The Upper Tribunal of the Tax and Chancery Chamber has recently decided in favour of the Financial Conduct Authority (FCA) in agreeing to continue restrictions imposed by supervisory notices on the e-money firm Nvayo Limited (Nvayo).
Nvayo is an e-money institution that is authorised by the FCA under the Electronic Money Regulations 2011 (EMRs). Nvayo is subject to various regulations including obligations in relation to Anti-Money Laundering (AML) and the Payment Services Regulations (PSRs).
In May 2023, Christopher Scanlon, Nvayo's ultimate beneficial owner (UBO), was arrested by the US Department of Justice (DOJ) on charges of conspiracy to control and own an unlicensed money transmitting business. The FCA issued Nvayo with First and Second Supervisory Notices on 8 and 24 August 2023 respectively as a result of FCA concerns about Nvayo's handling of Mr Scanlon's arrest and the DOJ Investigation that had preceded it. The FCA then issued a Further Supervisory Notice on 21 November 2023 following the discovery of what it regarded as significant AML compliance deficiencies after carrying out a review of some of Nvayo's client files. The Supervisory Notices imposed on Nvayo had the following effect:
- restricted Nvayo from undertaking new business;
- restricted Nvayo's dealings of its own assets until the FCA considered that their concerns in respect of Mr Scanlon and AML were satisfied; and
- stopped redemptions by existing customers unless the appropriate AML due diligence in relation to the customer had been remediated to the satisfaction of a skilled person (an independent third party appointed under s166 of the Financial Services Markets Act 2000).
Nvayo applied to the Upper Tribunal to suspend the effect of the requirements pending a full hearing of its reference to the Tribunal. Rule 5(5) of the Tribunal Procedure (Upper Tribunal) Rules 2008 gives the Tribunal the power to suspend the effect of a decision in relation to which a reference has been made pending the determination of the reference. The condition for granting the application to suspend is that the Tribunal:
“…is satisfied that to do so would not prejudice
(a) the interests of any persons (whether consumers, investors or otherwise) intended to be protected by that notice;
(b) the smooth operation or integrity of any market intended to be protected by that notice; or
(c) the stability of the financial system of the United Kingdom"
The Tribunal rejected Nvayo's application.
Restriction on Nvayo undertaking new business
The Tribunal placed particular emphasis on Mr Scanlon's ongoing status as the UBO of Nvayo following his arrest. Mr Scanlon had served as the CEO of Nvayo between 21 November 2022 and May 2023. He was immediately relieved of his position as CEO after his arrest in 2023. However, his ongoing status as the UBO of Nvayo was directly relevant to Nvayo's regulated status.
The Tribunal took the view that potential new customers and indeed the general public could quite rightly be concerned if Nvayo was allowed to take on new customers without restrictions when its UBO was facing such serious criminal allegations.
Another factor that was relevant to the issue of the interests of those intended to be protected by the notice was the fact that two of Nvayo's bank accounts had been closed after the publication of Mr Scanlon's arrest and it had received a notice of withdrawal of service by its last remaining account provider. The closure of the last remaining bank account would undermine Nvayo's ability to fulfil its regulatory obligation to safeguard the funds of its current and potential future customers. The Tribunal was not persuaded by assurances put forward on behalf of Nvayo that it could persuade the last remaining banking provider not to close its account. It therefore concluded that suspending the restriction on Nvayo taking on new customers would leave the persons intended to be safeguarded under rule 5(5)(a) unprotected.
Restriction on Nvayo dealing with its own assets until the FCA considered that their concerns in respect of Mr Scanlon and AML were satisfied
The Tribunal concluded that because there could be no guarantee that the last remaining bank account would not be closed there arose an impending risk that Nvayo could be wound down because it would not be able to carry on its business. The closure of the bank account would have the effect of leaving it unable to comply with its regulatory safeguarding obligations. In view of this the Tribunal concluded that the asset restriction had to remain in place because it was only in these circumstances that the interests of existing customers who would be entitled to have their safeguarded funds returned to them could be protected. As such, a return would require the existence of funds to facilitate it and this could only be guaranteed by a restriction on Nvayo's dealing with its own assets.
Stopping redemptions by existing customers
The FCA had previously examined ten of Nvayo's client files selected on the basis of transactional volume and/or value data. The FCA detected a number of serious AML compliance issues with these client files such as:
- clients who should have been classified as high risk being rated as medium risk
- a lack of proper verification of clients
- a lack of proper application of enhanced due diligence
- an absence of ongoing monitoring.
The Tribunal accepted that there was an absence of appropriate AML controls in relation to these client files and the absence of any concrete evidence of appropriate remedial action being taken in respect of Nvayo's AML controls. This led the Tribunal to conclude that the interests of the general public (who AML requirements were intended to protect) would be undermined if the restriction preventing redemptions by existing customers were lifted. It was reported that Nvayo managed 13,400 active accounts.
It was argued on behalf of Nvayo that the company had engaged the help of outside independent compliance firms to help with its remediation programme but the Tribunal made it clear that the issue was not just having AML policies in place but ensuring that those policies were being properly applied.
Guy Wilkes comment:
We are seeing increasing examples of the FCA placing restrictions on firms assessed as not AML compliant. These restrictions can include preventing firms from returning funds to customers until such time as a skilled person has reported that the firm's systems and controls are substantially compliant or (as in this case) is satisfied that appropriate AML due diligence in relation to the customer has been remediated. We reported on another, similar case here. As the Tribunal commented, these measures are intended to protect the public from the harm caused by money laundering. However, such measures have the effect of freezing thousands of accounts of ordinary customers who, through no fault of their own, have to suffer the consequences of their product provider's deficiencies. Inevitably, appointing a skilled person and reviewing thousands of customer accounts to ensure due diligence is complete is likely to take many weeks. In the meantime, customers have no access to their money. In this case, there appears to have been little regard (by either the FCA or the Tribunal) to provisions in Article 31 of the Money Laundering Regulations 2017 which expressly permit funds to be remitted back to the account holder in circumstances where customer due diligence is not complete. Whilst the FCA generally likes to be seen to be acting in the interests of customers (for example by implementing the all-pervasive consumer duty) the FCA has frequently demonstrated that it is happy to sacrifice the interests of customers on the altar of financial crime prevention. The FCA's insouciance in light of bank de-risking is perhaps another example.
Payments and e-money firms are dependent upon access to banking for continued operation. Banks are themselves subject to heavy regulatory scrutiny of the financial services firms to which they provide facilities. E-money firms are generally considered by banks to be high-risk and any adverse news (in this case an arrest) can result in banks choosing to pull the plug. Action taken by the FCA to protect the interests of customers in this case was therefore unsurprising. Continued access to bank facilities (including maintaining viable alternatives) must be at the forefront of any e-money firm's risk management strategy.