Brac Saajan Exchange Ltd & Ors v The Commissioners for HMRC

Mr Curran began his career in 1978 working for HM Customs and Excise as an Executive Officer, and in 1986 he moved to the Investigation Division as a Drugs and Financial Crime Investigator. In 1997 he joined the National Criminal Intelligence Service (“NCIS”), now the NCA, where he was a Senior Intelligence Officer dealing with suspicious activity reports from UK financial institutions. In that role he designed the NCIS Financial Investigations Course and the Financial Intelligence Development Course and was a senior instructor on both.

From 2001 to 2004, Mr Curran was the global MLRO for Travelex Holdings, a MSB, where he was responsible for the design and implementation of a global compliance structure and the design and review of AML training materials on a worldwide basis. From 2004 to 2008 he was Vice Crime Officer and MLRO for the Bank of New York Mellon, where he was responsible for oversight of anti-money laundering policies. From 2008 to 2020, he worked as a consultant, and as such held the MLRO position for variety of financial institutions including DBS Bank and HSBC. He joined BSEL as the Head of Financial Crime Compliance on 28 September 2020, and was appointed as the Nominated Officer and MLRO.

Mr Furnival was BSEL’s COO from July 2018 to March 2021. He was previously the chief executive of a company providing loans, and before that the managing director of another; neither were MSBs or otherwise within the scope of the MLR.

As COO he reported to Mr Salam. He was responsible for overseeing BSEL’s administration and its business operations. The role included designing and implementing business strategies, plans and procedures; overseeing the daily work of executives including the Heads of Operations, Business Development, Marketing and HR; evaluating BSEL’s performance, and managing relationships with partners and agents/aggregators. On 1 February 2021, he was placed on furlough and he subsequently left the company by mutual agreement.

Mr Garcia joined BSEL in 2017 as the Head of Global Compliance and Chief Information Officer. He had previously founded a company in Spain which provided consultancy advice on tax and money laundering compliance; he assisted as an expert in the drafting of the Spanish AML regulations in 2014, and in 2019 he completed the advanced AML course (ACAMS).

Mr Gomes joined BSEL in 2011, and was its MLRO between September 2011 and May 2015. From November 2016 to October 2019 he was BSEL’s Business Development Manager, responsible for identifying new business opportunities to generate revenue, improve profitability, establish relationships with potential clients and help the business grow. Since October 2019 he has been the Business System Manager, responsible for managing and developing BSEL’s IT systems.

Mr Hashmi joined BSEL as its Head of Risk and Internal Control on 1 September 2020. He is a member of the Institute of Chartered Accountants in England and Wales; the Institute of Chartered Accountants of Pakistan and the Institute of Financial Accounts. He has over 20 years of experience in banking and internal audit, including five years as the senior internal auditor at the Banque Saudi Fransi in Saudi Arabia, after which he was Senior Vice President and Head of Corporate & Group Audits at Noor Bank PJSC, of which he was a founding member.

Mr Ahmad was BSEL’s Company Secretary from 2011 to March 2021; he was also the Company Secretary and Head of Regulatory Affairs for Brac Bank. His specific responsibilities were:

The focus of BSEL’s business is the remitting of money to Bangladesh and Pakistan from UK individuals of Bangladeshi and Pakistani origin or heritage. BSEL defines its customer base as “an adult immigrant worker, who sends money back to his/her hometown for
savings or family support”.

BSEL has around 80,000 regular customers, many of whom live in communities populated by others with the same ethnic origin or roots, such as Whitechapel in London. They typically work in low-paid jobs in retail or as taxi drivers, and share accommodation, not just on a family basis but also in flats above shops and restaurants. BSEL’s reputation within these communities is one of trust, honesty and integrity.

BSEL remits the customers’ money to the beneficiaries’ bank account in Bangladesh or Pakistan, or to a bank in those countries for collection by the beneficiaries on presentation of the requisite ID documents. It has always been part of BSEL’s risk-mitigation policy to transfer funds only to banks; it does not transfer funds to other MSBs.

As an MSB, BSEL is required to comply not only with the MLR but also with the Payment Services Regulations 2017 (“the PSR”). The PSR is overseen by the FCA, which registered BSEL as an Authorised Payment Institution (“API”). The FCA requires that each director and others responsible for payment services complete a form of notification, so that the FCA can check whether that person is “fit and proper”; the FCA must also be informed if any of those persons change.

The majority of transactions carried out by BSEL are in cash, but the percentage has been declining over time. In March 2020, 96% of senders paid cash to BSEL, and once transferred, 61% were paid out by the receiving bank in cash, with the balance paid into the beneficiary’s bank account. Around the end of 2019, BSEL introduced card readers; this was followed in around February 2020 by a web-based application called REMITnGO to facilitate online card transactions. By October 2020, the percentage of funds being paid in cash by senders had reduced from 96% to 81%, and the percentage of funds paid directly into a beneficiary’s bank account had increased from 39% to 44.5%.

BSEL has some individual customers who transact at its branch office, by telephone, or by using REMITnGO, but around 95% of its customers transact using agents or aggregators. In July 2020, it had 306 agents and 13 aggregators, and in March 2021 there were 272 agents but only one aggregator, for the reasons explained at §272ff below.

In reliance on the figures in the ToF, which were agreed by the Appellants’ Schedule, I find that £417,988,591 was transmitted through BSEL’s agents in the period from 1 September 2018 to 31 August 2020, of which 81% was remitted to Bangladesh and 18% to Pakistan, and the remaining 1% to other jurisdictions. In the same period, £505,876,637 was transmitted through BSEL by its aggregators, of which 88% was to Pakistan and the remaining 12% to Bangladesh. The total was therefore £923,865,228.

Agents are recruited in accordance with a defined policy, which includes requiring the agent to be on the Financial Services Register, see §462. Agents have their own customers, and process transactions through BSEL’s Remit ERP System (see §214). The overwhelming majority of agents operate as small companies, and their directors and employees are almost all from the Bangladeshi or Pakistani communities, as is also the case with the minority of agents which operate as sole traders or partnerships. Like their customers, agents transferred funds overseas to friends and family.

All aggregators are registered with HMRC as MSBs in their own right, not as agents of BSEL. They are also APIs or Small Payment Institutions (“SPI”), so are also registered with the FCA. Each aggregator had entered into an agreement with BSEL for the provision of cross border payment services. The aggregators transfer the money from their customers to BSEL, which acts as an Intermediary Payment Service Provider (“IPSP”), transferring the money to its destination in Pakistan or Bangladesh via its account with Barclays.

Aggregators conduct their own risk assessments of their individual customers as they are required to do by HMRC, and BSEL will not accept an MSB as an aggregator unless it has first approved its risk assessment methodology.

BSEL has a formal “Aggregator Policy” document, which was initiated in October 2017 and has been regularly updated in response to changes to regulations and guidance. It was explicitly drafted with reference to guidance provided by the Financial Action Task Force (“FATF”), the global money laundering and terrorist financing watchdog. There is more about this policy at §570.

BSEL is not authorised to open accounts for customers in the way (for example) a bank would. Instead, BSEL registers customers on the Remit ERP system in accordance with its PCPs. Customers are not given a registration number, account book or other unique identifier, but their details are stored and can be accessed if the customer makes a repeat visit.

BSEL monitors each and every transaction a customer undertakes, regardless of amount or whether the money has been sent via an aggregator or an agent. Part of the transaction monitoring is carried out by BSEL’s automated Remit ERP system and part by manual review of print-outs usually triggered by system alerts/flags.

Before BSEL transacts any business, it applies Customer Due Diligence (“CDD”). Above certain thresholds, it applies Enhanced Due Diligence (“EDD”). All agents and aggregators are required to apply the same CDD/EDD thresholds.

The CDD/EDD position until January 2020 is set out below. The requirement column is cumulative, so that a person transmitting £2,400 was required to provide proof of ID and proof of address. In all cases, the documents were scanned and uploaded into the Remit ERP system.

As can be seen from the above table, a key difference between CDD and EDD was that EDD required the sender to prove the source of the funds being transferred. BSEL accepted the following documents for that purpose: the customer’s bank statement showing that the money to be transferred had been in his account at least two clear days before the transaction date; a payslip issued within the last 60 days; an employment contract or a letter from the employer; a loan confirmation letter/agreement dated within the last 30 days; property mortgage/sale documents also dated within the last 30 days; a tax return or P60; proof of the receipt of state benefits or a letter from the customer’s accountant.

BSEL operates a three-tier compliance model, which is structured as follows:

BSEL also had two AML specialists who had passed the Certified Anti-Money Laundering Specialist exams and so held ACAMS certification. BSEL’s annual accounts show that it spent £388,447 on compliance in 2019 and £538,497 in 2020; this was 10% and 12% respectively of the company’s total operating costs. In both years, eighteen BSEL employees were engaged in compliance activities; this was 20% of the total workforce in 2019 and 22% in 2020.

The Nominated Officer/MLRO and the Risk and Audit Committee (“RAC”) both played key roles in BSEL’s approach to AML/CTF

Reg 21 of the MLR requires a firm within its scope to appoint a “Nominated Officer” with statutory responsibility for filing SARs. At BSEL, the Nominated Officer was also the MLRO. BSEL’s MLROs operated in a manner which met the description of the role given by the FCA:

“The job of the MLRO is to act as the focal point within the relevant firm for the oversight of all activity relating to anti-money laundering. He needs to be senior, to be free to act on his own authority and to be informed of any relevant knowledge or suspicion in the relevant firm. In turn he has to pass on issues to NCIS as he thinks appropriate.”

The purpose of the RAC was as follows:

“to provide assurance on the adequacy and effectiveness of the company’s
system of internal controls…RAC is responsible for understanding BSEL’s major risk areas and ensuring that appropriate internal controls are in place to manage the risk exposures. Additionally, the RAC is responsible for the monitoring of control process and the adequacy of the system of internal control and compliance framework by reviewing internal and external audit reports.”

The RAC had a direct reporting line to the Board and it was chaired by Mr Garcia. It considered the whole range of risk and regulatory requirements to which BSEL was subject, including regulatory reporting, SARs, agents and aggregators, IT requirements and improvements, anti-MLR requirements and compliance; risk assessments and new initiatives.

It held its first meeting on 7 February 2018; it was attended by Mr Ahmad, Mr Olayinka, who at that time was the MLRO; Mr Brian Strathie, who had previously been the MLRO, and Mr Omar Siddiqui, the audit, ethics and training partner for the firm of Reddy Siddiqui LLP, a firm of Chartered Accountants in London; he sat on the RAC as an independent member.

The RAC’s second meeting took place on 21 November 2018, with Mr Salam observing. The attendees were the same (other than Mr Strathie); new members were Mr Furnival and Mr Morris, the Senior Compliance Officer, and Mr Graeme Ashley-Fenn, an additional independent member. Mr Ashley-Fenn had over 36 years of experience in financial regulation: he previously had a lead role at the FSA/FCA; he was a board member of both Lloyds Bank and NatWest Bank and a senior partner at Alvarez & Marsal, where he had established a regulatory consultancy business.

Following a recommendation from Exiger, it was decided that the RAC should hold three meetings a year. In fact, there were four meetings in 2019 and two in 2020, none of these were attended by Mr Ahmad. The third meeting took place on 9 April 2019; it was additionally attended by Mr Richard Atkin, a director of Exiger.

Mr Atkin stepped down before the July 2019 meeting, and a third independent member, Mr Trevor Barrett, was added. He had more than 25 years experience as a senior executive in governance and risk management, including being head of strategic risk for Lloyds Bank and Chief Risk Officer for the Charities Aid Foundation Bank; he also chairs the Risk Committee of a UK building society.

BSEL has had documented compliance PCPs since at least 2012; these have been regularly updated for changes to law, regulations, guidance, BSEL’s own risk management experience and a range of other factors. The PCPs issued in February 2018 run to 78 detailed pages of closely typed text. They include the definitions of CDD and EDD, and set out the thresholds for the application of each. They were revised and reissued in April 2019, May 2019 and October 2020. I return to the PCPs later in this judgment.

BSEL uses Remit ERP, a web based remittance application, as both its payments system and its transaction monitoring system. Remit ERP checks every transaction to ensure that customer ID and validation requirements are satisfied; it also checks the CDD/EDD thresholds and requirements. The system also has other inbuilt transaction validation triggers which are continually reviewed and updated; these check transactions for other risks. The screening process carried out by Remit ERP can result in a transaction receiving the following characterisation:

The compliance staff not only review the transactions identified by the Remit ERP system as set out above, but also carry out pre-transaction checks; review samples of released transactions and report on any relevant findings to the MLRO, and they randomly check sample transactions which have been released, and report on any exceptions.

In 2017, BSEL implemented eleven Money Laundering Prevention Dashboards (“MLP Dashboards”); these were automated in November 2018. They provide a real time picture of BSEL’s transactions by comparing them with those for the previous month, and for the year to date, and are reviewed by the transaction monitoring team on a daily basis. They have a drill down capability that allows compliance officers to select transactions for checking, and are also used by senior compliance officers to identify trends and abnormalities.

BSEL has a range of sanctions and other actions which it exercises if an agent, aggregator or customer was identified as having attempted to bypass the money laundering requirements. These include:

For example, the December 2019 RAIC report noted that:

“An agent for [named aggregator] attempted to fraudulently bypass our controlling measures by employing multiple IDs in an attempt to remit to a large number of beneficiaries. This matter is being investigated by the Compliance department, which will provide further information at an appropriate stage. The fraud attempt was averted, which did NOT allow
the funds to leave the country. Subsequently, the aggregator [name] has offboarded the agent.”

In the three year period before the Cancellation Decision, BSEL engaged Exiger and Eversheds to carry out MLR related reviews and audits, and the business was additionally audited by JW Risk. All these firms visited the premises, held face-to-face discussions with key personnel, carried out random samples of the files and interrogated the Remit ERP system in order to assess BSEL’s compliance.

Exiger is a global specialist firm specialising in risk and compliance, particularly in the context of financial crime. In July 2018, BSEL engaged Exiger to perform an independent review of its AML/CTF compliance program and its governance framework. Exiger described the methodology it used as follows

“The Exiger team developed a test plan to support the assessment of BSEL’s AML and sanctions Compliance Program and governance framework against industry standards, regulatory expectations and internationally accepted good practices for AML and sanctions risk management. The review considered both local market regulatory requirements and, where applicable, the following industry standards which specifically target AML and sanctions risk management for money service businesses:

•

HMRC – Anti-Money Laundering Supervision: Money Service Businesses

•

FATF Guidance on the Risk-Based Approach for Money Services Businesses.”

Exiger tested twenty-four different areas of BSEL’s compliance, by reviewing processes and documents, by interviewing staff and by sampling. The sampling covered CDD profiles for customers and agents; SARs and transaction monitoring alerts. Exiger recorded that “Throughout the course of the review, we noted management’s desire to respond immediately to issues identified by Exiger”. In relation to the PCPs the report said:

“Overall, BSEL maintains adequate CDD procedures that align with UK regulatory requirements and facilitate the identification of all customers and agents at the time of entering into a business relationship or undertaking an occasional transaction. The ‘Comprehensive Policies and Procedures to Mitigate Compliance and Operational Risks’ document (“Comprehensive P&Ps”) provides clear guidance on the CDD requirements for both standard and enhanced due diligence of customers…Every transaction is risk rated according to the CDD thresholds outlined in the Comprehensive P&Ps. The CDD thresholds are clearly defined, and the documentation required for each category (Low, Medium and High) is commensurate with the level of risk associated with that particular transaction…

BSEL has appropriate EDD requirements for high risk transactions that ensure that additional work is done to verify the identity of the customer and scrutinise the nature of the transaction. In addition, all transactions are screened for the involvement of PEPs (sender and beneficiary) by Remit ERP, BSEL’s core transaction processing system, and EDD measures are applied accordingly where there is a positive hit.”

Exiger specifically recorded and approved both the categorisation of transactions below £2,000 as “low risk”, as well as the CDD checks BSEL carried out on those transactions.

Exiger also recommended that BSEL use its Remit ERP system to track MLTF risks in a “more considered and focused way”. BSEL accepted the recommendation and appointed Exiger to design and implement new Management Information Dashboards (“MI Dashboards”). Exiger gave BSEL an expected delivery date of December 2018, but did not complete the project until November 2019. Ms Toman submitted that this delay showed BSEL’s lack of commitment to dealing with MLTF. The Appellants robustly rejected this and I agree: there is no evidence that BSEL was responsible for the delay and no adverse inference can be drawn. Instead, Exiger had contracted to deliver the project in December 2018, but did not meet that date.

The MI Dashboards contain 32 dashboards under the following categories:

Ms Toman submitted that BSEL did not have an adequate management information system until the introduction of the MI Dashboards, but I disagree. It is instead clear from the evidence that the Remit ERP system previously provided BSEL with the same information; the role of the Dashboards was to pull the information together so it was all in one place.

Following the introduction of the EU’s Fourth AML Directive (“4MLD” or “4AMLD”)) in 2015, and its transposition into UK law by the MLR in December 2018, BSEL appointed Exiger to provide a Risk Assessment Methodology Report in relation to AML/CTF. This was issued on 12 December 2018, and it begins by saying:

“The EU’s Fourth Anti-Money Laundering Directive (4AMLD) was introduced on June 25th 2015 and introduced an explicit legislative requirement to perform an AML/CTF risk assessment. 4AMLD was
transposed into UK law by the Money Laundering Regulations 2017 s.18, which requires firms to take appropriate steps to identify and assess the risks of money laundering and terrorist financing to which its business is subject. Such risk assessments must also be in writing and kept up to date.

The main purpose of an Enterprise-Wide Risk Assessment (EWRA) is to drive improvements in risk management by identifying the financial crime risks faced by BSEL. This is completed by determining how these risks are mitigated by controls; establishing the residual risk that remains; and defining the further actions that are required to mitigate unacceptable risk exposures.

The risk assessment process detailed below has been tailored to fit the BSEL’s specific business model and FCC risk exposure, specifically acknowledging the high-risk nature of remitting cross border transactions to beneficiaries situated in high-risk jurisdictions.

From an inherent risk perspective, BSEL’s FCC risk assessment process and scoring methodology are focused on developing a granular understanding of specific areas of risk exposure within the customer base, as well as developing understanding of the geographical risks and product / service risks posed by the financial activities/transactions of this customer base.”

Exiger designed a risk methodology approach for BSEL which had the following separate stages:

Under the heading “inherent risk”, Exiger said “All risks identified are initially assessed on an inherent risk basis. Inherent risk is the level of risk that presents when controls are not factored into the assessment”.

The methodology classified inherent risks as low, medium, or high; these were determined according to the methodology set out in the table, and then takes into account BSEL’s controls. In relation to “customers”, Exiger said that the inherent risk level was “low” where:

“Over the last 12 months, less than 5% of customer transactions were rated
High risk (transaction value over £8500 or cumulative transaction value over a six month period is higher than £8500) and were therefore subject to EDD.”

When assessing BSEL’s risk exposure, Exiger said:

“BSEL’s geographical risk exposure is more significant, as it provides payment services to the following countries: Bangladesh, Pakistan, Sri Lanka, and India. In October 2018, HMT published two statements identifying jurisdictions with strategic deficiencies in their AML/CTF regimes. These countries included both Pakistan and Sri Lanka, so both countries are considered as high risk. While Bangladesh is no longer on the FATF AML deficient countries list, it is exposed to significant terrorist financing risk, predominantly from domestic terrorist groups, with a number of attacks occurring in recent years, and is therefore considered as a high-risk country from a CTF perspective. In general to assess country risk BSEL should take into account the HMT Advisory Notice on higher risk jurisdictions, FATF guidance on AML deficient countries, whether the country is sanctioned or is in close proximity to sanctioned countries, and Transparency International’s Corruption Perception Index (CPI).

For distribution risk, BSEL operates a large agent network that requires significant oversight through CDD, ongoing RM visits and the completion of annual training.

To demonstrate that BSEL faces a higher level of geographic and distribution risk, more weighting has been applied to these risk categories. If the weightings are adjusted at any point in the future, the responsible individual (i.e. MLRO) will provide and document sufficient justification for the amendment, which must be approved by the Risk and Audit Committee.”

In relation to the final two stages, Exiger said:

“Where control assessment reviews indicate that the controls are operating effectively and do not identify any findings, the residual risk rating should be lower than the inherent risk rating. Where reviews identify substantive findings on specific controls, and the findings remain open any reduction to the residual risk rating due to those controls are not applicable.”

Control effectiveness was measured as follows:

The matrix also set out what criteria were to be applied in order to score each of the above as “strong”, “effective”, “needs improvement” or “deficient”. The “residual risk scoring matrix” was set out as follows:

After further meetings and visits to BSEL’s premises, Exiger issued a “Financial Crime Compliance Follow-up Review” on 22 November 2018. This review did not recommend any change to the CDD or EDD thresholds, but highlighted the many improvements which had been made to the Remit ERP system, adding:

“These system enhancements demonstrate BSEL’s commitment to investment in their technology and continued refinement of their financial crime compliance framework. As evidenced in the Business Requirements document 2017, BSEL have been proactive in analysing their systems and controls requirements to identify enhancements and new functionality such as the risk matrix that has delivered additional automation, which has increased the effectiveness and sustainability of the financial crime controls within their core processing platform.”

The report also noted that Reg 18 of the MLR separated out a fifth risk element to their risk assessment matrix, namely transactions, but did not recommend a change to the matrix, instead saying with approval:

“In the last five months, BSEL has continued to develop its Risk
Assessment Matrix by classifying the risk of various transaction scenarios and
configuring these scenarios to trigger alerts in the Remit ERP system...The current iteration of the Risk Assessment Matrix contains specific details on how the scenarios are configured, and what controls are in place to mitigate high risk scenarios and alerts.”

In March 2019 BSEL appointed Eversheds as its AML/CTF auditor. In initial discussions with BSEL, Eversheds recommended that the fifth risk factor identified in Reg 18 of the MLR, namely transactions, should be explicitly separated out in the risk matrix, and BSEL adopted that approach.

In accordance with the methodology in the Exiger model, but with the addition of “transactions” as a separate category, BSEL carried out an AML/CTF EWRA. It was issued in April 2019 and covered the year to March 2019; it opened by setting out Reg 18 and adding that it “requires all UK businesses and other regulated firms to assess their money laundering/terrorist financing risks and determine how they will be managed”. That was followed by a summary of BSEL’s risk-based strategy, as follows:

The EWRA used the Exiger framework to divide inherent risk into customer type; product and delivery risk; distribution risk and geographic risk, and it additionally separated out the transaction type as a separate category, as recommended by Eversheds. It then identified “the inherent risk score” for each of the risk elements; the controls which BSEL exercised, and the residual risk after those controls had been applied.

The “assumptions underlying scoring methodologies” were then set out:

“The scoring methodologies underlying BSEL’s FCC risk assessment process reflect that it is exposed to its highest levels of inherent AML risk through its agent network and the jurisdictions to which it remits funds (Bangladesh, Pakistan, Sri Lanka and Nepal).

For the inherent risk categories, additional weighting has therefore been applied to Distribution Risk and Geographic Risk. These risks need to be managed through a rigorous client due diligence process (especially for agents), and robust transaction monitoring systems and investigations processes. For control effectiveness, additional weighting has been applied to the controls required to mitigate the distribution and geographic risks posed by BSEL’s business operations (CDD for agents, CDD for retail customers, transaction monitoring and sanctions screening). These underlying assumptions will need to be reassessed as part of the planning process for the next iteration of the FCC risk assessment process, when BSEL’s business activities during the intervening period can be analysed to determine whether revisions to this methodology are required”

BSEL then assessed each risk category for the last twelve months as follows:

The EWRA contained further detail about each of these risk assessments. In relation to customers, it took into account the following:

In relation to transactions, the risk assessment weighed the following factors:

In relation to distribution, the risk assessment took into account that all retail customers interacted on a face-to-face basis with BSEL either in branches or agencies; in addition, BSEL relationship managers also made regular visits to the agents. The aggregators were classified as not face-to-face. Delivery channel risk was therefore assessed as “medium” because:

Taking into account the rating for each of the categories, and using the residual risk scoring matrix provided by Exiger, BSEL rated its overall risk assessment as “medium”. This was calculated by giving customers and products each a 15% rating; distribution and geography each a 25% rating, and transaction type a 20% rating. The higher weighting given to distribution and geography reflects the recommendations in the Exiger report.

BSEL also assessed the mitigating controls using the framework in the Exiger report, and the overall score was “effective”. BSEL concluded the EWRA by saying:

“Given the control framework in place, BSEL has assessed its residual risk of facilitating money laundering and CTF as MEDIUM.

This is based on the overall inherent risk posed by its customer type, jurisdiction, transaction type, products and services and delivery channel risks having been assessed as MEDIUM and the effectiveness of its control framework having been assessed as averaging 'EFFECTIVE'.”

Having carried out their AML/CTF audit (which included reviewing the EWRA), Eversheds issued their report on 24 May 2019. They classified their recommendations as follows:

The executive summary opens by saying:

“This audit focused on BRAC Saajan Exchange Limited’s (‘BSEL’) AML, CTF and sanctions control framework. We conducted a review of relevant policies and procedures in order to assess the effectiveness of the controls which BSEL has implemented to mitigate its risk of money laundering and/or terrorist financing. In order to determine whether BSEL is compliant with its legal and regulatory requirements, we conducted a review of relevant policies, procedures and systems against legal requirements set out in the legislation and guidance, detailed at page 8 of this report.

In our opinion, BSEL has sufficient controls in place to ensure that it complies with legal requirements imposed upon it from an AML/CTF and sanctions perspective. We are of the opinion that BSEL is complying with its legal and regulatory obligations pursuant to the MLR 2017 and the majority of the recommendations made in this report are generally to reflect best practice. We identified four recommendations of medium priority, and in our opinion these recommendations should be implementable by BSEL within a relatively short timeframe.”

As is clear from the above summary, Eversheds identified no high priority issues and no breaches of the MLR. The four medium priority issues related to recording NCA acknowledgments of SARs, and to training. Of the “low priority” issues, one was “consider reclassifying transaction risk in the EWRA”. The related text in the main body of the report reads:

“In accordance with Regulation 18 MLR 2017, the EWRA addresses customer, geographical, product, delivery channel and transaction risks. Risk areas have been identified for each risk type and a scoring methodology is clearly illustrated in respect of inherent risk, control effectiveness and the overall residual risk. The EWRA also details other risks which the business faces to include (but not limited to) fraud, regulatory risk, business disruption,
data security, IT security, currency risk, market risk, liquidity risk and reputation risk.

Upon considering the EWRA, we would recommend re-classifying transaction risk given that the majority of transactions are conducted in cash and this presents a higher risk of money laundering, irrespective of the average transaction amount.”

Eversheds also concluded that “the CDD and EDD thresholds are appropriate and in compliance with BSEL’s legal and regulatory obligations”.

As noted above, Mr Kirby joined BSEL shortly before May 2019 as Head of RAIC, but by November 2019 he had replaced Mr Olayinka as the Nominated Officer and MLRO. There is no suggestion in any of the external reports from Exiger or Eversheds that Mr Kirby did not have the training or experience to undertake that role, and neither party suggested this was the position. I therefore make the inference that Mr Kirby had the training and experience required to fill the role.

In his role as Nominated Officer and MLRO, Mr Kirby’s responsibilities included providing reactive and proactive advice to business areas on all aspects of AML; ensuring that the AML/CTF PCPs were up to date at all times, and providing “effective strategic and operational oversight and management of the compliance, Financial Crime Control and Data Protection functions across the company”.

The Fifth Anti-Money Laundering Directive (“5MLD”) was implemented in the UK with effect from 10 January 2020 by the Money Laundering and Terrorist Financing (Amendment) Regulations 2019, which introduced various amendments to the MLR. The “update” page for BSEL’s detailed PCP document records that Mr Kirby updated the company’s PCPs for 5MLD on implementation day, 10 January 2020.

On 22 January 2020, Mr Kirby issued a document entitled “MLRO Approval - CDD and EDD threshold conditions 5^th MLD”; it states that “the threshold conditions for high risk third countries - ie Pakistan and Sri Lanka” has “been completed in Jan 2020”. The detailed attachment to that document shows that the threshold at which EDD was required for transactions with Pakistan had been lowered from £5,000 to £2,000 for cash, and to £3,000 for electronic bank transfers; the thresholds applied whether there had been a single transaction or a cumulative total over 30 days. The EDD threshold for Bangladesh had been lowered to £3,000 for cash and £5,000 for bank transfers, whether as a single transaction or a cumulative total. For transactions under those thresholds, customers were subject to CDD, which required proof of identity.

Mr Kirby initialled each page of the document, and above his signature on the final page is the following formal statement under the heading “MLRO Approval”:

“I, David M Kirby acting as the UK MLRO and approved by HMRC as the appointed person under the Money Laundering Regulations 2017 is exercising my authority to act honestly, reasonably and with independent judgment in assessing and determine the risks presented to BSEL.

I have determined that the measures detailed above have been implemented by applying additional elements of due diligence to mitigate the risks in relation to high risk third countries. The measures have been determined as adequate and proportionate to meet the new requirements and obligations, as provided under Part 3: customer due diligence of ‘The Money Laundering and Terrorist Financing (Amendment) Regulations 2019’.”

The other officers and employees of the company relied on Mr Kirby’s review and on his conclusions. In particular, none of the Individual Appellants had detailed knowledge of 5MLD. BSEL’s new CDD and EDD levels were also broadly comparable with those of other MSBs.

The coronavirus pandemic began in early 2020 and formed the backdrop to the rest of the events with which this case is concerned. The pandemic and the associated lockdowns had a significant effect on BSEL: Mr Garcia said it affected “everything” and Mr Furnival said it had been “a struggle organising staff” following the introduction of a work-from-home policy and furlough. Despite the pandemic, BSEL continued to conduct its transaction monitoring and other controls, although it had to delay some onsite agent visits.

A further EWRA was carried out in April 2020. In it, BSEL noted the implementation of 5MLD, and recorded that it included a “black list” of high risk third countries, which included Pakistan. Although Bangladesh was not so classified, BSEL continued to treat it as a high risk jurisdiction. The EWRA also noted that BSEL had reduced the threshold for EDD; this followed from Mr Kirby’s changes. The risk assessment for each category remained the same as the previous year, as did the overall assessment as being “medium”.

From the date the business began operations in 2004 until the events with which this appeal is concerned, BSEL maintained a clean record with all regulators, never receiving any adverse notifications, penalties or sanctions. Between 2004 and 2018, four HMRC AML Supervision Officers visited BSEL’s premises, many of them on more than one occasion; during those visits the Officers discussed BSEL’s PCPs with the directors and staff; reviewed files and documents and interrogated the Remit ERP system. None identified any issues in relation to the operation of BSEL’s PCPs; the Remit ERP system or indeed in any other respect.

On 20 December 2018, Officer Stuart Marlor informed BSEL that he would be visiting its premises on 10 January 2019 to check BSEL’s MLR compliance. On that day, he spent five and a half hours on the premises, meeting Mr Garcia and Mr Olayinka, the MLRO.

After Mr Marlor’s visit there was regular communication between him and BSEL’s MLRO until September 2019. BSEL provided Mr Marlor with over thirty types of data and information, including monthly summaries of agent transactions for 2018; aggregator transactional data; risk assessments and BSEL’s PCPs dated October 2018. After September 2019, BSEL heard nothing more from HMRC for nearly a year. BSEL was later informed that Mr Marlor had passed away in the summer of 2020.

In August 2020, Dr Naheem was dismissed after a lengthy investigatory meeting with Mr Furnival. I make no finding as to whether his dismissal was justified.

Mr Kirby left the company unexpectedly but voluntarily in early August 2020. He retained his company laptop and used it to access BSEL’s network and attempted to delete a large volume of data. Although BSEL recovered that data, it was unable to access other files which had been stored on Mr Kirby’s hard drive. Mr Furnival was asked to notify the FCA and the Information Commissioner’s Office of Mr Kirby’s activity, and did so. Mr Salam also asked Mr Furnival to persuade Mr Kirby to return his laptop.

Subsequently, Dr Naheem and Mr Kirby submitted reports to the FCA. The Tribunal was not provided with any information as to the contents of these reports or whether they were shared with HMRC.

In August 2020, Ms Chapman was “allocated” to BSEL. At least some of the Individual Appellants considered that there was a link between the departure of Mr Kirby and/or Dr Naheem, and the approach taken by Ms Chapman to her review of BSEL. During the hearing of these appeals, a series of exchanges took place between Mr Lakha and Ms Toman about whether or not there had been contact between HMRC and Mr Kirby. After taking instructions, Ms Toman said:

On the basis of the evidence before the Tribunal, and taking into account Ms Toman’s statements, I am unable to make any finding of fact as to whether there is a link between (a) HMRC’s subsequent actions in relation to BSEL and the Individual Appellants and (b) Mr Kirby himself and/or the material he had filed with the FCA.

Ms Chapman decided not to consider the material which BSEL had previously provided to HMRC at Mr Marlor’s request. She did not see the Remit ERP system in operation; when BSEL offered a demonstration, the offer was declined. BSEL also suggested that Ms Chapman would find it helpful to visit a branch to talk to those operating the Remit ERP system, but that offer too was declined. Ms Chapman also did not read Exiger’s Risk Assessment Methodology Report, the earlier Exiger report or that firm’s Follow-up Review. When Ms Chapman was asked in cross-examination why she hadn’t looked at the Exiger Methodology Report, she said “I can’t answer why I didn’t look at that”. It was common ground that, despite the pandemic, during at least some part of that period it would have been possible for Ms Chapman to visit BSEL’s premises, but she not do so: all contact was by email or conference call until March 2021, when she asked BSEL if they were happy with a video meeting, adding that if not she would “consider gaining authorisation” for a face to face visit. The meeting went ahead by video.

On 9 September 2020, Ms Chapman contacted Ms Dhillon, who was covering the MLRO role given Mr Kirby’s unexpected departure. Ms Chapman sent Ms Dhillon a long and detailed list of information which she required BSEL to provide by 1 October 2020: the list included BSEL’s organisational chart; details of its directors, company secretary and senior management; its Risk Assessments; PCPs for the period September 2018 to September 2020; a list of current aggregators; detailed transactional data for aggregators and agents for the period 1 September 2018 to 31 August 2020, and data about BSEL’s agents. Ms Dhillon complied. In October Ms Chapman requested more information about agents and aggregators, and this was also provided.

Reg 57(4) of the MLR required BSEL to notify HMRC within 30 days if it appointed certain “responsible persons”, so HMRC could check whether they met the “fit and proper” (“F&P”) requirements in Reg 58.

On 24 September 2020 Ms Chapman contacted Ms Dhillon to say that four such individuals “had not been notified to HMRC” for the purpose of F&P testing, namely Mr Garcia, Mr Ahmad, Mr Furnival and Ms Dhillon herself. Ms Chapman subsequently acknowledged that Mr Ahmad had in fact been notified to HMRC many years previously and that his F&P status had been accepted. I make further findings about the other three individuals at §345.

Ms Dhillon provided Ms Chapman with the relevant notification forms on 29 September 2020. On the same date, she also provided forms for Mr Curran, who had been appointed as MLRO on 28 September 2020, and for Mr Hashmi, who had been appointed as head of RAIC on 1 September 2020 after Dr Naheem’s departure Both of these latter notifications were made within 30 days. HMRC subsequently confirmed that all these individuals were “fit and proper” persons.

On 12 October 2020, Ms Chapman emailed Ms Dhillon, saying “I notice from Companies House that there is an additional director for whom an MLR101 has not been submitted, Selim Raza Farhad Hussein”. By return Ms Dhillon send Ms Chapman the MLR101 which Mr Hussein had previously submitted, and on 13 October 2020, Ms Chapman confirmed the form was valid. BSEL had therefore not failed to comply with Reg 57(4) in relation to Mr Hussein.

In early October 2020, Barclays terminated BSEL’s UK bank account; BSEL endeavoured to find out the cause of this, but Barclays would not provide its reasons. As a result BSEL had no viable facility to act as IPSP for cash aggregators.

As a result. on 12 October 2020 BSEL terminated its arrangements with all aggregators other than Visa. As a result, its business reduced by 55%. In November 2020, BSEL established an aggregator relationship with MoneyGram. All the transfers from Visa and MoneyGram were to beneficiaries’ bank accounts; no money was paid out by banks in Pakistan or Bangladesh to beneficiaries over the counter.

On 22 October 2020, Ms Chapman issued a letter suspending BSEL’s registration for a period of up to 45 days (“the Suspension Decision”), on the basis that there had been a “consistent failure” to comply with the following regulations:

BSEL responded the same day, informing Ms Chapman that they had reduced the EDD threshold to £1,000 for a single transaction to either Pakistan or Bangladesh. They had also strengthened their CDD for new customers: on registering the government-issued ID document would be scanned into the Remit ERP system and no subsequent transactions would be approved unless the sender produced the same ID document as that held on the system,

On 23 October 2020, Ms Chapman told Ms Dhillon the proposed changes were insufficient, and that “EDD needs to have a threshold of zero due to the fact that the jurisdictions that the customers have been transmitting to have been identified as high risk”. Ms Chapman had a further conversation on the same day with Mr Salam and Mr Furnival, in which she said that “EDD requires going further than just verifying the customer it needs to look at the purpose of the transaction and the source of funds”. Mr Salam and Mr Furnival said that other MSBs did not operate a zero threshold; Ms Chapman reiterated that it was a requirement and said “she couldn’t comment on other MSBs”.

In her witness statement, Ms Chapman said that as a result of that conversation she “was concerned that BSEL was reluctant to comply with its obligations in respect of the Regulations and that it’s overriding concern was its competitors and market position”. That witness statement prompted Mr Salam to file a further statement, because the call had been recorded. The transcript shows that Mr Furnival said:

“[BSEL] is very keen to be super compliant, but we are also concerned that where we are in the market we are on an equal playing field with our competitors if you like. So there's a there's a level playing field in terms of the way the regulations are applied in the way they are interpreted etcetera.”

Thus, Mr Furnival did not say BSEL was reluctant to comply with its regulatory obligations, or that it needed to consider business needs “alongside” the regulatory requirements, but instead that BSEL was keen to be compliant, but needed HMRC to apply the same approach to the competition. Evidence provided for the hearing showed BSEL was correct: at least two other well-known MSBs operated a £2,000 EDD threshold for Pakistan: that Mr Salam and Mr Furnival were right to be worried can be seen by the effect on BSEL’s business after the zero threshold was implemented, see §305 below.

On 27 October 2020, Ms Dhillon and Mr Curran held a telephone conversation with another HMRC officer, Ms Zoe Kenning. They discussed whether a zero threshold was required; the note of that call shows that Ms Kenning replied as follows:

“ZK said EDD should be applied to remittances to high-risk jurisdictions (HRJs) and should go above and beyond normal customer due diligence (CDD). For example, verifying source of funds (SOF) in a high-risk situation. ZK continued and said it does not necessarily mean SOF must be applied
on every transaction. ZK said it does mean you have to go beyond the standard
requirements and for EDD to be meaningful source of funds verification is the most relevant. [BSEL] need to consider what else you are going to establish; including, asking for the purpose of the transaction.”

Ms Dhillon and Mr Curran responded by saying that none of their competitors required customers sending small amounts of money to Pakistan/Bangladesh to provide information or documentation about the source of funds. BSEL subsequently provided Ms Chapman with documentation to show that the majority of its customers’ transactions were under £250.

BSEL instructed Eversheds to carry out a further audit. It is clear from the documents reviewed that this took place before BSEL’s next EWRA, even though the EWRA was dated October, and Eversheds issued its report on 5 November 2020.

The purpose of the audit was:

“To examine and evaluate the adequacy and effectiveness of the policies, controls and procedures adopted to comply with the MLR 2017 (as amended by the) MLR 2019; and make recommendations in relation to those policies, controls and procedures.”

Eversheds’ summary of the position was as follows:

“This audit focused on BRAC Saajan Exchange Limited’s (“BSEL”) AML, CTF and sanctions control framework. We conducted a review of relevant policies and procedures in order to assess the effectiveness of the controls which BSEL has implemented to mitigate its risk of money laundering and/or terrorist financing. In order to determine whether BSEL is compliant with its legal and regulatory requirements, we conducted a review of relevant policies, procedures and systems against legal requirements set out in the legislation and guidance, detailed at page 9 of this report.

With the exception of our one high priority recommendation, we are of the opinion that BSEL is complying with its legal and regulatory obligations pursuant to the MLR 2017 (as amended by MLR 2019) and the majority of the recommendations made in this report are generally to reflect best practice. We identified one recommendation of high priority, which should be dealt with by BSEL on an urgent basis. We identified 3 recommendations of medium priority, and in our opinion these recommendations should be implementable by BSEL within a relatively short timeframe.”

That high priority recommendation was as follows:

“As a matter of priority, BSEL is advised to update its compliance procedures so that EDD is carried out for funds transfers exceeding 1,000 euros to/from
Pakistan in accordance with Regulation 33 MLR 2017 (as amended by Regulation 5 MLR 2019). The EDD carried out must include those requirements specifically set out in regulation 33 MLR 2017 (as amended)”.

As is clear from the above:

In the list of low priority/no breach issues, Eversheds repeated their recommendation that transaction risk be reclassified as “high”. Mr Hashmi explained to Eversheds that BSEL still considered that it was appropriate to take the size of transactions into account, but he nevertheless agreed that BSEL would accept the recommendation.

The October EWRA covered the period from January to September 2020; it was triggered by BSEL’s decision to stop doing business with cash-based aggregators. The EWRA also changed the weighting given to Bangladesh, for the following reasons:

“Bangladesh, which previously rated as a high-risk country in the March 2020 enterprise-wide risk assessment, has been downgraded to medium risk. The previous assessment of the country was made on the basis of FATF’s assessment of 2016, when Bangladesh was asked to implement
recommendations for the improvement of its AML regime. Since then, there have been three updates, August 2019 being the most recent one, where Bangladesh has been assessed by FATF as fully compliant / mostly compliant on most of the recommendations (the link below refers). Additionally,
Bangladesh is also not on the European Union list of high risk third countries.”

In the October EWRA, BSEL assessed each risk category as follows:

Taking into account the weighting of the above factors, BSEL’s overall risk rating remained at “medium”. That took into account both the lower rating for transfers to Bangladesh, and the higher ratings for customers and transaction type. The weighting given to each factor was unchanged from that in the earlier EWRAs, namely customers and products 15%; distribution and geography 25%, and transaction type 20%. The control mitigation assessment continued to be “effective”.

On 2 November 2020, Mr Curran emailed Ms Chapman attaching amended PCPs, which included the following changes:

On 5 November 2020, a telephone conference took place between Ms Chapman, Mr Garcia and Mr Curran. Ms Chapman rejected the proposed PCPs as insufficient, and said that (a) proof of address was required for all transactions, and did not constitute EDD, and (b) declarations were insufficient; BSEL must also “verify” the senders’ occupation and income. At §390, I consider whether Ms Chapman was correct that EDD was required.

A few hours after that telephone conversation, Ms Chapman emailed Mr Curran setting out her understanding of the main points discussed. Mr Curran responded the following day, replying to her specific points. I have transcribed the parties’ points verbatim as they form a part of the basis for the Decisions which followed.

On 10 November 2020, revised PCPs were sent to Ms Chapman; these included the above changes. The wording of “customer/beneficiary limits” in the PCPs was identical to that in Box 6 above. Because Bangladesh had been reclassified as “medium-risk”, the new proof of occupation and income requirements applied only to Pakistan, the remaining HRJ.

On 12 November 2020 Mr Curran emailed Ms Chapman, stating that “all promised enhancements to our Remit ERP systems have been completed and are now ‘live’”. What was meant by that statement, and by some of Mr Curran’s responses in the table set out above, was disputed and I return to those points later in this judgment.

Ms Chapman lifted the suspension and issued the Reinstatement Decision on 13 November 2020. Her letter said (my emphasis):

“The Business has revised its Risk Assessment (RA) and Policies, Controls and Procedures (PCP). The updated RA and PCP address the specific points detailed within the Suspension Notice and the Business has also provided assurances and evidence that the updated PCP have been fully implemented throughout the Business and its agent network. As such, I am satisfied that the Business is a fit and proper person under Regulation 58(1). As a result, the registration of the Business has been reinstated with effect from 13 November 2020.

This decision is specifically in relation to the Regulations and associated risks detailed in the Suspension Notice of 22 October 2020, it should not be taken as acceptance that the Business is fully compliant with its obligations under the Regulations or that it will be able to demonstrate compliance in the future.

In addition, please be aware that my ongoing review of the Business’s current and historical compliance with the Regulations will continue and this could result in further sanctions, including where appropriate a financial penalty.”

Ms Chapman thus accepted that, by the date of the Reinstatement Decision, BSEL had remedied both of the breaches she had identified, namely the failure to notify HMRC that Mr Garcia, Mr Furnival and Ms Dhillon had been appointed as responsible persons; and the failure to apply EDD to all transactions with high risk jurisdictions.

At the hearing, Ms Toman explicitly confirmed on behalf of HMRC that:

On 16 November 2020, Eversheds wrote to BSEL summarising the outcome of the audit and BSEL’s subsequent response. The letter said:

“We are of the opinion that BSEL is complying with its legal and regulatory obligations pursuant to MLR 2017 (as amended by MLR 2019), subject to one audit finding relating to EDD requirements. The remaining 21 recommendations included in the report were made to reflect recent guidance and best practice only.

With regard to EDD, we recommended that BSEL should amend its procedures as a priority in order to comply with Regulation 33 MLR 2017 (as amended by Regulation 5 MLR 2019). In particular, we noted that BSEL must apply EDD measures as stipulated by the aforementioned regulations for all funds transfers exceeding 1,000 Euros in respect of any High Risk Third
Country (“HR3C”) it transacted with.

Since the audit, we can confirm that BSEL has taken steps to comply with these requirements set out above by amending its Compliance Policy to apply EDD for all funds transfers, regardless of the transfer amount, in respect of customer transactions to/from any HR3C;

 introducing a beneficiary identifier process, including a new policy of refusing to accept beneficiaries from HR3C as customers;

 requiring verification of the occupation and income of customers wishing to send money to a HR3C; and

 refreshing the ID and address verification of active customers transacting with an HR3C on a six-monthly basis rather than annually.”

The second of those changes is listed in the table at §292 above, the first is additional and the third was further developed by using Experian to check ID and address details for all transactions.

Ms Chapman continued to discuss AML/CTF compliance with BSEL. On 1 and 3 December 2020 a conference call took place, which was attended on behalf of BSEL by Mr Garcia, Ms Dhillon, Mr Curran and Mr Furnival; Mr Hashmi was unable to attend as he was off sick with severe covid during November and December 2020.

During the call, Ms Chapman raised more issues, and subsequently sent BSEL a list of questions. On 10 March 2021 a video meeting took place; this was attended for BSEL by Mr Garcia, Ms Dhillon, Mr Curran, Mr Hashmi, Mr Gomes and Mr Agarwal, BSEL’s Business Manager. This was the only meeting which Mr Gomes attended, and he did so in order to offer to demonstrate the Remit ERP system, as he was BSEL’s head of IT. However, in his words “she did not appear to be remotely interested in having a full system demonstration that I offered”. Mr Hashmi also attended only this one meeting. Mr Furnival did not attend because he had been furloughed on 1 February 2021 and he subsequently left the business by mutual agreement.

After that meeting, Ms Chapman sent BSEL a list of 22 questions. In the later Parts of this judgment I make further findings of fact about the calls on 1 and 3 December 2020; about the video meeting on 10 March 2021, and about the communications between Ms Chapman and BSEL after both meetings.

When she began her review, Ms Chapman had required BSEL to provide significant amounts of data. In September 2020 she gave the aggregator and agent data to Mr Allington-Jones, together with a brief describing what she required, and a set of parameters. Mr Allington-Jones began working on the data around 26 October 2020, and provided Ms Chapman with his first spreadsheets at the end of November. He discussed those spreadsheets with Ms Chapman, and in February and March 2021 she asked him to run more tests. In total, Mr Allington-Jones ran over 150 tests/programs, of which around two-thirds were summaries, and thus in total he produced some 50 spreadsheets. Ms Chapman did not discuss Mr Allington-Jones’s analysis, or the conclusions she had drawn from that data, with BSEL.

In March or April 2021, Ms Chapman sent her draft ToF and draft Prohibition Decisions to an internal HMRC governance panel, which approved those Decisions without making any changes. On 8 April 2021, Ms Chapman provided a draft of her ToF and a draft Cancellation Decision to Mr McLean, and he began to draft the Personal Decisions. I make findings at §888ff about the process he followed.

By March 2021, BSEL’s business with Pakistan had reduced by 98%. This had been caused by the new EDD requirement that every customer transferring funds to Pakistan had to provide proof of occupation and income, irrespective of amount and without taking into account BSEL’s knowledge of their previous transactions. In consequence, BSEL’s customer base had transferred to competitor MSBs which did not require EDD for all transactions, but instead continued to allow money (below a threshold) to be transferred to Pakistan without senders having to provide payslips, bank statements or other proof of source of funds.

As noted earlier in this judgment, JW Risk is the company through which Mr Wall provides consultancy services following his thirty-year career in the Metropolitan Police. It specialises in combatting financial crime and money laundering. One of Mr Wall’s clients is the Choice Group, for which he has carried out over 160 compliance audits.

On 24 May 2021 JW Risk carried out an audit of BSEL; this was only two days before the Cancellation Decision was issued. Mr Wall concluded in his written report that BSEL “have invested heavily in Compliance systems and are very strict with Regulatory adherence” and “have a achieved a very good level of Compliance”. In his witness evidence for these appeals, he said that, from his sample of BSEL’s agent files “these were probably some of the most in-depth agent due diligence records I have seen as an auditor”. He added that:

“From the material I inspected, I formed the impression that excellent and very in-depth due diligence is carried out on all agents, all to the same high standard. Furthermore, BSEL keep excellent records which record the due diligence undertaken.”

In relation to CDD, he said:

“I was able to verify that the high level of customer due diligence described to me at this stage of the inspection, was actually in place. In my opinion, Brac Sajaan have one of the best operational approaches to compliance and due diligence that I have seen during my time working with the Choice Group.”

On 26 May 2021, Ms Chapman sent BSEL the Cancellation Decision, and on the same day, she issued the Prohibition Decisions to Mr Salam, Mr Garcia and Mr Furnival, and Mr McLean issued the Personal Decisions to all the Individual Appellants, with the exception of Mr Furnival as he was no longer employed by BSEL. I make further findings of fact about all the Decisions later in this judgment.

Mr Salam’s unchallenged evidence as set out in his first witness statement on 16 July 2021 was the Decisions had the following consequences for BSE::

The Decisions caused personal distress to all the Individual Appellants, as well as harming their livelihoods and reputations. The Personal Decisions made it difficult for the six Individual Appellants to obtain work commensurate with their experience. Mr Salam, Mr Garcia and Mr Furnival were banned for life from taking a management role in a regulated industry: Mr Furnival said “the terms of the prohibition are very wide-ranging and effectively render me unemployed for the rest of my life. All of my skills and experience in 35 years have been gained in financial institutions and I am devastated by this decision”. Mr Lakha described the Decisions as having “catastrophic drastic consequences” and I agree.

This Part summarises the EU money-laundering legislation and the UK regulations which implement that legislation. It also summarises the relevant parts of the related guidance provided by the NRA, HMRC and the Joint Committee of the EU Supervisory Authorities.

The EU issued 4MLD on 20 May 2015. Recital 4 states that the implementation and enforcement of the Directive represent “relevant and effective means of preventing and combating money-laundering and terrorist financing”; this is followed by Recital 5, which provides that:

“This Regulation is not intended to impose unnecessary burdens or costs on payment service providers or on persons who use their services. In this regard, the preventive approach should be targeted and proportionate.”

Recital 22 reads:

“The risk of money laundering and terrorist financing is not the same in every case. Accordingly, a holistic, risk based approach should be used. The risk-based approach is not an unduly permissive option for Member States
and obliged entities. It involves the use of evidence-based decision-making in order to target the risks of money laundering and terrorist financing facing the Union and those operating within it more effectively.”

The EU issued 5MLD on 30 May 2018. Recital 1 says:

“Directive (EU) 2015/849 of the European Parliament and of the Council constitutes the main legal instrument in the prevention of the use of the Union financial system for the purposes of money laundering and terrorist financing. That Directive…sets out an efficient and comprehensive legal framework for addressing the collection of money or property for terrorist purposes by requiring Member States to identify, understand and mitigate the risks related to money laundering and terrorist financing.”

Recital 2 says:

“Recent terrorist attacks have brought to light emerging new trends, in particular regarding the way terrorist groups finance and conduct their operations…In order to keep pace with evolving trends, further measures should be taken to ensure the increased transparency of financial transactions…with a view to improving the existing preventive framework and to more effectively countering terrorist financing. It is important to note that the measures taken should be proportionate to the risks.”

Recital 5 begins:

“While the aims of Directive (EU) 2015/849 should be pursued and any amendments to it should be consistent with the Union’s ongoing action in the field of countering terrorism and terrorist financing, such amendments should be made having due regard to the fundamental right to the protection of personal data, as well as the observance and application of the proportionality principle.”

Many of the Recitals refer to alternative currencies, beneficial ownership of trusts and other corporate bodies, and cross-border co-operation between governments. However, Recital 43 includes this passage:

“…recognising that not all cross border correspondent banking services present the same level of money laundering and terrorist financing risks, the intensity of the measures laid down in this Directive can be determined by application of the principles of the risk based approach and do not prejudge the level of money laundering and terrorist financing risk presented by the respondent financial institution.”

The MLR, which implemented 4MLD, came into force on 26 June 2017. The UK implemented 5MLD by the Money Laundering And Terrorist Financing (Amendment) Regulations 2019. This amended the MLR, and which came into effect on 10 January 2020.

The Explanatory Memorandum to the 2019 amending regulations includes the following statement:

“There are over 100,000 businesses within scope of the MLRs, requiring businesses to know their customers and manage their risks. The MLRs are deliberately not prescriptive, providing flexibility in order to promote a proportionate and effective risk based approach to combating money laundering and terrorist financing.”

The specific regulations in issue are set out under the relevant headings in the rest of this judgment.

The UK published its first NRA in 2015; a revised and updated NRA was published in 2017 (“NRA 2017” or “the NRA”). A further version was published in December 2020. Although this was included in the Authorities Bundle, Ms Chapman relied only on NRA 2017 in making her Decisions, on the basis that it was the version current during the period of her review. Ms Toman made two references to the 2020 version in her skeleton argument, but only to emphasise that the position had not changed since 2017, and neither party referred to the 2020 version during the hearing. I have therefore referred only to NRA 2017 in this judgment; key passages are set out below; paragraph references where relevant are in brackets.

The Executive Summary set out certain “key findings”, which included the following:

“Cash, alongside cash intensive sectors, remains the favoured method for terrorists to move funds through and out of the UK. The UK’s terrorist financing threat largely involves low levels of funds being raised by UK individuals to send overseas, fund travel or fund attack planning. The primary means of doing this are assessed to be through cash, retail banking or money service businesses (MSBs)”.

Under the heading “International Threat” is a subheading “Remittance and other financial flows”. Para 2.30 of that section includes the following passage:

“Given the large remittance and business links between Pakistan and the UK, both countries are exposed to this corridor being abused for money laundering or terrorist financing. There is a risk of criminal groups exploiting these links to facilitate money laundering, particularly the laundering of the proceeds of corruption, fraud and drug trafficking. Criminals have exploited tools including MSBs, cash smuggling, front businesses, trade based money laundering and property to launder funds both from the UK to Pakistan and vice versa.”

Chapter 10 is headed “Cash”, and opens by saying (10.1):

“Cash is inherently high risk due to it being untraceable, readily exchangeable and anonymous… use of cash remains a high risk for both money laundering and terrorist financing.”

Chapter 11 is headed “Money service businesses”, and begins:

“The MSB sector encompasses a range of services relating to the transmission or conversion of funds, including money transmission services, foreign exchange and cheque cashing. The sector is highly diverse, with providers ranging from local convenience stores offering remittance services to large multinational corporations and web-based businesses providing peer-to-peer money transfers. MSBs play an important function in many communities by providing financial services to those without access to banking services. Cross-border remittances facilitated by MSBs have also been shown to play a key role in supporting economic development within developing countries.”

The overall risk for the MSB sector was rated as high for both money laundering and terrorist financing (11.3 and 11.4). The Chapter continues at 11.5 by saying that “high risks associated with the MSB sector should be managed on a case-by-case basis”.

The compliance of smaller and larger MSB businesses are distinguished (11.15):

“the largest principal MSBs have sophisticated compliance and systems, HMRC considers that other businesses do not allocate sufficient resource to AML/CTF policies and controls.”

At 11.9 the NRA says:

“There is evidence of MSBs seeking to register with banks as different cash- rich businesses or routing their business through third party accounts and other MSBs. HMRC has also found strong evidence that the principal-agent relationship is being exploited to launder criminal funds, including through businesses becoming agents of well-known money transmitters while operating their own separate systems for illicit transactions.”

Paragraph 11.12 reads:

“The 2015 NRA identified key terrorist financing risks within the MSB sector as complicit employees involved in remitting funds destined for terrorists, terrorist exploitation of the CDD threshold, and low reporting from the sector in relation to terrorist financing. While the due diligence threshold has been lowered from €1,000 to €0 through the Funds Transfer Regulation 2017, the general risks in the sector remain. The low cost of transferring funds and the ability to reach a wide number of jurisdictions linked to terrorism continue to make MSBs an attractive method for moving terrorist funds in small volumes.”

In March 2018 HMRC updated its guidance to MSBs, entitled “Anti-Money Laundering Supervision: Money Service Business” (“the HMRC Guidance”), and it was common ground that this version was the most relevant for the purposes of the Appellants’ appeals. The document was updated again in April 2020, after the implementation of 5MLD in January of that year. Where that later version is relevant to specific requirements and provisions, I have made reference to it. The HMRC Guidance was approved by the Treasury.

Chapter 3 of the HMRC Guidance is headed “Risk-based approach”, and begins:

“A risk-based approach is where you assess the risks that your business may be used for money laundering or terrorist financing, and put in place appropriate measures to manage and lessen those risks. An effective risk-based approach will identify the highest risks of money laundering and terrorist financing that your business faces, and put in place measures to manage these risks.”

Paragraph 3.3 of that Chapter reads:

“A risk-based approach should balance the costs to your business and customers with a realistic assessment of the risk that your business may be exploited for the purpose of money laundering and terrorist financing. It allows you to use your informed judgement to focus your efforts on the highest-risk areas and reduce unnecessary burdens on customers presenting a
limited risk of money laundering and/or terrorist financing.”

Paragraph 3.4 reads “Assessing your business’s risk profile will help you understand the risks to your business and how they may change over time…”; and 3.6 similarly says that each risk assessment needs to reflect changes in your business and the environment that you do business in”. The need for the risks to be re-assessed over time as circumstances change is repeated in other parts the HMRC Guidance.

Chapter 9 deals with principal-agent relationships; gives guidance for the appointment of an agent; says that HMRC expect principals to have “clear agent selection criteria”; train the agents, and have PCPs to monitor agent transactions.

Chapter 10 is headed “risk indicators for each type of money service business” and it opens:

“The following is an example list of common risk indicators that call for enhanced due diligence. It's not an exhaustive list, and neither are these signs always suspicious. It depends on the circumstances of each case.”

That heading is followed by a long lists of “common risk indicators”. These include problems around customer identity or source of funds; unusual or large transactions; a change in the normal pattern of transactions, and customers who are under-age or who seem to be acting under instruction from others. Among that list are the following points:

“• there's no apparent reason for a customer using your business's services, for example, another business is better placed to handle the size of transaction or the destination of the transmission;

•

non face-to-face customers;

•

the customer sends or receives money to or from himself;

•

agents who undertake business outside normal business hours;

•

agents who carry out transactions too fast to be possible;

•

multiple money service business premises operating in very small area.”

Para 10.6 says:

“Where the beneficiary of a money transmission is in a high risk country you should do enhanced due diligence checks on your customer. To help you decide if you're sending money to a high-risk country, FATF and the EC publish a list of high risk and non-cooperative countries.”

The HMRC Guidance also directs the reader to other guidance including:

Before setting out a list of risk factors, the EU Guidance says:

“Firms should note that the following risk factors are not exhaustive, nor is there an expectation that firms will consider all risk factors in all cases. Firms should take a holistic view of the risk associated with the situation and note that, unless Directive (EU) 2015/849 [4MLD] or national legislation states otherwise, the presence of isolated risk factors does not necessarily move a relationship into a higher or lower risk category.”

It also says:

“34.

Firms should take a holistic view of the ML/TF risk factors they have identified that, together, will determine the level of ML/TF risk associated with a business relationship or occasional transaction.

35.

As part of this assessment, firms may decide to weigh factors differently depending on their relative importance.

36.

When weighting risk factors, firms should make an informed judgement about the relevance of different risk factors in the context of a business relationship or occasional transaction. This often results in firms allocating different ‘scores’ to different factors; for example, firms may decide that a customer’s personal links to a jurisdiction associated with higher ML/TF risk is less relevant in light of the features of the product they seek.

37.

Ultimately, the weight given to each of these factors is likely to vary from product to product and customer to customer (or category of customer) and from one firm to another.”

At para 51 the EU Guidance says “Firms should apply additional EDD measures in those situations where this is commensurate to the ML/TF risk they have identified”. It sets out numerous risk factors, of which the following are of particular relevance to this appeal, and/or were relied on by HMRC:

As is clear from the findings of fact set out earlier in this judgment, Ms Chapman suspended BSEL on 22 October 2020 for having breached (a) Reg 57(4) and (b) Reg 19(1)(a) by reference to Reg 33(1)(a). On 13 November 2020 she accepted that those two breaches had been remedied and issued the Reinstatement Decision.

However, the issues which had caused the suspension were also included by Ms Chapman as part of her justification for the Cancellation Decision. This Part therefore consider whether Ms Chapman was correct that BSEL had breached the MLR in the ways identified in the Suspension Decision.

The first breach included in the Suspension Decision was that BSEL had not notified HMRC within 30 days that four individuals had been appointed as responsible persons, as required by Reg 57(4).

Reg 57 sets out the requirements a person must satisfy when it applies to be registered with its supervisory authority, which in BSEL’s case was HMRC. Para 1 provides that that information is to be provided “in such manner and provide such information as the registering authority may specify”.

Reg 57(4) provides that if, at any time after the applicant has provided the registering authority with any information under paragraph (1), there is a material change affecting any matter contained in that information, “the applicant must provide the registering authority with details of the change…within 30 days beginning with the date of the occurrence of the change…or within such later time as may be agreed with the registering authority”.

It is clear from the above that when there is a change to a relevant officer or manager, the business must inform HMRC within 30 days, and must provide “such information as HMRC may specify” about that person.

Reg 58, to which reference is made in Reg 57(2)(h)(ii) cited above, is headed “Fit and proper test”, and para 1 reads:

“The registering authority must refuse to register an applicant for registration in a register maintained under regulation 54 as a money service business or as a trust or company service provider, if it is satisfied that—

(a)

the applicant;

(b)

an officer or manager of the applicant;

(c)

a beneficial owner of the applicant; or

(d)

where the applicant is a money service business—

(i)

any agent used by the applicant for the purposes of its business; or

(ii)

any officer, manager or beneficial owner of the agent,

is not a fit and proper person to carry on that business.”

Reg 58(3) deems any person who has been convicted of a criminal offence in Schedule 3 of the Regulations as not being a fit and proper person. Schedule 3 lists a range of criminal offences under English law; it also includes criminal offences under the law of a foreign country and acts which would have constituted criminal offences within Schedule 3 had they been committed in the UK.

Paras 4 and 5 read as follows:

“(4)

If paragraph (3) does not apply, the registering authority must have regard to the following factors in determining the question in paragraph (1)—

(a)

whether the applicant has consistently failed to comply with the requirements of—

(i)

these Regulations;…

(b)

the risk that the applicant's business may be used for money laundering or terrorist financing; and—

(c)

whether the applicant, and any officer, manager or beneficial owner of the applicant, has adequate skills and experience and has acted and may be expected to act with probity.

(5)

Where the applicant is a money service business, the registering authority may, in determining the question in paragraph (1), take account of the opinion of the applicant as to whether any person referred to in paragraph (1)(d) is a fit and proper person to carry on the business.”

In addition to the HMRC Guidance considered in Part 4, HMRC also issued guidance entitled “The fit and proper test and HMRC approval: technical guidance” (“the F&P Guidance”). The version provided for the hearing was dated 14 August 2018; neither party sought to argue that it was different in any material respect at an earlier or later date.

The F&P Guidance begins by saying that “Most businesses supervised by HMRC for anti-money laundering purposes are subject to either the fit and proper test or approval requirements under the regulations”. Under the heading “the fit and proper test” it says that “HMRC carries out the fit and proper test as part of the money laundering supervision registration process for money services business…” and adds “you do not have to apply every year but if a new person joins your business they’ll have to take a test if it applies to them”.

Under the heading “who must apply”, the F&P Guidance defines “responsible persons” as being those who are:

The F&P Guidance links to separate online guidance which specifies that businesses must complete an MLR101 form to notify HMRC of a new responsible person who is required to satisfy the F&P test.

As set out in Part 3 of this judgment , Ms Chapman decided on 22 October 2020 that Reg 57(4) had been breached because BSEL had not notified HMRC within 30 days that Mr Garcia, Mr Furnival and Ms Dhillon had been appointed as responsible persons. She also:

I consider below the position of each of those individuals. I first make findings of fact, some of which were included in Part 3 but are repeated here for ease of reference. Other findings are additional.

It was HMRC’s case that Mr Garcia was required to be registered, and that Mr Salam shared responsibility for the failure to notify him to HMRC.

As the chief executive, Mr Salam had overall responsibility for the operations of the company, and for developing and executing the company’s business strategies. He carried out that role in large part by ensuring that he recruited appropriately skilled and experienced senior staff, to whom he gave the necessary leadership and direction. In relation to compliance and risk management, Mr Salam ensured that BSEL recruited MLROs, Heads of Global Compliance and heads of RAIC with the relevant experience and qualifications. Mr Salam is not a member of the RAC; that body reports to the Board.

BSEL’s policy was that the MLRO was responsible for notifying HMRC when a new responsible persons was appointed. When the MLRO changed, Mr Salam asked the new MLRO to check that all relevant compliance requirements had been met, and was assured on each occasion that this was the case.

Mr Garcia became BSEL’s Head of Global Compliance and Chief Information Officer in January 2017. At the time of his appointment, BSEL conducted a F&P assessment to assess his suitability for the job; obtained job references covering the last five years; carried out a DBS check and a credit check; Mr Garcia was also screened to ensure he was not on a sanctioned or politically exposed persons (“PEP”) list. Mr Garcia’s unchallenged evidence was that he had understood that the MLRO at the time, Mr Strathie, had completed the relevant HMRC and FCA/PSR approval forms and submitted them. He also said that the FCA had previously checked and confirmed he was a fit and proper person; Ms Toman relied on that statement as factually correct in her closing submissions.

I therefore find as facts that Mr Garcia had been given F&P status by the FCA; he completed all relevant forms when he joined BSEL; he understood that the MLRO had submitted the necessary forms to HMRC, and he was unaware of the breach until Ms Chapman contacted Ms Dhillon on 24 September 2020. Mr Garcia’s MLR101 was sent to HMRC on 29 September 2019.

Mr Garcia was the Head of Global Compliance, so it was plainly necessary for him to be notified under Reg 57(4). Although the FCA had already confirmed that he was a fit and proper person in relation to the PSR, HMRC is the relevant regulator for AML purposes. I was unable to find any provision, or any official guidance, which allows a person regulated by both bodies to rely on F&P clearance by the FCA, and I had no related submissions. I therefore find that there was a failure to notify HMRC within 30 days that Mr Garcia had joined the business, and that this was a breach of Reg 57(4).

Responsibility for the initial timely notification rested with Mr Strathie, who was the MLRO when Mr Garcia was appointed. However, responsibility for the continuing failure to notify rested with the subsequent MLROs, Mr Olayinka and Mr Kirby, each of whom were required by Mr Salam to check the compliance position when they took on the role.

Ms Toman submitted that Mr Salam was also responsible for the breach because he “didn’t adequately supervise the MLRO”. I do not accept this. Mr Salam was the chief executive. His role was to provide overall direction and leadership, and to ensure that appropriately qualified and experienced senior staff were appointed, and he carried out that responsibility. When a new MLRO was appointed, Mr Salam asked him to check that all relevant compliance requirements had been met, and was assured this was the case. It was not Mr Salam’s role to monitor whether an MLRO had sent each individual MLR101 to HMRC.

The parties disagreed on whether BSEL was required to notify Mr Furnival under Reg 57(4).

Mr Furnival joined BSEL in July 2018 when the MLRO was Mr Olayinka. He was BSEL’s Chief Operating Officer (“COO”) and a member of its Management Committee. In reliance on BSEL’s corporate governance document I find that the role of the Management Committee was as follows:

“The Management Committee (MANCOM) meets monthly and is a key sub-committee which ensures that all department heads are aware of and can
contribute to any areas of risk, opportunity or challenge which the company is facing.”

The Management Committee was made up of the Managing Director, the Head of Global Compliance, the MLRO, the Head of Finance, the Head of RAIC, the COO, the Manager of International Relationships, the Head of UK Sales, the Manager for Collection, Recovery and Communication, the Manager of Business Systems and the Head of Foreign Exchange and Fund Management.

BSEL accepted that Mr Furnival was “a key member of the senior management team”. He reported to Mr Salam; his role was to run the operations, marketing, sales, HR and business development teams. He was not involved in managing compliance, risk and audit, or finance functions.

Shortly before Mr Furnival’s appointment, Exiger produced their first report. One of their recommendations was that:

“The terms of reference for the RAC should be extended to
include a suitably senior member of the business. A good candidate for
inclusion would be incoming the Chief Operating Officer [sic] who is expected to be appointed soon. This will help to ensure that the business, which ultimately owns the financial crime risk, is properly represented at the RAC.”

BSEL responded by saying that “the COO who joined on 15 July will be part of the RAC as recommended”. As set out at §207, RAC’s role was to oversee BSEL’s AML/CTF governance and provide oversight of the compliance function. Mr Furnival’s evidence was that he joined to provide information as to the business and operational consequences of policy decisions, and not because he had any knowledge of AML or compliance. I accept that evidence, which was consistent with Exiger’s recommendation that he join the RAC to represent the business.

On 24 September 2020, Ms Chapman informed Ms Dhillon that Mr Furnival was required to be “fit and proper tested” and he completed the MLR101 on 28 September 2020. The form was submitted on the following day.

Ms Toman submitted that Mr Furnival was an officer of BSEL, because he was a member of BSEL’s Management Committee. Mr Furnival denied that he was an officer. I decided, for the reasons given later in this judgment (see §969) in the context of his Prohibition Decision, that he was not an officer.

HMRC’s alternative argument was that Mr Furnival was s a manager “engaged directly in the provision of regulated activity” because of his role on the RAC. Mr Furnival’s position was that he was not “routinely involved” in BSEL’s AML/CTF PCPs, see the F&P Guidance at §354(3).

The RAC is a permanent committee which reports to the Board. As set out at §208, its role was “to provide assurance on the adequacy and effectiveness of the company’s system of internal controls” and it was “responsible for understanding BSEL’s major risk areas and ensuring that appropriate internal controls are in place to manage the risk exposure”. Although Mr Furnival had joined the RAC to represent the business, I agree with HMRC that by virtue of his position on that committee, he was “routinely involved” in BSEL’s AML/CTF PCPs. I therefore agree with Ms Chapman that Mr Furnival should have been notified under Reg 57(4).

Ms Dhillon was recruited by Mr Kirby as Deputy MLRO. The Tribunal was not given the date she joined BSEL, but it is clear from the documents in the Bundle that she completed a compliance training course on 3 February 2020 and it is reasonable to infer that she had joined the business shortly before that date. She was furloughed from 1 April 2020 to 30 June 2020. On 6 August 2020 she replaced Mr Kirby as BSEL’s MLRO on a temporary basis.

Before the end of August 2020, Ms Dhillon tried to make her F&P registration online, but was denied access to the relevant part of HMRC’s system. She emailed BSEL’s contact in HMRC’s Large Traders Team for assistance, but received no reply. On 16 September 2020, Ms Chapman emailed Ms Dhillon to ask if she had submitted her MLR101, and Ms Dhillon replied on the following day, saying:

“We have been in the process of getting myself registered but I believe there have been some queries we have gone back to HMRC with and are yet awaiting a response from them.”

Ms Chapman followed up internally, and on the same day, 17 September 2020, a Ms Ingham from the Large Traders Team contacted Ms Dhillon: told her that she needed to complete a form and email it, rather than using the online portal, and she attached a copy of the MLR101. Ms Dhillon completed the form on 27 September 2020, the day before she handed over the MLRO role to Mr Curran: her form was submitted to HMRC on 29 September 2020.

Ms Dhillon was the deputy MLRO from her appointment in January 2020, and was acting MLRO from 6 August 2020. Ms Chapman decided Ms Dhillon should have been notified with effect from the latter date. I have therefore taken it that Ms Chapman accepted that Ms Dhillon was not a “senior manager” until she took on the MLRO role, see the F&P Guidance at §354(3).

Ms Dhillon was therefore required to be registered within 30 days of 5 August 2020. However, when she tried to register, she was denied access to the relevant part of HMRC’s system; she tried to resolve this by emailing her contact in the Large Trader Team, but received no reply until Ms Chapman intervened.

Reg 57(4) provides that the relevant information is to be provided within 30 days “or within such later time as may be agreed with the registering authority”. HMRC might reasonably have exercised that discretion in a case such as this, where a person had tried to make contact in advance of the deadline to resolve a difficulty, but had received no reply from HMRC. However, Ms Chapman did not take that position in Ms Dhillon’s case. Instead, she decided that the failure to notify within the 30 day period was a breach of Reg 57(4). As HMRC did not exercise their discretion to grant an extension, there was a breach. Responsibility for the late notification rested with Ms Dhillon as she was the Nominated Officer.

Mr Hashmi was the Head of Risk and Internal Control, and Mr Curran the new MLRO, so both had to be notified to HMRC. Mr Hashmi joined BSEL on 1 September 2020 and his MLR101 was submitted to HMRC on 29 September 2020. Mr Curran joined on 28 September 2020 and completed an MLR101 form on 30 September 2020, which was submitted to HMRC on 7 October 2020.

Ms Chapman said Ms Dhillon had notified Mr Curran and Mr Hashmi within the 30 days “only after being prompted in an email from HMRC”. I do not accept that. It is clear from the contemporaneous evidence of Ms Dhillon’s emails that she had already contacted HMRC about making her own notification, and I reject the inference that Ms Dhillon only notified Mr Curran and Mr Hashmi because of an email from Ms Chapman.

Ms Chapman checked the Companies House website to identify BSEL’s directors and officers, and having done so, she incorrectly identified not only Mr Ahmad as not having been notified to HMRC, but also Mr Hussein, one of BSEL’s other two directors, see §271.

Ms Chapman has not said that there was any other failure to comply with the Reg 57(4) notification requirement in relation to other responsible persons. I make the reasonable inference that, having carried out that Companies House research, Ms Chapman would have informed BSEL had she identified any other failures, and these would have been taken into account in her Decisions. Moreover, it was clearly part of BSEL’s policy that the MLRO should notify HMRC when a new responsible person was appointed. I therefore find as a fact that all other responsible persons had been notified as required by Reg 57(4).

Ms Chapman said in the Suspension Decision that BSEL had demonstrated “a consistent failure” to comply with the Regulations by:

Of the three relevant individuals notified late, Ms Dhillon had made contact with HMRC before the deadline and was awaiting a response, a situation which might reasonably have been expected to result in an extension of the deadline. Mr Garcia’s F&P status had already been confirmed by the FCA, and he reasonably believed that any further relevant checks had been carried out by the MLRO. Mr Furnival was required to be registered because of his role on the RAC, and not because of his day-to-day responsibilities. There were no other failures, and both Mr Curran and Mr Hashmi were notified before the due date. I find that BSEL did not “consistently fail” to comply with Reg 57(4).

Ms Chapman states in the Cancellation Decision that BSEL’s breaches of the MLR were “deliberate”. It is clear from the above findings of fact that the failure to notify Mr Garcia, Mr Furnival and Ms Dhillon by the due dates was not “deliberate”. Ms Dhillon tried to file online before the deadline but was unable to do so, and HMRC failed to reply to her request for assistance. There is no evidence that BSEL acted deliberately in relation to either Mr Garcia or Mr Furnival. On the contrary, BSEL had a policy which required the MLROs to notify all responsible persons. Given the existence of that policy and the very small number of failures, I find that the MLROs failed to notify HMRC of Mr Garcia and Mr Furnival by oversight and the failures were not deliberate.

I find that there was a breach of Reg 57(4) in relation to Mr Garcia and Mr Furnival. There was also a breach in relation to Ms Dhillon, but she had tried to HMRC failed to reply to her email. There was no consistent breach and no deliberate breach.

The other reason for the Suspension Decision was that Ms Chapman also decided BSEL had breached Reg 19(1)(a) by reference to Reg 33(1)(a), because since “at least” February 2018 BSEL’s PCPs had failed to treat all transactions with Pakistan and Bangladesh as requiring EDD; instead, BSEL had set a threshold below which only CDD was required.

This Part is structured as follows:

Regulation 4 defines “business relationship” as:

“a business, professional or commercial relationship between a relevant person and a customer, which—

(a)

arises out of the business of the relevant person, and

(b)

is expected by the relevant person, at the time when contact is established, to have an element of duration.”

Regulation 27 is headed “Customer due diligence” and the first paragraph reads:

“A relevant person must apply customer due diligence measures if the person—

(a)

establishes a business relationship;

(b)

carries out an occasional transaction that amounts to a transfer of funds within the meaning of Article 3.9 of the funds transfer regulation exceeding 1,000 euros;

(c)

suspects money laundering or terrorist financing; or

(d)

doubts the veracity or adequacy of documents or information previously obtained for the purposes of identification or verification.”

Regulation 28 is headed “Customer due diligence measures” and begins:

“(1)

This regulation applies when a relevant person is required by regulation 27 to apply customer due diligence measures.

(2)

The relevant person must—

(a)

identify the customer unless the identity of that customer is known to, and has been verified by, the relevant person;

(b)

verify the customer's identity unless the customer's identity has already been verified by the relevant person; and

(c)

assess, and where appropriate obtain information on, the purpose and intended nature of the business relationship or occasional transaction.”

It is thus clear that if there is a “business relationship” between BSEL and its customers, it is required to apply CDD to all transactions, but if there is no business relationship, it has only to apply CDD to “occasional transactions” of more that €1,000.

The HMRC Guidance at para 4.13 gives the following examples of a “business relationship”:

“• another money service business is your customer

• you set up a customer account

• there's a contract to provide regular services

• you give preferential rates to repeat customers

• any other arrangement [which] facilitates an ongoing business relationship or repeat custom, such as providing a unique customer identification number for the customer to use.”

The parties agreed that BSEL had a business relationship with its agents and aggregators. The issues to be decided were whether BSEL had a business relationship with the following, each of which is considered below:

Mr Garcia understood there to be no business relationship with any customers, because (a) each person could choose whether to use BSEL or whether to use a competitor MSB, and (b) this had been confirmed by Eversheds (as to which see §433 below) and (c) Exiger and Eversheds had consistently confirmed that the aggregators’ customers were not BSEL’s customers. I find that to be his honest belief, for the reasons he gave.

Ms Toman submitted that BSEL had a “business relationship” with its customers because that relationship had the necessary element of duration. She relied on the last of the bullet points in HMRC’s list of examples, namely that it was “any other arrangement [which] facilitates an ongoing business relationship or repeat custom, such as providing a unique customer identification number for the customer to use”.

Mr Lakha submitted that there was no business relationship because:

My starting point is the statutory definition in Reg 4, which has two parts. The first requires there to be a business or commercial “relationship”. According to the Oxford English Dictionary, the primary meaning of a “relationship” is “the state or fact of being related; the way in which two things are connected; a connection, an association”. The word therefore has a wide meaning, and the usages cited in the OED indicate a low threshold. Applying that definition, there is plainly a “connection” or an “association” between BSEL and a direct customer.

The second part of Reg 4 requires that the relationship “is expected by the relevant person, at the time when contact is established, to have an element of duration”. It is clear from the italicised words that this must be seen from BSEL’s perspective, not that of the customer. In my judgement, BSEL does have an expectation that the customers are likely to return, for the following reasons:

I therefore find that BSEL has a business relationship with its direct customers.

Jowett’s Dictionary of English Law (5^th ed) defines “agency” as “the legal relationship that arises when one person (the agent) has the authority to act for another (the principal)”. It follows that customers who transact with an agent are transacting with BSEL. The HMRC Guidance reflects this when it says at para 9.6 that an MSB acting as principal “is the party that contracts with a customer through its agent and owns and is responsible for the transaction”. BSEL therefore has a business relationship with customers who transact through its agents, just as it has a business relationship with its direct customers.

I found this a difficult issue, on which neither side provided submissions. As set out at §195, aggregators are APIs who may operate from a single location, through branches or via agents, or they may be purely digital businesses offering electronic, non-cash services. They take money from their own customers and transfer it to BSEL, which in turn transfers the money to its destination in Pakistan or Bangladesh using its bank account with Barclays. The simple answer is thus that customers have a business relationship with the aggregators, who in turn have a business relationship with BSEL.

However, that simple answer was difficult to fit with the documentation in the Bundle. BSEL has a standard “Aggregator Agreement” with its aggregators, but no copy of that agreement was provided to the Tribunal. The Bundle did include BSEL’s Aggregator Policy, which says that the relationship between BSEL and its aggregators was governed by Reg 39. That provision is headed “Reliance” and provides:

“(1)

A relevant person may rely on a person who falls within paragraph (3) (‘the third party’) to apply any of the customer due diligence measures required by regulation 28(2) to (6) and (10) but, notwithstanding the relevant person's reliance on the third party, the relevant person remains liable for any failure to apply such measures.

(2)

When a relevant person relies on the third party to apply customer due diligence measures under paragraph (1) it—

(a)

must immediately obtain from the third party all the information needed to satisfy the requirements of regulation 28(2) to (6) and (10)…in relation to the customer, customer's beneficial owner, or any person acting on behalf of the customer;

(b)

must enter into arrangements with the third party which—

(i)

enable the relevant person to obtain from the third party immediately on request copies of any identification and verification data and any other relevant documentation on the identity of the customer, customer's beneficial owner, or any person acting on behalf of the customer;

(ii)

require the third party to retain copies of the data and documents referred to in paragraph (i) for the period referred to in regulation 40.

(3)

The persons within this paragraph are—

(a)

another relevant person who is subject to these Regulations under regulation 8;…”

Reg 39 thus imposes specific requirements in relation to reliance on third parties acting as such, ie who are not acting as agents. It also allows relevant persons (such as BSEL) to rely on another relevant person (such as an aggregator which is also an API) to carry out CDD or EDD as required by Reg 28. But BSEL is only required to carry out CDD and EDD if it has a business relationship with the customer; in other words, Reg 39 allows a relevant person to delegate the carrying out of CDD and EDD in relation to its own customers. The Aggregator Policy correctly summarises the effect of Reg 39 when it says:

“Reliance is where BSEL may agree to rely on the CDD undertaken by a third
party. Where appropriate, BSEL may rely on a third party to conduct CDD on BSEL’s part. Any agreement must be in writing and the requirements are set out in the regulations. The third party must consent to being relied upon.
In these circumstances, BSEL continues to be liable for any failure in relation to CDD/EDD. i.e. BSEL can outsource responsibility, but not accountability.”

The Aggregator Policy also says (my emphasis):

“The legal basis of the relationship and responsibilities of the parties are
detailed in the Aggregator Agreement and are subject to the law of agency
in England and Wales.”

Under the heading “Agency/Aggregator Agreement Model”, the Aggregator Policy reads:

“The use of the agency model is widespread in the MSB sector. Law of Agency applies - where the agent is authorised to act on behalf of the principal. The arrangements between the agent/aggregator and the principal is set out
in an agency/aggregator agreement. An agent/aggregator who acts within the scope of authority conferred by their principal binds the principal in the obligations the agent/aggregator creates with third parties. The agent/aggregator binds the principal to perform the service the customer has paid for.”

The above passages were the only evidence before the Tribunal which set out BSEL’s understanding of its relationship with the aggregators, and I thus conclude that the aggregators were acting as agents for BSEL. As a result, the aggregator is acting on BSEL’s behalf, and a business relationship exists between BSEL and the aggregator’s customer.

HMRC’s position on this was not entirely clear, see Ms Toman’s submissions in the context of EDD at §424 below. The Appellants’ position was that they had no business relationship with the beneficiaries.

I agree with the Appellants. It is clear on the facts that BSEL does not have a “relationship” with the beneficiaries: it does not make contact with the beneficiary at all. Instead, it transfers the money to a bank overseas; the beneficiaries access the funds by visiting a branch of that bank or by accessing their account with that bank, see §189.

For the reasons set out above, BSEL has a business relationship within the meaning of the MLR with its UK customers, including those who transact with agents and aggregators, but does not have a business relationship with the beneficiaries.

Regulation 19 is headed “Policies, controls and procedures”. The paragraphs in issue were not changed by 5MLR; they read:

“(1)

A relevant person must—

(a)

establish and maintain policies, controls and procedures to mitigate and manage effectively the risks of money laundering and terrorist financing identified in any risk assessment undertaken by the relevant person under regulation 18(1);…

….

(3)

The policies, controls and procedures referred to in paragraph (1) must include—

(a)-(b)…;

(c)

customer due diligence (see regulations 27 to 38);…

(4)

…

(5)

In determining what is appropriate or proportionate with regard to the size and nature of its business, a relevant person may take into account any guidance which has been—

(a)

issued by the FCA; or

(b)

issued by any other supervisory authority or appropriate body and approved by the Treasury….”

Regulation 33 is headed “Obligation to apply enhanced customer due diligence”. In the period before the amendments introduced by 5MLD, it read as follows:

“(1)

A relevant person must apply enhanced customer due diligence measures and enhanced ongoing monitoring, in addition to the customer due diligence measures required under regulation 28 and, if applicable, regulation 29, to manage and mitigate the risks arising—

(a)

in any case identified as one where there is a high risk of money laundering or terrorist financing—

(i)

by the relevant person under regulation 18(1), or

(ii)

in information made available to the relevant person under regulations 17(9) and 47;

(b)

in any business relationship or transaction with a person established in a high-risk third country;

(c)

- (f) …

(g)

in any other case which by its nature can present a higher risk of money laundering or terrorist financing…

(3)

For the purposes of paragraph (1)(b), a ‘high-risk third country’ means a country which has been identified by the European Commission in delegated acts adopted under Article 9.2 of the fourth money laundering directive as a high-risk third country…

(4)

…

(5)

Depending on the requirements of the case, the enhanced customer due diligence measures required under paragraph (1) may also include, among other things—

(a)

seeking additional independent, reliable sources to verify information provided or made available to the relevant person;

(b)

taking additional measures to understand better the background, ownership and financial situation of the customer, and other parties to the transaction;

(c)

taking further steps to be satisfied that the transaction is consistent with the purpose and intended nature of the business relationship;

(d)

increasing the monitoring of the business relationship, including greater scrutiny of transactions.

(6)

When assessing whether there is a high risk of money laundering or terrorist financing in a particular situation, and the extent of the measures which should be taken to manage and mitigate that risk, relevant persons must take account of risk factors including, among other things—

(a)

customer risk factors, including whether—

(i)

the business relationship is conducted in unusual circumstances;
(ii) the customer is resident in a geographical area of high risk (see sub-paragraph (c));

(iii)

the customer is a legal person or legal arrangement that is a vehicle for holding personal assets;

(iv)

the customer is a company that has nominee shareholders or shares in bearer form;

(v)

the customer is a business that is cash intensive;

(vi)

the corporate structure of the customer is unusual or excessively complex given the nature of the company’s business;

(b)

product, service, transaction or delivery channel risk factors, including whether—

(i)

the product involves private banking;

(ii)

the product or transaction is one which might favour anonymity;

(iii)

the situation involves non-face-to-face business relationships or transactions, without certain safeguards, such as electronic signatures;

(iv)

payments will be received from unknown or unassociated third parties;

(v)

new products and new business practices are involved, including new delivery mechanisms, and the use of new or developing technologies for both new and pre-existing products

(vi)

the service involves the provision of nominee directors, nominee shareholders or shadow directors, or the formation of companies in a third country;

(c)

geographical risk factors, including—

(i)

countries identified by credible sources, such as mutual evaluations, detailed assessment reports or published follow-up reports, as not having effective systems to counter money laundering or terrorist financing;

(ii)

countries identified by credible sources as having significant levels of corruption or other criminal activity, such as terrorism (within the meaning of section 1 of the Terrorism Act 2000, money laundering, and the production and supply of illicit drugs;

(iii)

countries subject to sanctions, embargos or similar measures issued by, for example, the European Union or the United Nations;
(iv) countries providing funding or support for terrorism;

(v)

countries that have organisations operating within their territory which have been designated—

(aa) by the government of the United Kingdom as proscribed organisations under Schedule 2 to the Terrorism Act 2000, or

(bb) by other countries, international organisations or the European Union as terrorist organisations;

(vi)

countries identified by credible sources, such as evaluations, detailed assessment reports or published follow-up reports published by the Financial Action Task Force, the International Monetary Fund, the World Bank, the Organisation for Economic Co-operation and Development or other international bodies or non-governmental organisations as not implementing requirements to counter money laundering and terrorist financing that are consistent with the recommendations published by the Financial Action Task Force in February 2012 and updated in October 2016.

(7)

In making the assessment referred to in paragraph (6), relevant persons must bear in mind that the presence of one or more risk factors may not always indicate that there is a high risk of money laundering or terrorist financing in a particular situation….”

Reg 33(1)(a)(ii) cross-refers to Reg 17(9) and Reg 47. The first of those provisions does not apply on the facts of this case, but the second is headed “Duties of supervisory authorities: information” and until Brexit it read as follows. After IP completion day on 31 December 2020, subparagraphs (3)(a) to (e) were revoked.

“(1)

A supervisory authority must, in any way it considers appropriate, make up-to-date information on money laundering and terrorist financing available to those relevant persons which it supervises (“its own sector”).

(2)

The information referred to in paragraph (1) must include the following—

(a)

information on the money laundering and terrorist financing practices considered by the supervisory authority to apply to its own sector;

(b)

a description of indications which may suggest that a transfer of criminal funds is taking place in its own sector;

(c)

a description of the circumstances in which the supervisory authority considers that there is a high risk of money laundering or terrorist financing.

(3)

The information referred to in paragraph (1) must also include information from the following sources which the supervisory authority considers is relevant to its own sector—

(a)

reports drawn up by the European Commission under Article 6.1 of the fourth money laundering directive;

(b)

recommendations made by the European Commission under Article 6.4 of that directive (unless the Treasury and the Home Office notify the supervisory authority that a recommendation will not be followed);

(c)

joint opinions issued by the European Supervisory Authorities under Article 6.5 of that directive;

(d)

high-risk third countries identified in delegated acts adopted by the European Commission under Article 9.2 of the fourth money laundering directive;

(e)

guidelines issued by the European Supervisory Authorities under Articles 17, 18.4, or 48.10 of that directive;

(f)

the report prepared by the Treasury and the Home Office under regulation 16(6);

(g)

any relevant information made available by the Treasury and the Home Office under regulation 16(8);

(h)

any relevant information published by the Director General of the NCA under section 4(9) (operations) or 6 (duty to publish information) of the Crime and Courts Act 2013.”

From those lengthy provisions, the following points are particularly relevant:

Ms Toman submitted that Reg 33(1)(a)(ii) required EDD where information made available” by HMRC or the NAC identified the case as high risk, and that was the position here. She relied on the following:

Mr Lakha did not accept that EDD was required by that guidance, and I agree. The first of the citations relied on by Ms Toman is from Chapter 10 of the HMRC Guidance. That Chapter opens by saying that it is setting out “examples of common risk indicators”; that the signs listed in the Chapter are not always suspicious, but “it depends on the circumstances of the case”. That guidance is also given in the context of the overall approach at Chapter 3, namely that the relevant person is required to carry out its own risk-based approach and use its informed judgement.

At the relevant time, there was no statutory requirement that all transactions with Pakistan required EDD. Instead, as the EU Guidance said “Firms should apply additional EDD measures in those situations where this is commensurate to the ML/TF risk they have identified”. That is what BSEL had done. There is more about BSEL’s risk assessment at Part 6 in the context of Reg 18.

Although the NRA did identify money services as high risk, it also said that this should be “managed on a case-by-case basis”, and noted in particular the difference between large MSBs with sophisticated compliance and systems (such as BSEL) and smaller businesses.

Nothing in the HMRC Guidance or the NRA 2017 required all cash transactions, or all transactions with agents, to be classified as high risk: as the Explanatory Memorandum to the amending regulations said, “the MLRs are deliberately not prescriptive, providing flexibility in order to promote a proportionate and effective risk based approach” and the EU Guidance stated:

“Firms should take a holistic view of the risk associated with the situation and note that, unless Directive (EU) 2015/849 or national legislation states otherwise, the presence of isolated risk factors does not necessarily move a relationship into a higher or lower risk category.”

Ms Toman also submitted that when assessing the risks, BSEL should have reclassified transaction risk when it received Eversheds’ 2019 audit report (see §248). Mr Lakha made the following submissions, with which I agree:

Although not referred to by Ms Chapman in either the Suspension Decision or the Cancellation Decision, Ms Toman also submitted that BSEL had breached Reg 33(1)(b) on the basis that EDD was required “in any business relationship or transaction with a person established in a high-risk third country”.

Again, I do not agree. Although the beneficiaries were established in Pakistan, which was a high-risk third country, BSEL does not have a business relationship with the beneficiaries for the reasons set out at §411. BSEL also does not transact with those beneficiaries; it simply arranges for cash to be transferred to a bank in that country.

Reg 33(1)(g) extends EDD to “any other case which by its nature can present a higher risk of money laundering or terrorist financing”. This subparagraph also formed no part of the Suspension Decision or the Cancellation Decision, but was relied on by Ms Toman. I reject that submission, for the following reasons:

For the reasons set out above, I find that BSEL did not breach Reg 33 in the period before the implementation of 5MLR. In coming to that conclusion, I note that it was also the view of Exiger, who in their 2018 report specifically recorded and approved both (a) the categorisation of transactions below £2,000 as “low risk” and (b) the CDD checks which BSEL carried out on those transactions; it was also the view of Eversheds, who in their April 2019 audit report concluded that “the CDD and EDD thresholds are appropriate and in compliance with BSEL’s legal and regulatory obligations”.

I next consider the position in the period from implementation of 5MLD to the changes notified to Ms Chapman on 5 November 2020, and in particular, the change to verification of occupation and income which went live on 10 November 2020.

By 5MLD, Reg 33 was amended as follows (here was no change to Reg 33(5) to (7)):

“(1)

A relevant person must apply enhanced customer due diligence measures and enhanced ongoing monitoring, in addition to the customer due diligence measures required under regulation 28 and, if applicable, regulation 29, to manage and mitigate the risks arising—

(a)

in any case identified as one where there is a high risk of money laundering or terrorist financing—

(i)

by the relevant person under regulation 18(1), or

(ii)

in information made available to the relevant person under regulations 17(9) and 47;

(b)

in any business relationship with a person established in a high-risk third country or in relation to any relevant transaction where either of the parties to the transaction is established in a high-risk third country

(c)

…

(d)

if a relevant person has determined that a customer or potential customer is a PEP, or a family member or known close associate of a PEP (in accordance with regulation 35);

(2)

…

(3)

For the purposes of paragraph (1)(b)—

(a)

a “high-risk third country” means a country which has been identified by the European Commission in delegated acts adopted under Article 9.2 of the fourth money laundering directive as a high-risk third country (Footnote: ¹);

(b)

a “relevant transaction” means a transaction in relation to which the relevant person is required to apply customer due diligence measures under regulation 27;

(c)

being “established in” a country means—

(i)

in the case of a legal person, being incorporated in or having its principal place of business in that country, or, in the case of a financial institution or a credit institution, having its principal regulatory authority in that country; and

(ii)

in the case of an individual, being resident in that country, but not merely having been born in that country.

(3A)     The enhanced due diligence measures taken by a relevant person for the purpose of paragraph (1)(b) must include—

(a)

obtaining additional information on the customer and on the customer's beneficial owner;

(b)

obtaining additional information on the intended nature of the business relationship;

(c)

obtaining information on the source of funds and source of wealth of the customer and of the customer's beneficial owner;

(d)

obtaining information on the reasons for the transactions;

(e)

obtaining the approval of senior management for establishing or continuing the business relationship;

(f)

conducting enhanced monitoring of the business relationship by increasing the number and timing of controls applied, and selecting patterns of transactions that need further examination.”

Reg 33(1)(b) was therefore rewritten, so that EDD was required not only in any business relationship with a person established in a high-risk third country but also “in relation to any relevant transaction where either of the parties to the transaction is established in a high-risk third country”.

In this case, one of the parties to the transactions (the beneficiary) is established in Pakistan. The key question is thus whether there is a “relevant transaction”. That term defined at Reg 33(2)(b) as “a transaction in relation to which the relevant person is required to apply customer due diligence measures under regulation 27”. As already set out but repeated for ease of reference, Reg 27(1) says:

“A relevant person must apply customer due diligence measures if the person—

(a)

establishes a business relationship;

(b)

carries out an occasional transaction that amounts to a transfer of funds within the meaning of Article 3.9 of the funds transfer regulation exceeding 1,000 euros;…”

I have already decided at §413 that BSEL has a business relationship with its direct customers and those transacting through UK agencies and aggregators, and thus that it is required to apply CDD to all its transactions. The transactions are therefore “relevant transactions” and it follows that BSEL was required to apply EDD to all transactions with Pakistan from 10 January 2020 when the revised version of Reg 33 came into force.

My conclusion differs from that of Eversheds, who advised BSEL on 5 November 2020 (see §284) that it was only required to apply EDD in relation to transactions above €1,000, in other words, on the basis that they were carrying out “occasional transactions”. Since I have found that BSEL has a business relationship with its UK customers; the occasional transaction threshold is irrelevant.

My conclusion also differs from that of Ms Chapman, who decided that BSEL had breached Reg 33(1)(a), whereas I have found that it breached Reg 33(1)(b). But the outcome is the same: I agree with Ms Chapman that for this period, BSEL was required to apply EDD to all its transactions with Pakistan.

Para (3A) opens by saying that “the enhanced due diligence measures taken by a relevant person for the purpose of paragraph (1)(b) must include”, and this is then followed by a list of measures. This new provision is in addition to para (3), which as before says that “Depending on the requirements of the case, the enhanced customer due diligence measures required under paragraph (1) may also include, among other things…”.

Given that para (3A) begins with a “must”, I considered whether each of the EDD measures there specified were required. I noted that:

It is however clear that some of the items on the list cannot be applied to all relevant persons: for example, the references to “the customer’s beneficial owner” is inapplicable to individuals, and the requirement to obtain “additional information on the intended nature of the business relationship” is not applicable to an MSB such as BSEL because the nature of the business relationship is to send funds overseas, and no additional relevant information could be provided. It would also be surprising if the senior management of an MSB such as BSEL had to check every single customer transacting with Pakistan, to see whether or not to continue that particular business relationship, rather than being able to rely in at least some cases on information already obtained about its customer base, and about the nature and type of the transactions.

The HMRC Guidance says at 4.42: “If enhanced due diligence is appropriate, then you must do more to verify identity and scrutinise the background and nature of the transactions than for standard customer due diligence. How this goes beyond standard due diligence must be made clear in your risk assessment and procedures”. It then sets out a bullet point list of examples. When the guidance was updated for 5MLD, in April 2020, a new bullet point has been added which transcribes Reg 33(3A), including the list of specified measures, again without using “and” or “or” after each one. I have thus taken it that HMRC also do not consider that Reg 33 requires that every one of these measures be applied by each relevant person, because if so, HMRC would have said so clearly, and they have not done so.

Taking into account that it is not possible or realistic to apply each of the measures to every relevant person, together with the approach taken in the 2020 edition of the HMRC Guidance, I find that it is mandatory to comply with at least one of the Reg 33(3A) measures, but not with all of them.

As set out in Part 1 of this judgment, on 22 January 2020 Mr Kirby signed off the document entitled “MLRO Approval - CDD and EDD threshold conditions 5^th MLD” by which he reduced the threshold for Pakistan from £5,000 to £2,000 for cash, and to £3,000 for electronic bank transfers; in either case the threshold applied whether there had been a single transaction or a cumulative total over 30 days. For transactions under that threshold, customers had only to provide proof of identity in order to meet the CDD requirement. It followed that EDD was not required for all transactions with Pakistan, and none of the mandatory requirements of Reg 33(3A) were met.

I therefore find that in the period from 10 January 2020 to 10 November 2020, BSEL was in breach of Reg 19(3)(b) because it did not introduce EDD for all transactions with Pakistan.

Mr Kirby was the MLRO at the time, and he formally approved the changes to BSEL’s procedures. As MLRO, part of his role was to ensure that the policies and procedures to combat money laundering and terrorist financing were up to date. Ms Chapman and Mr McLean were both asked in cross-examination whether HMRC had taken any action against Mr Kirby. Ms Chapman’s response was that she had not done so because Mr Kirby had left BSEL by the time of the Cancellation Decision; Mr McLean said he was “only looking at what is happening now”, in other words, he was focused on the review of the Individual Appellants which he had been instructed to carry out.

As is clear from the foregoing, BSEL was required to implement EDD on all transactions with Pakistan from 10 January 2020. From 10 November 2020, BSEL introduced verification of occupation and income from customers transacting with Pakistan, with documented proof such as recent payslips, bank statements or P60s, see §292 at box 4.

One of the mandatory EDD requirements at Reg 33(3A) is “obtaining information on the source of funds”. Consistent with that requirement, by the Reinstatement Decision Ms Chapman accepted that providing third party evidence of source of funds was sufficient to meet the EDD requirements of Reg 33.

At the hearing Ms Toman explicitly confirmed on behalf of HMRC that this was the position, and that BSEL’s breach of Reg 33 had been remedied before the date of the Reinstatement Decision. It is not necessary for the purposes of this judgment for me to express a view on whether BSEL could have satisfied Reg 33 by introducing a form of EDD other than proof of source of funds.

In the Suspension Decision, Ms Chapman also decided BSEL had breached Reg 19(1)(a) by reference to Reg 33 in relation to transactions with Bangladesh.

During the period before the implementation of 5MLD, BSEL had classified Bangladesh as a high-risk country, and so the analysis set out at §419ff above in relation to Pakistan also applies to Bangladesh. In summary, BSEL was entitled to rely on its own risk-based approach in deciding whether EDD was required, and there was no breach of the MLR.

When the law changed on 10 January 2020, Reg 33(3)(a) defined Pakistan (but not Bangladesh) as a high risk country which required EDD. The legal position in relation to Bangladesh was thus unchanged. The HMRC Guidance was also the same: the relevant person was still required to carry out its own risk-based approach and use its informed judgement, with Chapter 10 setting out examples of common risk indicators. There was thus no breach of the MLR.

In October 2020, following FATF’s reassessment, BSEL reclassified Bangladesh as medium-risk (see §287). By the Reinstatement Decision, Ms Chapman accepted that EDD was not required because Bangladesh was no longer a high risk jurisdiction.

In relation to transactions with Pakistan, BSEL was in breach of Reg 19(1) read with Reg 33(1)(b) for the period from 10 January 2020 to 10 November 2020, when the breach was remedied. In relation to transactions with Bangladesh, there was no breach.

The Cancellation Decision was made under Reg 60, which reads:

“(1)

If paragraph (2) applies, the registering authority may suspend (for such period as it considers appropriate) or cancel—

(a)

the registration of a money service business or a trust or company service provider in a register maintained under regulation 54…

(2)

This paragraph applies if, at any time after registration, the registering authority is satisfied that—

(a)

the money service business…

is not a fit and proper person for the purposes of regulation 58.”

As set out at §351, Reg 58 requires that when deciding whether or not a person is “fit and proper”, HMRC must have regard to whether the person has “consistently failed to comply” with the MLR; the risk that the business may be used for MLTF, and whether the business, and any of its officers, managers or beneficial owners, has “adequate skills and experience and has acted and may be expected to act with probity”.

Ms Chapman’s reasons for the Cancellation Decision were as follows:

This Part 6 of the judgment considers the second and third of those reasons. The first and fourth are at Part 7, which discusses the Personal Decisions.

Attached to the Cancellation Decision was the ToF, which set out in more detail why Ms Chapman had decided BSEL was not a “fit and proper person” by reference to particular provisions of the MLR. Both the Personal Decisions and the Prohibition Decisions are also based on the matters set out in the ToF.

I have therefore first considered each of the issues set out in the ToF, and then any additional points made in the Cancellation Decision, see §871ff. Because the Cancellation Decision depends not only on Ms Chapman’s conclusions in relation to BSEL, but also on the Personal Decisions, it is not possible to decide whether to uphold or set aside the Cancellation Decision until the Personal Decisions have been considered. As a result, my conclusion on the Cancellation Decision is at the end of Part 7.

Reg 18 begins as follows:

“(1)

A relevant person must take appropriate steps to identify and assess the risks of money laundering and terrorist financing to which its business is subject.

(2)

In carrying out the risk assessment required under paragraph (1), a relevant person must take into account—

(a)

information made available to them by the supervisory authority under regulations 17(9) and 47, and

(b)

risk factors including factors relating to—

(i)

its customers;

(ii)

the countries or geographic areas in which it operates;

(iii)

its products or services;

(iv)

its transactions; and

(v)

its delivery channels.

(3)

In deciding what steps are appropriate under paragraph (1), the relevant person must take into account the size and nature of its business.”

Reg 18 therefore requires a relevant person to assess the risks of MLTF. A “relevant person” is a person who is required to comply with the MLR, see Reg 3 read with Reg 8. Such persons include financial institutions, defined by Reg 10(2)(a) to include most MSBs. It was common ground that BSEL was a “relevant person”.

Reg 18(2) requires that, when carrying out its risk assessment, a relevant person must take into account “information made available to them by the supervisory authority under regulations 17(9) and 47”. Reg 17(9) is not relevant on the facts; Reg 47 is at §416. It sets out the type of information which the supervisory authority must provide, and requires that authority to take into account information and guidelines relevant to its own sector from Treasury and the Home Office; from the NCA, and from various EU sources.

Ms Chapman decided that BSEL had failed to comply with Reg 18(2)(a) because, having taken into account the HMRC Guidance and the NRA 2017, it should have assessed all its products, transactions and delivery channels as “high risk”, and had not done so. In particular, she considered that BSEL had wrongly assessed transactions as “low risk” despite the majority of those transactions being in cash. Relevant extracts from the HMRC Guidance and the NRA 2017 are set out in Part 4 of this judgment.

As is clear from the findings of fact already made:

BSEL’s PCPs provide that the first stage in a person becoming an agent for BSEL is that the following must be provided to the compliance department:

BSEL’s compliance department reviews those documents and carries out the related checks. If all is satisfactory, BSEL registers the agent with the FCA. The agent must then carry out AML/CTF training and pass an exam with at mark of at least 80%. Unless and until the training has been completed, the agent cannot act for BSEL or carry out any transactions. There are further findings about the risk rating of agents and about training at §742.

Ms Toman asked the Tribunal to find that Ms Chapman was right, for the reasons she had given. Mr Lakha submitted that Ms Chapman had misunderstood what Reg 18(2)(a) actually requires, which is for BSEL to assesses overall risk by considering of each separate factor before coming to an overall conclusion. Consistently with that approach, the HMRC Guidance requires each MSB to use its own “informed judgement to focus efforts on the highest-risk areas and reduce unnecessary burdens on customers presenting a limited risk of money laundering and/or terrorist financing”. He submitted that this was exactly what BSEL had done, as was clear from the EWRAs.

He emphasised that BSEL had already assessed products as high risk, and that the “transaction” factor considered the range of issues summarised at §461(2). The Eversheds’ recommendation had been expressly flagged as “low priority/no breach but recommended action to reflect best practice”.

The Recitals to 4MLR specify that the provisions are “targeted and proportionate”, requiring a “holistic, risk-based approach”, involving “the use of evidence-based decision-making”, and this is reflected in the HMRC Guidance cited by Mr Lakha.

There is nothing in the HMRC Guidance or in the NRA 2017 which require all cash transactions, or all transactions with agents, to be classified as high risk: as the Explanatory Memorandum to the amending regulations says, “The MLRs are deliberately not prescriptive, providing flexibility in order to promote a proportionate and effective risk based approach”.

The EU Guidance explicitly states that “unless Directive (EU) 2015/849 or national legislation states otherwise, the presence of isolated risk factors does not necessarily move a relationship into a higher or lower risk category”; firms are instead to take a “holistic view of the MLR” so as to “make an informed judgement about the relevance of different risk factors in the context of a business relationship or occasional transaction” noting that “this often results in firms allocating different ‘scores’ to different factors”, and that “the weight given to each of these factors is likely to vary from product to product and customer to customer (or category of customer) and from one firm to another”.

BSEL instructed Exiger, a market leading firms of international repute, to design its methodology and having taken into account further advice from Eversheds as to the separation of transaction risk, it followed that methodology. Products were always assessed as high risk; transaction type was moved to high risk in October 2020 and delivery channel risk was medium. The HMRC Guidance requires businesses to use their “informed judgment”. I agree with Mr Lakha that this is exactly what BSEL has done, and I also agree with his submissions on transaction risk.

Ms Chapman made a number of specific criticisms of the EWRAs of April 2019 and March 2020.

Her first criticism was that BSEL had rated transactions as “low risk” on the basis that almost 100% were below the EDD threshold. In fact, transaction risk as a whole was always assessed as medium risk, as explained above, and that rating changed to high in the November 2020 EWRA.

Ms Chapman also criticised BSEL for not changing its transaction risk following receipt of the Eversheds’ 2019 audit. That report identified no high priority breaches of the MLR, and two unrelated medium priority issues. The recommended change to transaction risk was categorised as low priority. Moreover, the original risk classification was itself dependent upon the CDD threshold, which Eversheds explicitly approved (see §249).

Ms Chapman also said that BSEL had failed to take into account the NRA which stated that “cash is inherently high risk due to it being untraceable, readily exchangeable and anonymous”. However, BSEL had already assessed its products as high risk on the basis that they consisted almost entirely of cash remittances, and as explained above, had assessed transaction risk by balancing a number of different factors.

Ms Chapman also criticised BSEL for having arrived at an overall risk rating of “medium” having considered its customer type, geography, products and services, distribution channel and transaction type. She said that as the business used agents and sent cash to Pakistan, this overall risk assessment was a “direct contradiction” to both the NRA, which stated that cash was high risk, and the HMRC Guidance, which said that (a) the “principal-agent relationship is being exploited to launder criminal funds” and (b) that there was “ risk of criminal groups exploiting UK-Pakistan corridor”.

However, as is clear from the findings of fact, BSEL carried out a complex and sophisticated risk assessment. It classified its products (cash) as high risk, and its Pakistan business as high risk. Indeed, BSEL classified Bangladesh as high risk on the basis of its own assessment in 2019, and maintained that assessment in its April 2020 EWRA, even though Bangladesh was not identified as high risk jurisdiction by the amendments to the MLR introduced by 5MLD. BSEL only reduced the assessment of Bangladesh to medium when that country’s risk level was formally confirmed by FATF as being fully compliant/ mostly compliant (see §287).

The HMRC Guidance does not require that all businesses using agents classify that part of their risk as “high”. Instead, it sets out criteria for principals to follow in managing their agents (see Chapter 9). As set out at §462 and §742, BSEL required agents to meet numerous requirements before being accepted (on-boarded). Its compliance team visited the agents and carried out audits; its Remit ERP system checked every single transaction; and agent oversight formed a separate “Dashboard” on the MI Dashboards (see §224(5)).

Ms Chapman also said that BSEL had failed to include in its assessments the risk of multiple agents operating within a small area, despite it being identified in the HMRC Guidance as a risk factor. However, as Mr Lakha pointed out, the HMRC Guidance states that their list of common risk indicators (which includes MSBs operating in a small area) is not an “exhaustive list, and neither are these signs always suspicious. It depends on the circumstances of each case”. BSEL’s customers tend to live in communities (such as around Whitechapel), and I agree with Mr Lakha that it entirely reasonable that multiple MSBs would be set up in such an area to offer money transfer services to those communities, many of whom are migrant workers.

Moreover, as set out under the previous sub-heading, BSEL’s risk assessment of agents was the result of monitoring and checks carried out via the Remit ERP system and by a programme of visits. These steps were appropriate, taking into account the size and nature of BSEL’s business, as required by Reg 18(3), and BSEL did not breach Reg 18 by not including the risk of multiple agents operating within a small area as a check within its systems.

Ms Chapman also said that the transactional data reviewed by Mr Allington-Jones had shown that “almost £36m was transmitted through 13 agents, all with premises located on approximately 0.3 miles of Whitechapel Road in London, including three within the same building”. Mr Allington-Jones’s witness statement and exhibits did not provide any supporting evidence for this statement. For the reasons explained at §133ff, it is not in the interests of justice for the Tribunal to place any reliance on spreadsheet data which has not been exhibited, unless it was clear from the Appellants’ Schedule that they had re-run the transactional data and obtained the same results, and then only to that extent.

In relation to this particular statement in the ToF, the Appellants’ Schedule confirmed the existence of 13 agents along Whitechapel Road and the total value of the transactions over the two year period, although not the reference to 0.3 miles or there being three in the same building. Mr Garcia’s unchallenged evidence was that Whitechapel was the only place in the UK where there was this concentration of agents.

I therefore find as a fact that there were 13 agents operating in Whitechapel Road and that over the two year period they transacted almost £36m of business. However, this fact does not change the reasoning set out in the previous paragraphs: BSEL had numerous and appropriate checks on its agents, and not having a further check relating to agent proximity was not a breach of the regulation.

For the reasons set out above, BSEL did not fail to comply with Reg 18(2)(a).

Reg 18(2)(b) requires a relevant person, when carrying out its risk assessment, to take into account the risk factors posed by customers, the countries in which it operates, its products or services, its transactions and its delivery channels. Ms Chapman decided that BSEL had failed properly to risk assess its customers, transactions and delivery channels, for the reasons set out and considered below.

Ms Chapman decided that BSEL had failed properly to risk assess its customers, because it had not taken into account the risk of customers using agents not local to their residential address. She said:

“the risk of MLTF here is that these customers have chosen agents not based on convenience or economic factors, but rather on ease of carrying out illicit transactions or carrying them out without detection. There is also an increased possibility of these transactions not being carried out face to face and thus posing a higher risk of MLTF as potential criminals may seek to exploit this to conceal their identity.”

In deciding that this risk should have been taken into account in BSEL’s PCPs, Ms Chapman relied on SAJ04. As explained at §114ff, HMRC identified during the hearing that this contained “material errors”, and the parties subsequently agreed that “as a result of those material errors, HMRC cannot and do not rely on SAJ04 or the alleged failures within the Table of Failures based on SAJ04”.

Despite that agreed statement, Ms Toman said that HMRC had nevertheless not withdrawn the part of their case which relied on BSEL not having taken into account the risk of customers using agents not local to their residential address. However, absent the data, HMRC had no evidence to support Ms Chapman’s decision that this risk that should have been taken into account.

Even before the withdrawal, Mr Allington-Jones had in terms accepted under cross-examination that the spreadsheet did not support Ms Chapman’s decision. That was because the program had been run by comparing the postcode of the customer with that of the agent: the report showed where the two differed. Postcodes had been reduced to the first two digits, and no further analysis had been carried out to eliminate postcodes which were geographically close together. Mr Allington-Jones agreed that “further work would be required to see how far apart the postcodes are”. The detailed data in the spreadsheet showed that many locations were close together: for example, both sender and agent having Luton or East London postcodes. Thus, even had the spreadsheet not been withdrawn, the Tribunal would have found that it did not support Ms Chapman’s conclusion that this risk should have been taken into account.

Ms Chapman said in her witness statement that in deciding that BSEL had failed properly to risk assess its customers, because it had not taken into account the risk of customers using agents not local to their residential address, she had relied on one of HMRC’s list of risk factors, namely that “there's no apparent reason for using your business's services, for example, another business is better placed to handle the size of transaction or the destination of the transmission”.

However, the use of an agent in a different location is not the same as there being “no apparent reason” for using the agent. The customer may work close to the agent’s location or the customer may be away from home or have a mobile job: many of BSEL’s customers are taxi-drivers. In cross-examination Ms Chapman agreed that “there may be genuine reasons” for a person to use an agent in a different postcode.

The HMRC Guidance is not prescriptive; as cited above in relation to Reg 18(2)(a), it requires MSBs to “balance the costs to your business and customers with a realistic assessment of the risk that your business may be exploited for the purpose of money laundering and terrorist financing. It allows you to use your informed judgement to focus your efforts on the highest-risk areas”. BSEL had done exactly that, as can be seen from the following six points, which constitute findings of fact:

Ms Chapman did not say, in either the ToF or in her witness statement, that she had relied on the EU Guidance in making this part of her Cancellation Decision; the EU Guidance was not included in the Authorities Bundle and neither was it referred to in HMRC’s skeleton. The first time Ms Chapman said she had relied on the EU Guidance was under cross-examination.

The EU Guidance lists as one possible factor “The customer’s needs may be better serviced elsewhere, for example because the money remitter is not local to the customer”. The risk factor here is that “the customer’s needs may be better serviced elsewhere”, the reference to a non-local agent is an example. There was no evidence that by using an agent in a different postcode, a customer was choosing an agent despite his needs being better served elsewhere.

Moreover, this is one the very long list of possible risk factors set out in the EU Guidance, all of which are prefaced by the statement that:

“the following risk factors are not exhaustive, nor is there an expectation that firms will consider all risk factors in all cases. Firms should take a holistic view of the risk associated with the situation”.

I find that BSEL did not fail to follow the EU Guidance by not having a control which flagged when a customer was using an agent in a different postcode, or (more broadly) one who was not local to the customer

Ms Chapman also said that using a non-local agent increased the risk of the transaction not being on a face-to-face basis. However, BSEL classify all non-face-to-face transactions as high risk, so this is plainly wrong.

BSEL did not breach Reg 18(2) by deciding that there was no need to have an extra control factor based on the postcodes of the agent and the customer, or based on the distances between them. BSEL instead made a realistic risk assessment of customer and agent risk, as it was required to do by the HMRC Guidance and the EU Guidance..

Ms Chapman also decided that BSEL had breached Reg 18(2)(b) because “it had not identified the risk of aggregators having agents with high average transaction sizes”.

BSEL has had a written Aggregator Policy since 2017 under which it carries out enhanced due diligence before onboarding an aggregator, including screening of all directors, disclosure and review of beneficial ownership, list of directors, shareholding structure, proof of ID and address for each director and other directorships held, the three most recent sets of financial accounts, the aggregators’ latest AML/CTF policies. BSEL also requires information about the number of agents, how long they have been trading and the level of business, and it carries out a company credit check, an adverse media search, a site visit and an audit. Once these internal control and compliance checks have been passed, the aggregator also has to be approved by BSEL’s CEO. BSEL’s PCPs also require the Internal Control department to perform yearly visits and evaluations on all aggregators, including refreshing the AML, director and company credit checks.

The software used by the aggregators has to be compatible with the Remit ERP system and transactions made by the aggregator are subject to the same monitoring thresholds as those carried out by BSEL’s agents. As already found earlier in this judgment, BSEL monitored transactions on a customer by customer basis, so customers’ transactions were cumulated irrespective of which agent/aggregator they used, and customers were also risk-assessed. In addition, each aggregator is individually registered with HMRC and with the FCA.

Ms Chapman placed reliance on an analysis of one of the aggregators which she said had been carried out by Mr Allington-Jones, but no related spreadsheet was provided. For the reasons explained at §133ff, I find that there is no reliable evidence before the Tribunal to support Ms Chapman’s view as to the extent of the risk.

Mr Lakha submitted that this was another example of Ms Chapman seeking to impose her own views as to the correct risk assessment for BSEL and failing to acknowledge that, as stated in HMRC’s own guidance, the business used its own “informed judgement” to asses the risks to its business. I agree with Mr Lakha and find there is no basis for Ms Chapman’s conclusion.

Ms S decided that BSEL had failed properly to risk assess its transactions, saying it had “failed to take cumulative transactions into account” because it “assessed its transactions as being low risk due to being small average amounts, however it did not take into account customers who make multiple transactions within a short period of time”.

This is simply wrong. BSEL did not assess its transactions as being low risk, but as being medium risk. Moreover, one of the factors which was explicitly taken into account in coming to the overall medium risk assessment was cumulative transactions (see the findings of fact at §240(3)).

Ms Chapman provided an example of a named customer who “sent five transactions on 9 May 2020 of £149, £486, £729, £149 and £390” and said that BSEL “did not take into account the fact that £1,903 had been sent on one day”.

Mr Garcia’s evidence, which was not challenged, and which was supported by detailed documentation, was that the BSEL had previously carried out enhanced due diligence on that customer and had obtained proof of ID, proof of address; several declarations of source of funds and purpose of transfer and proof of source of funds. The customer works for a national utility company and sends monies to his family for support and for medical purposes; he made 45 transactions in two years, but only ever to a total of eight beneficiaries.

Mr Lakha submitted that this finding by Ms Chapman demonstrates “the severe limitation on simply relying on transaction quantity and amount” without considering factors that are known to BSEL, namely the identity of the sender, source of funds and the purpose of the transaction, and BSEL’s processes for monitoring transactions. I again agree.

Ms Chapman decided that BSEL had failed properly to assess its delivery channels, because the Remit ERP system did not include, as a risk factor, a “dense proximity of agents”. She said that “the transactional data showed, for example, almost £36 million was transmitted through 13 agents, all with premises located on approximately 0.3 miles of Whitechapel Road in London, including three within the same building”. This has already been considered at §477, and for essentially the same reasons I find there was no breach of Reg 18(2)(b).

Ms Chapman decided that BSEL had failed correctly to asses its delivery channels for the further reason that the system did not include a specific flag to identify when agents are sending money to themselves. She said agents “know BSEL’s CDD and EDD thresholds, which gives them the potential to create fictitious transactions or purposely split larger amounts into smaller transactions” and in reliance on Mr Allington-Jones’s spreadsheet (SAJ09) said “the transactional data for the period 1 September 2018 to 31 August 2020 showed that 83 agents had sent funds themselves, from their own premises, totalling £642,354.95”.

On the basis of Mr Garcia’s unchallenged evidence, I find that agents are unable to approve and override BSEL systems in order to transfer their own money. In particular:

Ms Chapman did not say that the spreadsheet provided by Mr Allington-Jones demonstrated that agents were splitting transactions and Mr Allington-Jones did not give evidence to that effect. I find as a fact that the spreadsheet does not demonstrate that these agents were splitting transactions.

I have already found as facts (see §187ff) that there were 306 agents in in July 2020; that they were mostly from the same ethnic background as the customers, and, like the customers, transfer funds back home to friends and family and travel to see relatives overseas. I have made the reasonable assumption that the 83 agents in Mr Allington-Jones’s spreadsheet were those who had remitted the highest amounts of money. The following further facts are based on that spreadsheet:

I agree with the Appellants that this figure is entirely consistent with agents sending money to their friends and family. Moreover, that figure is the average remittance of the 83 agents with the highest level of remittances. This is around 25% of the total number of agents, with around 75% of agents sending lower amounts.

BSEL did not breach Reg 18(2) by deciding that there was no need to have an extra control factor relating to agents’ own transactions.

For the reasons set out above, BSEL did not fail to comply with Reg 18(2)(b) in relation to customers, transactions or delivery channels.

Regulation 19 is headed “Policies, controls and procedures”. The paragraphs in issue were not changed by 5MLR; they read:

“(1)

A relevant person must—

(a)

establish and maintain policies, controls and procedures to mitigate and manage effectively the risks of money laundering and terrorist financing identified in any risk assessment undertaken by the relevant person under regulation 18(1);

(b)

regularly review and update the policies, controls and procedures established under sub-paragraph (a);

(c)

maintain a record in writing of—

(i)

the policies, controls and procedures established under sub-paragraph (a);

(ii)

any changes to those policies, controls and procedures made as a result of the review and update required by sub-paragraph (b); and

(iii)

the steps taken to communicate those policies, controls and procedures, or any changes to them, within the relevant person's business.

(2)

The policies, controls and procedures adopted by a relevant person under paragraph (1) must be—

(a)

proportionate with regard to the size and nature of the relevant person's business, and

(b)

approved by its senior management.

(3)

The policies, controls and procedures referred to in paragraph (1) must include—

(a)

risk management practices;

(b)

internal controls (see regulations 21 to 24);

(c)

customer due diligence (see regulations 27 to 38);

(d)

reliance and record keeping (see regulations 39 to 40);

(e)

the monitoring and management of compliance with, and the internal communication of, such policies, controls and procedures.

(4)

The policies, controls and procedures referred to in paragraph (1) must include policies, controls and procedures—

(a)-(c) …

(d)

under which anyone in the relevant person's organisation who knows or suspects (or has reasonable grounds for knowing or suspecting) that a person is engaged in money laundering or terrorist financing as a result of information received in the course of the business or otherwise through carrying on that business is required to comply with—

(i)

Part 3 of the Terrorism Act 2000; or

(ii)

Part 7 of the Proceeds of Crime Act 2002;

(e)

which, in the case of a money service business that uses agents for the purpose of its business, ensure that appropriate measures are taken by the business to assess—

(i)

whether an agent used by the business would satisfy the fit and proper test provided for in regulation 58; and

(ii)

the extent of the risk that the agent may be used for money laundering or terrorist financing.

(5)

In determining what is appropriate or proportionate with regard to the size and nature of its business, a relevant person may take into account any guidance which has been—

(a)

issued by the FCA; or

(b)

issued by any other supervisory authority or appropriate body and approved by the Treasury….”

Ms Chapman decided that BSEL breached Reg 19(3)(a) on the basis that it had failed to establish and maintain appropriate risk management practices in the ways set out below. In addition, Ms Chapman also relied on the “agents not local to the residential address” issue, which has already been considered at §484.

Ms Chapman decided that BSEL had breached Reg 19(3)(a) because it did not prevent agents from logging into their system from outside their registered premises. In the Cancellation Decision she said BSEL “was aware that its system cannot currently prevent agents from logging on outside of their registered premises; it as not yet implemented a PCP to prevent this” and that this constituted a “deliberate failure” to comply with the MLR.

Ms Chapman did not refer to any guidance in coming to this conclusion. I note that the HMRC Guidance lists among its common risk indicators, “agents who undertake business outside normal business hours”, and the same factor is also included in the EU Guidance. Neither includes any risk indicator relating to agents logging on to their computers outside their registered premises.

The Remit ERP system:

The only effective way of preventing an agent from logging on to his computer other than at his registered premises would require the Remit ERP system to track his location. However:

Ms Toman invited me to agree with Ms Chapman that BSEL had failed to comply with Reg 19(3)(a) because it did not have a flag to identify when an agent was accessing the Remit ERP system outside of his registered premises. Mr Lakha emphasised various of the facts set out above, and made this further submission:

“Sarah Chapman commenced this review during the Coronavirus Pandemic, when working from home was the norm. It is surprising that HMRC has elected to focus on this as a risk indicator given the particular circumstances that BSEL found itself in at that time. Furthermore, the particular nature of the underlying risk is not entirely clear. The Coronavirus Pandemic has utterly transformed the prevailing attitude towards remote use of computers.”

Reg 19(2) requires PCPs to be “proportionate with regard to the size and nature of the relevant person's business”. BSEL had numerous PCPs relating to agent onboarding, transactions and risk assessments, as set out at §519 and §742ff. Neither the HMRC Guidance nor the EU Guidance identifies, as a risk factor, an agent logging on away from his premises.

Taking into BSEL’s extensive and detailed PCPs in relation to agents, together with the other facts set out above, I find that BSEL acted entirely proportionately in not including in its Remit ERP system a measure relating to whether an agent was logging on to that system from a location other than his registered premises, and that there was no breach of Reg 19(3)(c).

Moreover, BSEL did not “deliberately” fail to address the issue. It was reasonable and appropriate for it to rely on its existing PCPs, and it was not technically possible to implement the further control which Ms Chapman wanted BSEL to install.

Ms Chapman decided BSEL had breached Reg 19(3) because it “did not establish PCPs to effectively mitigate the risk of its customers setting up and using multiple accounts” by using variants of their names. The risk here was that if customer had more than one account, his transactions would not be cumulated, allowing him to stay below the EDD threshold. Possible variants to a name might include putting a dot after an initial, or including a space, a hyphen, a number, or an alphabetic variant using an accent, tilde or similar (“a special character”),

Not all special characters are indicators of a name being wrongly recorded: for example, some names correctly include foreign letters, such as ñ in Spanish or ç in French.

BSEL recognised the risk of incorrect special characters leading to duplicate accounts. In January 2018, it introduced a new tool into the Remit ERP system. This deleted any special character inserted by an agent when he created a customer profile. That default spelling could only be overridden by the compliance department who would compare the name the customer wanted to register with that on his official ID document.

In January 2020, BSEL introduced an OCR feature into Remit ERP which checked ID documents and prevented any transaction being completed if the name included special characters; any such cases were flagged and checked by the compliance department against the official ID document.

In reliance on a spreadsheet produced by Mr Allington-Jones (SAJ01) based on agent data, Ms Chapman said that BSEL’s controls were ineffective. The spreadsheet showed that there were just over £1m of agent transactions between September 2018 to 31 August 2020 in which a customer had either a dot or a hyphen in the name.

However, Mr Allington-Jones accepted in cross-examination that some customers’ names (including his own) did include hyphens or special characters and the mere occurrence of these special characters in a name did not mean that it had been recorded incorrectly.

I find as follows:

I find as a fact, on the basis of the Appellants’ evidence as given to Ms Chapman during the meeting on 10 March 2021, that the same Remit ERP tool was introduced for special characters for aggregator transactions, and that the OCR function was added in March 2020.

Ms Chapman says in the ToF that “the aggregator data for the same period contains over £1 million of transactions where a dot or hyphen appears in the sender name”. However, no related evidence was exhibited by Mr Allington-Jones, and there is also no reference to this alleged breach in the Appellant’s Schedule. HMRC have therefore provided no evidence to support Ms Chapman’s statement and for the reasons explained at §133ff, I do not accept it.

In any event, the total figure is around 0.2% of aggregator transactions in the two year period, and as explained in the previous paragraphs, the existence of a small number of special characters does not indicate that BSEL’s controls were ineffective.

BSEL did not fail to establish PCPs to mitigate effectively the risk of its customers setting up and using multiple accounts using special characters. On the contrary, it introduced controls in January 2018 and improved them in January 2020. There was no breach of Reg 19(3).

Ms Chapman also decided that BSEL had breached Reg 19(3) because, in addition to the special character issue, it “did not establish PCPs to effectively mitigate the risk of its customers setting up and using multiple accounts”. She followed this statement by a reference to work carried out by Mr Allington-Jones, but no supporting evidence was provided and there is no reference to it in the Appellants’ Schedule. For the reasons explained at §133ff, I have not placed any weight on Ms Chapman’s summary of that work.

In 2018 BSEL identified the possibility that customers could have opened more than one account, but the issue was very difficult to resolve, because many Bangladeshis and Pakistanis have the same name: for instance, Mohammed Ali or Mustafa Khan, and the same customer name may also have been entered with slightly different spelling over the many years of the company’s operation. BSEL sought to resolve this issue as follows:

Ms Chapman decided that:

The Appellants’ position was that:

I agree with the Appellants on all three points.

For the reasons set out above, BSEL did not fail to establish PCPs to mitigate effectively the risk of its customers setting up and using multiple accounts, and there was no related breach of Reg 19(3).

Ms Chapman also decided that BSEL had breached Reg 19(3) because “until March 2019 BSEL had failed to establish effective PCPs to prevent customers providing a telephone number that was shared with more than one other customer and had no PCPs to monitor the transactions of these senders as being linked”.

On registration, BSEL requires original proof of identity to be provided. Valid ID documents are limited to a passport, driving licence, national identity card or a residence permit card, all of which must contain the customer’s full name, photograph, and date of birth. Proof of UK residency is required for all customers.

BSEL also undertakes an electronic ID verification for all customers, using an independent external provider, Experian. From July 2019, BSEL used Experian’s Auto Doc function to authenticate electronically the identity documents. In November 2020, BSEL instead implemented Experian’s Proof ID, which authenticated the customer’s name, date of birth and address.

In February 2019, BSEL introduced a control which flagged when a telephone number was shared by more than two individuals, but that a number shared by two people did not trigger an alert. BSEL decided on that threshold because it had taken into account its customer base: the majority of customers are Bangladeshi or Pakistani migrants, who commonly live in a house with two or more households; in addition, some customers are elderly. It is therefore common for an individual to share the same contact number with another close family member.

That two-person control operated as a flag, not an absolute bar. If two people were already on the Remit ERP system as sharing a given phone number, and a third individual then gave the same number, the transaction would be referred to the compliance department for review. If the three individuals were, for example, two elderly parents and a child, the transaction would be released. Some numbers therefore continued to be shared between more than two people after February 2019.

BSEL has subsequently developed a new program called “One Customer, One Mobile Number” which would require each customer to have a separate mobile number. However, BSEL was unable to implement this program before its registration was cancelled.

Ms Chapman did not cite any HMRC guidance in the ToF, and her witness statement does not say that she relied on any guidance. Under cross-examination, she again said she had been relying on the EU Guidance. That lists as one of many possible risk factors that “several of the firm’s customers transfer funds to the same payee or appear to have the same identification information, for example address or telephone number”.

The risk factor referred to in the EU Guidance is therefore overlapping ID, but BSEL does not rely on customers’ telephone numbers to establish their identity. Instead, it requires the provision of government approved third party documentation, independently verified by Experian. Ms Chapman has misunderstood the EU guidance.

Ms Chapman relied on a spreadsheet prepared by Mr Allington-Jones (SAJ02), which in HMRC’s submission showed that 446 telephone numbers accounted for:

“Transactions totalling £5,340,952 in the period 1 September 2018 to 31 August 2020 where three or more sender accounts shared the same telephone number.”

The Appellants did not agree that that this was correct. On the basis of the same transaction data, their results as set out in the Schedule showed that there were 257 shared phone numbers and the transactions totalled £2,616,293, less than half HMRC’s figure.

Mr Allington-Jones accepted that there was more than one way of summarising the data, and said that “if the test was summarised in a different way…it would likely give different results”. My own review of the spreadsheet shows that users with the same family name have not been removed, nor been separately quantified as a subset of the data, before conclusions were drawn.

I find that HMRC have failed to prove the extent of the risk, because:

The ToF also stated that Mr Allington-Jones had carried out an analysis of the position for the period after the number of customers had been limited to two. Not only has no supporting evidence been exhibited in Mr Allington-Jones’s witness statement, but in cross-examination he said he had not carried out a test to identify transactions after the two person limit had been introduced. I have therefore not placed any reliance on that part of the ToF.

I find that BSEL did not fail to establish PCPs to mitigate effectively the risk of its customers sharing phone numbers. Instead BSEL had taken an informed decision, in the light of its knowledge of its client base, that two customers sharing phones was not a significant risk factor. That decision was made in accordance with the holistic and risk-based approach required by the MLR and the related guidance. There was no related breach of Reg 19(3).

Ms Chapman decided that BSEL had breached Reg 19(3) because it “had not established PCPs to ensure that the time taken to carry out transactions by its agents was credible and thus allowed potentially fictitious transactions to take place without detection”. Ms Chapman relied on (a) the HMRC Guidance; (b) spreadsheet SAJ03 and (c) the minutes of the conference call on 1 and 3 December. I consider each in turn, but I first make findings of fact.

In reliance on Mr Garcia’s unchallenged evidence, I find that the Remit ERP system includes the following functions:

As Ms Chapman herself accepted, BSEL had repeatedly invited her to view and test the Remit ERP system, but she had always declined; in the context of “fast transactions”, BSEL had also invited her to visit the branch and interview cashiers, but she also refused that offer.

Given that the Remit ERP system was designed to function quickly and efficiently, plus the extensive checks already in that system together with the other compliance checks on agents, BSEL did not consider that it was necessary to include a further control to monitor the number of transactions within a defined time period, such as one or two minutes. However, when this issue was raised by Ms Chapman, BSEL agreed to introduce a new control.

Ms Chapman relied on one of HMRC’s long list of “common risk indicators” which was “agents who carry out transactions too fast to be possible”. However, on the basis of my findings of fact, it is possible for two genuine transactions to take place in under a minute.

In the ToF Ms Chapman cited Mr Allington-Jones’s analysis of the transactional data (SAJ03) saying that it had identified “163 occasions with transactions totalling £166,396.04, where a cashier has carried out two transactions for two different customers in less than a minute, this has occurred across 40 different agents”. The Appellants reran the data but were “not able to confirm or deny” those conclusions.

In her witness statement, Ms Chapman said that in the process of writing that statement she had identified that the figures stated in the ToF were wrong, and she now considered that the correct figures were 131 occasions totalling £131,876. If Ms Chapman were to be correct, the figure in the ToF was 26% too high, but Ms Chapman said that the “difference in the figures is minimal” and she was not changing her decision on this issue.

I place no reliance on spreadsheet SAJ03. As explained at §114ff, HMRC accepted at the hearing that one of the spreadsheets (SAJ04) contained “material errors” and although I rejected Mr Lakha’s submission that no reliance should therefore be placed on the other spreadsheets, I made an exception for spreadsheets where Ms Chapman had identified an error. This was such a case: Ms Chapman herself identified that the figures in the ToF were incorrect, but she did not explain how the error had arisen, or why the new number was in her view correct.

Even if Ms Chapman’s new figures were to be correct, I would have come to the same conclusion, because it was possible for genuine transactions to take place in less than a minute, see the findings of fact above.

In the ToF Ms Chapman relied on two points from HMRC’s notes of the telephone meetings she had held with BSEL on 1 and 3 December 2020. The first was that Mr Curran had “confirmed BSEL does not monitor the speed of transactions carried out by agents in order to ensure that they are credible” and the second that Mr Furnival had said that “a transaction would take a couple of minutes if no new documents or further information was required”.

However, those citations were incomplete. The notes of the meeting on which Ms Chapman relied also included the following:

Thus, both Mr Curran and Mr Furnival had explained to Ms Chapman that the Remit ERP system had controls which were relevant to her concerns about “fast” transactions, but she failed to mention those controls in the ToF. I add that Mr Furnival’s statement that “a transaction would take a couple of minutes” was plainly not intended to be a definitive statement as to the minimum time within which a genuine transaction could be completed: in normal speech the phrase “a couple of minutes” simply means “quickly” or “a very short time”.

For the reasons set out above, BSEL did not breach Reg 19(3) as the result of not including in the Remit ERP system a specific flag to identify when two transactions were completed in less than a minute.

Ms Chapman decided that “BSEL had failed to establish effective risk management PCPs to ensure its aggregators were complying with MLR 2017” because:

BSEL has had a written Aggregators Policy since October 2017 which has been regularly updated by the MLRO, Mr Garcia and others. The Aggregators Policy provides that BSEL will carry out a risk assessment before onboarding an aggregator, and prescribes a list of twenty documents which must be obtained and considered at that stage. These include:

In some cases BSEL obtained additional supporting documents, such as external audit reports and CVs of directors and key personnel such as compliance managers and MLROs.

The following searches and reports were then run on an annual basis: company credit checks, AML checks of UK directors and shareholders owning more than 10% of the business, directorship search and adverse media search on the entity, its directors and its principal shareholders. The Aggregator Policy also sets out a programme for annual site visits for the compliance team to perform an independent assessment of each aggregator’s controls. Ms Chapman accepted in cross-examination that BSEL had PCPs for onboarding aggregators and for their regular review.

After the telephone meetings on 1 and 3 December 2020, on 10 December 2020 Ms Chapman emailed Mr Curran attaching “a list of further information required and outstanding from the meetings”. She has not exhibited either that list or all the information provided in response, but what is clear is that the list of information required was extensive: Ms Chapman’s email refers to “the size of the list” and she gave two delivery dates of 17 December 2020 and 7 January 2020 “to reduce the burden on BSEL”. From the numbering on the specific items which have been exhibited, she asked for information about at least 27 issues.

BSEL supplied the first tranche of that information on 18 December 2020 and the balance on 7 January 2021. Item Number 24 included a statement that no risk assessment had been obtained for the following four aggregators, all of which were “small payment institutions” or SPIs:

Mr Garcia’s witness statement clarified that information, saying that for all but Standard Exchange, the risk assessments were not separate but contained within their PCPs, and he exhibited those risk assessments. In her subsequent witness statement, Ms Chapman accepted that Mr Garcia’s clarification was factually accurate.

In relation to Standard Exchange, Mr Garcia gave unchallenged evidence that this company had carried out a stand-alone risk assessment which was reviewed at the time of onboarding, and he exhibited a copy of that risk assessment.

Item 24 also contained this statement:

“Company risk-assessments were not a pre-requisite prior to onboarding in 2017, 2018, 2019 or within the BSEL compliance policy. We started requesting Risk assessment to our aggregators on Jan 2020, they were notified, particularly with the new companies which came on board in 2020.”

Mr Garcia’s unchallenged evidence was that this statement was simply wrong, and that it is instead clear from the Aggregator Policy that risk assessments were required as a pre-requisite of onboarding. I accept that evidence, which is consistent with the fact that BSEL was able to supply Ms Chapman with copies of the risk assessments it had obtained for all its aggregators.

I also make the reasonable inference that BSEL was under a lot of pressure at the time of Ms Chapman’s further demands. It had only just had its registration reinstated; its Barclays account had been closed; its Pakistan business was disappearing and the pandemic was still causing problems. On top of those difficulties, Ms Chapman required information on at least 27 further topics to be provided by her deadlines of 18 December 2020 and 7 January 2021, a period which included Christmas and New Year.

On the basis of the facts as found, the basis for Ms Chapman’s decision falls away. BSEL did not failed to obtain aggregators’ risk assessments as a pre-requisite to onboarding, and it is not the case that no risk assessment was obtained for the four named aggregators.

Although Ms Chapman accepted this was the position, her witness statement sought to amend the part of her decision relating to the three aggregators which had provided their PCPs to BSEL. She said:

“However, my review of these [PCPs] has identified that these references to risk within the PCPs did not meet the requirements of regulation 18(1) and would not have been adequate in order for BSEL to assess whether these aggregators had established PCPs to effectively mitigate and manage the specific risks each faced.”

In closing, Ms Toman asked me to find that Ms Chapman’s new position was correct. However, HMRC have not explained in what way the PCPs failed to meet the requirements of Reg 18. The burden of proof is on them, and requires considerably more than a mere assertion.

On the basis of my findings of fact, which were not in dispute, BSEL did not fail to establish effective risk management PCPs to ensure its aggregators were complying with the MLR, and thus did not breach Reg 19(3).

Ms Chapman decided that BSEL failed to adhere to its own PCPs in relation to SARs, and so breached Reg 19(4)(d).

As set out above, Reg 19(4)d) requires that a company must have PCPs under which anyone in the company who “knows or suspects (or has reasonable grounds for knowing or suspecting)” that a person is engaged in MLTF is required to comply with Part 3 of the Terrorism Act 2000 and/or Part 7 of the Proceeds of Crime Act 2002.

Reg 21 requires that a firm within the scope of the MLR must appoint a “nominated officer”, defined at Reg 3 as “a person who is nominated to receive disclosures under Part 3 (terrorist property) of the Terrorism Act 2000 or Part 7 (money laundering) of the Proceeds of Crime Act 2002”. Reg 21(5) provides that:

“Where a disclosure is made to the nominated officer, that officer must consider it in the light of any relevant information which is available to the relevant person and determine whether it gives rise to knowledge or suspicion or reasonable grounds for knowledge or suspicion that a person is engaged in money laundering or terrorist financing.”

The HMRC Guidance says at 6.9:

“Staff must report to the nominated officer as soon as possible if they know or suspect that someone, not necessarily the customer, is involved in money laundering or terrorist financing. The nominated officer will then decide whether to make a report.”

The HMRC Guidance also warns against “tipping off”, saying that “nobody should tell the person involved or anyone else” that a SAR is being or has been made. It provides an outline as to how to obtain a “defence against money-laundering” or “DAML” from the National Crime Agency (“NCA”), which allows the transaction to proceed, and adds at 6.17:

“If you do not receive a refusal notification from the NCA within the notice period it is up to you to interpret your position and you may, if you consider that you have met the requirements for making a disclosure, assume a defence at the end of the notice period.”

The HMRC Guidance cross-refers to that published by the NCA. Under the heading “What constitutes ‘suspicion’ under POCA”, that guidance says:

“Suspicion is not defined in legislation. The Court of Appeal (R v Da Silva) defined suspicion of money laundering as a possibility, which is more than fanciful, that the other person was or had been engaged in, or benefited from criminal conduct and that the suspicion formed was of a settled nature. There does not need to be anything amounting to evidence of the suspected money laundering. The threshold for suspicion under POCA is generally considered to be low.”

BSEL’s 2018 PCPs contain three pages on SARs, which include the following:

Later PCPs contained all the above with some further detail, in particular in relation to DAMLs. Between the middle of 2017 and January 2019, BSEL submitted 221 SARs, and the related reference numbers were provided to Officer Stuart Marlor after his meeting with Mr Olayinka and others in January 2019. Exiger reported in July 2018 that “BSEL files approximately two SARs a week to the NCA, which demonstrates that employees, including the MLRO, have a high level of awareness of their reporting requirements”.

Eversheds’ November 2020 audit report recorded that “BSEL also provided us with confirmation of five agents with whom it terminated its relationship in the last 12 months due to their misuse of IDs”. In the course of the meetings with BSEL on 1 and 3 December 2021, Ms Chapman asked for the names of those agents; what the misuse entailed, and whether SARs had been submitted. Ms Dhillon said that BSEL had identified via its ID verification procedures that the ID documents in question did not belong to the customer, and that “the agent may have created ghost accounts to transmit money overseas”. For the avoidance of doubt, I make no finding of fact that the agents created such accounts but only that Ms Dhillon said this was a possibility. Ms Dhillon also said she did not know if SARs had been submitted but would check. She subsequently confirmed that a SAR had been filed with respect to one agent. The MLRO at the time was Mr Kirby.

In the ToF Ms Chapman accepted that the PCPs recognise that there was “a statutory and regulatory obligation for the MLRO to report to the National Crime Agency (NCA) information or other matters which come to his attention during business activities and which in his opinion give rise to knowledge or suspicion of money laundering”. She continued by saying that as BSEL had nevertheless failed to submit a SAR in relation to four of the five agents, it had “knowingly disregarded” its MLR obligations in relation to the position of those four agents.

Under cross-examination, Ms Chapman:

Ms Toman asked the Tribunal to confirm Ms Chapman’s decision for the reasons she had given. Mr Lakha pointed out that under the MLR, BSEL was required to appoint a Nominated Officer, and to have appropriate PCP. There was no dispute that BSEL had complied with those requirements. Reg 21(5|) then placed the obligation on the Nominated Officer to make SARs reports: as set out at §586 above, it says (his emphasis):

“Where a disclosure is made to the nominated officer, that officer must consider it in the light of any relevant information which is available to the relevant person and determine whether it gives rise to knowledge or suspicion or reasonable grounds for knowledge or suspicion that a person is engaged in money laundering or terrorist financing.”

Mr Lakha said that the MLR imposed a “personal obligation”, which here rested on Mr Kirby. Given the serious nature of that obligation, it was reasonable to assume that Mr Kirby would have considered “any relevant information” before making the decision only to file a SAR in relation to one of the agents.

HMRC’s case on this point rests on BSEL having failed to file SARs for the other four agents. However, the obligation to file those SARs rested on Mr Kirby. HMRC have no evidence that Mr Kirby improperly failed to file SARs when he should have done, and they did not seek to investigate the issue. The burden of proof is on HMRC and they have not met that burden.

I agree with Mr Lakha that, given Mr Kirby’s role and the seriousness of a failure to file a SAR, the reasonable presumption is that he decided for good reasons that no SAR was required. Even if that were to be wrong, the failure to file SARs would have been a breach of Mr Kirby’s obligation as the Nominated Officer. As Mr Lakha said, BSEL had met its own MLR requirements by putting in place appropriate PCPs and by appointing an appropriately qualified and experienced Nominated Officer.

It follows that BSEL did not fail to adhere to its own PCPs in relation to SARs; had not “knowingly disregarded” its MLR obligations and had not breached Reg 19(4)(d).

As set out at §515, Reg 19(3)(c) requires PCPs to include CDD. The main issue under this heading has already been considered in Part 5 at §415ff. However, Ms Chapman also decided that BSEL breached Reg 19(3)(c) for the further reason that it failed to establish and maintain appropriate PCPs in relation to CDD as regards “many-to-one” transactions.

The term “many-to-one” transactions is used to refer to separate persons sending money to a single individual. The following points were common ground:

I have already found that the beneficiaries were not BSEL’s customers: BSEL did not have a business relationship with them, or carry out occasional transactions for them. Instead, BSEL transacted with a UK customer to send money to a bank in Pakistan or Bangladesh, where it was either credited to the account of the beneficiary or collected over the counter. BSEL therefore had no contact with the beneficiaries.

Ms Chapman did not cite any guidance relating to this alleged breach and neither did Ms Toman. From my own review, the HMRC Guidance does not set out any requirements for MSBs to obtain information about beneficiaries who are not customers, and I was unable to identify any such requirement in other guidance. Instead, the requirement was the more general one that businesses take a risk-based approach which “should balance the costs to your business and customers with a realistic assessment of the risk” of MLTF.

As BSEL’s client base was made up of migrant workers who sent money back to their home countries, their family and kinship networks meant that multiple remittances from different senders to the same beneficiary were normal, particularly around Eid and Ramadan.

BSEL nevertheless recognised the risk that many-to-one transactions could be used to split a larger sum, and in November 2018 introduced an automatic flag in its Remit ERP System which would alert the compliance department when many senders were making remittances to a single beneficiary. For instance, the system would flag when more than a certain number of senders were making transfers to a beneficiary called Habibur Rahman within a certain period. However, this was not an efficient method of managing the risk, because it returned too many false positives. To use the same example, BSEL now know (as the result of the work described below) that they had over 4,370 different beneficiaries called Habibur Rahman.

BSEL therefore decided to stop the alert, and instead to address the issue in a different way. They contracted with an external IT partner to create a unique beneficiary identifier using the following information about the beneficiary: name, mobile number, plus proof of ID and bank account details where these were available. In order to carry out this project, the key missing piece of information was the beneficiaries’ mobile numbers.

Obtaining the beneficiaries’ phone numbers took time, and it was a mammoth task because:

The Appellants’ evidence was that:

The first of those points was unchallenged, but in relation to the second, Ms Chapman did not accept that BSEL began requiring mobile numbers from beneficiaries in February 2019. In her witness statement, she said that “this chronology is contradicted by the information Mr Garcia gave during the meeting of 5 November 2020 where he stated that the phone numbers for beneficiaries had been mandatory since June/July 2020”. However, HMRC’s notes of that meeting do not say that. Instead, they record (my emphasis) that “[Mr Garcia] stated that since June/July this year a beneficiary isn’t able to share their phone number, he explained that in the past they have allowed father and son to share a number”.

It is clear from those meeting notes that Mr Garcia was not talking about the collection of the beneficiaries’ numbers from senders, but a later development, preventing the sharing of phone numbers by beneficiaries. I find as a fact that the position is as stated by the Appellants: from February 2019, senders had to provide beneficiary phone numbers and if the sender refused, BSEL did not carry out the transaction. I further find that from June/July 2020, the phone number for each beneficiary could not be the same as that for another beneficiary, but had to be unique.

In November 2019, having gathered sufficient data, BSEL commenced the creation of a “Virtual Beneficiary Profile” (“VBP”) for each beneficiary. This proved difficult for technical reasons (for example, some telephone numbers were provided in different formats) and also for external reasons: the pandemic and the consequential lockdowns, and an unusually long and severe cyclone season in South Asia.

In August 2020, before Ms Chapman became involved, BSEL implemented an algorithm which it hoped would allow the identification of each individual beneficiary using the newly developed VBP. However, some problems with the algorithm emerged. BSEL’s management team thought these had been sorted out by November 2020, but the problems proved more intractable than anticipated. All issues were however resolved by April 2021.

During the period before the introduction of the VBP, the Remit ERP system flagged many-to-one cases for review by the compliance department. That this is the case is clear from the compliance reports. For example, the October 2019 report issued by the MLRO said that the compliance team were “checking all daily transactions submitted by agent and aggregator network and using pivot tables” to identify any concerns around many-to-one transactions, and it also recorded that two related SARs had been made. The amount of time invested by BSEL in monitoring the many-to-one issue is illustrated by a comment made in the same report that the VBP program was entering the testing phase and that when live it would “free up many hours spent by compliance analysing daily transactions”. The monitoring procedures are exemplified by Mr Kirby filing a SAR in March 2020 relating to three beneficiaries who had received money from a large number of senders. Because of the sensitivity around SARs, I have called these beneficiaries MSU, AH and ZHC. After filing the SAR, BSEL blocked transfers to two of the beneficiaries in June 2020, and it also terminated one of the agents involved. In November 2020, BSEL identified that a fourth beneficiary, AK, was also receiving money from multiple senders.

As already noted at §291, on 5 November 2020 a telephone conference took place between Ms Chapman, Mr Garcia and Mr Curran. A few hours later, Ms Chapman emailed Mr Curran setting out her understanding of the main points discussed and agreed. These included “Limits for senders per beneficiary and number of beneficiaries per sender to be communicated to me once these have been decided”.

As noted in the table set out at §292, Mr Curran replied to that question as follows:

“The financial crime team, in conjunction with the Management decided to set the limit as below:

Senders per beneficiary: Six

Beneficiaries per sender: Six

The above will be implemented in production by Friday, November 13, 2020.”

The PCPs issued on 10 November 2020 included the following text:

“Customer/Beneficiary Limits

the number of sending customers per beneficiary, and the number of beneficiaries per customer, has been limited as set out below:

•

Senders per beneficiary: Six

•

Beneficiaries per sender: six

Beneficiary Identifiers

the system will allocate a unique identifier to each beneficiary, and this will be used for ongoing monitoring. This identifier is established through a combination of at least three of the beneficiary’s details as listed below:

•

Full name

•

Country/city

•

mobile number

•

Bank account number

•

Mobile wallet number.”

On 12 November 2020 Mr Curran emailed Ms Chapman, stating that “all promised enhancements to our Remit ERP systems have been completed and are now ‘live’”, and on 13 November 2020, Ms Chapman lifted the suspension.

On 31 March 2021 a telephone conversation took place between Ms Chapman and Mr Curran, at the end of which she sent him an email which included the following text:

“My understanding of our conversation is as follows:

•

The virtual beneficiary profile (based on name and bank account number/telephone number was trialled successfully last week…

•

The automated process of identifying beneficiaries with multiple senders is expected to be implemented fully by the end of this week, this will use the virtual beneficiary profile. Prior to this the monitoring has been manual, the system did not have the ability to automate it.

•

There is not an absolute limit of six senders per beneficiary or six beneficiaries per sender, this is instead a trigger point at which further investigation will be carried out. The sender profile on the system cannot have more than six beneficiaries on it at one time so in order to send to a seventh beneficiaries the most historical beneficiary would drop off of the preferred beneficiary list.”

Mr Curran responded on 1 April 2021, confirming that there had been some implementation issues with the VBPs, but that they were expected to be fully automated by the end of the week. He also confirmed the text in Ms Chapman’s final bullet point was correct.

Mr Garcia and Mr Curran both gave evidence about these exchanges. They said that the intention had always been for the system to set a “threshold limit”, or flag, of six senders to a single beneficiary, so that if more than six senders sent money to the same beneficiary the transaction would be flagged for review by the compliance team. That team would then investigate the reasons for the transactions: in other words, whether there was no reason for concern – for example, because beneficiary was an elderly person receiving support or a child receiving birthday presents, or whether there was reason to suspect MLTF. As Mr Garcia said, “an absolute limit of six made no sense because of large families”.

Ms Chapman’s position was that BSEL had changed its position, and had originally promised to set an absolute limit of six senders per beneficiary, with the result that if a seventh person tried to make a remittance to that person, the system would inevitably and automatically bar the beneficiary from receiving that money. It was also HMRC’s case that the Appellants had deliberately given Ms Chapman “false or misleading” information about the limit of six senders to one beneficiary.

I find as a fact that there was no change of position, but that BSEL had always intended to implement these controls by introducing a flag into the Remit ERP system. I come to that conclusion both because I found that Mr Garcia and Mr Curran had given honest evidence, but also because it is the only sensible reading of the communications. As Mr Lakha said, it would be a nonsense for BSEL to implement an absolute limit of six senders, because it would automatically prevent any beneficiary from receiving transfers from more than six senders. So no child could receive more than birthday presents, or gifts at Eid, from more than six senders. That is plainly an absurd outcome. I further find that none of the Appellants deliberately misled Ms Chapman. Instead, she misunderstood the position.

Ms Chapman also concluded that Mr Curran had deliberately misled her by saying in his letter of 5 November 2020 that the VBP was in place; that this untruth was repeated in the PCPs, and that in reality the VBP was not completely operational until April 2021. I do not accept that, but instead confirm my finding above, that BSEL and its management team genuinely thought that the VBP had been fully implemented when they so informed Ms Chapman in November 2020. In making that finding I accept the Appellants’ evidence both (a) as to their genuine belief, and (b) that the implementation was more intractable than anticipated. I agree with Mr Lakha that this is another example of Ms Chapman’s failure to grasp that implementing changes to large and complex computer systems commonly takes longer than expected.

Finally, Ms Toman submitted that BSEL had intentionally misled Ms Chapman in order to get the suspension lifted. I reject that submission for the following reasons:

Ms Chapman decided that BSEL had failed to comply with Reg 19(3)(c) in relation to many-to-one transactions for the reasons set out below.

Ms Chapman decided that although BSEL had correctly identified many-to-one transactions as a risk, it had not established effective PCPs until April 2021. In the Cancellation Decision, the “many-to-one” issue was the first of Ms Chapman’s examples of alleged non-compliance: she said that BSEL had failed to introduce PCPs “to automatically identify beneficiaries of many-to-one transactions until April 2021” and that BSEL had therefore demonstrated “a consistent and deliberate failure to address this risk”. In her oral evidence she said “they have left this issue for so long and did nothing”, and criticised BSEL for having rejected the original approach of placing a flag in the Remit ERP system because it had produced too many false positives.

Ms Toman’s skeleton argument said that “this was a very serious breach of the MLR”; although in her oral submissions she took a less extreme position, acknowledging that BSEL had been trying to resolve the issue, but she said this was insufficient. She reiterated Ms Chapman’s position that BSEL was only compliant with Reg 19(3)(c) after it had installed the automated unique beneficiary identifier.

Mr Lakha submitted that this was plainly wrong. BSEL had taken a proportionate approach to dealing with this risk, taking into account (a) that its client base would be expected to make many entirely innocent many-to-one transactions, and (b) the nature and scale of the task which BSEL had decided to undertake in order to provide a thorough and robust solution. He added that it was a nonsense to say that BSEL had “left this issue for so long and did nothing”; on the contrary, BSEL was continually working to design an effective automated solution, and this took a considerable investment in time and money to resolve.

I again agree with Mr Lakha for the reasons he gave. There is nothing in the guidance which requires MSBs to provide a unique identifier for each beneficiary (none of whom are customers). It would be contrary to the proportionate approach prescribed by the MLR, and to the recognition that systems and approaches will change over time, for BSEL to be held in breach of Reg 19(3)(c) until it had perfected an automated solution: BSEL was continually monitoring and controlling this issue in the meantime. In addition, when BSEL decided that flagging all customers who shared the same name gave rise to too many false positives, this was not an indicator of its unwillingness to address the issue. On the contrary, it was a recognition that the control was not proportionate, and that a new approach was required. That is exactly the approach the MLR requires.

Ms Chapman decided that BSEL had also breached Reg 19(3)(c) because:

I agree with Mr Lakha that these conclusions cannot stand. It was Mr Kirby’s role as the MLRO to send in SARs, and the same points apply as at §597ff. As regards the three beneficiaries about whom he had filed SARs, there was no evidence as to whether Mr Kirby decided that there was a risk of “tipping off”; whether the NCA provided a DAML; or if not, whether he had considered it was appropriate to “assume a defence”, see §588. In relation to AK, it was for Mr Kirby to decide whether or not to file a SAR.

In short, there was no evidence before the Tribunal to support Ms Chapman’s conclusion that BSEL had acted in breach of Reg 19 in failing to blacklist the beneficiaries sooner; failing to terminate the other agents, and/or failing to file a SAR in relation to AK.

Mr Allington-Jones produced two spreadsheets relating to the many-to-one issue. One of these (SAJ08) summarised beneficiaries’ phone numbers. Ms Chapman relied on this to state that there were:

“large amounts of invalid phone numbers, 879 beneficiaries with no telephone number recorded at all, a lack of consistency in the length of the numbers and the use of numbers by multiple beneficiaries. For example, the number 880088 was used for 11,294 beneficiaries on transactions totalling over £9 million.”

The data provided to Mr Allington-Jones covered the period from September 2018 to August 2020. In January 2019, BSEL required senders to provide the beneficiaries’ phone numbers. Mr Allington-Jones’s evidence was that the spreadsheet did not analyse the information by date, so it was not possible to know whether his results came entirely from transactions made in the period between September 2018 and January 2019. Given that fundamental uncertainty, I placed no reliance on this spreadsheet.

Ms Chapman said that another of Mr Allington-Jones’s spreadsheets (SAJ05) showed that in the same two year period, 1,488 beneficiaries had received funds from more than 10 senders, and that these transactions totalled £39 million. She added that “this included 336 beneficiaries that had received funds from over 20 customers, with transactions totalling £20,111,766.71”. There are several difficulties with those conclusions:

For those reasons, all that can be reliably concluded from SAJ05 is that, as the Appellants accept, many-to-one transactions occurred. That is not surprising, given the customer base. BSEL designed and implemented the unique beneficiary identifier to improve its PCPs in this area.

In addition, in reliance on the same spreadsheet, Ms Chapman said in the Cancellation Decision (my emphasis) that “Analysis of the transactional data highlighted that in the period 1 September 2018 to 31 August 2020 approximately £22 million was transmitted to beneficiaries that each had over 20 different senders”. Mr Allington-Jones’s spreadsheet had produced a figure of £20,111,766.71. The figure used in the Cancellation Decision to exemplify this alleged breach by BSEL is £2m higher than that in Mr Allington-Jones’s spreadsheet. The difference is unexplained and I place no reliance on the figure in the Cancellation Decision.

Mr Allington-Jones’s witness statement exhibits a further spreadsheet (SAJ06) which was based on data-sets extracted from SAJ05, and in reliance on that spreadsheet, the ToF additionally sets out various details relating to specific values, ranges, agents and thresholds. However, given the extent of the differences between SAJ05 and the figures in the Appellants’ Schedule and the other points set out at §635 above, it is not possible to use SAJ05 as the basis for making reliable detailed findings of facts as to specific values, ranges, agents or thresholds. I therefore place no reliance on SAJ06 or the related figures in the ToF.

In reliance on her own analysis of Mr Allington-Jones’s data and of BSEL’s lists of agents, Ms Chapman also concluded that in March 2021 BSEL was still dealing with 8 out of the 15 agents who had acted for senders to the ten largest recipients of transferred funds in the two year period considered by Mr Allington-Jones.

For the reasons given in the previous section I place no reliance on the detailed figures taken from SAJ05. I note also that Ms Chapman emphasised the fact that BSEL did not terminate eight out of 15 agents, rather than on the fact that it did terminate the other seven. This is a significant percentage, and supports BSEL’s case that it is actively monitoring compliance by agents in relation to many-to-one as well as in other respects.

Ms Chapman also decided that BSEL had breached Reg 19(3)(c) because it did not introduced a PCP relating to “one-to-many” transactions until November 2020, and that control was not automated until April 2021.

One-to-many transactions are where a sender in the UK sends money to more than one beneficiary overseas. These transactions could be entirely innocent: for instance one person sending money at Eid to several different relatives overseas. It is also possible that a sender could send small amounts (below the EDD threshold) to different beneficiaries, who would then collude to recombine the funds.

On 2 November 2018, BSEL implemented a transaction monitoring alert in the Remit ERP system to identify cases where a person had sent to more than 10 different beneficiaries. However, this produced too many false positives, in other words cases where, on review by compliance, there was no risk of MLTF. This was because it was not unusual for a customer with a South Asian background to be sending money to more than 10 beneficiaries, because of the size of their family network, and because religious practices and cultural traditions meant that it was normal practice to give money widely, especially during Ramadan.

On reconsideration BSEL decided the alert was not necessary, given that:

In summary, BSEL considered that its decision not to include a flag to identify one-to-many transactions was proportionate and in compliance with the MLR.

Because of Ms Chapman’s concerns, BSEL agreed to introduce a control. As I have already found, on 5 November 2020, Mr Curran told Ms Chapman that it would implement a limit of six beneficiaries per sender and included this in the November PCPs, and on 10 November he emailed her to say that “all promised enhancements to our Remit ERP system have been completed and are now ‘live’”. The Appellants’ evidence was that by this they were communicating to Ms Chapman that their intention was as follows:

As with the many-to-one control, Ms Chapman had understood that BSEL had promised to implement an automatic limit of six beneficiaries per sender, with the result that it would be impossible for customers to send money to more than six beneficiaries, and a customer who tried to do so would be find that transaction had been automatically blocked. When Ms Chapman realised this was not the position, she decided Mr Curran and others of the Individual Appellants had deliberately misled her by making statements that were “not true” about the introduction of absolute limits on the number of beneficiaries per sender and that the checks had not been automated when Mr Cullen told her that the changes were “live”.

I accept the Appellants’ evidence because:

I therefore reject HMRC’s case that the Appellants acted dishonestly in their communications with Ms Chapman about one-to-many transactions. None of the Appellants deliberately misled Ms Chapman. Instead, she again misunderstood the position.

On the basis of spreadsheet SAJ07 exhibited by Mr Allington-Jones, Ms Chapman said that “the transactional data for the period 1 September 2018 to 31 August 2020 showed that 8,395 sender accounts sent to more than 10 beneficiaries with transactions totalling £84,972,052”. Those figures were not challenged and I accept them. However, from my own review of SAJ07, I find that:

From this it can be seen that the overwhelming majority of the transactions are well within what would be expected of BSEL’s client base. In particular, 90% of those on his spreadsheet sent to fewer than 20 beneficiaries over a two year period, which is self-evidently well within normal parameters, as is the average remitted amount. Moreover, the spreadsheet figures should not be considered in a vacuum, separately from BSEL’s other control procedures including the transaction monitoring carried out by BSEL’s compliance teams.

Ms Toman submitted that Ms Chapman was correct to have decided that BSEL had breached Reg 19(3)(c) because it did not introduce a PCP relating to customers sending to multiple beneficiaries until November 2020, and the process which was then introduced was less effective than the automated check which was operational from April 2021.

Ms Lakha submitted that this was another example of Ms Chapman failing to understand the approach required by the MLR. BSEL’s PCPs dealt in a proportionate way with the nature and extent of the risk involved, and none of the Appellants had acted dishonestly. I agree with Mr Lakha for the reasons he gives. It follows that BSEL’s PCPs did not breach Reg 19(3)(c).

Ms Chapman also decided that BSEL had breached Reg 19(3)(c) in four further ways. Of those, two points have already been addressed:

The remaining two points are considered below.

Ms Chapman also decided BSEL had breached Reg 19(3)(c) because:

“Until November 2020 BSEL had not established PCPs regarding multiple senders transacting large amounts from the same address, such as identifying the transactions as linked or having controls in place to restrict the numbers of customers per household.”

It was Mr Garcia’s unchallenged evidence that the statement above was factually incorrect. Mr Gomes’ witness statement added further detail:

“Customers from Same Address is an enhancement which was implemented in October 2015 and generates a report which shows customers registered in the same postcode and residing at the same address. Compliance officers monitor any of the transactions which have been identified and review the profile of all customers registered at the same address including the KYC documents on the profiles, check for electronic ID verification results and contacting all the customers at the address at the contact numbers on record. If necessary, further action may be taken such as follow up on the customers or escalating the matter to a senior compliance officer or the MLRO or adding the customer to BSEL’s Internal Blacklist.”

Ms Toman asked Mr Gomes about this evidence but did not challenge its correctness. In addition, the Appellants’ list of IT implementations states that on 19 October 2015, a change was implemented to the Remit ERP system so as to produce a report which showed customers registered at the same postcode and residing at the same address. HMRC’s comments on that list did not dispute that this reform had been implemented, but said that they understood “that customers residing in the same address still had to be manually identified”. The Appellants responded by saying that since October 2015, the system has produced a report which is used by the compliance team to monitor customers from the same postcode and address; this is consistent with Mr Gomes’ evidence. Moreover, a print-out of this report was provided to Ms Chapman on 29 March 2021, and another example is included in the Bundle as part of BSEL’s internal IT guide for Remit ERP.

I find as a fact that since October 2015 the Remit ERP system has produced a report showing customers registered at the same postcode and residing at the same address, and this report was reviewed by BSEL’s compliance department in the ways set out in Mr Gomes’s witness statement.

BSEL’s position was that no further control was required. However, in response to concerns raised by Ms Chapman, BSEL began to implement an automated systems amendment that flagged when multiple senders from the same address sent money to the same city, and this was implemented from November 2020.

HMRC’s position was that customers from the same household would have been able to split their transactions to avoid triggering additional CDD or EDD thresholds, and that BSEL had breached Reg 19(3)(c) because, until November 2020, there was no automated flag within the system.

Mr Lakha submitted that the system had included a control since October 2015, and the nature and extent of that control was entirely appropriate, given BSEL’s knowledge of its client base and the very limited extent of the related risks: many of BSEL’s customers are migrants who typically share accommodation, not just on a family basis but also in flats above shops and restaurants. He said in his skeleton argument that Ms Chapman “appears to operate under the belief that every conceivable risk factor should be dealt with, whereas as 3.1 of the HMRC Guidance states that ‘An effective risk-based approach will identify the highest risks of money laundering and terrorist financing that your business faces and put in place measures to manage these risks’”. Mr Lakha said that was what BSEL had done, and there was no breach of Reg 19(3)(c).

It follows from the findings of fact that Ms Chapman was wrong to say that BSEL did not have PCPs in place to check transactions made by customers from the same address: such a control had been in place for over five years. There is no requirement, statutory or otherwise, that controls have to be fully automated.

Mr Allington-Jones produced a spreadsheet (SAJ10) which showed that, over the two year period to August 2020, transactions with agents where five or more senders resided at the same address totalled over £1.3 million and of these, 22 addresses had sent over £50,000. The Appellants’ Schedule set out that detailed information but did not disagree with it. I accepted the evidence in the spreadsheet.

Ms Chapman relied on SAJ10 to support her inference that senders at the same address were transaction splitting to avoid the CDD or EDD thresholds. However:

There is no relevant detail in the spreadsheet to show the amounts or frequency of individual transactions, so it does not provide support for Ms Chapman’s inference that they are being split. Moreover, the amounts are very small in the context of BSEL’s overall transactions, and thus does not support her conclusion that this was a serious risk which should have been addressed in a different way. .

BSEL did not breach Reg 19(3)(c) in relation to its PCPs for senders living at the same address.

Ms Chapman decided that BSEL had breached Reg 19(3)(c) because it “had not established PCPs to identify customers using multiple agents, despite this being listed as a risk indicator in HMRC guidance”.

The HMRC Guidance includes in its list of “common risk indicators for new customers” that “the customer (or two or more customers) is using more than one local Money service business, perhaps to break one transaction into smaller transactions”. The risk indicator thus relates to new customers, and the underlying risk factor is transaction splitting.

HMRC preface their list of risk indicators by saying that “it not an exhaustive list, and neither are these signs always suspicious. It depends on the circumstances of each case”. I have already set out earlier in this judgment the approach required by 4MLD and 5MLD and by the MLR, together with relevant extracts from the HMRC Guidance about the need for business to take “a risk-based approach” and use their “informed judgment”, and it is not necessary to repeat those citations.

Mr Allington-Jones provided a spreadsheet (SAJ11) relating to this issue. The Appellants’ Schedule set out the specific details relied on by Ms Chapman, and did not challenge them. I accept the evidence in SAJ11.

On the basis of that spreadsheet I find that during the two year period 1 September 2018 to 31 August 2020, 20,964 customers used more than one agent, with transactions totalling over £127 million. Of these customers, 190 used five or more agents.

Customers are free to use any agent, because it makes no difference to the procedure which is applied to the transaction. A customer may use one agent when transacting near his home, and another close to his place of work; in a two year period a migrant worker may move home a number of times, and many of BSEL’s customers are taxi-drivers who may use an agent based in an area where they happen to be working.

All BSEL’s agents are linked by the Remit ERP system, and so using a different agent for a second or subsequent transaction does not prevent the transactions being cumulated for CDD or EDD purposes, so using separate agents would be an ineffective means of splitting transactions.

BSEL has a detailed and co prehensive policy for “onboarding” agents, which requires that they provide extensive supporting documentation, including certified copies of passports or residence cards; details of shareholding and corporate structure; BSEL also carries out AML and (from 22 November 2018) DBS checks and company credit checks, see §462ff and §713ff. Once on-boarded, the agent is monitored and assessed as set out in more detail at §742ff.

Nevertheless, in an attempt to cooperate with HMRC, BSEL implemented further controls to identify customers using several agents. As set out at §292, on 6 November 2020, Mr Curran told Ms Chapman that:

In accordance with those commitments, new transaction monitoring reports were run off the Remit ERP system every day and the financial crime team monitored them for the use of more than two agents. As already noted, on 12 November 2020 Mr Curran emailed Ms Chapman, stating that “all promised enhancements to our Remit ERP systems have been completed and are now ‘live’”. In 2021 the alert was automated.

Ms Toman asked the Tribunal to uphold Ms Chapman’s decision that the failure to track customers using “multiple agents” was a breach of Reg 19(3)(c). She also submitted BSEL had provided “misleading information” because Mr Curran had said in November 2020 that the system would generate a report which included this criteria, but it was not automated until the following year.

Mr Lakha said that BSEL had been dealing with the underlying risk factor – transaction splitting – by cumulating all transactions irrespective of the agent, and that BSEL had not provided misleading information to Ms Chapman. Daily reports were prepared for the financial crime team who reviewed them to identify use of non-local agents, and this was later automated.

It is clear from the HMRC Guidance that the identified risk factor relating to transaction-splitting, and equally clear that BSEL’s linkage of all agents so as to cumulate all transactions was an appropriate and sufficient PCP to address the risk of transaction splitting by using different BSEL agents.

I also agree with Mr Lakha that BSEL did not provide misleading information about the introduction of a system change to satisfy Ms Chapman. Mr Curran’s email of 6 November 2020 said that BSEL’s financial crime team would review reports from the system daily so as to check for use of multiple agents, and that was what they did. Entirely reasonably, it took BSEL time to automate the flag.

Ms Chapman also decided BSEL had breached Reg 19(1)(c) because it did not receive data from most of the aggregators in real time; instead the aggregators uploaded the data once every working day. In Ms Chapman’s view “this prevented BSEL monitoring transactions in real time, meaning that transactions could only be stopped or reported as suspicious after they had been processed”.

I have already made findings of fact relating to aggregators at §498ff and §570ff. Each aggregator is registered with and licensed by HMRC and the FCA, and carries out due diligence on the transactions; once received each individual transaction is then subject to BSEL’s usual policies including CDD/EDD thresholds and are monitored accordingly. Any breach of thresholds or documentary evidence triggers a request for additional information and prevents the transactions from being completed. Accordingly, it made no difference whether the transactional data was in real time because until it cleared the Remit ERP system it would not be processed.

It is plain that (a) a transaction was not “processed” until BSEL moved the money to the overseas country, and (b) BSEL could not make that transfer until after the transaction data was received from the aggregators.

Ms Chapman was thus wrong to say that the practice of uploading data once a day meant that “transactions could only be stopped or reported as suspicious after they had been processed”. Instead, when the bulk data was received by BSEL, it was subject to due diligence measures including those which followed from cumulating transactions, and if the relevant requirements were not met, the transaction was not processed – in other words, the money was not moved to the overseas country. Furthermore, aggregators were MSBs in their own right, separately registered with HMRC and required to comply with the MLR. I find that receiving aggregator data in bulk did not breach Reg 19(1)(c).

Ms Chapman also decided that BSEL had breached Reg 19(3)(c) because:

“BSEL did not establish PCPs to obtain the date and time of when the transaction took place, from its aggregators. Without this BSEL was unable to identify suspicious activity in relation to split transactions that occurred within short periods of time, leaving it vulnerable to criminals exploiting this to split illicit funds without detection.”

Each aggregator was required to apply the thresholds for cumulation set out in BSEL’s CDD/EDD policies, and the aggregators therefore linked transactions and required extra information and documentation as necessary. Ms Chapman accepted that this was the case in cross-examination.

When the aggregator’s upload of daily transactions was received, the date was logged in the Remit ERP system. The transactions were not processed until they were checked by the controls within the Remit ERP system and where appropriate reviewed by the compliance department; those checks included thresholds when transactions were linked.

A new aggregator Application Programming Interface integration was implemented in June 2020, and this extracted the date and time of the customer’s transaction from the aggregator’s own system.

The aggregator had already applied cumulation thresholds to the transactions before uploading them into the Remit ERP system. Until June 2020, when the Application Programming Interface was introduced, BSEL carried out an extra check based on the date of upload. If the cumulated amount exceeded the EDD threshold, BSEL checked that the relevant documentation had ben uploaded before processing the transaction.

There is thus no basis for Ms Chapman’s conclusion that this risk was not being managed by BSEL’s PCPs. Her statement that “BSEL was unable to identify suspicious activity in relation to split transactions that occurred within short periods of time” ignores the fact that the CDD/EDD cumulation thresholds were applied by the aggregator, and BSEL then carried out an extra check based initially on the date of upload, with a more sophisticated version being implemented in June 2020. There was no breach of Reg 19(3)(c).

Ms Chapman decided that BSEL had breached Reg 19(3)(c) because transactions were received from one aggregator, M Ltd, “in bulk rather than being split by agent” and “as a result, BSEL was unable to carry out any monitoring on the transactions of this aggregator at agent level”.

M Ltd was onboarded as an aggregator in August 2019. The Compliance Report for October 2019 issued by Mr Kirby, the MLRO, included this statement:

“[M Ltd] has been by far the most efficient and compliant aggregator…The upload of correct IDs and KYC documentation has been right first time from their agent network.”

However, M Ltd was suspended by HMRC on 14 December 2019 and was offboarded by BSEL in consequence.

As noted at §573, on 10 December 2020, Ms Chapman asked BSEL an extensive list of questions covering at least 27 issues, although that list of questions is not exhibited to her witness statement. The replies are numbered, and as part of the answer to Q27, BSEL provided this response:

“M Ltd did operate a network of agents and, although historically some of [its] data was in bulk, BSEL started to capture the details of its agents in early 2020. M Ltd was offboarded in December 2019.”

That statement is internally inconsistent – since M Ltd was offboarded in December 2019, BSEL cannot have “started to capture details of its agents the following month”. It is also inconsistent with the contemporaneous evidence of the October 2019 Compliance Report that (a) BSEL was receiving “correct IDs and KYC documentation from their agent network” and (b) was monitoring that documentation, as it was “right first time”. In addition, I have already found that BSEL was under pressure to meet Ms Chapman’s deadlines which extended over the Christmas and New Year period, see §579.

I place no reliance on the answer given to question 27, and find as facts, in reliance on the October Compliance Report, that BSEL did receive documentation about individual customers from M Ltd’s agent network, and that those transactions were monitored.

It follows from my findings of fact that Ms Chapman was wrong to conclude that BSEL was breaching Reg 19(3)(c) in relation to the data supplied by M Ltd.

Ms Chapman also decided that there had been breaches of Reg 19(3)(c) because BSEL had not implemented an effective PCPs so as to:

These are essentially the same issues as have already been considered at §656ff and §600ff, and for the same reasons, I find there was no breach. I add that the aggregators were also separately regulated by HMRC.

Ms Chapman additionally stated in the ToF that “although a phone number is now mandatory for all beneficiaries and the format of it is now checked, these controls weren’t implemented until the new aggregator API [Application Programming Interface] integration in June 2020”.

I have already found that all aggregator transactions in cash were subject to the same monitoring thresholds as for agents, and any breach of thresholds or documentary evidence provided by the aggregator would trigger a request for additional information and prevent the transactions from being completed; furthermore BSEL designed and implemented a new Application Programming Interface to obtain additional transaction and customer data from the computer system of each aggregator, and this was finalised in June 2020. I accept that evidence, and incorporate it into my findings of fact.

Reg 19(2) requires PCPs to be “proportionate with regard to the size and nature of the relevant person's business”. BSEL had numerous checks on its aggregators (see §570ff). In June 2020, BSEL improved the controls over aggregator data in the ways set out above. That is consistent with Reg 19(1)(b), which requires relevant persons to “regularly review and update” its PCPs.

Ms Chapman also decided that BSEL had breached Reg 19(4)(e)(i) because it did not have PCPs so as to ensure “that appropriate measures are taken…to assess whether an agent used by the business would satisfy the fit and proper test provided for in regulation 58”. Ms Chapman came to her conclusion because she decided that:

Reg 58 has already been considered at Part 5, and so far as relevant to this part of the ToF, it provides that HMRC “must refuse to register” an MSB if it is satisfied that “any officer, manager or beneficial owner” of an agent is not a “fit and proper” person, but in deciding whether or not that is the case, HMRC may take into account the opinion of the principal, here BSEL.

The HMRC Guidance says at 9.16 that:

“Principals should ensure that an agent meets minimum expectations, in particular that:

● the beneficial owners, senior managers, officers and nominated officer of the agency are fit and proper persons for their fiduciary role;

● they should be of good character, they should not have criminal records (see Appendix 1: Relevant offences under schedule 3 of the Regulations), or have been the subject of any professional conduct or disciplinary action, and they must demonstrate professional standards and competence in business conduct…”

Schedule 3 of the Regulations lists a range of criminal offences under English law; it also includes criminal offences under the law of a foreign country, and acts which would have constituted criminal offences within Schedule 3 had they been committed in the UK.

HMRC’s Guidance on the F&P test says that principals “must”:

The same guidance also says that “HMRC suggests” that “principals should have the individuals concerned get a certificate following a basic Disclosure and Barring Service check” but goes on to say that “HMRC is happy to consider accepting other methods as long as the results achieved can be shown to be equally robust” and that “HMRC cannot register a principal unless it’s satisfied that responsible persons in the business and its agents are fit and proper”.

HMRC’s separate guidance entitled “Apply for the fit and proper test and HMRC approval” says:

“To reach a decision we’ll consider a range of information including whether you have:

•

been convicted of or are being investigated for money laundering or other offences involving dishonesty, fraud or financial crime

•

been disqualified from acting as a company director

•

been subject to a confiscation order under the Proceeds of Crime Act 2002

•

a track record of consistent non-compliance with the Money Laundering Regulations, or with the EU Payments Regulation which applies to money
transmission service providers

•

been disciplined or expelled by another supervisor or professional body for regulatory or professional failings.”

In addition to the MLR, Reg 29(4)(iii) of the Payment Services Regulations 2009 similarly required that an authorised payment institution such as BSEL ensured that agents were fit and proper: the provision reads:

“In the case of an agent of an authorised payment institution, the identity of the directors and persons responsible for the management of the agent and evidence that they are fit and proper persons.”

Reg 34(3)(a) of PSR 2017 provided that an application for an agent to be included on the register must contain, inter alia “the identity of the directors and persons responsible for the management of the agent and, if the agent is not a payment service provider, evidence that they are fit and proper persons”.

BSEL has a detailed and comprehensive policy for “onboarding” agents, as outlined at §462ff. In reliance on Mr Garcia’s evidence I find that since at least since January 2017, when he joined BSEL, would-be agents have been required to complete an “Individual Information Form”. That form had to be completed and signed by the owner of the business (if a sole proprietor); by each partner (if the business was a partnership); and by each director (if a company) and also by “any other person directly and/or indirectly responsible for managing the business”. These requirements are explicitly set out in the “Application Checklist” which summarises all the documents which must be submitted by an applicant.

Under the heading “Fitness and Propriety” the Individual Information Form asks extensive questions. which include the following:

In relation to the questions about criminality, the Individual Information Form specifies that disclosure is required of “matters whether in your country of residence or overseas” and must include “spent convictions and cautions”.

Before November 2018, BSEL checked the information on the Individual Information Form by carrying out credit checks and AML checks via a third-party provider, Creditsafe; these checks also identified whether the applicant had any registered county court judgments. In November 2018 Exiger provided its second report to BSEL. Under “Recommendations” Exiger said that although there was no regulatory requirement to conduct negative news searches, BSEL should consider these for higher risk agents. Exiger then said:

“Similarly, BSEL should consider performing criminal record checks on UK based agents using a risk based approach to target higher risk agents.”

BSEL accepted that recommendation, and went further: from November 2018 BSEL carried out DBS checks before onboarding for all agents, not just those who were “higher risk”.

Once the agent had submitted all the required documents and satisfied all BSEL’s extensive checks, the compliance team applied to the FCA to register the agent. In addition, BSEL’s PCPs require that it notify HMRC of the agent’s name and address within 30 days from its first transaction.

All agents undergo extensive online AML/CTF training before they are permitted to carry out any transaction, and before they can access the Remit ERP system. The Bundle included around 200 pages of training material relating to AML/CTF, covering periods from 2018 to 2021. Applicants who fail the training are not permitted to be an agent.

BSEL classifies agents as high, medium or low risk (see further §743ff below). Agents classified as high risk are subject to an annual review; medium risk agents are subject to review every 18 months and low risk agents every two years. On review, BSEL carries out another AML check using Experian and also obtains a further PEP screening, sanction screening and adverse media screening. In addition, a further DBS check is obtained on high risk agents. If an agent appoints a new director, a DBS check has to be obtained for that individual. BSEL’s unchallenged evidence was that it was one of very few MSBs in the UK to require DBS checks on its agents.

Ms Toman asked the Tribunal to uphold Ms Chapman’s decision for the reasons given in the ToF, namely that there had been a breach of Reg 19(4)(e)(i) because:

Mr Lakha submitted that he said it was patently clear on the facts that BSEL had taken “appropriate measures” to assess whether its agents would satisfy the F&P test. In relation to the final point, reliance was placed on BSEL’s rebuttal which is set out below.

I have taken each of HMRC’s points in turn.

Reg 19(2)(a) requires that a business adopt PCPs which are “proportionate with regard to the size and nature of the relevant person's business”; by Reg 19(4)(e)(i) these include taking “appropriate measures” to assess the F&P status of an agent. Reg 19(5) says that “in determining what is appropriate or proportionate with regard to the size and nature of its business”, a person may take into account guidance issued by HMRC.

The HMRC Guidance has a list of requirements which it says “must” be followed by MSBs. In relation to DBS checks, it says only that “HMRC suggests” that a DBS check is obtained for agents, but that HMRC are “happy to consider accepting other methods as long as the results achieved can be shown to be equally robust”.

There is thus no mandatory requirement for principals to obtain DBS checks on any agent, let alone to renew them every year. BSEL has carried out these checks for all agents onboarded since November 2018 and annually for all agents categorised as high risk.

In relation to agents who had been onboarded before November 2018, it would be extraordinary if the steps taken by BSEL were insufficient to fall within HMRC’s alternative category of “other methods” so as to be “satisfied the responsible persons in the business are fit and proper”, given that (a) BSEL has consistently required all agents to complete a lengthy disclosure form which more than meets the requirements of Schedule 3, as it covers not only criminal convictions and civil judgments but also a range of other indications of involvement with the justice system, both in the UK or overseas; and (b) BSEL also carried out credit checks and AML checks via a third-party provider, Creditsafe which additionally confirmed whether the applicant had any registered county court judgments.

BSEL carries out AML and other checks on each agent; the frequency depended on the that agent’s risk status, see §743ff. I find that this, taken together with its other PCPs, is sufficient to meet the MLR requirement to have “appropriate measures…to assess whether an agent used by the business would satisfy the fit and proper test provided for in regulation 58”, as required by Reg 19(4)(e)(i).

Ms Chapman’s decision that BSEL’s documentation had “no reference to identifying, verifying or F&P testing in relation to managers or company secretaries” is incorrect because:

The final point under this heading was Ms Chapman’s conclusion that thirteen agents with transactions totalling more than £32 million had responsible persons who had not been identified as such by BSEL and were thus not F&P tested. That conclusion was based on (a) the company’s list of 272 agents together with (b) a second list of individuals she had obtained from BSEL, which she took to be a list of those who had been “F&P” tested.

Ms Chapman (or a colleague at her direction) meticulously checked each of the agents on the first list against the Companies House register to identify their directors and officers. Each of those directors and officers were then checked against BSEL’s second list, with the aim of identifying whether any agent had a director or officer who had not been F&P tested. This exercise having been carried out, Ms Chapman concluded that BSEL had omitted 13 individuals from F&P testing.

On 16 July 2021, BSEL filed and served the Appellants’ Schedule (see §110). This set out the following detailed rebuttal of those conclusions:

Ms Chapman’s witness statement is dated 30 November 2021, over four months later, but she did not respond to BSEL’s detailed rebuttals. In particular, HMRC did not file and serve any evidence from Companies House to support points where her ToF had been challenged by the Appellants; neither did HMRC dispute BSEL’s statement that the list on which Ms Chapman was relying did not show all those who had been F&P tested.

As HMRC have the burden of proof, I have accepted BSEL’s evidence that six of the twelve had been “F&P” tested; that one was a duplicate, and that the twelfth was not a director or beneficial owner. Ms Chapman had also inferred that (a) as one agent had two branches, there must be a manager in the second branch, and (b) as no second person was on BSEL’s list, there had been a further failure. However, Ms Chapman did not provide evidence that there was a manager in the second branch.

I therefore find as a fact that the only individuals on Ms Chapman’s list who had not been F&P tested were five company secretaries. Mr Garcia told Ms Chapman during the conference call on 1 and 3 December that all those who transact business with BSEL are F&P tested, and I therefore further find that the five company secretaries identified by Ms Chapman did not transact business. That finding is consistent with the responses on the Appellants’ Schedule.

As already set out above, BSEL required all directors of agents, and also “any other person directly and/or indirectly responsible for managing the business” to complete the Individual Information Form. A company secretary comes within that definition. It follows that company secretaries are required by BSEL’s PCPs to undergo F&P testing, and there was no failure to comply with Reg 19(4)(e)(i).

I accept that five company secretaries did not complete that testing, but that was a failure to comply with the PCPs. I decided that this was a minor failure, having taken the following into account: