Key Takeaways
- AML and KYC obligations in Guernsey apply to specified businesses, which must carry out risk assessments to determine the controls they need.
- Customer due diligence forms the core requirement, with enhanced or simplified measures applied depending on the risk a relationship presents.
- Businesses must monitor relationships on an ongoing basis, report suspicious activity to the Financial Intelligence Unit, and keep AML records.
- Failure to meet these obligations can lead to penalties and enforcement, making the MLCO and MLRO roles central to staying compliant.
AML and KYC Obligations in Guernsey: An Overview
Anti-money laundering and know-your-customer rules in Guernsey are a regulatory obligation that binds businesses providing financial services or certain professional services within the Bailiwick. The regime rests on the Criminal Justice (Proceeds of Crime) (Bailiwick of Guernsey) Law, 1999, supervised by the Guernsey Financial Services Commission, and reaches every firm that carries on banking, fund administration, trust and company services, investment, insurance, or other regulated activity in the islands.
These obligations apply to the firm conducting the business, not to its overseas owners directly, but they shape how a Guernsey-based entity onboards clients, monitors relationships, reports suspicion, and keeps records. This article explains who falls within scope, what customer due diligence and reporting duties involve, the internal compliance roles required, and the penalties for getting it wrong. It is most relevant to foreign owners and advisers whose Guernsey company itself provides financial or prescribed services, and to those whose entity is a customer of such a firm and must satisfy its checks.
The Guernsey AML Legal Framework and Its Supervisor
The Proceeds of Crime Law sits at the centre of the regime, criminalising money laundering and requiring regulated firms to identify and scrutinise their customers. It works alongside the Terrorism and Crime (Bailiwick of Guernsey) Law, 2002, the Drug Trafficking Law 2000, the Sanctions (Bailiwick of Guernsey) Law 2018, and the Financial Services Business (Enforcement Powers) Law 2020.
Predicate offences are drawn widely. Any offence indictable under Bailiwick law qualifies, and property of any value derived directly or indirectly from criminal conduct counts as proceeds of crime.
The operative obligations live in Schedule 3 to the Proceeds of Crime Law, published on the Guernsey legal resources site. The detail of how to comply comes from the GFSC's Handbook on Countering Financial Crime (AML/CFT/CPF), whose most recent edition is dated 19 November 2024 after several revisions through the year.
The Handbook is not optional reading. The courts must take account of GFSC rules and guidance when deciding whether a firm has met its Schedule 3 duties, which gives the Handbook real legal weight in any enforcement or prosecution.
Since 26 April 2024, corporate "failure to prevent" offences cover the facilitation of money laundering and terrorist financing. A firm can be criminally liable where someone acting for it commits such an offence, unless it can show it had adequate prevention procedures in place.
The GFSC is the primary supervisor for financial services businesses, including banks, insurers, funds, and fiduciaries. The Guernsey Registry enforces minimum standards for estate agents, accountants, and lawyers who are not Guernsey Advocates, while the Chambre de Discipline covers Advocates.
A point worth registering for context: the February 2025 MONEYVAL report recorded very high levels of compliance with FATF standards across the Bailiwick. Guernsey also published a second National Risk Assessment in 2023 and a separate assessment on legal persons and arrangements in 2024.
Company Incorporation in Guernsey
Set up your company in Guernsey with Expanship handling registration end to end.
Who Must Comply: Specified Businesses and Their Risk Assessments
The regime applies to "specified businesses." That category splits into two groups: financial services businesses and prescribed businesses.
Financial services businesses cover any person carrying on banking, financial leasing, money services, insurance, investment, asset management or administration, trusteeship, or company and trust formation and administration. Prescribed businesses bring in lawyers, accountants, and estate agents, though law firms are regulated only for defined activities such as conveyancing and mergers and acquisitions, not litigation.
Geography matters less than activity. The rules apply to all specified businesses conducting business in the Bailiwick, including Guernsey branches and offices of companies incorporated elsewhere that carry on financial or prescribed business locally.
Every specified business must complete a Business Risk Assessment that identifies where its products and services are exposed to money laundering and terrorist financing risk, informed by the National Risk Assessment. Each individual client relationship and occasional transaction then requires its own relationship risk assessment.
Beyond risk assessments, firms must keep proper records, monitor relationships on a continuing basis, screen new starters, and train staff and business partners. Failing to do so is itself an offence under Schedule 3.
General insurers and intermediaries are not required to comply with the AML/CFT Handbook, because they are not regarded internationally as carrying significant money laundering exposure. They must still report suspicion to the Financial Intelligence Service.
One further obligation arrived in 2024: specified businesses had to complete a counter-proliferation financing business risk assessment before 31 December 2024. Even though the islands' own proliferation financing risk is rated very low, the factor still has to be built into risk assessments and training.
KYC and Customer Due Diligence Requirements
Customer due diligence is the practical core of the regime. A firm must conduct CDD on every customer before it establishes a business relationship, never afterwards.
Where the customer is a legal person or arrangement, the firm has to take reasonable measures to understand the nature of its business. Prescribed businesses are held to a demanding standard on origin of money: they must establish and understand both source of funds and source of wealth, and obtain corroborating evidence rather than relying on the client's word.
Identifying the real customer is a recurring difficulty when a firm acts through an intermediary. The rules require firms to work out which entity in a transaction chain is the actual customer, then weigh all the risk factors attaching to that relationship.
A global compliance template does not satisfy the Bailiwick. Businesses that applied a multi-jurisdictional approach to their policies and controls were found not to have met the Handbook; Guernsey-specific compliance is required.
Outsourcing is permitted but does not transfer responsibility. A firm may use a third party to gather identification data, or even appoint an external MLCO or MLRO, yet it must keep effective oversight of any outsourced compliance function. The Handbook organises this material across several chapters, with Chapter 7 addressing the powers that bind legal persons and Chapter 8 setting out the enhanced measures discussed next.
Ongoing Compliance in Guernsey
Keep your Guernsey entity compliant with filings, returns, and statutory obligations.
Enhanced and Simplified Due Diligence: When Each Applies
Enhanced due diligence is mandatory in defined high-risk situations rather than left to discretion. The triggers include:
- A relationship involving a foreign politically exposed person
- A relationship otherwise assessed as high-risk, having regard to GFSC notices and the National Risk Assessment
- Ownership structures using bearer shares or warrants
- A client or beneficial owner connected to a territory that does not properly apply FATF Recommendations, supports terrorism, or is flagged by FATF for enhanced scrutiny
- For financial services businesses, a correspondent banking relationship or similar
Several further circumstances pull a relationship into enhanced territory. These include a client who is not resident in the Bailiwick, the provision of private banking services, an entity used for personal asset holding, and a legal person with nominee shareholders.
For high-risk PEP relationships, whether domestic or international, senior management approval is required before the relationship continues. The specific domestic PEP rules sit in Chapter 8 of the Handbook, which should be consulted directly for the exact treatment.
At the lighter end, simplified due diligence may be applied to relationships and occasional transactions assessed as genuinely low-risk. A Bailiwick-resident client whose purpose and nature are clearly understood by the firm is one common example.
Appendix I of the Handbook lists high-risk jurisdictions and is revised frequently. A foreign owner whose structure touches any listed territory should expect deeper questioning and a longer onboarding process.
Ongoing Monitoring of Business Relationships
Due diligence does not end at onboarding. Specified businesses must monitor each relationship continuously, watching for changes in risk and keeping the customer picture current.
Training carries the same continuous obligation. It cannot be a single event; firms must refresh staff knowledge on regulatory changes and emerging typologies, and the duty reaches management and board members, not only client-facing employees.
Every specified business must also maintain an independent audit function that tests whether its AML/CFT policies and controls are adequate and actually followed. An employee may perform this audit provided they are independent of those who design or apply the controls, which means the MLCO cannot conduct it, though the MLRO can.
Higher-risk firms face a higher bar. Where a business has higher-risk products, channels, customer types, or geographic links, it should maintain a distinct and separate audit function, with firm size judged by customer numbers and assets under management. An audit may cover all or part of the control framework and may be carried out annually.
A public-private intelligence-sharing framework has operated since 15 August 2023, allowing the Financial Intelligence Unit and the private sector to exchange information outside the formal reporting regime.
Guernsey Incorporation Pricing
See transparent pricing to incorporate and maintain a company in Guernsey.
Suspicious Activity Reporting to the Financial Intelligence Unit
The Financial Intelligence Service receives, analyses, and disseminates suspicious activity reports. It reports into the Director of the Economic and Financial Crime Bureau, established in 2021, while remaining operationally independent.
The reporting duty is personal and broad. Anyone who, in the course of a financial services business, knows or suspects, or has reasonable grounds to know or suspect, that another person is engaged in money laundering must report as soon as possible to the MLRO or to the FIU, under the Disclosure (Bailiwick of Guernsey) Law 2007. Failing to disclose is a distinct offence.
Reports are filed electronically through the Themis system, reached at https://mlro.gov.gg or through the Guernsey FIU website. The FIU received 2,030 such reports in 2023.
The threshold for reporting is deliberately low. An MLRO must file where they think there is "a possibility, which is more than fanciful, that the relevant facts exist" - a subjective standard backed by the threat of criminal prosecution for a failure to report.
Dealing with property suspected to be criminal proceeds is an offence unless the FIU gives prior consent. Unlike the United Kingdom, there is no deemed-consent timer: the FIU can simply refuse, and a firm that proceeds without consent risks prosecution.
Two further rules constrain conduct after a report. Tipping off a client that a report has been or will be made is an offence, and the FIU's approach is to grant consent to act only where there is an identified law-enforcement interest in doing so.
AML Record-Keeping Obligations
The minimum retention period under the Proceeds of Crime Law is five years. This covers customer due diligence documentation, transaction records, and copies of suspicious activity reports.
Other Guernsey legislation can require longer retention. Records of members' resolutions must be kept for at least six years under the Companies (Guernsey) Law 2008, and certain tax documentation falls under the Income Tax (Keeping of Records etc) Regulations 2006.
There is no central repository for these records. They are held by the regulated firm and must be producible on GFSC inspection or by court order, so a foreign owner relying on a local administrator should confirm where and how those records are stored.
One gap is worth flagging plainly: Guernsey has no statutory protection for AML whistleblowers, although the Enforcement Powers Law 2020 allows the States to legislate on this by Ordinance. The GFSC does operate a telephone hotline for reporting concerns.
The MLCO and MLRO: Internal Compliance Roles
Two named officers anchor a firm's internal compliance. The Money Laundering Compliance Officer monitors the firm's adherence to its own policies and controls and reports to the board, which retains overall responsibility for compliance. The MLCO role had to be filled by 31 March 2019, with the GFSC notified within 14 days of appointment.
The Money Laundering Reporting Officer handles the reporting line to the authorities. The MLRO must have direct access to the Financial Intelligence Service and freedom to liaise on whether to proceed with a transaction, and is the person obliged to file a report where the more-than-fanciful threshold is met.
| Role | Core function | Key limit |
|---|---|---|
| MLCO | Monitors compliance; reports to board | Cannot perform the independent audit |
| MLRO | Reports suspicion to the FIS; liaises on consent | Files SAR at the more-than-fanciful threshold |
| Nominated Officer | Stands in for the MLRO during extended absence | Should be made temporary MLRO if absence is long |
| Board | Holds overall responsibility for AML compliance | Cannot delegate ultimate accountability |
One person may hold both the MLCO and MLRO positions where appropriate, though any conflict between the roles and other functions must be managed. Both roles may also be outsourced to a third party, subject to the GFSC's outsourcing guidance, which suits smaller foreign-owned entities without local compliance headcount.
Penalties and Enforcement for AML Failures
Enforcement runs along two tracks: administrative penalties imposed by the GFSC and criminal prosecution brought by the prosecuting authorities. The civil penalty power sits in the Financial Services Business (Enforcement Powers) Law 2020, and the GFSC has held discretionary financial penalty powers since 2008.
Administrative penalties are capped and banded by seriousness.
| Subject | Maximum penalty |
|---|---|
| Individual | £400,000 |
| Firm | £4,000,000 |
Recent cases show the regulator using these powers in practice. In July 2024, Trident Trust Company (Guernsey) Limited was fined £266,000, with three individuals fined £70,000, £70,000, and £35,900 and given prohibition orders, for AML and governance failings. In March 2026 the GFSC announced its largest penalty to date, over £2 million against Utmost Worldwide Limited and two executives for systemic breaches, with the firm fined £1,960,000.
Criminal exposure runs in parallel. The GFSC cannot prosecute but can refer serious matters to the States of Guernsey Police or HM Procureur, where factors such as harm to consumers, damage to the islands' reputation, and premeditation come into play.
The Proceeds of Crime Law sets out four primary offences: concealing or transferring criminal property, assisting another to retain it, acquiring or using it, and tipping off. On summary conviction the penalty is up to 12 months' imprisonment and a fine of up to £10,000; conviction on indictment carries a longer term, and courts can confiscate assets and bar individuals through prohibition orders.
A reform from 2022 sharpened the civil forfeiture regime. The burden of proof now shifts to the asset owner where there are reasonable grounds to suspect assets are criminal proceeds, and a summary forfeiture process applies to assets held under "no consent" for at least a year.
Conclusion
Compliance here is activity-driven, not owner-driven: if your Guernsey company actually carries on financial or prescribed services, it carries the full weight of Schedule 3, the Handbook, and a regulator that has shown it will fine in the millions. If your entity is simply a client of a local administrator, the burden falls on that firm, but its checks will be thorough and Guernsey-specific, so source-of-funds questions and documentation requests are to be expected.
The practical next step is to establish which side of that line your business sits on, because the answer determines whether you need internal MLCO and MLRO arrangements or merely good records to satisfy someone else's due diligence.
How Expanship Can Help Your Business in Guernsey
Expanship supports foreign-owned entities in meeting their AML and KYC duties, from preparing business and relationship risk assessments and Handbook-aligned procedures to arranging MLCO and MLRO coverage where a firm lacks local compliance staff. The same team handles the wider obligations that come with operating a company in the Bailiwick.
- Company formation and structuring for non-resident owners
- Registered agent and registered office services
- Management of ongoing compliance and statutory filings
- Accounting and bookkeeping support
- Economic substance and beneficial ownership assistance
- Introductions to local banking providers
To discuss how these obligations apply to your structure, contact Expanship Guernsey.
Frequently Asked Questions
The rules apply based on the activity carried on, not headcount, so a passive holding company that conducts no banking, investment, or other regulated business is generally outside the definition of a specified business. Where your entity is administered by a local fiduciary, that administrator is the regulated firm and must apply due diligence to you as its client.
The Proceeds of Crime Law sets a minimum retention period of five years for customer due diligence documentation, transaction records, and suspicious activity reports. Other legislation may require longer, such as the six-year period for members' resolutions under the Companies (Guernsey) Law 2008.
Enhanced due diligence is mandatory for defined high-risk situations, including relationships with foreign politically exposed persons, structures using bearer shares, and clients connected to territories that do not properly apply FATF standards. It also applies to non-resident clients, private banking, personal asset-holding vehicles, and legal persons with nominee shareholders.
Reports are filed electronically through the Themis system, accessed at https://mlro.gov.gg or via the Financial Intelligence Unit website. The MLRO must report where they think there is a more-than-fanciful possibility that the relevant facts exist, a deliberately low threshold backed by criminal liability for failing to report.
The Commission can impose discretionary financial penalties of up to £400,000 on an individual and up to £4,000,000 on a firm, banded according to the seriousness of the breach. Serious matters can also be referred for criminal prosecution, with consequences ranging from imprisonment to asset confiscation and prohibition orders.
Yes. A firm may appoint a third party as its MLCO or MLRO, subject to the GFSC's outsourcing guidance, and a single person may hold both roles where conflicts are managed. The firm retains responsibility for overseeing any outsourced compliance function, so effective monitoring of the provider is required.
Legal Disclaimer
The information provided in this article is for general informational purposes only and does not constitute legal, tax, or professional advice. While we strive to ensure the accuracy and timeliness of the content, laws and regulations are subject to change, and the application of laws can vary widely based on specific facts and circumstances.
Readers should not act upon this information without seeking professional counsel tailored to their individual situation. Expanship and its authors disclaim any liability for actions taken or not taken based on the content of this article.
For specific advice regarding your business setup, compliance requirements, or any legal matters, please consult with qualified legal and tax professionals in the relevant jurisdiction.
