Key Takeaways
- Foreign-owned businesses classed as relevant persons fall within Jersey's AML regime and must register and comply under the supervision of the JFSC.
- Compliance requires appointing an MLRO and MLCO, adopting AML policies, conducting a business risk assessment and applying a risk-based approach.
- Customer due diligence, enhanced measures for PEPs and higher-risk situations, ongoing monitoring and record-keeping form the core operational duties.
- Suspicious activity must be reported to the Jersey Financial Intelligence Unit, and failures to meet AML obligations can carry penalties and other consequences.
AML and KYC Obligations in Jersey: An Overview
AML/KYC in Jersey is a statutory duty placed on businesses that carry on defined financial activities to know who their customers are, assess the money laundering and terrorist financing risks they pose, and report suspicion to the authorities. The obligation applies, and it is detailed. It rests on the Proceeds of Crime (Jersey) Law 1999 and the Money Laundering (Jersey) Order 2008, supervised by the Jersey Financial Services Commission (JFSC), with suspicious activity routed to the island's financial intelligence unit.
This article sets out who is caught, what the registration, governance, due diligence, monitoring, record-keeping, and reporting duties involve, and what non-compliance costs. It is most relevant to foreign owners and advisers behind a Jersey entity that provides trust, company, fund, lending, or other regulated services, and to anyone running a structure that may now fall within scope.
The Jersey AML Legal Framework and the JFSC as Supervisor
Three statutes form the backbone of the regime. The Proceeds of Crime (Jersey) Law sets the core offences and makes it unlawful for a "financial services business" to operate without procedures to prevent and detect money laundering. The Proceeds of Crime (Supervisory Bodies) (Jersey) Law 2008 governs registration and supervision, while the Money Laundering Order spells out the practical controls a business must run.
Sanctions and counter-terrorism duties sit alongside these, drawn from the Terrorism (Jersey) Law 2002 and the Sanctions and Asset-Freezing (Jersey) Law 2019. A new offence of failing to prevent money laundering has been introduced, with a defence for firms that maintained adequate procedures, which hard-wires the risk-based approach into the supervisory framework.
The JFSC supervises banks, trust and company service providers, investment firms, and other in-scope businesses. Its statutory rules are read together with the AML/CFT/CPF Handbook, which carries enforceable codes of practice and detailed guidance. An updated Handbook is intended to take effect on 31 May 2026, reflecting actions recommended after the island's evaluation.
The framework tracks the FATF Standards closely. A Mutual Evaluation Report by FATF and MONEYVAL, following a 2023 on-site visit and published in May 2024, assessed both technical compliance and how effectively the system works in practice, and set out where it should be strengthened.
Company Incorporation in Jersey
Set up your company in Jersey with Expanship handling registration end to end.
Who Is in Scope: Relevant Persons and Registration Under the Money Laundering Order
Scope turns on Schedule 2 to the Proceeds of Crime Law, which lists the activities that, when carried on as a business, count as "financial services business." Amending legislation in force from 30 January 2023 recast Schedule 2 into four categories: Financial Institutions, Trust and Company Service Providers, Designated Non-Financial Businesses and Professions, and Express Trusts. These break down into 24 specific activities, among them lending, securities trading, portfolio management, and acting as trustee of an express trust.
Two limbs trigger the duty to register with the JFSC. Anyone conducting Schedule 2 Business in or from within the island is caught, as is any Jersey-incorporated entity carrying on such activity anywhere in the world. Registration is mandatory; failing to register is a criminal offence under the Supervisory Bodies Law.
The 2023 recast pulled in structures that owners often assumed were outside the net.
- Private trust companies must register on an entity-by-entity basis.
- Single family offices fall within scope and must register.
- Governance entities, including private protector companies, are now treated as carrying on Schedule 2 Business.
Existing entities that became newly in-scope had until 30 June 2023 to comply; any entity formed after that date must comply from the outset. Each business must complete a Level 1 registration, which includes fit and proper (criminality) checks.
To decide whether a given activity is caught, a three-part Scope Test is applied to each activity the entity carries on. Two narrower categories deserve a note. Non-professional trustees, who act in an honorary capacity for no fee, need not register but remain bound by core customer due diligence and record-keeping duties under a dedicated 2016 order. Separately, the Proceeds of Crime (Low Risk Financial Services Business) (Jersey) Order 2024 exempts certain demonstrably low-risk activities from specified obligations, though those activities still require JFSC registration and remain subject to suspicious activity reporting.
If your Jersey entity is a PTC, family office, or governance vehicle that was historically treated as outside AML supervision, confirm its registration status. The 2023 changes brought many such entities in, and non-registration is a criminal matter, not an administrative one.
Appointing an MLRO and MLCO and Adopting AML Policies and Procedures
Every Schedule 2 Business must build a governance structure around two named roles. A Money Laundering Reporting Officer (MLRO) handles suspicion and reporting. A Money Laundering Compliance Officer (MLCO) monitors whether the firm is meeting its AML obligations and any relevant code of practice.
The MLCO must be an individual, employed by the firm, and based in the island. This person is a Key Person under the Financial Services (Jersey) Law 1998 and the Supervisory Bodies Law, vetted and approved by the JFSC for fitness, propriety, residency, employment, and independence. When the named individual stops acting as MLCO, a replacement must be appointed forthwith, and the JFSC must receive written notice within one month of an appointment taking effect.
For foreign owners without a local team, the regime offers a practical route. An eligible entity may appoint an Anti-Money Laundering Service Provider (AMLSP) to fill the MLRO and MLCO roles and meet the wider AML duties. Eligibility is narrow: the entity must not be a regulated person carrying on regulated business (other than as an AIF services business) but must still be required to register under the Supervisory Bodies Law.
Outsourcing does not transfer accountability. The entity that appoints an AMLSP keeps ultimate responsibility for compliance, and the officers an AMLSP supplies must be employed by the AMLSP or a member of its group. Alongside the named roles, the business must adopt customer and business risk assessments, written policies and procedures, and maintain adequate arrangements for monitoring and testing how well those controls actually work.
A Government of Jersey consultation issued in January 2026 proposes relaxations to the MLCO regime, including a "management level" requirement, decoupling responsibility from function, and a risk-based path that could let smaller or lower-risk firms operate without a dedicated MLCO. These are proposals, not law, and the existing requirements continue to apply.
Ongoing Compliance in Jersey
Keep your Jersey entity compliant with filings, returns, and statutory obligations.
The Business Risk Assessment and the Risk-Based Approach
The whole regime is risk-based: controls are meant to be calibrated to the threats a particular firm actually faces, not bolted on as a generic template. If inherent risk is misjudged, the controls built on top of it tend to fail. The statutory requirements for the Business Risk Assessment (BRA) sit in the Money Laundering Order and the code of practice.
The board or senior management must prepare and record a BRA, then keep it current. The assessment weighs risk appetite and exposure across organisational structure, customers, the countries and territories customers are connected to, products and services, and delivery channels. It must also account for the cumulative effect of risks, which can be greater than the sum of the individual parts.
Handbook guidance treats an annual review as a baseline for demonstrating that the BRA is up to date, with more frequent reviews where the internal or external environment shifts materially or where control weaknesses surface. On the strength of the BRA, senior management must set a formal strategy to counter the risks identified. Superseded BRAs, and records of cultural barriers, must be retained for five years.
JFSC examination feedback from the 2023 to 2024 cycle flagged BRA weaknesses repeatedly. Firms are expected to write clear, realistic risk appetite statements covering all relevant financial crime risks, review them at senior level, and refresh the BRA as new risks emerge.
KYC and Customer Due Diligence Requirements
Customer due diligence (CDD) under the Money Laundering Order means two things working together: identifying and verifying the customer, and monitoring the relationship over time. Where someone acts on the customer's behalf, the firm must identify that person and confirm their authority. Where a third party is involved, the business must understand its ownership and control and identify each beneficial owner or controller behind it.
Beneficial owners must be identified in all relevant cases. Legal entities and trusts attract detailed CDD, and higher-risk customers, including politically exposed persons, require enhanced measures. The JFSC Registry applies the same risk-based logic, drawing on the Handbook's CDD section and Appendices D1 and D2.
A threshold worth holding in mind: at incorporation, the Registry expects disclosure of all beneficial owners holding 25% or more of ownership or control, with information on lower interests required where higher risk is present. The Order also allows simplified due diligence in some cases, and sets a one-off transaction threshold of at most 15,000 euro; the JFSC has repeatedly found firms waiving CDD where they should not have.
Two features ease the operational burden when used correctly:
- Safe harbours. The Handbook describes methods that will be accepted as obtaining evidence of identity from a reliable, independent source. These are not mandatory, but they mark the line of JFSC expectation, and any alternative must be shown to be equally effective.
- Reliance. A firm may rely on CDD already performed by another business rather than starting from scratch, which speeds onboarding and cuts duplication, provided the regime is applied properly.
Whether simplified, standard, or enhanced checks apply, and how long the resulting records must be kept, is governed by the Order and the Handbook.
Jersey Incorporation Pricing
See transparent pricing to incorporate and maintain a company in Jersey.
Enhanced Due Diligence, PEPs, and Higher-Risk Situations
A politically exposed person (PEP) is someone entrusted with a prominent public function: heads of state and government, senior politicians, senior officials in government, the judiciary or the military, and important political party figures. The definition reaches their immediate family and close associates. PEP status is not an accusation; it signals risk and triggers enhanced controls.
Supervised persons must apply enhanced customer due diligence and enhanced ongoing monitoring to PEPs. Since 1 September 2023, the Order has allowed firms, subject to conditions, to declassify a PEP so that enhanced measures fall away.
| Type of PEP | Period before declassification may be considered |
|---|---|
| Domestic PEP | 2 years after leaving the prominent public function |
| Foreign PEP | 5 years after leaving the prominent public function |
Declassification is conditional on a risk assessment confirming the person no longer presents higher risk. In practice the JFSC has confirmed it will retain enhanced due diligence for all foreign PEPs, while domestic PEPs need no enhanced measures unless higher risk is identified. There is no single template for PEP handling; the expectation is a genuine risk-based judgment that goes beyond what the client discloses.
The JFSC is updating its guidance on "complex structures" in CDD, with a follow-on consultation published in November 2025 aimed at a proportionate, risk-based approach. PEPs were the regulator's first thematic examination area for 2024, with reviews across PEP risk assessment, policies and procedures, CDD, screening, and ongoing monitoring.
Ongoing Monitoring of Business Relationships and Transactions
Monitoring is not a separate task bolted on after onboarding; it forms part of the CDD definition itself under the Order. A firm must keep watching the relationship and its transactions for the life of the relationship, ready to act when something looks inconsistent with what it knows about the customer.
JFSC examinations have found recurring gaps here. Transaction monitoring procedures that fail to state the coverage and limitations of the monitoring tools, and how often the system is updated, draw criticism. The regulator expects firms to track Compliance Monitoring Plan testing priorities against the risks identified in the BRA, review them annually, and report to senior management.
The scale of supervisory attention is real. The Financial Crime Examination Unit ran 25 examinations across the 2023 to 2024 cycle, averaging 4.5 findings each, with lapses in ongoing monitoring and reporting among the common deficiencies. One narrow but firm rule: when the JFSC sends a risk questionnaire, the supervised person must complete and return it by the stated deadline.
AML Record-Keeping Obligations
Records of customer identification and of transactions must be kept for at least five years. For the standard case, the clock runs from the end of the relationship or the completion of the transaction. Superseded BRAs and records of cultural barriers carry the same five-year minimum.
Documents may be held in scanned form, but the record should show whether an original or a certified copy was seen or reviewed before any destruction. Where an internal suspicious activity report has been raised, the firm must place alerts or restrictions on the relevant customer profiles and keep records of what happens afterwards.
Reporting procedures must make clear that internal reports are to be considered regardless of the amount involved, since any property can represent the proceeds of crime. JFSC reviews have repeatedly turned up incomplete records, registers and internal report forms missing key details such as the date suspicion arose or the reporter's role, and delays in reporting.
Suspicious Activity Reporting to the Jersey Financial Intelligence Unit
The Jersey Financial Intelligence Unit (JFIU) receives, analyses, and disseminates reports of suspicious transactions and possible money laundering or terrorist financing. Firms must maintain reporting procedures that tell employees who the MLRO is and how to raise an internal report.
When the MLRO knows, suspects, or has reasonable grounds to suspect money laundering, terrorist financing, or proliferation financing, they must disclose the internal report's contents to a designated police or customs officer as soon as is practicable, using the approved form. All external submissions go through the PolSAR Portal.
Two points matter especially for cross-border owners:
- A UK consent does not carry over. Separate JFIU consent is required for assets or transactions connected to the island, under the Article 32 consent regime; the JFIU has published guidance on how that process works.
- Tipping-off is a serious offence. A firm may still engage a client after filing a report, for example to check adverse media, but only where doing so would not tip off the subject about the report or any investigation.
Reporting duties are continuing, not one-off. Failing to report fresh suspicion or a material change of circumstances, such as a significant transaction after consent was given, can breach the reporting provisions of the Proceeds of Crime Law. The JFSC expects timely submission of both internal and external reports, with documented investigations and timelines maintained by the MLRO.
Penalties and Consequences for AML Non-Compliance
Exposure runs from heavy criminal sentences to administrative action and loss of licence, and it reaches senior management as well as the entity. The figures below come straight from the legislation.
| Offence category | Maximum penalty |
|---|---|
| Primary offences (concealing, arrangements, acquisition/use/possession, failure to disclose), on indictment | Up to 14 years' imprisonment, a fine, or both |
| Tipping-off and disclosure offences | Up to 5 years' custody, a fine, or both |
| Virtual asset sector AML/CFT/CPF breaches | A substantial fine and up to 7 years' imprisonment |
Beyond the criminal courts, the JFSC can impose administrative penalties, including monetary fines, warnings, and other sanctions, on both businesses and individuals. For serious non-compliance it can revoke a licence, which can end an entity's operations outright. Registered and supervised persons also face a late filing fee for failing to file documents required under the regulatory laws or the Supervisory Bodies Law.
The supervisor's own posture is under pressure to harden. The 2024 evaluation by FATF and MONEYVAL observed that, although the use of financial sanctions had risen, the regulator tended to favour less severe measures over financial penalties, leaving the overall sanctioning approach out of step with the island's risk profile and the breaches actually found. That is a formal recommendation to improve, which points toward firmer enforcement rather than lighter.
Conclusion
Treat AML/KYC here as a board-level obligation with criminal teeth, not a back-office formality, especially since the 2023 recast pulled private trust companies, family offices, and governance vehicles into the supervised population. Many foreign owners are now in scope without realising it, and the duty to register, appoint officers, and run real controls applies from day one.
The single most useful next step is to test your structure against Schedule 2 and confirm its registration and governance position. If the entity is in scope and you lack local presence, weigh appointing an Anti-Money Laundering Service Provider, remembering that responsibility for compliance stays with you whatever you outsource.
How Expanship Can Help Your Business in Jersey
Expanship supports foreign-owned entities with the full AML/KYC build-out: confirming Schedule 2 scope, completing JFSC registration, sourcing or providing MLRO and MLCO cover, drafting the business risk assessment, and putting CDD, monitoring, and reporting procedures in place. We also handle the wider obligations that keep a company in good standing.
- Company formation and structuring for non-resident owners
- Registered agent and registered office services
- Ongoing compliance management and statutory filings
- Accounting and bookkeeping support
- Economic substance and beneficial ownership assistance
- Introductions to banking partners
To discuss your entity's AML position and broader compliance needs, contact Expanship Jersey.
Frequently Asked Questions
It must register if it carries on any Schedule 2 activity, either in or from within the island or as a Jersey-incorporated entity operating anywhere in the world. The 2023 recast brought private trust companies, single family offices, and governance entities into scope, so structures previously thought exempt often now need a Level 1 registration with the JFSC.
Yes, an eligible entity may appoint an Anti-Money Laundering Service Provider to fill both roles and meet the wider AML duties, which suits owners with no local staff. The officers supplied must be employed by the provider or its group, and the entity itself keeps ultimate responsibility for compliance regardless of the arrangement.
The minimum retention period is five years, running from the end of the relationship or the completion of the transaction for customer and transaction records. Superseded business risk assessments and records of cultural barriers must also be kept for five years, and scanned copies are acceptable provided the record notes whether an original or certified copy was reviewed.
At incorporation, the Registry requires disclosure of all beneficial owners holding 25% or more of ownership or control. Where higher-risk factors are present, it may ask for information on individuals holding a smaller interest.
Suspicion is reported to the Jersey Financial Intelligence Unit through the PolSAR Portal using the approved form, with the MLRO disclosing as soon as is practicable. A UK consent does not automatically apply; separate JFIU consent is required for assets or transactions connected to the island under the Article 32 consent regime.
They are severe and extend to senior management. Primary offences can carry up to 14 years' imprisonment on indictment, tipping-off offences up to 5 years, and the JFSC can impose administrative fines or revoke a licence for serious non-compliance.
Legal Disclaimer
The information provided in this article is for general informational purposes only and does not constitute legal, tax, or professional advice. While we strive to ensure the accuracy and timeliness of the content, laws and regulations are subject to change, and the application of laws can vary widely based on specific facts and circumstances.
Readers should not act upon this information without seeking professional counsel tailored to their individual situation. Expanship and its authors disclaim any liability for actions taken or not taken based on the content of this article.
For specific advice regarding your business setup, compliance requirements, or any legal matters, please consult with qualified legal and tax professionals in the relevant jurisdiction.
