The prevention of money laundering and combating the financing of terrorism
Policies, procedures and controls
4.7 Casino operators must establish and maintain policies, procedures and controls to mitigate and manage effectively the risks identified in the operator's risk assessment of money laundering and terrorist financing. The policies, procedures and controls must be:
- proportionate with regard to the size and nature of the operator's business
- approved by its senior management (regulation 19(1) and (2)).
4.8 In determining what is appropriate or proportionate with regard to the size and nature of their business, casino operators may take into account any guidance issued by the Commission or appropriate body, and approved by HM Treasury (regulation 19(5)). An appropriate body isa body which regulates or is representative of any trade, profession, business oremployment carried on by a casino operator (regulation 3(1)) (and includes trades bodies such as the National Casino Forum and the Remote Gambling Association).
4.9 Casino operators must maintain a record in writing of:
- their policies, procedures and controls
- any changes to those policies, procedures and controls
- the steps they have taken to communicate the policies, procedures and controls, or any changes to them, within the operator's business (regulation 19(1)(c)).
4.10 The policies, procedures and controls must include:
- risk management practices
- internal controls
- CDD measures and ongoing monitoring, including enhanced measures for high riskcustomers
- reliance and record keeping
- the monitoring and management of compliance with, and the internalcommunication of, such policies, procedures and controls (regulation 19(3)).
4.11 The policies, procedures and controls must also include specific policies, procedures and controls:
- that provide for the identification and scrutiny of:
- complex or unusually large transactions, or unusual patterns of transactions,that have no apparent economic or legal purpose
- and other activity or situation that the casino operator regards as particularly likely, by its nature, to be related to money laundering or terrorist financing.
- that specify the undertaking of additional measures, where appropriate, to preventthe use for money laundering or terrorist financing of products or transactions thatmight favour anonymity
- which ensure that, when new technology is adopted by the casino operator, appropriate measures are taken in preparation for, and during, the adoption of such technology to assess and, if necessary, mitigate any money laundering or terrorist financing risks this new technology may cause
- under which anyone in the operator's business who knows or suspects, or has reasonable grounds for knowing or suspecting, money laundering or terrorist financing must report such knowledge or suspicion to the operator's nominated officer (regulation 19(4)).
4.12 The casino operator’s policies, procedures and controls should also cover:
- the arrangements for nominated officer reports to senior management
- the systems for customer identification and verification, including enhancedarrangements for high risk customers, including PEPs
- the circumstances in which additional information in respect of customers will besought in the light of their activity
- the procedures for handling SARs, covering both reporting by employees and submission to the NCA
- the mechanisms for contact between the nominated officer and law enforcement orthe NCA, including the circumstances in which or defence (appropriate consent)should be sought
- the arrangements for recording information not acted upon by the nominated officer,with reasoning why no further action was taken
- the monitoring and management of compliance with internal policies, proceduresand controls
- the communication of such policies, procedures and controls, including details of how compliance is monitored by the nominated officer, and the arrangements for communicating the policies, procedures and controls to all relevant employees;
- employee training records; and supporting records in respect of business relationships, and the retention period for the records.
4.13 Casino operators must, where relevant, communicate the policies, procedures and controls they establish and maintain to their branches and subsidiary undertakings which are located outside the United Kingdom (regulation 19(6)).
Next chapter: Internal controls