Jan 9, 2025
Key takeaways
This update provides an overview of the recent key publications, findings and reports issued during the last quarter.
You can find previous editions of our Regulatory updates here:
Channel Islands Regulatory Update: October 2024
Channel Islands Regulatory Update: August 2024
1. On 5 December 2024 the UK's Sanctions (EU Exit) (Miscellaneous Amendments) (No.2) Regulations 2024 came into force. The UK Regulations are made under the UK Sanctions and Anti-Money Laundering Act 2018 ("SAMLA") and make various amendments to existing UK sanctions regulations in order to enhance compliance, enforcement and clarity in the UK sanctions framework. Through the provisions of the Sanctions (Implementation of UK Regimes) (Bailiwick of Guernsey) (Brexit) Regulations, 2020, several legislative changes took effect automatically in Guernsey when the UK Regulations came into force.
2. On 1 January 2025, the Income Tax (Approved International Agreements) (Implementation) (OECD Pillar II) Regulations 2024, being legislation to implement the OECD's global minimum tax rate of 15%, known as "Pillar 2", came into force in Guernsey. This will apply to in scope multinational enterprises for fiscal years commencing on or after 1 January 2025.
For insights on the proposed approach to the implementation of OECD Pillar Two in Guernsey please see our article here.3. The GFSC has published two Consultation Papers which cover:
(a) proposed updates to the Prospectus Rules (here). Responses are due by 3 March 2025.
(b) proposed Rules and approach to regulating equity release products (here). Responses are due by 28 February 2025.
4. The GFSC has issued a public Statement dated 14 October 2024 (here). This statement relates to the failure of the Licensee to identify, monitor, and manage the financial crime risks associated with a client as required by Schedule 3 and the Rules within the Handbook.
5. On 20 December 2024 the GFSC confirmed that, since an application to appeal to the Privy Council has been refused in matter of Ian Domaille & Margaret Hannis v GFSC (here), it now intends to proceed to appoint a Senior Decision Maker further to the judgment of the Guernsey Court of Appeal of 18 January 2024 to redetermine the sanctions to be applied in this matter as per paragraph 194 of that judgment (here).
6. The GFSC has also:
(a) issued a comprehensive update to the rules and guidance that apply to operators of regulated investment exchanges (here) which apply from 1 January 2025.
(b) issued updates to two appendices in the Handbook on Countering Financial Crime (here) which add Gibraltar to the Appendix C list of equivalent jurisdictions and update the Appendix I list of higher risk jurisdictions following the Financial Action Task Force changes to its list of jurisdictions under increased monitoring.
(c) issued an amended version of its Explanatory Note regarding the surrender of the authorisation or registration of collective investment schemes (here).
(d) issued Unclaimed Investor Money Guidance which addresses the need for funds to have a policy for unclaimed investor money, to identify a responsible entity for overseeing this policy and to make appropriate disclosure investors (here).
7. The GFSC also plans to increase licence fees paid by firms from 1 January 2025 by 5.3% (here).
8. The GCRA has:
(a) Found that Sure (Guernsey) Limited ("Sure"), between 1 January 2021 and 31 July 2022, failed to comply with the terms of a price control for on-island wholesale leased lines to which it is subject (here). The GCRA has directed Sure to reimburse other licensed telecommunications operators who paid too much for on Island leased lines between 1 January 2021 and 31 July 2022.
(b) Issued a formal "case to answer" to Sure on the basis that Sure may have contravened condition 32 (Fair Competition) of its fixed telecommunications license.
(c) Published for publication its proposed business plan for 2025. The proposed plan outlines the priorities the Authority proposes for next year.
9. The annual registration window has now opened and will run until 28 February 2025 (here).
10. The ODPA has announced the launch of a Guidance Advisory Panel as part of its commitment to continually review and improve guidance for organisations to help them comply with local data protection legislation (here).
11. In addition, the ODPA has:
(a) Signed a Memorandum of Understanding with Abu Dhabi (here), Bermuda (here) and Isle of Man (here) (the "MoUs"). The MoUs sets out how the respective offices will work collaboratively with the ODPA in a number of key areas, further strengthening the cooperation requirements that are contained within the data protection legislation; and
(b) Joined global partners to combat unlawful data scraping (here) by working with some of the world's largest social medial companies following the release of a joint statement on data scraping in 2023 (here). As a result of this engagement, a follow-up concluding statement (here) has been published with additional guidance to help companies protect users’ personal data from unlawful scraping.
12. A number of sanctions have also been imposed by the ODPA:
(a) The Medical Specialist Group ("MSG") have been issued with an Enforcement Order (here) for failings identified in processing agreement. A significant element of the issues highlighted related to the lack of clarity in the Joint Data Processing Agreement that MSG had in place with other parties they shared personal data with.
(b) The Committee for Health and Social Care ("HSC") has been ordered to improve its access request response, requiring that the HSC carry out further searches for a data subject's personal data, and provide them with a copy of everything that they are entitled to receive.
(c) The Revenue Service has been reprimanded allowing a data breach where personal information was erroneously sent to an incorrect email address.
13. Finally, in its latest breach statistics (published on 7 November 2024) (here), the ODPA has reported that there have been 40 reported personal data breaches for the period 1 July to 30 September 2024. The reported breaches affected 2,3834 people and 517 people were affected by high-risk breaches. Of the 40 personal data breaches, 20 involved personal data being sent to the incorrect recipient via email.14. On 27 November 2024 the JFSC published its planned response to recommended actions in Jersey's MONEYVAL evaluation report. The plan addressed 54 recommendations directed at Jersey authorities. Key take aways are as follows:
(a) access to central registry of beneficial owners has been highlighted, with access for obliged entities being reported as being on track for the end of 2024 and discrepancy reporting requirements to also be introduced for entities;
(b) in the context of counter terrorist financing ("TF"), non-profit organisations ("NPOs") remain in focus;
(c) JFSC will be reviewing its supervisory strategy to ensure frequency and type of examinations it utilises will be proportionate to risks presented by different industry sectors; and
(d) there will be more focus on targeted financial sanctions ("TFS") which will include identification of indirect links to close associations with entities and individuals subject to sanctions.
15. In March 2023, Jersey adopted a new Deferred Prosecution Agreements ("DPA") regime to encourage corporate entities to self-report specified economic crimes.
16. Under the regime, an entity that commits a prescribed offence must submit a self-report to the Attorney General ("AG") (prior to being the subject of a prosecution) identifying the offences and providing relevant evidence. The AG considers the self-report and determines whether it is in the interests of justice to enter into a DPA with the entity in respect of the specified offence. The DPA must then be approved by the Court, with the Court ensuring that the proposed terms are "fair, reasonable and proportionate".
17. On 18 December 2024, the AG entered into its first DPA (here). As part of the DPA, a £408k fine and £60k fee for the AG's costs were applied.
18. On 5 December 2024 the UK's Sanctions (EU Exit) (Miscellaneous Amendments) (No.2) Regulations 2024 came into force. The UK Regulations are made under the UK Sanctions and Anti-Money Laundering Act 2018 ("SAMLA") and make various amendments to existing UK sanctions regulations in order to enhance compliance, enforcement and clarity in the UK sanctions framework. Through the provisions of the Sanctions and Asset-Freezing (Implementation of External Sanctions) (Jersey) Order 2021 ("SAFO"), several legislative changes took effect automatically in Jersey when the UK Regulations came into force.
19. On 14 November 2024, the Government of Jersey launched a follow up consultation on the proposed legislative changes to introduce a consumer credit regime in Jersey. This consultation closed on 13 December 2024 and we anticipate draft legislation to be lodged for debate in the first quarter of 2025.
20. On 21 November 2024, the Government of Jersey launched a consultation seeking views on the introduction of the Crypto-Asset Reporting Framework ("CARF") and amendments to the Common Reporting Standard ("CRS"). The consultation closes in February 2025.
21. On 1 January 2025, the Multinational Taxation (Global Anti-Base Erosion – IIR Tax) (Jersey) Law 2025 and Multinational Corporate Income Tax (Jersey) Law 2025, being legislation to implement the OECD's global minimum tax rate of 15%, known as "Pillar 2", came into force in Jersey. This will apply to in scope multinational enterprises for fiscal years commencing on or after 1 January 2025.
For insights on the proposed approach to the implementation of OECD Pillar Two in Jersey please see our article here.
22. JFSC have published:
(a) an update to its guidelines on interpretation of Article 36 of the Proceeds of Crime (Jersey) Law 1999 ("POCL"). The changes clarify that for the purposes of Schedule 2 of the POCL, and provided specific criteria are met, issuers of debt securities are not in scope or required to register with the JFSC.
(b) results on 2023 examination feedback on terrorist financing and proliferation financing (here). The paper flagged that whilst TF risk is generally well implemented into entities' BRAs and CRAs, less consistent consideration was given to proliferation financing ("PF") risk;
(c) its Q2 Registry Supervision inspection programme feedback (here). Key findings include statutory registers containing inaccurate or outdated information, lack of understanding of the three-tier test, failure to disclose the individuals who control a corporate trustee if not JFSC regulated and difficulties associated with recording joint ownership of shares correctly;
(d) "Compliance functions: Key Persons Regime green paper" (here). The paper highlights that recruiting and retaining compliance professionals is an ongoing challenge. This was noted in the MONEYVAL report which identified that shortage of qualified AML/CFT compliance staff seems to be a persistent problem across most sectors;
(e) bitesize feedback for virtual asset service providers ("VASPs") on the travel rule (here); and
(f) bitesize feedback for fund services businesses in respect of unregulated funds (here). Key findings include investor customer risk assessments being inadequate, funds not having customer business and risk profiles for their investors and it being identified that periodic reviews of investors were not completed in a timely manner.
23. In addition, the JFSC has also now published a checklist/application form for the issuance of tokenised real world assets This can be found as a link embedded in the JFSC's Tokenisation of Real World Assets Guidance Notes (here).
24. The JFSC have also announced:
(a) in January 2025 they will launch their annual supervisory risk data collection to collect data from supervised businesses and individuals;
(b) the launch of their AI-powered regulatory chatbot. The chatbot, named Reggie, aims to provide users with a self-help platform providing humanlike answers top regulatory questions;
(c) an update to the countries and territories in AML/CFT/CPF Handbook appendices. The changes can be located here; and
(d) change of Registry (here) and Regulatory (here) fees for 2025, being effective from 1 January 2025.
25. In October 2024, Jersey hosted the Global Privacy Assembly 2024, which is the largest annual gathering of data privacy authorities and professionals. The key areas of focus of the conference were:
(a) accessible privacy – the need for a cultural change to ensure equal access to privacy rights for vulnerable data subjects;
(b) AI – ensuring the use of sensible regulation and the necessity for a diverse regulatory approach to this sector; and
(c) data breaches – noting that controller obligations do not stop at reporting and recording a breach and must include post-breach data subject support.
Key contacts
