04.21 – Information maintained for regulatory or customer relationship purposes

Under certain circumstances, Financial Institutions will have an obligation to review information maintained for regulatory or customer relationship purposes (including information collected under AML/KYC Procedures).

This is needed when

  • determining whether an Entity Account Holder is a Specified Person,
  • undertaking a paper based review of a high-value account holder,
  • identifying whether a Controlling Person of a Passive NFFE is a Specified US Person, or
  • confirming the reasonableness of a self certification.

For complying with the regulations a Financial Institution only to review ‘active’ information, as this is the information being ‘maintained’ for the customer and regulatory purposes i.e. information that accessible and is in current use. Information that is in use for automated purposes only, such as mailing lists, will still qualify as active.

Information that is simply being retained for regulatory or customer purposes (i.e. AML says you must keep for X years, or access to the information will only be needed on a ‘just in case’ basis, a change of status, such as death of the named contact or maturation of a policy) will not need to be reviewed as, for the purposes of these Regulations, is not being maintained so does not have to be reviewed until such time as it is used again.

Data that is being retained will need to be reviewed if the information ever becomes ‘active’ again. This will be when the information is used with respect to the operation of the account, such as on a change in the status of the type mentioned above. A review of the information that does not relate to the operation of the account (such as an AML review of the Financial Institution) will not lead to the information being treated as ‘active’, and no review would be needed. When the material is reviewed, new information found will qualify as a Change in Circumstance (see 4.18). Information is only ‘new’ if it is in addition to what was found on previous reviews, for example, the finding of an indicia for an individual where that indicia has been identified from other documentation and was cured, will not be new information. If the Financial Institution has previously “cured or repaired” other indicia, the same information may be used, provided that the date of the ‘cure’ postdates the date of the information being reviewed, and that the cure obtained meets the criteria for curing the new indicia found.

In practice, this is likely to mean that the data held electronically then this is the information maintained for regulatory purposes. Although there may be situations where paper files or electronic non-searchable documents also need to be reviewed, archived data that may have been obtained for regulatory purposes, or historic records that being retained until account closure or in the case of dispute, do not need to be reviewed.