Satisfying the BMA’s regulatory requirements

Here, we will discuss the means employed by the BMA to ensure that licensed entities have their house in order, including prudential meetings and on-site visits.

To recap, regulated entities (including those licensed under the Investment Business Act 2003, the Investment Funds Act 2006 and the Insurance Act 1978) must meet certain minimum criteria. Such entities must make an annual filing with the BMA, certifying that the entity has met these minimum criteria. Consequently, entities should evaluate the minimum criteria regularly (at least annually) and create a plan and timeline for any deficiencies found by their internal review or audit.

The minimum criteria include (but are not limited to):

• Fit and proper person test.
• Corporate governance.
• Whether business is conducted in a prudent manner.

In addition, certain regulated entities may be required to:

• Have a policy of insurance to cover risks inherent in the operation of its business of an amount that is commensurate with the nature and scale of operations.
• Maintain adequate accounting and other records of its business and systems of control of its business and records.
• Maintain minimum net asset, capital and liquidity requirements.

To ensure that regulatory requirements are being satisfied, senior management should audit and periodically test the entity’s policies, procedures and controls for effectiveness and must be made aware of the potential personal liability if legal obligations are not being met. Senior management must address in a timely manner any shortcomings revealed by the independent internal audit.

An independent audit function should include:

• An evaluation of the Anti-Money Laundering / Anti-Terrorist Financing (AML/ATF) risk rating the entity assigns with respect to its size, customers, products, services, transactions, delivery channels, outsourcing arrangements and geographical connections.
• An assessment of the adequacy of its policies, procedures and controls.
• A testing of compliance with relevant laws and regulations.
• A review of any outsourced activities.
• An assessment of the adequacy of employee training and awareness.
• Sample testing.

The audit should be documented and retained, and the results should be reported to senior management and the board. The results of each audit should be used to guide any improvements that the policies, procedures and controls require.

The BMA supervises licensed entities on an ongoing basis to evaluate whether they satisfy the minimum criteria for licensing — and reviews the nature of the provider’s business, the quality of management, the effectiveness of its controls and compliance, the fairness of its treatment of customers and its financial viability. This is designed to ensure that minimum standards are being maintained.

To evaluate a licensed entity, the BMA holds regular prudential meetings with senior management of the entity, scrutinises financial information and performs regular on-site compliance visits of the entity’s premises.

Prudential meetings are generally scheduled annually and provide an opportunity for the BMA to discuss with senior management the development of the licensed entity’s business including past performance and future direction for the business. Topics that are likely to be discussed include internal control issues, adequacy of procedure manuals, planned changes to the business strategy and operational changes.

On-site supervision enables the BMA to review compliance with policies and procedures as well as the processes that management has put in place to monitor and control key risks in the business. This will involve interviews with management and staff, reviews of a selection of documentation of files and a review of customer due diligence and record-keeping measures.

On-site visits are normally scheduled on a three-year rolling basis but may be more frequent depending on the BMA’s assessment of the degree of risk in the business and the effectiveness of the investment provider’s personnel, systems and controls for monitoring risk.

The BMA will generally request information prior to the on-site visit including a staff chart, job descriptions for key personnel, the entity’s questionnaire regarding AML/ATF compliance and copies of policies, procedures, as well as the staff training plan and disaster recovery plan.

Breaches uncovered by the BMA’s prudential meetings and on-site visits may result in a request to remediate or, if a breach is more serious, could result in severe fines, restrictions placed on the licence or even revocation of licence. The BMA may also publish details of any serious breaches and fines levied.

All regulated entities should take a pro-active approach, ensuring that they create a clear and consistent plan of action to evaluate their ability to meet the minimum criteria of licensing under the relevant legislation. It is better to plan than to wait for prudential meetings and/or on-site visits to reveal deficiencies