All reporting entities should be ready for the significant changes to regulations under the Anti-Money Laundering and Counter-Financing of Terrorism Act 2009 (the ‘Act’) taking effect on 1 June 2024. 

The changes comprise the second stage of regulatory amendments (Stage 2) resulting from the Ministry of Justice (MoJ) review of the Act, released in November 2022 (MoJ Report). We have previously discussed in more detail the wide-ranging nature of the Stage 2 amendments and the first stage of regulatory amendments, which came into effect on 31 July 2023.

The MoJ Report recommended, both in the short and long term, regulatory amendments to enable relief for businesses and where appropriate, clarification of their existing AML/CFT obligations. However, the practical reality of the Stage 2 changes is overall they impose additional obligations on reporting entities. Whether this is an unintended consequence or a necessary prelude to regulatory relief down the line is yet to be seen. But for now, reporting entities should be aware of what is changing under Stage 2, and in particular, how some of these changes will impact customer due diligence (CDD) requirements and AML/CFT policy and programme documents.

Updated customer due diligence requirements

The AML supervisors have recently released the below guidelines (all are updated versions of previously released guidelines, other than the new Limited Partnerships Guideline):

• Customer Due Diligence: Companies Guideline 
• Customer Due Diligence: Trusts Guideline 
• Customer Due Diligence: Limited Partnerships Guideline
• Enhanced Customer Due Diligence Guideline 
• Beneficial Ownership Guideline

The guidelines are essential reading for reporting entities, with the following key points to be aware of:

Standard CDD expanded – legal structure

From 1 June 2024, reporting entities must obtain and, according to risk level, verify, information relating to a customer’s: 

• legal form and proof of existence;
• ownership and control structure; 
• powers that bind and regulate the customer;
• if a limited partnership, the existence and name of any nominee general partners; and
• if a company, the existence and name of any nominee directors or nominee shareholders.

The supervisors’ view is the above requirements will help reporting entities accurately identify the beneficial owners and in turn, the level of risk associated with the customer. Although each of the above requirements are set out separately, the supervisor guidance states the requirements can be read in combination with each other as there are likely to be overlapping elements across the various limbs. For example, identifying the powers that bind and regulate a company is likely to help with understanding the company’s ownership and control structure. 

Additionally, information should be obtained to show how each relevant person meets the Act’s definition of ‘beneficial owner’ and whether this is through ownership and/or effective control. By way of example, for a company, this could involve considering information in respect of the identity of any directors, shareholders, capital contribution, shareholding interests, distribution rights, voting rights and/or powers that may be obtained from the company’s constitution or shareholders’ agreement (if any). This potentially involves a more detailed consideration of these documents to sufficiently meet this requirement. 

To determine the existence of nominee directors or shareholders or nominee general partners, the onboarding process for customers may need to change to ensure this issue is covered. This could mean adding direct questions to specifically address this requirement during the onboarding process.

The Stage 2 changes also confirm reporting entities are obligated to undertake ongoing CDD and account monitoring under s31 of the Act depending on the level of risk involved. In determining the extent of this obligation, the reporting entity must consider when CDD was last conducted in relation to the customer and the adequacy of the CDD information held.

Verification

Reporting entities should already have policies, procedures, and controls (PPCs) in place to determine the level of risk and how this impacts the level of verification needed. The updated guidance provides a few useful clarifications on how verification may be actioned for the new CDD requirements:

• For verification of the existence of a nominee director or shareholder or nominee general partner, verification may be done by using information from a reliable source (it does not need to be independent).
• For verification of legal form and proof of existence, ownership and control structure and any powers that bind and regulate a customer, the verification must be from a reliable source. Again, this does not necessarily mean the source needs to be independent (except if verifying settlors or protectors of a trust), and in all cases, should be according to the level of risk involved.
• In the case of a trust, for verification of legal form and proof of existence, ownership and control structure and any powers that bind and regulate it, it may be possible to rely on written confirmation from a professional acting for a trust (such an accountant or lawyer) which sets out the verification information required. Note that this is only referenced in the guidance and relates to the verification aspect of CDD only – this is not an expansion of sections 33-35 of the Act regarding reliance by reporting entities on agents or third parties.

Enhanced CDD

The new regulations expand the scope of enhanced CDD (ECDD) by requiring it to be conducted for existing customers, or customers conducting an occasional transaction or activity, where there are grounds to report suspicious activity as described in the Act. The reporting entity must conduct ECDD as soon as practicable after becoming aware that it must make a suspicious activity report.

The Stage 2 amended regulations also set out the below four additional (but non-exhaustive) ECDD measures:

• obtaining further information from the customer in relation to a transaction.
• examining the purpose of a transaction.
• enhanced monitoring of a business relationship.
• obtaining senior management approval for transactions or to continue the business relationship.

The above must be carried out before establishing a business relationship with a customer requiring ECDD, and during a business relationship should the need for ECDD arise, and will be necessary where information regarding the source of wealth and/or source of funds may not be sufficient to manage the AML/CFT risk.

Prescribed requirements for risk assessments and compliance programmes

Every reporting entity should review and update its risk assessment and compliance programmes to reflect the amendments and the new guidelines. Key action points (this is not an exhaustive list of the Stage 2 changes) for reporting entities relate to:

• Risk assessment: must take into account new or developing technologies, products, or mechanisms.
• Compliance programme:
  • must now contain PPCs setting out how, in certain circumstances where it is needed as part of ECDD, the reporting entity will differentiate between the requirement to obtain:
    • the source of the funds or the source of the wealth of a customer; and
    • both the source of the funds and the source of the wealth of the customer.
  • for any reporting entity who may be an intermediary or beneficiary institution for an international wire transfer, its compliance programme must set out adequate and effective PPCs for the reasonable steps it will take if the international wire transfer does not contain the originator or beneficiary information required under the Act, and what risk-based policy or process will apply if an international wire transfer does not have that information.
  • for reporting entities who have functions carried out by agents, their compliance programme must set out adequate and effective PPCs for:
    • any functions carried out by an agent of the reporting entity as part of the programme;
    • vetting agents who carry out functions of the reporting entity;
    • training agents of the reporting entity on AML/CFT matters; and
    • maintaining a list of agents of the reporting entity acting in the AML/CFT programme.

There are also other changes that will require operational attention to ensure compliance, such as the new requirement to keep records of prescribed transaction reports for at least five years after the end of the business relationship with the customer and around transactional matters, such as the minimum information needed for international wire transfers.

Stage 2 means more than a review of CDD and AML/CFT programme documentation

In this article, we have mainly focused on the impact of the Stage 2 changes in respect of CDD and AML/CFT programme documents. These two areas represent only a couple of aspects of the Stage 2 changes and are not, and should not, be treated as giving a full picture of the changes. The scope of the Stage 2 changes are broad and varied, and reporting entities will need to assess these and how they may impact their current AML/CFT PPCs to maintain compliance.

In releasing the new and updated CDD and ECDD guidance, the supervisors communicated that their approach to the Stage 2 changes will be “broadly educative and constructive.” This approach is both welcome and practical, given there will be a period of bedding in needed and the release of the guidelines is relatively recent. However, reporting entities should not use this approach to delay acting on or addressing the Stage 2 changes - it is likely to only be an initial approach by the supervisors and will not last indefinitely.

Ongoing reform continues

Beyond the Stage 2 changes, the AML/CFT regime continues to evolve:

• The third and final stage of the current amendment regulations comes into effect on 1 June 2025. This third stage is fairly limited in scope and mainly introduces obligations on sectors (such as internet auction providers) that were not previously subject to AML/CFT obligations and a requirement give and record a risk rating to new customers.
• The MoJ is still working on implementing the twelve proposed changes featured in the initial exposure draft AML/CFT amendment regulations, but which were not included in the finalised amendment regulations. These amendments need to be effected by way of an amendment to the Act itself. Among others, these proposals include relaxing the requirement to verify an address for standard CDD and extensions to prescribed transaction report reporting times, both of which will be very welcome in easing the compliance burden. At the time of writing, there has been no firm indication by the MoJ as to when these amendments will be advanced, but in our view, these cannot come too soon.
• In addition to the above, more substantive reform to the Act itself to address further recommendations in the MoJ Report remains on the government’s agenda. Associate Minister of Justice Nicole McKee has recently commented the AML/CFT reform work is one of her priorities for this parliamentary term, but the scope of the reform work continues to be discussed within government. According to the CoFR regulatory initiatives calendar for Q1 2024, a new AML/CFT bill is planned to be introduced in the second quarter of 2026.

Navigating the Act and the regulations to distil what is practically required of reporting entities remains extremely challenging. Both some immediate relief to many from the overly prescriptive compliance requirements and an overhaul of the Act and its regulations remain both overdue and urgently needed. The focus of further reform must be to ensure that the regime delivers on the ‘risk-based approach’ recommended by the MoJ. The Stage 2 changes fail to deliver any of the relief that had been hoped for from that recommendation.