Chapter 4Provision of information to law enforcement authorities

Provision of information

64H.  A cryptoasset business must respond fully and without delay to a request in writing from a law enforcement authority (within the meaning of regulation 44(10)) for any information held in connection with this Part which that authority reasonably requires in connection with the authority’s functions.”.

(6) In regulation 74A(1)(a) (reporting requirements: cryptoasset businesses)(12), after “Parts 2 to 6” insert “and 7A”.

(7) In Schedule 6 (relevant requirements)(13) after paragraph 11 insert—

“11A.  The requirements specified in this paragraph are those imposed in—

(a)regulation 64C (information accompanying an inter-cryptoasset business transfer);

(b)regulation 64D (missing or non-corresponding information: the cryptoasset business of a beneficiary);

(c)regulation 64E (missing information: intermediaries);

(d)regulation 64F (retention of information with an inter-cryptoasset business transfer: intermediaries);

(e)regulation 64G (requesting information: unhosted wallet transfers and cryptoasset businesses);

(f)regulation 64H (provision of information).”.

Proliferation financing

6.—(1) In regulation 3 (general interpretation), after the definition of “PRA-authorised person” insert ““proliferation financing” has the meaning given by regulation 16A(9);”.

(2) After regulation 16 (risk assessment by the Treasury and Home Office)(14) insert—

“Risk assessment by the Treasury

16A.—(1) The Treasury must make arrangements for a risk assessment to be undertaken to identify, assess, understand and mitigate the risks of proliferation financing affecting the United Kingdom (“the proliferation financing risk assessment”).

(2) The proliferation financing risk assessment must, among other things—

(a)identify, where appropriate, the sectors or areas of lower and greater risk of proliferation financing;

(b)provide the information and analysis necessary to enable it to be used for the purposes set out in paragraph (3).

(3) The Treasury must ensure that the proliferation financing risk assessment is used to—

(a)consider the appropriate allocation and prioritisation of resources to counter proliferation financing;

(b)consider whether the exclusions provided for in regulation 15 (exclusions) are being abused.

(4) The Treasury must prepare a report setting out, as appropriate, the findings of the proliferation financing risk assessment as soon as reasonably practicable after the proliferation financing risk assessment is completed.

(5) A copy of that report must be laid before Parliament and sent to the supervisory authorities.

(6) The Treasury must take appropriate steps to ensure that the proliferation financing risk assessment is kept up-to-date.

(7) The proliferation financing risk assessment may be included in the risk assessment made under regulation 16 (risk assessment by the Treasury and Home Office).

(8) The report referred to in paragraph (4) may be included within the joint report of the Treasury and Home Office referred to in regulation 16(6).

(9) In this regulation, “proliferation financing” means the act of providing funds or financial services for use, in whole or in part, in the manufacture, acquisition, development, export, trans-shipment, brokering, transport, transfer, stockpiling of, or otherwise in connection with the possession or use of, chemical, biological, radiological or nuclear weapons, including the provision of funds or financial services in connection with the means of delivery of such weapons and other CBRN-related goods and technology, in contravention of a relevant financial sanctions obligation.

(10) In this regulation—

“biological weapon” means a biological agent or toxin (within the meaning of section 1(1)(a) of the Biological Weapons Act 1974(15)) in a form capable of use for hostile purposes or anything to which section 1(1)(b) of that Act applies;

“chemical weapon” has the meaning given by section 1 of the Chemical Weapons Act 1996(16);

“CBRN-related goods and technology” means technology (including dual-use technology) and dual-use goods used for non-legitimate purposes in connection with the matters referred to in paragraph (9);

“dual-use goods” means (a) any thing for the time being specified in Annex I of the Dual-Use Regulation, other than any thing which is dual-use technology, and (b) any tangible storage medium on which dual use technology is recorded or from which it can be derived;

“Dual-Use Regulation” means Council Regulation (EC) No 428/2009 of 5 May 2009(17) setting up a Community regime for the control of exports, transfer, brokering and transit of dual-use items;

“dual-use technology” means any thing for the time being specified in Annex I of the Dual-Use Regulation which is described as software or technology;

“nuclear weapon” includes a nuclear explosive device that is not intended for use as a weapon;

“radiological weapon” means a device designed to cause destruction, damage or injury by means of the radiation produced by the decay of radioactive material;

“relevant financial sanctions obligation” means a prohibition or requirement in regulations made under section 1 of the Sanctions and Anti-Money Laundering Act 2018(18) and imposed for one or more of the purposes in section 3(1) or (2) of that Act so far as it relates to compliance with a relevant UN obligation;

“relevant UN obligation” means an obligation that the UK has by virtue of a resolution adopted by the Security Council of the United Nations which relates to the prevention, suppression and disruption of the proliferation of weapons of mass destruction and the financing of such;

“technology” has the meaning given by paragraph 37 of Schedule 1 to the Sanctions and Anti-Money Laundering Act 2018.”.

(3) After regulation 18 (risk assessment by relevant persons) insert—

“Risk assessment by relevant persons in relation to proliferation financing

18A.—(1) A relevant person must take appropriate steps to identify and assess the risks of proliferation financing to which its business is subject.

(2) In carrying out the risk assessment required under paragraph (1), a relevant person must take into account—

(a)information in the report referred to in regulation 16A (risk assessment by the Treasury); and

(b)risk factors including factors relating to—

(i)its customers;

(ii)the countries or geographic areas in which it operates;

(iii)its products or services;

(iv)its transactions; and

(v)its delivery channels.

(3) In deciding what steps are appropriate under paragraph (1), the relevant person must take into account the size and nature of its business.

(4) A relevant person must keep an up-to-date record in writing of all the steps it has taken under paragraph (1), unless its supervisory authority notifies it in writing that such a record is not required.

(5) A relevant person must provide the risk assessment it has prepared under paragraph (1), the information on which that risk assessment was based and any record required to be kept under paragraph (4), to its supervisory authority on request.”.

(4) After regulation 19 (policies, controls and procedures)(19) insert—

“Policies, controls and procedures in relation to proliferation financing

19A.—(1) A relevant person must—

(a)establish and maintain policies, controls and procedures to mitigate and manage effectively the risks of proliferation financing identified in any risk assessment undertaken by the relevant person under regulation 18A(1);

(b)regularly review and update the policies, controls and procedures established under sub-paragraph (a);

(c)maintain a record in writing of—

(i)the policies, controls and procedures established under sub-paragraph (a);

(ii)any changes to those policies, controls and procedures made as a result of the review and update required by sub-paragraph (b); and

(iii)the steps taken to communicate those policies, controls and procedures, or any changes to them, within the relevant person’s business.

(2) The policies, controls and procedures adopted by a relevant person under paragraph (1) must be—

(a)proportionate with regard to the size and nature of the relevant person’s business; and

(b)approved by its senior management.

(3) The policies, controls and procedures referred to in paragraph (1) must include—

(a)risk management practices;

(b)internal controls (see regulations 21 to 24)(20);

(c)the monitoring and management of compliance with, and the internal communication of, such policies, controls and procedures.

(4) The policies, controls and procedures referred to in paragraph (1) must include policies, controls and procedures—

(a)which provide for the identification and scrutiny of—

(i)any case where—

(aa)a transaction is complex or unusually large, or there is an unusual pattern of transactions; or

(bb)the transaction or transactions have no apparent economic or legal purpose, and

(ii)any other activity or situation which the relevant person regards as particularly likely by its nature to be related to proliferation financing;

(b)which specify the taking of additional measures, where appropriate, to prevent the use for proliferation financing of products and transactions which might favour anonymity;

(c)which ensure that when new products, new business practices (including new delivery mechanisms) or new technology are adopted by the relevant person, appropriate measures are taken in preparation for, and during, the adoption of such products, practices or technology to assess and if necessary mitigate any proliferation financing risks this new product, practice or technology may cause;

(d)which, in the case of a money service business that uses agents for the purpose of its business, ensure that appropriate measures are taken by the business to assess—

(i)whether an agent used by the business would satisfy the fit and proper test provided for in regulation 58(21); and

(ii)the extent of the risk that the agent may be used for proliferation financing.

(5) A relevant person must, where relevant, communicate the policies, controls and procedures which it establishes and maintains in accordance with this regulation to its branches and subsidiary undertakings which are located outside the United Kingdom.”.

(5) In regulation 20(1)(a), for “regulation 19(1)” substitute “regulations 19(1) and 19A(1)”;

(6) In regulation 21(7)—

(a)after “regulation 19(1)” insert “or 19A(1)”;

(b)in paragraph (10)(a), after “regulation 18(1)” insert “and 18A(1)”.

(7) In the following provisions, for “money laundering and terrorist financing” substitute “money laundering, terrorist financing and proliferation financing”—

(a)regulation 3 (interpretation)(22), in the definition of “senior management”;

(b)regulation 20(1)(b), (3), (4)(b) and (5) (policies, controls and procedures: group level)(23);

(c)regulation 21(2)(b)(ii)(aa) and (2)(b)(ii)(bb) (internal controls);

(d)regulation 24(1)(a)(i), (2)(b)(i), (2)(b)(ii) and (3)(a)(iii) (training).

(8) In the following provisions, for “money laundering or terrorist financing” substitute “money laundering, terrorist financing or proliferation financing”—

(a)regulation 21(7)(a);

(b)regulation 24(1)(a)(ii);

(c)regulation 41(1), (6)(a), (7) and (8) (data protection)(24);

(d)regulation 45ZB(11)(a), (11)(b) and (11)(d) (access to information on the register)(25);

(e)regulation 52A(3)(a)(i) (confidentiality)(26);

(f)regulation 74C(3)(c) (directions: cryptoasset businesses)(27).

(9) In Schedule 6 (meaning of “relevant requirement”), in paragraph 5(28)—

(a)after sub-paragraph (a)(i) insert—

“(ia)regulation 18A (risk assessment by relevant persons in relation to proliferation financing);”;

(b)after sub-paragraph (a)(ii) insert—

“(iia)regulation 19A (policies, controls and procedures in relation to proliferation financing);”.

Art market participants

7.  In regulation 14 (art market participants)(29)—

(a)in paragraph (1)(d), after “means” insert “, subject to paragraph (3),”;

(b)after paragraph (2) insert—

“(3) A firm or sole practitioner is not an art market participant for the purposes of paragraph (1)(d)(i) in relation to the sale of a work of art which is created by, or is attributable to, a member of the firm or the sole practitioner.”.

Exceptions

8.  In regulation 15(3)(f), after “or (h)” insert “to (k)”.

Reporting of material discrepancies to the registrar of companies

9.  In regulation 30A(30)—

(a)in paragraph (1)—

(i)at the end of sub-paragraph (d), omit “or”;

(ii)at the end of sub-paragraph (e), insert “or”;

(iii)after sub-paragraph (e), insert—

“(f)an overseas entity which is subject to registration under Part 1 of the Economic Crime (Transparency and Enforcement) Act 2022(31),”;

(iv)for the words after new sub-paragraph (f) substitute—

“a relevant person must collect an excerpt of the register which contains full details of any information specified in paragraph (1A) held on the register at the relevant time before the business relationship is established, or must establish from its inspection of the register that there is no such information held on the register at that time.”;

(b)after paragraph (1) insert—

“(1A) The information specified in this paragraph is as follows—

(a)in relation to a firm of a type described in paragraphs (1)(a) to (e), information relating to beneficial owners of the customer; and

(b)in relation to an overseas entity of a type described in paragraph (1)(f), required information relating to registrable beneficial owners specified under Schedule 1 to the Economic Crime (Transparency and Enforcement) Act 2022.”;

(c)in paragraph (2), for “any discrepancy” substitute “any material discrepancy”;

(d)after paragraph (2) insert—

“(2A) When taking measures to fulfil the duties to carry out customer due diligence and ongoing monitoring of a business relationship (including enhanced customer due diligence and enhanced ongoing monitoring) under Part 3 of these Regulations after a business relationship with a customer of a type described in paragraph (1)(a) to (f) has been established, a relevant person must also collect an excerpt of the register which contains full details of any information specified in paragraph (1A) which is held on the register at that time, or must establish from its inspection of the register that there is no such information held on the register at that time.

(2B) The relevant person must report to the person mentioned in paragraph (3) any material discrepancy the relevant person finds between information relating to the beneficial ownership of the customer—

(a)which the relevant person collects under paragraph (2A), and

(b)which otherwise becomes available to the relevant person in the course of carrying out its duties under these Regulations.”;

(e)in paragraph (3)—

(i)for “The discrepancy” substitute “A material discrepancy referred to in paragraphs (2) and (2B)”;

(ii)for “or an eligible Scottish partnership,” substitute “, an eligible Scottish partnership or an overseas entity,”;

(f)in paragraph (4), after “paragraph (2)” insert “or (2B)”;

(g)in paragraph (5), for “the discrepancy”, the first time it occurs, substitute “a material discrepancy”;

(h)for paragraph (6) substitute—

“(6) A discrepancy which is reported to the registrar under paragraph (3) is material excluded from public inspection for the purposes of—

(a)section 1087 of the Companies Act 2006 (material not available for public inspection)(32), including for the purposes of that section as applied—

(i)to unregistered companies by paragraph 20 of Schedule 1 to the Unregistered Companies Regulations 2009(33);

(ii)to limited liability partnerships by regulation 66 of the Limited Liability Partnerships (Application of Companies Act 2006) Regulations 2009(34); and

(iii)to eligible Scottish partnerships by regulation 61 of the Scottish Partnerships (Register of People with Significant Control) Regulations 2017(35); and

(b)section 22 of the Economic Crime (Transparency and Enforcement) Act 2022 (material unavailable for inspection).”;

(i)after paragraph (7) insert—

“(8) In this regulation, a “material discrepancy” is one described in Schedule 3AZA.”;

(j)after Schedule 3 (relevant offences), insert—