Source: Isle of Man
1. Action
1.1 The Isle of Man Financial Services Authority (the “Authority”) makes this public statement in accordance with powers conferred upon it under each of section 27 of the Designated Businesses (Registration and Oversight) Act 2015 (the “Act”) and regulation 5(7) of the Anti-Money Laundering and Countering the Financing of Terrorism (Civil Penalties) Regulations 2019 (the “Regulations”).
1.2 The making of such public statement supports the Authority’s regulatory objectives of, among other things, securing an appropriate degree of protection for customers of persons carrying on a regulated activity, reducing financial crime and maintaining confidence in the Isle of Man’s financial services industry.
1.3 Following an inspection of EAF by the Authority under section 14 of the Act (the “Inspection”), which identified a number of contraventions by EAF in relation to the Anti-Money Laundering and Countering the Financing of Terrorism Code 2019 (the “Code”), and the opening of a formal investigation (the “Investigation”), the Authority has deemed it appropriate, necessary and proportionate, in all the circumstances, that EAF be required to pay a civil penalty imposed under the Regulations.
1.4 The Regulations allow for penalties to be imposed at two levels depending on the seriousness of the contraventions of the Code identified. Penalties imposed equate to a percentage of the relevant person’s income (as such terms are defined in the Regulations). In this instance, the Authority has deemed that the contraventions of the Code identified, in all of the circumstances, merit that a civil penalty be imposed in the higher, Level 2, penalty bracket.
1.5 The civil penalty imposed on EAF is the sum of £2,640 which is discounted by 10% to £2,376 (the “Civil Penalty”).
1.6 The level of the Civil Penalty reflects the fact that EAF co-operated with the Authority and agreed settlement at an early stage.
1.7 As with all discretionary civil penalties issued by the Authority, the level of the Civil Penalty is calculated as a percentage of EAF’s relevant annual income at the time that the contraventions noted within this public statement were identified. The absolute amount of the Civil Penalty relative to other civil penalties that have been issued by the Authority previously is not necessarily indicative of the seriousness of the contraventions and is determined each time on the facts of a particular matter and regard is had by the Authority to the level and the percentage of civil penalties imposed in other matters. In determining the Civil Penalty, the Authority considered mitigating factors specific to the circumstances of this case.
2. Background
2.1 EAF is a sole practitioner who at all material times has been registered with the Authority as an External Accountant, Tax Adviser and Payroll Agent under the Designated Business (Registrations and Oversight) Act 2015.
2.2 The Authority’s on-site Inspection in June 2024 and the subsequent Investigation identified a significant number of contraventions of the Code by EAF (the “contraventions”).
2.3 The contraventions were systemic and longstanding, reaching back to EAF’s initial registration under the Act in 2019, evidencing that EAF had materially contravened the Code over a significant period.
2.4 EAF’s failure to establish, record, operate and maintain adequate AML/CFT procedures and controls, as required by the Code, increases the vulnerability of EAF being used for money laundering or terrorist financing (including proliferation financing).
2.5 EAF has engaged positively with the Authority throughout this matter in a timely and constructive manner.
3. Key Findings from Inspection Report and Investigation
Contraventions of the Code identified by the Inspection and Investigation included:
3.1 EAF failed to establish, record, operate or maintain procedures and controls relating to its Business Risk Assessment (“BRA”), Customer Risk Assessment (“CRA”), customer screening, ongoing monitoring, including transaction monitoring, and monitoring and testing compliance with the AML/CFT legislation (paragraph 4 of the Code).
3.2 EAF failed to carry out a BRA and therefore failed to estimate the risk of ML/FT posed by his business and customers (paragraph 5 of the Code).
3.3 EAF failed to carry out CRAs for his customers and therefore failed to estimate the risk of ML/FT posed by his customers (paragraph 6 of the Code).
3.4 EAF failed to carry out a Technology Risk assessment and therefore failed to estimate the risk of ML/FT posed by his customers (paragraph 7 of the Code).
3.5 EAF failed to establish, record, or maintain Customer Due Dilligence information such as onboarding, photo identification or proof of address documents, in relation to New Business Relationships, therefore failing to take reasonable measures to verify the identity of new customers and not taking reasonable measures to establish the source of funds of new clients (paragraph 8 of the Code).
3.6 EAF, in relation to his customers who were not a natural person, failed to adequately identify the beneficial owner as required by the Code (paragraph 12 of the Code).
3.7 EAF, in relation to his customers, failed to perform, record or document Ongoing Monitoring as required by the Code, and undertook no Ongoing Monitoring or screening of customers to check for exposure to sanctions, Politically Exposed Person or adverse information as required by the Code. EAF’s failure to establish Source of Funds (“SOF”) before a business relationship was entered into meant he was not in a position to scrutinise transactions to determine whether or not they were consistent with the expected SOF of a transaction. As no CRAs were undertaken, EAF was unable to determine whether transactions were consistent with the customer’s business and risk profile (paragraph 13 of the Code).
3.8 EAF did not establish, record, maintain or operate appropriate procedures and controls for the purpose of determining whether any customer (amongst other individuals) was, or subsequently became, a Politically Exposed Person (paragraph 14 of the Code).
3.9 EAF did not establish and maintain separate registers to record internal disclosures, external disclosures, or any other disclosures to the Financial Intelligence Unit (paragraph 28 of the Code).
3.10 EAF failed to establish, record, maintain and operate appropriate procedures and controls for monitoring and testing compliance with the AML/CFT legislation. EAF failed to produce reports in accordance with the requirements of paragraph 30(2) of the Code. Such reports are required at least annually and serve as a confirmation of the firm’s adherence to its legal obligations and the robustness of its AML/CFT framework (paragraph 30 of the Code).
3.11 EAF failed to provide or arrange staff AML/CFT education and training as required by the Code (paragraph 32 of the Code).
3.12 EAF failed to adequately meet the record keeping and record retention requirements of the Code (paragraphs 33 & 34 of the Code).
4. Key Learning Points for Industry
4.1 The Island’s National Risk Assessment currently assesses the accountancy sector’s level of risk for money laundering as medium, with the risk of terrorist financing being assessed as medium Low. The comparative size of the accountancy sector in the Isle of Man, the wide breadth of activities, the range of businesses from sole practitioners up to large international firms and the attractiveness of the sector to criminals are some of the factors that have led to the money laundering risk rating. It is recognised that accountants have knowledge and specific technical abilities which can make them attractive to professional money launderers and that the accounting sector may be used by money launderers to provide additional layers of legitimacy to criminal financial arrangements, especially where large sums may be involved. Whilst accountants and tax advisers do not ordinarily handle funds, they will often see more of a customer’s overall affairs than any other single financial institution or designated business. It is therefore important that all firms in this sector understand the sector specific AML/CFT risks to their businesses, in order to adequately mitigate those risks.
4.2 Having understood the ML/FT risks they are exposed to, relevant persons must establish procedures and controls to maintain an appropriate risk framework including a BRA, CRA and TRA which must be recorded. The relevant person must operate these procedures and controls, meaning they must undertake the relevant risk assessments according to those procedures. Relevant persons must also maintain their risk assessment procedures to ensure they remain effective and up to date enabling the relevant person to manage and mitigate their ML/FT risks. This involves reviewing their procedures and documenting updates to those procedures as well as capturing the rationale for any variations from it. Such procedures and controls must be risk based meaning they should be tailored and proportionate to the relevant person’s particular circumstances.”
4.3 Whilst the size, nature and scale of a relevant person’s business are factors that can be taken into consideration in developing its risk framework, compliance with the Code is mandatory. All firms undertaking business in the regulated sector have an obligation to conduct their affairs in a manner that adequately mitigates the risks faced by it in order to ensure that the Isle of Man retains its reputation as a responsible, and well regulated, international financial centre. Compliance with the Code is the cornerstone of mitigating those risks.
4.4 The Authority has a dedicated AML/CFT section on its website where sector specific guidance for Accountants and Tax Advisers; and Payroll Agents can be found alongside the AML/CFT requirements and links to useful AML/CFT resources.
4.5 The Authority is committed to taking reasonable, proportionate, and appropriate action to address contraventions of the Code in order to help it achieve its regulatory objectives of protecting consumers, reducing financial crime and maintaining the reputation of the Isle of Man’s finance sector through effective regulation.