UT/2023/000092 - [2024] UKUT 00035 (TCC)

As already identified, in this context of AML, the persons intended to be protected by the Authority’s notices are the public. A risk of facilitation of financial crime arises where checks and monitoring that ought to have been carried out to stop someone opening or using an account were not properly carried out. The concern is, for instance, that individuals whose identities were not verified, or who ought to have their source of funds and wealth verified will receive repayment. For the purposes of this application, and the reasons set out below I consider that the matters raised in review of the ten client files show, on their face, that there are sufficient concerns with Nvayo’s AML compliance to justify customer redemptions only taking place with appropriate supervision by the Skilled Person. In agreement with Mr Temple, there is a lack of detailed evidence showing the AML concerns have been addressed.

It is true ten client files reviewed represent a tiny proportion of the total amount of clients, but the clients were selected as the top clients by transactional volume and/or value data Nvayo had provided. A risk-based approach, as Mr Jacklin’s statement indicates, is fundamental to the AML system. That such deficiencies arise in these top ten files might be considered of concern purely in terms of redemption for those particular customers given they will include amongst them the highest value clients. One might also accordingly expect that the top ten files would illustrate the high-water mark of Nvayo’s AML system and its implementation. However, the issues identified, which include lack of identity verification, and risk assessment and omitting to obtain information on source of funds and source of wealth are clearly fundamental. I reject the depiction of these deficiencies as merely administrative. The MLRs contain a number of requirements to carry out specified procedures and checks and obtain certain documents, which viewed in isolation and without context could be described as administrative, but they are no less significant because of that. The checks and assessments form the bedrock of the regime’s protection. I am also not persuaded by the argument that the deficiencies can be accounted for by the subjective nature of risk-based analysis. Even assuming that is correct, there are clearly risk issues which require no value judgment such as whether a particular country is designated in the MLRs as high-risk. The review indicates that even in matters involving no subjectivity something went wrong in Nvayo’s processes.

Nvayo argue the client files do not represent the whole of the picture and that there is information elsewhere in its systems which the Authority did not request (see [61]). However, in order to make good on this point it was incumbent on Nvayo to explain in its evidence before the tribunal how and where those gaps in compliance were filled. It ought not to have been an unduly onerous task to explain how other material not present on the client files relating to ten clients, or at the very least a sample of those, addressed the deficiencies.

Nvayo also refer to “additional information with respect of Nvayo’s policies, risk scoring, risk assessments, and ongoing remediation” which mean the AML failings are not as serious as stated. But it is not clear to me how further information on Nvayo’s policies will resolve the concerns which have arisen regarding the application of those policies in practice. The review findings concern an inconsistency of application of the AML regime rather than a complete lack of system or policies (the findings refer for instance the use of various compliance and screening tools and to a positive intervention by the MLRO). The review findings suggest something has gone wrong in the way the policy has been implemented in practice. It is also not explained in sufficient detail what additional information on risk scoring and risk assessments meant the failings were not as serious as made out.

As regards the evidence Nvayo has put forward regarding remediation this is also too high level and lacks the necessary detail. Mr Auld argued in reply that Nvayo should not have to give detailed evidence in an application for suspension producing a massive witness statement going through some 13000 accounts. I have already rejected the point that as a matter of principle detailed evidence is not called for (at [31] above) but the circumstances of this case illustrate that detailed evidence (which should of course be relevant evidence) does not necessarily equate to voluminous evidence. Such detailed relevant evidence might for instance have sought to demonstrate to the tribunal that Nvayo had put in place a system that would uncover the sorts of fundamental MLR compliance issues identified in the review, and which addressed any non-compliance before a customer payout was made.

Nvayo’s reference to the help it is getting from external providers also lacks detail and does not address the relevant concern. The file review of the ten clients refers to Nvayo using ComplyAdvantage and Jumio systems where it is clear they have been deployed as compliance tools with discrete functions. However, they quite clearly could not and did not address all of the relevant compliance obligations. Those required Nvayo’s interventions and oversight too. Ultimately the concern is that such evidence as there is, which is in very general terms, does not explain how the remediation work carried out by the independent compliance firms will provide the necessary reassurance that existing files will be checked for MLR compliance and remediated before any payout is made. Similarly, the fact a Skilled Person, once they are appointed, is carrying out a review will not address the specific concern that a customer would be paid out on a non-AML compliant file. Also, the fact that Mr Jacklin says the ten files that were reviewed were checked and found to contain no material error by another independent compliance specialist prior to submission of those files to the Authority, taken at face value, is a reason to approach the further claim that the involvement of such consultant in the remediation with caution rather than as a point in Nvayo’s favour.

In conclusion, in relation to this requirement, in the absence of sufficient evidence advanced by Nvayo, I am unable to be satisfied that the persons intended to be protected by the relevant Supervisory Notice (the public at large) would not be prejudiced if the requirement restricting the repayment to customers unless with the supervision of the Skilled Person, were to be suspended.

Nvayo also submit that, to the extent there were any AML concerns which would have been apparent earlier in February 2023, it is telling that the Authority did not at that point assert the consumer risks it now does or seek to impose the severe restrictions it has. Whether to take regulatory action and when are matters of discretion for the Authority and will be based on its own view of the facts. The particular question at this point in the Rule 5(5) analysis is whether the tribunal can be satisfied that no relevant prejudice would arise if a suspension would be granted. I am not persuaded the tribunal can draw any particular inference in relation to that from the Authority’s action or inaction at a given point of time. On a similar theme Mr Auld submitted as a general point that it must be the case that some regulatory matters will more appropriately dealt with by way of normal supervision or the involvement of a Skilled Person rather than the imposition of requirements. Again, that does not take the matter any further where, in a suspension application situation such as here, requirements, by definition, will already have been imposed.