Guernsey to progress public-private partnership

Guernsey's Financial Intelligence Unit (FIU) and Committee for Home Affairs have been exploring the possibility of a framework for information sharing between the authorities and the private sector aimed at combatting financial crime, money laundering and the financing of terrorism.

Introduction

Following a closed consultation by the FIU in autumn 2021, the Committee for Home Affairs put forward proposals to create a public-private partnership task force in a Policy Letter dated 22 November 2021 (here). It was due to be debated at the States meeting on 26 January 2022 but was withdrawn from the agenda pending further engagement and consultation.

The proposals are now being progressed and are contained in a Policy Letter dated 3 October 2022 (here) (the Policy Letter), which was approved at the States meeting on 23 – 25 November 2022.

The proposals

The Policy Letter states that the Guernsey Integrated Money Laundering and Terrorist Financing Intelligence Task Force (GIMLIT) is to be established in 2022. The intention is to set-up a ‘Pilot Scheme’ GIMLIT model which will consist of the four main retail banks in the Bailiwick, who have all confirmed that they are keen to promote and participate in it.

The FIU would make requests to members of GIMLIT for information. First, the FIU would make requests based on its own analysis. Second, it would share elements of requests for assistance received from domestic and international law enforcement agencies, financial intelligence units, and other public private partnerships to identify financial assets or products or to provide tactical intelligence about specific subjects or suspect financial activity within the Bailiwick.

The aim would be for each member of GIMLIT to search its databases and then provide the FIU (and, if that member considered it appropriate, other private sector participants) with any information it holds (or can obtain from elsewhere in the group to which the member belongs) which is relevant to a request. The provision of information to the FIU through GIMLIT would be voluntary.

On receipt of information through GIMLIT, the FIU could utilise its existing information gathering powers to formally request the information from the member. On receipt of that, the FIU would undertake operational analysis and, if a requesting authority was involved, disseminate relevant intelligence to that authority.

Suspicions Activity Reports (SARs) submitted to the FIU by reporting entities would not be shared within GIMLIT, although case information shared within GIMLIT might reflect the contents of one or more SARs (without identifying any Guernsey party or GIMLIT member as a source of information).

The FIU needs no new legal powers to establish GIMLIT. However, the legislative framework on the provision of information sharing will require amendment for the effectiveness of GIMLIT to be assured, including the confidentiality provisions or other restrictions on sharing such information between the members of the GIMLIT.

Confidentiality

Various measures are suggested to protect the confidentiality of information shared, including:

• The existing legislative framework should be amended along the lines of confidentiality provisions in the Civil Contingencies (Bailiwick of Guernsey) Law, 2012. These provide that it is an offence for any member of the Civil Contingencies Authority, or any employee of the States of Guernsey engaged in work for the Authority, to unlawfully disclose any information, document or other article to which they have access by virtue of their position.

• All participants in GIMLIT would require to sign a Memorandum of Understanding (modelled on that used in the UK), which would highlight the importance of confidentiality and the purpose(s) for which information obtained by GIMLIT members could be used.

However, it remains to be seen how businesses will reconcile their confidentiality obligations to clients with disclosures to the FIU and other GIMLIT members if the provision of information is not strictly necessary. When the proposals are at a more advanced stage, consideration should be given to amendments to terms and conditions.

Data protection

Under the data protection regime, personal data may only be processed in accordance with specified, explicit and legitimate purposes. The intention is that providing information to the FIU and potentially other GIMLIT members would be covered by one of the lawful processing grounds under Schedule 2 of the Data Protection (Bailiwick of Guernsey) Law, 2017 (paragraph 13A, 'necessary for a law enforcement purpose'). Businesses considering joining GIMLIT in the future should consider the wording in their privacy notices around disclosure given that the provision of information may not be mandatory.

The FIU proposes to draft a Data Protection Impact Assessment (DPIA) which would aim to identify and minimise the data protection risks that may need to be considered when developing GIMLIT. This DPIA will include the process that the FIU will adopt when sharing information between the GIMLIT members, the legal basis for sharing information, and the controls and measures that will be put in place to reduce the risk of breaching data protection requirements.

Next steps

At the States meeting, the States approved the preparation of the necessary legislation to effect the proposals.

It is thought that the progression of the proposals is part of Guernsey's preparations for the 2023/24 MONEYVAL visit.