Introduction

1. The JFSC Trust Company Business Examination Feedback 2014 has been issued (on the March 31^st 2016!!!)
2. This paper sets out the summary findings from the Jersey Financial Services Commission’s (“the Commission’s”) programme of onsite examinations conducted during the calendar year 2014.
3. The purpose, objective and process of the programme remain unchanged and each included an examination of
   1. corporate governance
   2. The key person functions (the latter defined in Article 1 of the Financial Services (Jersey) Law 1998).
   3. Conduct of business.
4. In almost all cases the resulting remediation following an Examination has been tracked via the issue of a Post Monitoring Examination Schedule (“PEMS”).
5. The Commission’s Examinations have, however, led to ENFORCEMENT ACTION IN THREE CASES.
   1. Public statements have subsequently been issued in two of these cases (that is to say in respect of
      1. Moore Stephens Jersey Partnership and
      2. Allied Trust Company Limited).
   2. Directions were issued in the third case, which is not subject to any public statement.

Findings

1. Findings falling into all categories are summarised below.
2. As might be anticipated from the scope of the Examinations in 2014 (described above) the majority of findings related to deficiencies in the AML/CFT framework.

Findings index

1. AML/CFT Findings
   1. Suspicious Activity Reporting Procedures, Evaluation of SARs and Reporting to the JFCU
   2. Customer Due Diligence
   3. Procedures
   4. Business Risk Assessment (“BRA”) and Strategy
   5. Record Keeping
   6. Monitoring Activity and Transactions
   7. Compliance Monitoring and Reporting
   8. MLRO and MLCO
2. Internal Control Findings
3. Corporate Governance Findings
4. Conduct of Business Findings
5. Business Model Findings

THE DETAILS

1. AML/CFT Findings
   1. Suspicious Activity Reporting Procedures, Evaluation of SARs and Reporting to the JFCU In 2013
      1. The highest number of Examination findings related to these areas. The Commission consequently confirmed that it would continue to focus on this area. The result has been further significant findings in 2014.
      2. Failure to reflect the requirements of Article 21 of the Money Laundering Order (Jersey) 2008 in internal procedures resulted in the most findings.
      3. These included, inter alia, arrangements being put in place which might result in internal reports not reaching the MLRO.
      4. In a small number of cases the Commission also noted with concern that:
         1. The evaluation process preceding the decision not to file a SAR was undocumented; or
         2. Evaluation of an internal SAR had taken a significant period of time, irrespective of the information available (for example from the public domain).
   2. Initial And Ongoing Customer Due Diligence
      1. Other areas where the Commission identified a significant number of findings relate to failures in Initial And Ongoing Customer Due Diligence, namely:
         1. The identification and verification of customers – including
            1. lacking information on file,
            2. a poor understanding of ownership and control and
            3. Failure to properly verify information/documents.
         2. A number of findings concerned provision of services before identification and verification had been properly completed;
         3. Identification of, and response to, related risk factors – in particular
            1. the identification of PEPS (and their continuing classification as such) and
            2. carrying out of enhanced due diligence (for these and other high risk customers); and
            3. Monitoring of activities in customer structures.
      2. The findings relating to risk factors predominantly reflect
         1. a lack of understanding and/or documentation of the rationale and,
         2. To a lesser extent, to capture specific risks via a sufficiently robust assessment.
      3. With regard to ENHANCED DUE DILIGENCE, The JFSC noted that significant red flags were often present but did not receive appropriate attention – these included, but were not limited to:
         1. Connections to high risk jurisdictions, or those subject to potential or actual sanctions (including the Ukraine and Myanmar);
         2. Allegations of corruption or an association with financial crime;
         3. Tax or legal advice stated as relevant but not present on file;
         4. Lack of control over an active bank account;
         5. Delegated authorities against a background of complex operations and activities;
         6. Uncertainty regarding the settlor of a structure; and
         7. Lacking information to support source of funds or title to assets.
   3. PROCEDURES
      1. Findings in this area principally relate to deficiencies in customer take on or failure to follow procedures in full, with business being conducted before all necessary approvals and sign offs are in place.
      2. Other findings reflect:
         1. Failure to develop procedures to address key risks;
         2. Risk assessment of customers not reflecting the procedures in place; and
         3. Compliance monitoring not testing the procedures in place.
      3. In one case procedures were developed such that reliance would be placed on a Group company to identify sanctions-related transactions only where these exceeded a given monetary threshold. This left the registered person exposed to the risk of breach of sanctions for all other payments and receipts.
   4. BUSINESS RISK ASSESSMENT (“BRA”) AND STRATEGY
      1. The Commission found that an inadequate overall assessment of AML/CFT risk also continues to result in a significant numbers of findings relating to Business Risk Assessments and Strategies.
      2. These arise primarily from a failure to reflect all the requirements of the Handbook and to consider the specific risks currently facing the business (or which can reasonably be anticipated).
      3. In a number of cases the documents prepared simply reproduced sections of the Handbook without considering what is happening in practice or included reference to generic risks without drilling down to consider the nature and extent of actual exposure to AML/CFT risk.
   5. RECORD KEEPING
      1. Whilst the Commission continues to identify deficiencies in the AML/CFT control framework, this has, in a number of cases, also been accompanied by poor record keeping:
         1. Recording of rationale in varying places or not at all (in some cases this has been confused with the activity undertaken);
         2. Failure to populate or sign off key control documents; and
         3. Storage of customer profiles in safe custody only, rather than being made readily available for reference.
   6. MONITORING ACTIVITY AND TRANSACTIONS
      1. The Commission noted a large number of examples of failure to:
         1. Obtain or review documents that are key to understanding a customer’s activities such as
            1. financial statements,
            2. Minutes and
            3. structure charts; and
         2. Complete or update customer profiles and periodic reviews, so that both remain fit for purpose.
   7. COMPLIANCE MONITORING AND REPORTING
      1. In one case the Commission noted that, whilst work had been agreed and carried out, the related plan and procedures had not been documented.
   8. MLRO and MLCO
      1. Findings in this area reflect:
         1. The registered person’s failure
            1. to establish job descriptions for these roles (including the Deputy MLRO) and
            2. to provide the resources needed to support the key persons in their work;
         2. Deficiencies / Failure
            1. reporting by these key persons and
            2. in the documentation of ensuing Board discussions (for example regarding regulatory changes); and
            3. To document the MLRO’s review of work undertaken by their Deputy.

INTERNAL CONTROL FINDINGS

1. Policies and Procedures –
   1. A third of the findings here related to Policies and Procedures either being incomplete/inaccurate or absent.
2. This included with regard to:
   1. New business acceptance;
   2. Obtaining tax advice (notwithstanding the Commission’s Dear CEO letter dated 13 March 2013);
   3. The use of various checklists without supporting guidance;
   4. Provision of limited services or those involving external parties;
   5. Reconciliation of non-cash customer assets;
   6. The registered person’s activities, including servicing its higher risk customers;
   7. Bearer shares (in cases where re-registration has not been possible); and
   8. Monitoring of customer activity.
3.  ALSO
   1. Errors in customer records
      1. dates for the issue of shares and certificates of incumbency
      2. incorrect references to loan agreements,
      3. documented rationale
   2. were seen to go hand in hand with missing records
      1. (Minutes and records of trustee decisions).
   3. Other deficiencies related to the grant of powers of attorney.
4. conflicts – 
   1. conflicts were not reflected in the Terms of Reference for the affiliation’s Board and Committees and
   2. A Conflict Register did not capture the granting of signatory role to the Deputy MLRO.
5. The Commission has continued to identify
   1. inadequate resourcing of the Compliance function,
   2. limitations in or non-completion of Compliance Monitoring (in one case this did not cover any legislative or regulatory requirements other than the TCB Codes) and
   3. limitations in Compliance Reporting for example no reference to PEPs

CORPORATE GOVERNANCE FINDINGS

1. Board or Committee Meetings
2. Board or Committee Meetings – Findings in this area reflect
   1. A failure to hold Board or Committee Meetings on a sufficiently frequent basis and, in two cases, to actually attend Board meetings.
3. Terms of Reference  – In other cases
   1. Terms of Reference or consideration by Board members of matters during interim meetings had not been documented.
   2. Terms of reference also reflected confused or inappropriate reporting lines.
4. Management Information – Further findings related to
   1. Failure to document the consideration of breaches inherent in Management Information provided, or to act on self-identified issues relating to corporate governance.
5. HR MATTERS – The Commission noted
   1. Board members had not been subject to any form of appraisal, such that the registered person could not demonstrate any assessment of competency or probity.
   2. The Board members did not have job descriptions.
6. Further deficiencies were also noted with regard to
   1. CPD (ensuring the ongoing competency of staff).
   2. CONFLICTS OF INTEREST – A failure to recognise, and respond to, CONFLICTS OF INTEREST continues to be identified at Board level and in relation to
      1. shareholders and
      2. Key persons.
   3. INEFFECTIVE MONITORING AND REMEDIATION through first line of defence (periodic) reviews also accounted for a large number of findings in this category. This reflects
      1. a failure to carry out such reviews on a timely basis,
      2. to ensure that they are sufficiently robust (in one case these did not reflect the requirements of the Handbook) and
      3. To act on the issues arising.

CONDUCT OF BUSINESS FINDINGS

1. The JFSC identified a number of findings where the provision of services appeared to have commenced prior to control processes having concluded evidenced for example by
   1. final sign offs not being in place until much later, or
   2. Key information remaining outstanding.
2. In other cases registered persons had failed to act on trigger events.
3. Other findings in this category relate to
   1. Failures to identify potential conflicts of interest in relation to customer structures or to act on those arising.
   2. Not obtaining independently generated, documented title to valuable assets in a relatively undeveloped jurisdiction, leaving it significantly exposed.

BUSINESS MODEL FINDINGS

1. During two examinations the Commission found (respectively) that the registered person:
   1. Appeared to be conducting unauthorised business (using non-Jersey companies to act as trustee in or from within Jersey); and
   2. Was incorrectly recorded in an overseas registry as providing services for which it does not hold the appropriate registrations, giving rise to the risk of “holding out”.
   3. Whilst the registered person had repeatedly requested that this be corrected by the local agent, they had not taken any other action.
2. The Commission views both situations as extremely serious.
3. Independent legal advice should always be sought where there are any questions regarding the need to register.

CONCLUSION

1. Whilst the format of the feedback has changed this year, registered persons will recognise a number of the messages from previous years.
2. All registered persons are strongly urged to consider the feedback for 2014 Examinations – hand in hand with that provided in previous years and the guidance already in issue by the Commission in various forms (including “Dear CEO letters”) – in terms of development of their own systems and controls, the implementation of these and subsequent testing (by the business, key persons and any additional control functions).
3. The number of AML/CFT findings identified, in particular, speaks for the need for focused and continued vigilance, taking into account the requirements of related legislation and the Handbook, both of which may be periodically updated as required.
4. The Commission consequently continues to focus on this area and has selected as one of its two themes for 2015 the functions carried out by key persons within the framework of AML/CFT systems and controls.
5. The issues arising relating to the proper safeguarding of customers assets have driven the choice of the second theme, principally relating to Examinations of customer money.

READ THE DOCUMENT IN FULL – http://bit.ly/1TklvIO