Cayman’s Compliance Crackdown - Cayman Adopts UK-Style SAR Timelines under the Proceeds of Crime Act

The Statutory Defence Now Requires the Consent of the FRA

On 2 January 2025, certain amendments to the Proceeds of Crime Act (POCA) came into force[1] that impose new requirements on persons seeking to obtain a defence against the core money laundering offences under the POCA[2].

Prior to these amendments, a person would not commit an offence under the POCA despite carrying out an act that would otherwise constitute an offence (such as transferring relevant funds to a third party), provided that they had first filed a suspicious activity report (SAR) with the Financial Reporting Authority (FRA). Under the new process, a person must not only file a SAR, but must now also obtain the prior consent of the FRA ‘to commit the act’.

This is a significant change that creates potential pitfalls for SAR filers. Failure to obtain the FRA’s consent prior to carrying out a relevant act could result in conviction and the imposition of statutory penalties, including fines and/or imprisonment.[3]

The Introduction of Deemed Consent and a Moratorium Period

The new consent regime is intended to be supplemented with a framework prescribed by regulations,[4] however the draft regulations are still the subject of consideration by the FRA. A consultation process is anticipated shortly.

In the absence of regulations, on 10 January 2025, the FRA issued an “Industry Advisory: Defence Against Money Laundering (DAML) / Consent Regime” with interim guidance for industry participants on how to navigate the present consent process. The Industry Advisory can be read in full here, and in summary, provides as follows:

1. Submitting a DAML / Consent Request: Where a person seeks the consent of the FRA, they should file a SAR indicating that it is a “DAML SAR”. [5] The SAR should specify the full details of the activity for which a DAML is sought, with supporting reasons.
2. Notice Period and Deemed Consent: Once a DAML SAR is filed, the FRA will have 7 working days (commencing the first working day after filing) to respond, failing which the applicant will be deemed to have obtained consent and can therefore proceed with the proposed act without attracting liability for the core money laundering offences.[6]
3. Refused Consent and Moratorium Period: If the FRA gives notice of refusal of consent, a 30-calendar day “Moratorium Period” will commence, during which time the applicant should not engage in the activity that is the subject of the DAML SAR (or they will risk committing a core money laundering offence). The Moratorium Period starts the day after the FRA issues the refusal notice. It is intended to provide a period within which law enforcement can take further action, for example by obtaining freezing or restraint orders over property. We understand from the FRA that if law enforcement does not take any action before the expiry of the Moratorium Period, the applicant will be treated as having deemed consent. As this is not stated in the Advisory, stakeholders should maintain regular contact with the relevant authorities during this period and seek specific advice on this aspect on a case by case basis.

Case Study

While the Industry Advisory is intended to strike a balance between the prevention of money laundering and the promotion of the free flow of trade, regulated entities and compliance professionals should be acutely aware of its implications. Consider the following hypothetical scenario:

A bank files a DAML SAR with the FRA, places an informal freeze over the relevant customer’s account and awaits the FRA’s response. The bank does not receive a response for six business days (or 8 consecutive days). The customer demands an explanation as to why the bank has refused to execute their payment instructions. The FRA responds on the seventh business day and refuses consent. The 30-day Moratorium Period commences. During this time, the bank is required to maintain an informal freeze over the customer’s account.

The scenario highlights the following concerns:

1. Tipping off: The bank cannot explain to the customer why their account has been frozen. If it does, it could be liable for the offence of “tipping off”.[7] Regulated entities should therefore update their procedures to ensure that they have a suitable generic response to provide to customers where a SAR has been filed that does not risk tipping off. The nature and extent of customer communication becomes acutely important for regulated entities where the Moratorium Period is in place, as customers are likely to become increasingly frustrated that (i) their instructions are not being complied with and (ii) they are not being given an explanation as to why.
2. Delays in processing transactions: regulated entities should be aware of the friction between the commercial and regulatory objectives that the new regime poses. Under the previous regime, a regulated entity only needed to file a SAR and could then proceed to execute customer instructions (as the filing of the SAR provided a statutory defence) – this could happen in a matter of hours. Under the new regime, the bank must await the FRA’s response, which could take 39 calendar days in a circumstance in which a Moratorium Period is imposed at the end of the Notice Period.
3. Litigation risk: regulated entities should be prepared for customers taking legal action against them when their instructions are not executed promptly. This risk is particularly heightened where the sum in question is significant, and the consequences for delayed payment are severe. In Guernsey,[8] there has been a rise in customers bringing “mandate proceedings” against banks/trustees for a failure to execute instructions (i.e. breach of mandate) while a regulator decision is pending.[9] Therefore, regulated entities may be exposed to considerable costs and risks of litigation while the FRA considers its response within the prescribed time periods.

Cayman industry stakeholders should therefore take steps to prepare for the road ahead, with appropriate policies and procedures, increased internal risk management processes, and adequately resourced regulatory teams. External advice should be taken as early as possible to manage the risks around potential legal claims from customers and a review of customer terms and conditions at the onboarding stage is advisable.

[1] Proceeds of Crime (Amendment) Act, 2023; Proceeds of Crime (Amendment) Act, 2023 (Commencement) Order, 2024; and Proceeds of Crime (Amendment) Act, 2023 (Commencement) (Amendment) Order, 2024.

[2] The core money laundering offences are prescribed under sections 133 to 135 of the POCA: these are (i) the “concealing” offence (s 133); (ii) the “arrangements” offence (s 134); and (iii) the “acquisition, use and possession” offence (s 135). For completeness, the other money laundering offences include (i) the “failure to disclose” offences (ss 136 and 137); and (ii) the “tipping off” offence (s 139).

[3] POCA, s 141(1): on summary conviction, a fine of CI$5,000 or imprisonment for up to two years, or both; and on conviction on indictment, imprisonment for up to fourteen years, a fine, or both.

[4] POCA, s 145(1)(fa).

[5] The SAR Form template can be downloaded from the FRA website here.

[6] The Director may extend this 7 working day period where he is of the view that an amendment to a SAR is required because it is incomplete.

[7] POCA, s 139: A person commits an offence if they know or suspect criminal activity has taken place, is taking place, or will take place, and makes a disclosure which is likely to prejudice any investigation. Tipping off can result in significant penalties, including, on summary conviction, a fine of CI$5,000 or imprisonment for up to two years, or both; and on conviction on indictment, imprisonment for up to five years, a fine, or both (POCA, s 141(2)).

[8] Although it should be noted that the Guernsey proceeds of crime framework is different to the present Cayman regime, with the former having no deemed consent, no moratorium period and no prescribed timeframe for the regulator to respond (Criminal Justice (Proceeds of Crime) (Bailiwick of Guernsey) Law).

[9] For example, Chief Officer v Garnet [2011-12 GLR 250]; Jakob International v HSBC (Royal Court Judgment 26/2016); Liang v RBC Trustees (Royal Court Judgment 20/2018); BD Limited v Investec Bank [2022] GRC103; L, M, N and Mrs B v Credit Suisse [2023] GRC026).