Changes between the draft and final Money Laundering Regulations 2017

Approval stamp

The government released a draft of the Money Laundering Regulations back in March 2017 outlining the proposed approach to transposing the Fourth Money Laundering Directive into UK law. On 26th June, those Regulations became law, having been rushed through Parliament.

Most of the content of the final law is the same as in the draft; the key changes we have outlined previously. However, there are a few important additions included in the final version of the Regulations that were not in the draft.

Key differences between the draft and the final Money Laundering Regulations 2017

  • Regulation 19: Regulated business must “regularly review and update” their policies and controls, and maintain a written record of all changes to AML policies as a result and “steps taken to communicate” the changes to staff.
  • Regulation 19(2): expressly endorses the proportionality principle. All policies and procedures must be “proportionate with regard to the size and nature of the business.”
  • Regulation 24: Written records of training given to employees must be kept and data protection training on matters related to money laundering must be given.
  • Regulation 35(14): ambassadors, charge d’affaires and high-ranking armed forces officers added to the definition of Politically Exposed Person.
  • Regulation 63(d): imposes a positive duty for transfer of funds supervisory authorities to cooperate with law enforcement, including sharing information about payment service providers.

Free webinar recording on the Fourth Money Laundering Directive

To help firms prepare for the Fourth Money Laundering Directive, VinciWorks hosted a webinar with Anti-Money Laundering Expert Amy Bell. Amy Bell is Chair of the Law Society’s Money Laundering Task Force and the Director of Amy Bell Compliance. Amy was previously Head of Compliance at Quality Solicitors and is the author of the Law Society’s toolkit on the Bribery Act. You can watch a recording of the webinar for free by clicking on the button below.

Watch now

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”

Picture of James

James

VinciWorks CEO, VInciWorks

Spending time looking for your parcel around the neighbourhood is a thing of the past. That’s a promise.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.