Vladimir Consulting Limited v The Financial Conduct Authority [2022] UKUT 00168 (TCC) [2022] UKUT 00168 (TCC)

UPPER TRIBUNAL

TAX AND CHANCERY CHAMBER

[2022] UKUT 00168 (TCC)

Between

Vladimir Consulting LimitedAppellant

The Financial Conduct AuthorityRespondent

Before

UPPER TRIBUNAL JUDGE TIMOTHY HERRINGTON DEPUTY

UPPER TRIBUNAL JUDGE ANNE REDSTON

For the Respondent: Mr Adam Temple, Counsel (instructed by the Financial Conduct Authority) for Authority 1

Date 28 June 2022

Category: Financial services

[1]On 23 September 2020, the Appellant, Vladimir Consulting Limited (“VCL”) applied to the Authority to be registered as a cryptoasset exchange provider (“the Application”) pursuant to Regulation 57 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (“the MLRs”).

[2]On 9 March 2022, the Financial Conduct Authority (“the Authority”) gave a Decision Notice (“the Decision Notice”) refusing the Application. By a notice dated 6 April 2022, VCL made a reference to the Tribunal by way of an appeal against that decision (“the Reference”).

[3]As a consequence of the giving of the Decision Notice, VCL’s temporary registration allowing it to operate as a cryptoasset exchange provider ceased to have effect by operation of Regulation 56A(1)(b) of the MLRs.

[4]In the Reference, however, VCL also applied for a direction that the effect of the Decision Notice be suspended pending the determination of the Reference (“the Suspension Application”) pursuant to Rule 5(5) of the Tribunal Procedure (Upper Tribunal) Rules 2008 (“the Rules”). For the reasons set out in this judgment, we decided to refuse the Suspension Application. Background

[5]A cryptoasset is defined by Regulation 14A(3)(a) of the MLRs as “a cryptographically secured digital representation of value or contractual rights that uses a form of distributed ledger technology and can be transferred, stored or traded electronically”, and a “cryptoasset exchange provider” is defined by Regulation 14A(1) to include a firm which by way of business exchanges money for cryptoassets, or vice versa, or makes arrangements with a view to such an exchange. Cryptocurrency is a type of cryptoasset, and operates as an alternative form of value to “fiat” currencies, such as sterling or dollars.

[6]In 2017, VCL began trading in cryptocurrency such as bitcoin on peer-to-peer (“P2P”) exchanges. These provide a market place where sellers offer to sell cryptocurrency, and buyers purchase cryptocurrency. VCL’s business is the buying and selling of cryptocurrency on P2P exchanges.

[7]The MLRs were amended with effect from 10 January 2020 to require cryptoasset exchange providers to be registered with the Authority. It was common ground that VCL was a cryptoasset exchange provider and so a “relevant person” for the purposes of the MLRs. On 23 September 2020, VCL applied to the Authority to be registered. In the Application, VCL set out its assessment of the anti-money laundering and counter terrorist financing (“AML”) risk faced by its business and to explain its AML measures.

[8]The amendment to the MLRs also included a transitional period for registration of pre-existing cryptoasset exchange providers, allowing them to continue to operate until 10 January 2021; this date was later extended to 31 March 2022, providing certain conditions had been met. Because the Application had not been determined by 10 January 2021, VCL moved on to the Authority’s “Temporary Registration Regime”, which applies to all cryptoasset firms who had been active prior to 10 January 2020, and who had outstanding applications as of 16 December 2020.

[9]Mr Vladimir Shadrunov is the sole shareholder, director and employee of VCL, and in the Application was put forward as the senior manager responsible for VCL’s compliance with the MLRs under Regulation 21(1)(a), and also as its Nominated Officer under Regulation 21(3). 3

[10]On 9 March 2022, the Authority refused the Application by way of the Decision Notice. VCL was then removed from the list of firms with temporary registration. Unfortunately, although the letter enclosing the Decision Notice made it clear that as a result of the issue of the Decision Notice VCL no longer had temporary registration, it did not inform VCL, as it should have done, of the reasons why the decision took immediate effect. That was rectified in a further letter from the Authority on 30 March 2022, which stated that the Authority considered it was in the interests of the public for its decision to have immediate effect. The reasons the Authority gave in that letter related to the risks arising from the concerns identified in the Decision Notice, as explained in more detail below Decision Notice

[11]Regulation 58A requires the Authority to refuse to register an applicant as a cryptoasset exchange provider business if it is not a fit and proper person to carry on that business; the Authority must also refuse to register an applicant if any officer, manager, or beneficial owner of the applicant is not a fit and proper person. In determining whether the Regulation 58A requirements are met, the Authority must have regard to the following factors:(1) whether the applicant has consistently failed to comply with the requirements of the MLRs;

(2) the risk that the applicant’s business may be used for money laundering or terrorist financing; and

(3) whether the applicant, and any officer, manager or beneficial owner of the applicant, has adequate skills and experience and has acted and may be expected to act with probity.

[12]The Authority considered that VCL had consistently failed to comply with the following requirements of the MLRs:(1) It had failed to understand and/or to apply Regulation 4(1), which defines the term “business relationship”.

(2) It had failed to comply with Regulation 28(2)(c), which requires a business to “assess, and where appropriate obtain information on, the purpose and intended nature of the business relationship or occasional transaction”.

(3) It had not satisfactorily addressed the requirements of Regulation 28(19)(b), which require that processes for the identification of identify are “secure from fraud and misuse and capable of providing assurance that the person claiming a particular identity is in fact the person with that identity”.

(4) It had relied on AML checks carried out by P2P exchanges despite not having contract with those businesses (as required by Regulation 39).

(5) Its approach to adverse media screening was “insufficient”. We have taken this to be a reference to a failure to comply with Regulation 18(2)(b), which requires a relevant person to take into account the risk factors relating to its customers.

(6) It was not compliant with Regulation 35(1)(a) or (b), which require a relevant person to have “appropriate risk-management systems and procedures to determine whether a customer, a family member or known close associate of customer is a Politically Exposed Person” or “PEP”.

[13]The Authority also decided that Mr Shadrunov did not have “adequate skills and experience” and so was not “a fit and proper person to carry on the business of a cryptoasset 4 exchange provider” as required by Reg 58A (2), and that as he was the only director and employee of VCL, that company also did not have adequate skills and experience. The approach of the Tribunal

[14]Rule 5(5) of the Rules gives the Upper Tribunal the power to direct that the effect of the decision in respect of which the reference or appeal is made (in this case the giving of the Decision Notice) is to be suspended pending the determination of the reference:

“…if it is satisfied that to do so would not prejudice – (a) the interests of any persons (whether consumers, investors or otherwise) intended to be protected by that notice; (b) the smooth operation or integrity of any market intended to be protected by that notice; or (c) the stability of the financial system of the United Kingdom.”

The judgment in Sussex

[15]We agreed with Mr Temple that the conditions to be met before the Tribunal can grant a suspension under Rule 5(5) are those set out in Sussex Independent Financial Advisers Limited v FCA

[2019] UKUT 228 (TCC)

(“Sussex”) at [14] and [15] as follows (with citations omitted):

“[14] The key principles to be applied…are… (1) The Tribunal is not concerned with the merits of the reference itself and will not carry out a full merits review but will need to be satisfied that there is a case to answer on the reference…; (2) The sole question is whether in all the circumstances the proposed suspension would not prejudice the interests of persons intended to be protected by the notice…; (3) Detriment to the applicant, such as it being deprived of its livelihood, is not relevant to this test; (4) The burden is on the applicant to satisfy the Tribunal that the interests of consumers will not be prejudiced…; and (5) So far as consumers are concerned, the type of risk the Tribunal is concerned with is a significant risk beyond the normal risk of a firm that is doing business in a broadly compliant manner…The reference to consumers should for such purposes have the same meaning as in section 1G of Financial Services Markets Act 2000 (“FSMA”) which defines consumers to mean persons who use, have used, or may use among other things regulated financial services… [15] Additionally, as noted in the [cited] decisions, even if satisfied that granting a suspension would not prejudice the interests of consumers, the Tribunal is not obliged to grant a suspension. The use of the word ‘may’ in Rule 5(5) means that it is a matter of judicial discretion as to whether or not a suspension should be granted. It is necessary for the Tribunal to carry out a balancing exercise in the light of all relevant factors and decide whether in all the circumstances it is in the interests of justice to grant the application. The power is a case management power, which in accordance with Rule 2 (2) of the Rules must be exercised in accordance with the overriding objective to deal with the matter fairly and justly…”

[16]As emphasised in Sussex, the burden is on the applicant to satisfy the Tribunal that the interests of those persons who are intended to be protected by the Decision Notice will not be prejudiced if the application was granted. Therefore, for an application of this nature to have 5 a chance of being successful, the applicant must make detailed evidence available to the Tribunal as to how its business will be carried on in a broadly compliant fashion during the period up to the hearing of the appeal. Application of those principles to this case

[17]The Decision Notice was issued with the intention of protecting against the risk of money laundering and terrorist financing (money laundering for short). Accordingly, it had been issued because the Authority was of the view that it was necessary to refuse VCL’s application for registration in order to:(1) protect those who are intended to be protected by the MLRs (the public in general, and in particular potential victims of criminal activity which may be facilitated or incentivised by a criminal’s ability to launder money); and

(2) the integrity of the UK financial system, in preventing it from being used to launder money.

[18]Assuming that we can be satisfied that there is a case for VCL to answer on the Reference (which we consider below), the essential question is whether we can be satisfied that if the Suspension Application is granted VCL would, pending the determination of its Reference, carry out its activities in a manner which was broadly compliant with the MLRs. The evidence

[19]We were provided with a bundle of documents prepared by the Authority (“the Bundle”), which included:(1) the Application; related email exchanges between the Authority and VCL dated 23 July 2021 and 3 August 2021; a warning notice sent by the Authority to VCL on 17 December 2021 (“the Warning Notice”); VCL’s representations to the Authority about the Warning Notice; Authorisations’ Response to VCL’s representations; the Decision Notice, and the further letter from the Authority to VCL dated 30 March 2022;

(2) VCL’s Business Plan; its AML policy; a document headed “Risk assessment, risk mitigation and internal control mechanisms” and its organisation and governance document, all as originally submitted to the Authority;

(3) VCL’s AML risk assessment; an updated version of its Business Plan and its Due Diligence Procedures, all dated 5 January 2021 and its AML Manual dated 6 January 2021, together with a covering email to the Authority dated 31 August 2021;

(4) a log of VCL’s transactions between 1 June 2021 and 31 August 2021 and details of a particular trade with an individual we have called Ms C, which took place on 20 August 2021; and

(5) the transcript of a voluntary recorded interview held via telephone conferencing with Mr Shadrunov on 26 October 2020 (“the Interview”) during which he was questioned about VCL’s business activities, operational structure, banking arrangements and AML framework, including its relevant systems and controls. Mr Shadrunov had been provided with a copy of the transcript and been given an opportunity to challenge the record there set out, but no such challenge was made. We have therefore taken it that the transcript accurately recorded the Interview.

[20]On 8 June 2022, we received VCL’s skeleton argument, together with its Reply to the Authority’s Statement of Case, both of which contained evidence as well as submissions. Attached to the skeleton argument was a certificate of “proficient comprehension in the course 6 of Money Laundering Reporting Officer” issued to Mr Shadrunov by a business called “Janet’s” on 4 June 2022.

[21]We also allowed Mr Shadrunov to give limited oral evidence to provide some further background to VCL’s business by way of response to questions from the Tribunal; Mr Temple then cross-examined Mr Shadrunov on that new evidence. We were satisfied that it was in the interests of justice to take that course, bearing in mind(a) our obligation to give effect to the overriding objective by avoiding unnecessary formality and seeking flexibility in the proceedings and

(b) that Mr Shadrunov had not had the benefit of legal advice when he prepared his evidence. We were also satisfied that the Authority would not be prejudiced, given the limited nature of the material in question and Mr Temple’s overall familiarity with the matter. The guidance

[22]The Authority provided the Tribunal with the following:(1) Parts I and II of the 2020 edition of guidance published by the Joint Money Laundering Steering Group (“JMLSG”). The JMLSG is a private sector body, but its guidance is approved by HM Treasury. Chapter 22 of the JMLSG guidance relates to cryptoasset exchange providers;

(2) the 2020 National Risk Assessment (“the NRA”) published by the Treasury and the Home Office, in which Chapter 20 relates to cryptoassets; and

(3) Booklet FG/17 published in July 2017 by the Authority entitled “The treatment of politically exposed persons for anti-money laundering purposes”. Findings of fact

[23]This part of our judgment sets out some limited findings of fact from the evidence summarised above; there are some further findings later in our decision, see §51.

[24]We have tried to be careful only to make findings which are directly relevant to the Suspension Application, and not to make definitive findings on disputed matters which will be explored in more detail on the hearing of the Reference. We have also proceeded on the basis that what Mr Shadrunov said as to certain aspects of VCL’s business is correct. That is without prejudice to the position that may be established after full consideration of all the evidence following the hearing of the Reference. Cryptocurrency and money laundering generally

[25]The Executive summary of the NRA states as one of its “Key findings” that:

“Overall, the cryptoasset ecosystem has developed and expanded considerably in the last 3 years, leading to an increased money laundering risk, with criminals increasingly using and incorporating them into their money laundering methodologies.”

[26]Chapter 8 begins by saying:

“The risk of money laundering through cryptoassets has increased since 2017, with criminals increasingly using and incorporating them into their money laundering methodologies. The risk of using cryptoassets for money laundering overall is now assessed as medium.”

[27]Neither party disagreed with those statements. VCL’s business and its AML procedures

[28]Since VCL began trading in 2017, it has bought and sold cryptoassets on various P2P exchanges, but by the time of the suspension it was only trading in bitcoin on LocalBitcoins 7 (“the Exchange”), a Finnish company. VCL is registered on the Exchange, and holds bitcoin in a “local wallet” within the Exchange.

[29]VCL understands that the Exchange carries out its own AML due diligence in accordance with Directive (EU) 2015/849 (the Fourth Money Laundering Directive), as amended by Directive (EU) 2018/849 and Directive (EU) 2018/1673 (the Fifth and Sixth Money Laundering Directives). However, VCL does not have a contract with the Exchange under which the latter agrees to carry out AML measures relating to VCL’s transactions, and VCL does not know what procedures the Exchange follows, other than that Mr Shadrunov was required to verify his identity when VCL registered to use the Exchange. VCL banks with Enumis, but there was also no contract in place allowing it to rely on any AML due diligence carried out by the bank.

[30]VCL does not have fixed operating hours; instead, Mr Shadrunov decides when to log into the Exchange. When he does so, he browses the available offers and also makes offers to customers, and on behalf of VCL may agree to buy or sell bitcoin at a price in a fiat currency. For the purposes of this judgment, we have called the other party to the transaction a “customer” of VCL, though the nature and extent of the relationship is in dispute.

[31]Before VCL transacts with a customer, it carries out the following procedures:(1) It requires the customer to verify its identity. Individuals must provide a copy of a passport, a photocard driving licence, or other government issued document, together with proof of residential address dated within the last three months. These documents are provided to VCL by email and inspected visually by Mr Shadrunov. If the customer is a corporate entity, each director must provide VCL with those same identity documents, together with certain other information about the company.

(2) VCL also requires the customer to have a UK bank account from which (or to which) payments for bitcoin are made.

(3) Mr Shadrunov checks whether a customer is a PEP by inputting the name into Wikidata. He described Wikidata as “the world’s largest open-source knowledge database”. VCL obtains an updated version of Wikidata once a month. If a customer’s full name were to match a PEP on the database, VCL would refuse to transact with that person, but to date there have been no matches.

[32]VCL’s AML Manual contains a section on Enhanced Due Diligence (“EDD”). This states that EDD is carried out for high risk customers, large transactions, PEPs and those from countries identified by the Financial Action Task Force (“FATF”) as high risk. VCL’s Due Diligence Manual adds that customers who transact more than £8,000 per day, £12,000 per week or £20,000 per month are subject to EDD. VCL set those thresholds so as to be compatible with the limits used by Enumis. VCL’s additional requirements for EDD are:(1) the provision of information about the customer’s occupation;

(2) two months of bank statements to show the source of funds used for the transaction; and

(3) a “selfie” picture of the customer holding a piece of paper on which the following words have been written: “I am buying cryptocurrency from Vladimir Consulting Ltd and am doing so for my own use and not under any pressure from a third party. I understand that if I send my cryptocurrency to another person it may be unrecoverable.” 8

[33]Customers who carry out more than £60,000 worth of transactions in a year are required to participate in a video conference call with Mr Shadrunov during which they must verify their identity documents and explain their intention when making the transaction.

[34]In the period from January 2020 until the Interview, VCL carried out around 3,000 transactions, four of which were subject to EDD. In one case, VCL carried out an “adverse media screening” using the internet. In the Interview, Mr Shadrunov said that in order to carry out that screening he “just enters the person’s name in the search engine and see[s] what comes out”, and that VCL would reject the customer if, for example, the search showed involvement in criminal activity.

[35]VCL carried out EDD in relation to Ms C, who had made five near-simultaneous transactions, each of £5,000. Ms C had provided VCL with two months of bank statements showing various unidentified deposits into her account, together with a certificate of completion for a property sale dated 3 May 2016. Ms C also emailed VCL a selfie showing herself holding a card with the words set out at §32(3). That further evidence was accepted by VCL as sufficient to proceed with the transactions.

[36]VCL’s AML Policy includes a section on SARs which states that all SARs will be notified to the National Crime Agency (“NCA”), but to date no SARs have been notified. Mr Shadrunov’s knowledge of AML requirements

[37]Mr Shadrunov has a degree in computer software and automated systems, and previously worked providing legal, administrative and regulatory services in relation to domain names.

[38]In 2017 Mr Shadrunov considered VCL might be classified as a “money services business” or MSB, but was subsequently advised that this was not the position. MSBs are regulated for AML purposes by HM Revenue & Customs (“HMRC”). Mr Shadrunov studied HMRC’s guidance for MSBs; he also completed an HMRC e-learning course and attended a webinar.

[39]Shortly before this hearing, Mr Shadrunov passed an MLR multiple choice test with 20 questions operated by a company called Janet’s; this test cost around £10. Janet’s also offers training modules, but Mr Shadrunov did not purchase a training module because he considered he already had sufficient knowledge to pass the test. The issues raised by the Authority: whether no case to answer

[40]In Gidiplus v FCA

[2022] UKUT 00043 (TCC)

at [46], the Tribunal (Judge Herrington) said:

“I start by considering whether I can be satisfied that there is a case to answer on the appeal. Although I am not concerned with the merits of the appeal itself, were I of the view that the Decision Notice did not make findings which were capable of demonstrating that Gidiplus has not met the conditions for registration as a crypto asset business contained in the MLRs then it would be possible for the Tribunal to take the view that granting the application would not result in a significant risk of money laundering.”

[41]In the Reference, Mr Shadrunov said that it was made in part on the basis that “there was no case to answer”. Mr Temple said it was plain from the points made in the Authority’s Decision Notice that this was not the position. In order to decide whether there is a case to answer, and if so, whether to allow or refuse the Suspension Application, we next consider each of the issues raised by the Authority as set out at §12, and Mr Shadrunov’s responses. 9 Business relationships?

[42]The parties disagreed on whether VCL had a “business relationship” with its customers. The Authority’s position was that VCL had at least some such relationships; VCL’s view was that it had none. The Regulations

[43]Regulation 4(1) defines “business relationship” as:

“a business, professional or commercial relationship between a relevant person and a customer, which— (a) arises out of the business of the relevant person, and (b) is expected by the relevant person, at the time when contact is established, to have an element of duration.”

[44]Regulation 27 is headed “Customer due diligence” and begins:

“(1) A relevant person must apply customer due diligence measures if the person— (a) establishes a business relationship; (b) carries out an occasional transaction that amounts to a transfer of funds within the meaning of Article 3.9 of the funds transfer regulation exceeding 1,000 euros; (c) suspects money laundering or terrorist financing; or (d) doubts the veracity or adequacy of documents or information previously obtained for the purposes of identification or verification. (2) A relevant person who is not…a cryptoasset exchange provider of the kind referred to in paragraph (7D)] …must also apply customer due diligence measures if the person carries out an occasional transaction that amounts to 15,000 euros or more, whether the transaction is executed in a single operation or in several operations which appear to be linked.”

[45]It was common ground that VCL was not making transfers of funds within the meaning of Article 3.9 of the funds transfer regulation and was also not the type of cryptoasset exchange provider referred to in Regulation 27(7D). As a result, the relevant threshold for occasional transactions was €15,000.

[46]Regulation 28 is headed “Customer due diligence measures”, and it begins: “(1) This regulation applies when a relevant person is required by regulation 27 to apply customer due diligence measures. (2) The relevant person must—(a) identify the customer unless the identity of that customer is known to, and has been verified by, the relevant person;

(b) verify the customer's identity unless the customer's identity has already been verified by the relevant person; and

(c) assess, and where appropriate obtain information on, the purpose and intended nature of the business relationship or occasional transaction.” 10

[47]It is thus clear that if there is a “business relationship” between VCL and a customer, it is required to apply CDD to all transactions, but if there is no business relationship, it has only to apply CDD to “occasional transactions” of €15,000 or more.

[48]Regulation 28(11) reads:

“The relevant person must conduct ongoing monitoring of a business relationship, including— (a) scrutiny of transactions undertaken throughout the course of the relationship (including, where necessary, the source of funds) to ensure that the transactions are consistent with the relevant person's knowledge of the customer, the customer's business and risk profile; (b) undertaking reviews of existing records and keeping the documents or information obtained for the purpose of applying customer due diligence measures up-to-date.”

[49]Regulation 33 is headed “Obligation to apply enhanced due diligence”, and it begins:

“(1) A relevant person must apply enhanced customer due diligence measures and enhanced ongoing monitoring, in addition to the customer due diligence measures required under regulation 28 and, if applicable, regulation 29, to manage and mitigate the risks arising— (a) in any case identified as one where there is a high risk of money laundering or terrorist financing— (i) by the relevant person under regulation 18(1), or (ii) in information made available to the relevant person under regulations 17(9) and 47; (b) in any business relationship with a person established in a high-risk third country or in relation to any relevant transaction where either of the parties to the transaction is established in a high-risk third country.”

[50]It is important to consider Reg 4(1) in the context of the rest of the MLRs. In particular, Regulation 18(1) provides that “a relevant person must take appropriate steps to identify and assess the risks of money laundering and terrorist financing to which its business is subject”, and Regulation 19(1) provides that a relevant person must:

“(a) establish and maintain policies, controls and procedures to mitigate and manage effectively the risks of money laundering and terrorist financing identified in any risk assessment undertaken by the relevant person under regulation 18(1); (b) regularly review and update the policies, controls and procedures established under sub-paragraph (a);…”

Findings of fact

[51]Numerous buyers and sellers of bitcoin operate on the Exchange, so a person wishing to purchase could buy from any one of many possible sellers and a person wishing to sell could transact with any one of many possible purchasers.

[52]VCL’s Business Plan (both the original and revised versions) includes this paragraph:

“The [P2Ps] provide an excellent sales channel as a huge number of company’s potential clients are already using them and some are naturally 11 expected to choose Vladimir Consulting as their cryptocurrency vendor, as happened in the past.”

[53]VCL’s updated Business Plan also includes a “Customer Journey Map”. This consists of five boxes, of which the first is customer “awareness”, followed by “engagement”, “conversion”, “adoption” and “loyalty”. The box headed “adoption” defines that stage as “customer explores our other offers and comes back for repeat trades”, and the box headed “loyalty” reads:

“Customer gets attracted to business and realises service is better than expected; promotes us to others. As business is done on a transaction by transaction basis, we encourage customers to trade again and share their experience and recommend to others.”

[54]In the Interview, Mr Shadrunov said:

“It’s usually, like, they [the customers] want to invest some money in Bitcoin or whatever and they do, like, do it in, like, two or three transactions maybe throughout several days to achieve, say, cost averaging their investment. That’s my guess, really. What I’m saying is from the pattern of transactions, we’re not seeing customers that transact every day for large amounts.”

[55]VCL’s original Business Plan stated that, based on the previous 12 months, it expected that it would make 5,000 individual transactions with 880 unique customers; it also set out a lower limit (“stress scenario”) of 3,700 transactions and 650 unique customers. The updated Business Plan did not include comparable information.

[56]VCL’s transaction log for a three month period in 2021 recorded a total of 903 transactions; 284 customers carried out more than one transaction, of whom 119 carried out more than three transactions and six carried out 10 or more transactions. Mr Shadrunov’s submissions on behalf of VCL

[57]Mr Shadrunov said that VCL did not establish a business relationship with any customer; instead, each transaction was on an “occasional” basis. He submitted that Regulation 4(1)(b) requires the relevant person to assess whether there is an “element of duration” to the relationship “at the time when contact is established”, and this means the position must be assessed at the time of first contact. In his words “such categorisation can only happen once, at the time we establish the first contact with a customer”.

[58]Mr Shadrunov added that at the time the customer first makes contact with VCL, the company has no expectation there will be an element of duration to the relationship. He supported this by saying that VCL:(1) does not create customers’ accounts;

(2) has “no contractual relationship with customers”;

(3) only offers services on an ad hoc, as available basis, so there is no expectation that VCL will be offering services in the future;

(4) can only communicate with customers using a chat facility at the time the trade is open; and

(5) does not operate a website or other facility which would allow customers to make contact at any other time.

[59]Mr Shadrunov also said that, in any event, VCL verified the identity and address of all customers, and so complied with Regulation 28(2)(a) and (b). In relation to subpara (c), which requires a relevant person to “assess, and where appropriate obtain information on, the purpose 12 and intended nature of the business relationship or occasional transaction”, he said VCL made the reasonable assumption that customers regard bitcoin as a store of value, like gold, and their purpose when transacting in bitcoin was to increase (by purchasing) or to crystallise (by selling) that store of value.

[60]He added that where the customer conducts a second or subsequent transaction, VCL will consider whether the cumulative transaction threshold has been exceeded and if so will require further information, as previously set out at §32. He did not consider that the lack of SARs was relevant, saying that VCL would “not hesitate” to make a SAR should it encounter a suspicious transaction. Mr Temple’s submissions on behalf of the Authority

[61]Mr Temple submitted that it was plain from VCL’s Business Plan that it expected its relationships with most, if not all, its customers would have an element of duration. He referred to the fact that 119 customers carried out repeat transactions, and some did so multiple times. He said that “the only reason why VCL does not know whether a particular customer is likely to make repeated transactions is because VCL does not ask the question”.

[62]He referred to the JMLSG guidance at 5.3.7, which says:

“The factors linking transactions to assess whether there is a business relationship are inherent in the characteristics of the transactions – for example, where several payments are made to the same recipient from one or more sources over a short period of time, or where a customer regularly transfers funds to one or more sources. For lower-risk situations that do not otherwise give rise to a business relationship, a three-month period for linking transactions might be appropriate, assuming this is not a regular occurrence.”

[63]He submitted that it was therefore clear that the regular occurrence of transactions was sufficient for there to be a business relationship, adding that if VCL has customers that regularly approach it to convert sterling into cryptocurrency, or vice versa, it is “artificial” for VCL to suggest that each transaction is merely “occasional”.

[64]Mr Temple also relied on para 5.3.24 of the JMLSG guidance, which explains why Regulation 28(3)(2)(c) requires the relevant person to “assess, and where appropriate obtain information on, the purpose and intended nature of the business relationship or occasional transaction”. That paragraph reads:

“A firm must understand the purpose and intended nature of the business relationship or transaction to assess whether the proposed business relationship is in line with the firm’s expectation and to provide the firm with a meaningful basis for ongoing monitoring. In some instances this will be self-evident, but in many cases the firm may have to obtain information in this regard.”

[65]In Mr Temple’s submission, VCL was wrong simply to assume that every customer’s purpose was to acquire bitcoin as a store of value, or to realise the store of value by selling bitcoin VCL had instead to establish each customer’s actual intention, and only then would it be able to assess whether the customer poses a risk of money laundering. Without that information, VCL had no way of knowing whether the transactions subsequently entered into were consistent with the customer’s stated intentions; this is clear from 5.3.24 of the JMLSG guidance. Mr Temple added that VCL’s interpretation of the MLRs would “avoid the very monitoring that the MLRs and JMLSG guidance requires”.

[66]He went on to say that a further but linked concern was that VCL only required more information from a customer when one of its higher thresholds were reached, and then the 13 customer had to write out and/or read a statement drafted by VCL. As a result, in his submission:

“Any criminal seeking to convert fiat currency into cryptocurrencies, or vice versa, would face zero questioning from VCL. VCL would, it appears, transact any size of transaction or any number of transactions, providing that the customer takes a photograph containing VCL’s required wording.”

[67]Mr Temple added that the money laundering risk was exemplified by the case of Ms C, where VCL had relied on a completion statement that was over five years old, and he suggested that the company’s failure to file a single SAR arose from “the lack of any questions about the nature and purpose of VCL’s customers’ transactions”. The Tribunal’s view

[68]Mr Shadrunov’s starting point is that whether or not there is a “business relationship” is a once and for all test, to be applied when contact is first established between the relevant person and the customer. We do not agree, for the following reasons:(1) Reg 4(b) does not say “when contact is first established”, but “when contact is established”. If a customer returns for a second transaction, contact between the customer and the relevant person must be established before the transaction can proceed.

(2) Like all legislative provisions, Regulation 4(1)(b) must be interpreted in its context, and in our judgment Mr Shadrunov’s interpretation of that Regulation cannot be reconciled with the overall scheme and approach of the MLRs. For example, Regulation 19(1)(a) requires the relevant person to “establish and maintain” policies, controls and procedures to mitigate and manage effectively the risks of MLTF, and Regulation 19(1)(b) requires those policies controls and procedures to be regularly reviewed.

(3) If Mr Shadrunov were to be correct, a relevant person could, entirely reasonably, have no expectation that there would be any element of duration at the inception of the relationship with its customer, and treat all subsequent transactions as “occasional”, even though as a result of those later contacts, the relevant person now expected that the relationship had an element of duration. As a result, those regular customers would always be treated as making “occasional transactions” despite the fact that they were repeated. That would be inconsistent with the Regulation 19 requirement that the relevant person carry out an ongoing assessment of risk, and it would undermine the effectiveness of the MLRs as a bulwark against money laundering.

(4) Our understanding is consistent with the JMLSG guidance, which at 5.3.6 gives two examples of “occasional” transactions: a single foreign currency transaction and an isolated instruction to purchase shares.

[69]We therefore agree with the Authority that VCL has misunderstood Regulation 4(1)(b). Applying our understanding of the law to the facts as found for this hearing, we accept that the nature of the Exchange is such that customers can obtain essentially the same product (bitcoin) from a multiplicity of sellers, and can sell bitcoin to any one of dozens of traders. However, there are other relevant facts: VCL is actively seeking to build customer loyalty, and has succeeded in the sense that it had over 100 repeat customers in a three month period. Our preliminary view, based on our understanding of the law and the facts as found for this hearing, is thus that VCL has a business relationship with at least some of its customers.

[70]We then considered Mr Shadrunov’s submission that, even if VCL were to have such relationships, appropriate CDD has been carried out on all customers. We agree with Mr Temple that VCL’s failure to ask for information about “the purpose and intended nature of the business relationship” gives rise to a significant concern that VCL has not complied with 14 the requirements of Regulation 28(2)(c). That both raises a serious case to answer at a final hearing of the Reference, and is also a significant factor weighing in the balance against granting the Suspension Application.

[71]The following linked factors increase that weighting:(1) Regulation 28(11)(a) requires a relevant person to conduct “ongoing monitoring of a business relationship”. On the basis of our preliminary view that VCL has failed to identify business relationships, it will also have failed to carry out that ongoing monitoring.

(2) Regulation 33 requires a relevant person to carry out EDD in the situations set out in that regulation, and Regulation 28 prescribes additional obligations tied to the existence of a business relationship. Given that VCL has misinterpreted and misapplied the “business relationship” concept, it is also likely to have failed properly to apply the EDD requirements in Regulation 33. The fact that VCL has only required four customers to provide EDD since it applied for registration in September 2020 provides support for the Authority’s view that there has been a failure to comply with the EDD requirements set out in the MLRs.

(3) We also had concerns about the case of Ms C. We accepted that this was a single example, but Mr Shadrunov did not suggest that she was unrepresentative of the three other customers in relation to whom VCL carried out EDD. We were unable to understand the basis on which a property completion statement dated 2016 could reliably form the source of Ms C’s funds for the five near-simultaneous transactions each of £5,000 occurring five years later. There was also no indication that VCL had asked any questions about the large money transfers appearing in Ms C’s bank account. Adequate skills and experience

[72]The Authority’s position was that Mr Shadrunov’s knowledge and skills were insufficient, such that “suspending the Decision Notice, and allowing VCL to continue in business will bring with it a risk that VCL will be used by others to facilitate money laundering”.

[73]Mr Shadrunov submitted that his previous background in regulatory compliance, albeit in a different field, together with his reading of the legislation and guidance, was sufficient for him to be a “fit and proper person” to carry on the business as required by Regulation 58A (2).

[74]The Tribunal accepted that Mr Shadrunov had read and studied the legislation and guidance. However, we were concerned that his understanding of the meaning of “business relationship” and his assumptions as to the purpose of customers’ transactions indicated that he did not as yet have sufficient experience of the MLRs. Our concern was exemplified by the way VCL handled the case of Ms C, see §71(3). Reliance on others

[75]The Decision Notice said VCL had placed reliance on the AML checks carried out by the customers’ banks and by the Exchanges, but that as VCL had no contracts with those parties, it was unable to place reliance on them. The Authority cited from the Interview, during which Mr Shadrunov had been asked how “critical” those checks were to VCL’s own compliance with the MLRs; he had replied that they were “absolutely critical” because VCL relies on the customer name as provided by the Exchange, this is then matched to the name on the bank account and on the ID documents provided by the customer. Mr Shadrunov added that the Exchange was based in Finland and so required to comply with the MLRs. 15

[76]In his submissions, Mr Shadrunov accepted that VCL had no relevant contract with banks or with the Exchange, but emphasised that VCL was not placing any formal reliance on AML checks carried out by these organisations. He submitted, however, that it was nevertheless relevant that the parties who facilitated the transaction were independently regulated and required to comply with the MLRs.

[77]We agree with Mr Temple that all regulated entities are “gatekeepers” of the AML regime, and must each comply in full with the requirements of the MLRs unless the requirements of Regulation 39 are met. That Regulation allows limited delegation of customer due diligence checks, but only if the other party has agreed to carry out the relevant checks, and responsibility always remains with the delegating party. There was no dispute that VCL did not have that sort of relationship with banks or with the Exchange. Despite Mr Shadrunov’s submissions for the purposes of this hearing, it was clear from the Interview that VCL was placing considerable weight on its belief that the banks and the Exchange were both regulated, and viewed this as reducing its own money laundering risks. This is not an approach permitted by the MLRs, and is a further factor weighing in the balance against allowing the Suspension Application. ID procedures

[78]The Authority’s position was that the visual check of the identity documents emailed to VCL by customers was insufficient to comply with Regulation 28. Regulation 28

[79]The opening paragraphs of Regulation 28 are set out earlier in this judgment, but are repeated here together with paragraphs 18 and 19: “(1) This regulation applies when a relevant person is required by regulation 27 to apply customer due diligence measures. (2) The relevant person must—(a) identify the customer unless the identity of that customer is known to, and has been verified by, the relevant person;

(b) verify the customer's identity unless the customer's identity has already been verified by the relevant person; … (18) For the purposes of this regulation— (a) except in paragraph (10), “verify” means verify on the basis of documents or information in either case obtained from a reliable source which is independent of the person whose identity is being verified; (b) documents issued or made available by an official body are to be regarded as being independent of a person even if they are provided or made available to the relevant person by or on behalf of that person. (19) For the purposes of this regulation, information may be regarded as obtained from a reliable source which is independent of the person whose identity is being verified where— (a) … (b) that process is secure from fraud and misuse and capable of providing assurance that the person claiming a particular identity is in fact the person with that identity, to a degree that is necessary for effectively managing and mitigating any risks of money laundering and terrorist financing.” 16 The parties’ submissions

[80]Mr Shadrunov submitted that carrying out a visual check on the identity documents was sufficient to meet the requirements of Regulation 28, because VCL also matched the identity shown on those documents to the name on the customer’s UK bank account and the name on the customer’s account with the Exchange.

[81]The Authority’s position was that visual checks were inadequate; that VCL could not rely on due diligence carried out by other parties, and does not require the documents to be certified by a professional person, or utilise a commercial system designed to “verify the authenticity of documentation, for example systems designed to identify digital editing or alteration”.

[82]Mr Shadrunov responded by saying:(1) certification provides little further protection, as VCL cannot check the identity and status of the person providing the certificate; in other words, a person who had forged the identity document would be capable of forging the certification; and

(2) it was “not technically possible to reliably determine whether an image has been tampered with”; that VCL was unaware of any software that would achieve this, and that the Authority had not provided any examples of such software. The Tribunal’s view

[83]Having considered the legislation and the guidance, and on the basis of the information before us, our view is that VCL’s approach to verifying identity documents may be broadly compliant with the MLRs.

[84]We have already found that VCL cannot place reliance on the customer’s bank or on the Exchange, but we nevertheless accept that a cross-check from the identity documents to the customer’s name on those accounts is an appropriate risk management procedure. Adverse media screening

[85]Under the heading “customer risk factors”, the JMLSG guidance asks relevant persons to consider whether there are “any adverse media reports or other relevant information sources about the customer”, and adds that EDD “may include obtaining and assessing information about the customer’s or beneficial owner’s reputation and assessing any negative allegations”. The position of the parties

[86]The Authority decided that VCL’s approach to adverse media screening was insufficient, because internet searches would not “access relevant or significant material”, such as “paid-for material, aged material removed from the internet, or information from governmental databases in other jurisdictions”. Mr Temple did not expand on this during his submissions. Mr Shadrunov said that VCL had only carried out one such adverse media search, and that the use of the internet was therefore proportionate. The Tribunal’s view

[87]There is no requirement in the MLRs for a relevant person to carry out an adverse media search; the JMLSG guidance says only that it “may” be a relevant AML check. We did not place significant weight on this issue. PEPSs

[88]The Authority decided that VCL’s reliance on Wikidata to check whether a person was a PEP was insufficient to meet the requirements of Regulation 35. 17 Regulation 35

[89]Regulation 35 is headed “Enhanced customer due diligence: politically exposed persons” and begins:

“(1) A relevant person must have in place appropriate risk-management systems and procedures to determine whether a customer or the beneficial owner of a customer is— (a) a politically exposed person (a “PEP”); or (b) a family member or a known close associate of a PEP, and to manage the enhanced risks arising from the relevant person's business relationship or transactions with such a customer.”

The parties’ submissions

[90]Mr Temple invited the Tribunal to uphold the Authority’s position that Wikidata was insufficiently reliable because it was editable by the public: the Decision Notice said that:

“Open-source searches are unlikely to sufficiently capture corporate information and identify PEPs that arise as a consequence of direct/or indirect relationships to exposed persons or organisations. Identifying exposure to PEPs in a comprehensive manner ordinarily would require capability provided by 3rd party screening systems.”

[91]Mr Shadrunov pointed out that the FCA’s own guidance on PEPS set out in FG/17 says at 2.11:

“In line with the nature and size of the firm, it may choose, but is not required, to use commercial databases that contain lists of PEPs, family members and known close associates.”

[92]He challenged the Authority’s understanding of Wikidata, saying it was continually reviewed by “patrollers” who quickly remove errors, and submitted that it was at least as reliable as a “closed commercial database” which was not peer reviewed and had a much smaller number of editors.

[93]Mr Temple suggested that Wikidata was unreliable because a PEP could “temporarily delete their own name from the database when making transactions”. Mr Shadrunov said this was incorrect, as VCL used a historic copy of the online database. The Tribunal’s view

[94]The reliability or otherwise of Wikidata was a matter of evidence. Neither party had put forward third party evidence for their position. As Mr Shadrunov said, there is no directly applicable provision in the MLRs, and FCA’s guidance does not require a business to use a commercial screening service. Taking into account those matters, we decided we were unable to come to even a preliminary view on this issue, and when coming to our conclusion we place no weight on it. Effect if not granted

[95]Mr Shadrunov said that the FCA had not approved any cryptocurrency exchange since they had been brought within the scope of the MLR. As a result, some businesses had stopped trading; some had moved overseas to a location with no or minimal regulation and some had continued to trade in the UK regardless of the requirement to register with the FCA. In Mr Shadrunov’s submission, it was in the interests of consumers and important for the integrity of the market that VCL be registered, as consumers would otherwise have no access to regulated traders and would instead be transacting entirely outwith the oversight of the FCA. 18

[96]This submission relates to what would happen if the Suspension Application were to be refused. That is, however, not something we are able to take into account. The Tribunal in Sussex explained the position at [53] of their judgment:

“The Tribunal's discretion to grant the suspension order only becomes relevant once it is first satisfied “that to do so would not prejudice persons…intended to be protected by the notice”

(emphasis added). It is the prejudice which arises if the suspension is granted which is relevant. What the Tribunal is not directed to consider, so far as the pre-condition is concerned, is the risk of prejudice to consumers if the suspension order is not granted. That nuance may at first sight appear an unduly restrictive gateway to the Tribunal's discretion but it is important and reflects the starting point that Parliament has given the regulator….” The Authority’s process

[97]Mr Shadrunov had two criticisms of the Authority’s processes. The first related to the treatment of his representations, and the other to the lack of constructive help. The representations

[98]Mr Shadrunov said that having received the Warning Notice on 17 December 2021, he made representations on behalf of VCL to the Authority, but when he received the Decision Notice, it was a carbon copy of the Warning Notice, other than that the words “warning notice” had been replaced by “decision notice”, and the Authority had therefore failed to take any of his representations into account. It was only when the Bundle was served for these proceedings that he saw a copy of the Authorisation’s Response to VCL’s representations. He submitted that the Authority had acted in a manner which was procedurally unfair. Mr Temple said that in cases involving executive procedures there is no longer any requirement for applicants to be copied on the Authorisation’s Response.

[99]The Tribunal has no jurisdiction over the internal procedures of the Authority, but if a reference is made, the Tribunal considers all the evidence and the parties’ submissions before making its decision, and in so doing remedies any earlier procedural unfairness. We nevertheless observe that if (as here) an applicant reasonably considers that none of its representations have been considered by the Authority, it is more likely that the matter will be referred to the Tribunal. The previous practice of the Authority of disclosing key communications between the investigation team and the decision-maker obviously assisted the subject of a Warning Notice in understanding why its representations were not accepted. In this case, the Decision Notice itself did not appear to us to do so. Constructive approach?

[100]Mr Shadrunov also said he was disappointed the Authority had not taken a more constructive approach to the Application. He said he had acted in good faith and was doing his best to comply with the MLRs, and it would have been helpful had the Authority pointed out how he could amend VCL’s procedures to satisfy the requirements.

[101]Again, this is not a matter over which we have any jurisdiction: the extent to which the Authority uses its resources to provide guidance as compared to issuing rulings is an internal matter. Where, however, the Authority has taken a particular stance in relation to the application of its guidance to a new industry (such as cryptocurrency exchanges), as appears to be the case in relation to adverse media and PEP screening, we agree that it would be helpful if the Authority’s position were to be set out in advance, together with practical options so businesses acting in good faith can know whether they have met the requirements of the MLR, as interpreted by the FCA. On the basis of the evidence currently before us, we have no reason to doubt that in this case Mr Shadrunov acted in good faith. 19 Balancing exercise and overall conclusion

[102]We have already found that there is a case to answer, see §70. We now carry out a balancing exercise in the light of all relevant factors in order to decide whether in all the circumstances it is in the interests of justice to grant the Suspension Application. For the reasons given in the rest of this judgment:(1) We place significant weight on VCL’s interpretation and application of the “business relationship” concept for the reasons explained at §68 to §70, the linked factors set out at §71 and the relevance of this issue for Mr Shadrunov’s “fit and proper” status, see §74.

(2) We agreed with the Authority that VCL had not fully understood its role as an “gatekeeper” and that in the absence of a formal contract permitting reliance it was required to apply the MLRs independently of the checks carried out by third parties, and we place weight on that factor.

(3) We place little or no weight on the other issues identified in the Decision Notice: the ID procedures, adverse media screening and PEPs issues.

(4) We are not able to take into account the effect on consumers or the integrity of the market if the Suspension Application was not granted. Mr Shadrunov’s criticisms of the Authority’s processes are also not a relevant factor.

[103]As a result of that balancing exercise we are not satisfied that VCL would carry on its business in a broadly compliant manner were we to grant the Suspension Application. In consequence, we cannot be satisfied that allowing VCL to continue to carry on its activities pending the determination of the Reference will not prejudice those who are intended to be protected by the Authority’s decision to refuse the Application. We therefore refuse the Suspension Application. Next steps

[104]In view of the matters on which we have relied in reaching our decision on the Suspension Application, VCL will need to consider whether to maintain the Reference. Alternatively, VCL could withdraw the Reference in order to review its approach in the light of this judgment, and perhaps having taken specialist advice, it could subsequently make a new application to the Authority.

[105]Accordingly, within 14 days from the date of issue of this judgment, VCL is to inform the Authority and the Tribunal whether it is maintaining the Reference.

[106]If so, within a further 14 days, the parties are to do their best to agree directions for a hearing of the Reference and send those directions to the Tribunal for its approval. SIGNED ON ORIGINAL JUDGE TIMOTHY HERRINGTON JUDGE ANNE REDSTON UPPER TRIBUNAL JUDGES Release date: 29/06/2022