.

Officers should also be mindful of diplomatic relations and any human rights issues in the country and the impact that a request may have. To request information involves sharing information, and we should not provide information which might lead to human rights implications such as the death penalty or torture in another country.

An EC-S request to a foreign authority can only be made, where the request is in connection with HMRC’s function as a supervisory authority under MLR 2017.

A foreign authority is not legally bound to respond and is entitled to decline our request. They may also set conditions to restrict the purposes for which we may use the information.

Where a foreign authority responds to a request, unless the foreign authority agrees otherwise, we may only use the information received:
- For the purposes for which it was requested (e.g. to conduct compliance activity), or
- For the purposes of proceedings as a result of breaches of relevant requirements of MLR 2017 (e.g. issuing penalties or other sanctions) or anything following on from such action (e.g. an appeal).
Where the foreign authority consents, the information and documents can appropriately be used for any purpose HMRC deem necessary and the limitations outlined above no longer applies.

Regulation 68 MLR 2017 must not be used to lobby a foreign authority to initiate investigations or change the course of its actions, as this would be unlawful, as it would not meet the criteria set out in regulation 68 MLR 2017.