ECSH45815 - Fit and proper and approvals: Contents: Operational Guidance: The fit and proper test: Risk assessment and policies, controls and procedures inspection

As Money Service Businesses (MSBs) and Trust or Company Service Providers (TCSPs) are considered to be the highest risk sectors for Money Laundering, Terrorist Financing and Proliferation Financing (MLTFPF), these businesses are required to provide copies of their Risk Assessment (RA) and Policies, Controls and Procedures (PCPs) to be inspected by a Decision Maker (DM) prior to their application being approved.

These checks are not mandatory under Regulation 58 of MLR 2017. HMRC check these documents at registration as failure to put in place adequate RA and PCPs will result in a DM refusing a business’ registration due to the risk that the business has left itself open to being used for MLTFPF. As the Regulations state that a business’ PCPs must be approved by its senior management, the DM may also determine that the senior manager(s) responsible for the RA and PCPs have failed the Fit and Proper test as they have not displayed that they have adequate skills and experience.

New application

When an MSB or TCSP applies for anti-money laundering registration with HMRC, the Fit and Proper (F&P) Admin Officer will send a letter to the business requiring it to provide copies of its business plan, Risk Assessment (RA) and Policies, Controls and Procedures (PCPs).

When determining the business’ application for registration, the F&P Decision Maker (DM) will inspect these documents to gain an understanding of the business’ operating model and ensure that it has sufficiently identified, assessed, addressed, and mitigated the MLTFPF risks to which it will be subject.

If the RA and PCP documents are not adequate, the DM should refuse the business’ application. Further guidance on refusing an application is available in ECSH47531.

Annual declaration

RA and PCPs are typically not requested when an MSB or TCSP submits an annual refresh application. The F&P DM should consider amendments to the registration information and whether they make a substantive difference to MLTFPF risks to which the business is subject to determine if they should request further copies of the business’ RA and PCPs.

The F&P DM should always request a copy of a business’ RA and PCPs when it is identified that an annual refresh has been submitted where:

  • The business has changed sector e.g., an MSB adds TCSP services.
  • The business has added a new subsector e.g., an MSB providing exclusively currency exchange services submits a renewal advising that it now also provides money transmission services.
  • All the business’ Beneficial Owners, Officers and Managers have been replaced.

If the DM determines that the RA and PCPs are not adequate as the business has not sufficiently identified, assessed, addressed and mitigated the MLTFPF risks to which it will be subject, they should contact the business, signpost to HMRC guidance on the creation of RA and PCPs and set a deadline for the business to provide amended documents.

If the amended RA and PCPs are also inadequate, the DM should consider suspending the business’ registration until it provides documents that satisfy the requirements of the Regulations. Further guidance on the suspension process is available in ECSH47581.