Gidiplus Limited v The Financial Conduct Authority [2022] UKUT 00043 (TCC) [2022] UKUT 00043 (TCC)

UPPER TRIBUNAL
TAX AND CHANCERY CHAMBER
[2022] UKUT 00043 (TCC)
Between
Gidiplus LimitedAppellantThe Financial Conduct AuthorityRespondent
Before
Judge Timothy Herringtontaking place in London, on 1 February 2022 Chengetai Mupara for AppellantAdam Temple, Counsel (instructed by the Financial Conduct Authority) for AuthorityDate 16 February 2022Category: Financial services
[1]On 15 November 2021 the Financial Conduct Authority (“the Authority”) gave a Decision Notice to the Appellant (“Gidiplus”) refusing its application to be registered as a cryptoasset exchange provider pursuant to Regulation 57 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (“the MLRs”).[2]By a notice dated 3 December 2021 Gidiplus appealed to the Tribunal against this decision. As a consequence of the giving of the Decision Notice the temporary registration held by Gidiplus to carry on the cryptoassets activity referred to above has ceased to have effect by operation of Regulation 56A (1) (b) of the MLRs.[3]Gidiplus, however, in its appeal notice also applied for a direction that the effect of the Decision Notice be suspended pending the determination of the appeal pursuant to Rule 5 (5) of the Tribunal Procedure (Upper Tribunal) Rules 2008 (“the Rules”).[4]Gidiplus also applied for privacy in respect of the Decision Notice and the particulars of his appeal as regards the Tribunal’s register, but that application is not being pursued. Accordingly, this decision relates purely to Gidiplus’s application to suspend the effect of the Decision Notice (“the Suspension Application”). Background[5]Gidiplus’s business is the operation of cryptoasset automated teller machines (“CATMs”). CATMs are computer-based terminals which are set up in shops or similar locations, which allow customers either to feed in currency (in the form of notes), to be converted into cryptocurrencies, or to receive currency from the sale of their own cryptocurrencies. I was told that Gidiplus only deals in bitcoin, and that all of its CATMs are focused solely on the receipt of banknotes, rather than the dispensing of the same.[6]On 22 June 2020, Gidiplus applied to the Authority to be registered as a cryptoasset exchange provider under the MLRs. The MLRs had been amended with effect from 10 January 2020 to require such providers to be registered under the MLRs, with a transitional period for registration of pre-existing cryptoasset exchange providers, allowing them to continue to operate until 10 January 2021, later extended to 31 March 2022, providing certain conditions had been met.[7]Because Gidiplus’s application had not been determined by 10 January 2021, it moved on to the Authority’s “Temporary Registration Regime”. This regime applies to all cryptoasset firms who had been active prior to 10 January 2020, and who had outstanding applications as of 16 December 2020. 3[8]Mr Olumide Osunkoya is the 75% shareholder in Gidiplus (with his wife, Ms Sally Osunkoya holding the other 25%). Mr Osunkoya is also a director of Gidiplus, and in Gidiplus’s application for registration was proposed as the senior manager responsible for Gidiplus’s compliance with the MLRs (under Regulation 21(1)(a)) and the proposed Nominated Officer (under Regulation 21(3)).[9]On 15 November 2021, the Authority refused the application by way of the Decision Notice. Gidiplus was then removed from the list of firms with temporary registration. Unfortunately, although the letter enclosing the Decision Notice made it clear that as a result of the issue of the Decision Notice Gidiplus no longer had temporary registration, the letter did not inform Gidiplus, as it should, of the reasons why the decision took immediate effect. That was rectified in a further letter from the Authority on 30 December 2021 which stated that the Authority considered that it is in the interests of the public for its decision to have immediate effect. The reasons the Authority gave related to the money laundering risks arising from the concerns identified in the Decision Notice, as explained in more detail below. Decision Notice[10]The Decision Notice was given because the Authority considered that Gidiplus had not met the conditions for registration as a cryptoasset business contained in the MLRs. In summary, the reasons given for that conclusion were:(1) Under Regulation 58A of the MLRs, the Authority must refuse to register an applicant for registration as a cryptoasset business if the applicant does not meet the requirement that it, and any officer, manager, or beneficial owner of the applicant, must be a fit and proper person to carry on the business of a cryptoasset exchange provider or custodian wallet provider. In determining whether this requirement is met, the Authority must have regard to the following factors: (a) whether the applicant has consistently failed to comply with the requirements of the MLRs; (b) the risk that the applicant’s business may be used for money laundering or terrorist financing; and (c) whether the applicant, and any officer, manager or beneficial owner of the applicant, has adequate skills and experience and has acted and may be expected to act with probity.(2) Under Regulation 59(1)(e) of the MLRs, the Authority may refuse to register an applicant for registration as a cryptoasset business where the Authority suspects on reasonable grounds that: (a) the applicant will fail to comply with any of its obligations under the MLRs 2017, Part 3 of the Terrorism Act 2000, or Parts 7 and 8 of the Proceeds of Crime Act 2002 (“the relevant obligations”); or 4 (b) any person whom the applicant has identified as one of its officers or managers will fail to comply with any of the relevant obligations.(3) Pursuant to Regulations 18 and 19 of the MLRs, Gidiplus is required to identify and assess the risks of money laundering and terrorist financing to which its business is subject and to establish and maintain policies, controls and procedures to mitigate and manage effectively those risks which are proportionate with regard to the size and nature of its business. As part of the Application, Gidiplus submitted the following documents which contain the majority of its anti-money laundering systems and controls: (a) AML CTF Policy; and (b) Governance Arrangements and Internal Control Mechanisms.(4) In addition, a voluntary recorded interview was held via video conferencing with Mr Osunkoya, on 22 October 2020 (“the Interview”). At the Interview, Mr Osunkoya was questioned about Gidiplus’ business activities, operational structure, banking arrangements and framework for anti-money laundering and counter-terrorist financing, including the firm’s relevant systems and controls. Mr Osunkoya was also asked about his role at Gidiplus and his professional skills and experience.(5) Having reviewed the documents submitted by Gidiplus in the context of the Application and Mr Osunkoya’s responses at the Interview, the Authority was not satisfied as to the adequacy of Gidiplus’ anti-money laundering systems and controls. The Authority had particular concerns in respect of Gidiplus’ business-wide and customer risk assessments, customer due diligence, enhanced due diligence and transaction monitoring.(6) The Authority also considered that Mr Osunkoya had not demonstrated that he has adequate knowledge, skills and experience in respect of Gidiplus’ obligations under the MLRs. Mr Osunkoya’s responses at the Interview in respect of Gidiplus’ banking arrangements also raised concerns regarding his probity.(7) In light of the above, the Authority was not satisfied that Gidiplus is a fit and proper person for the purposes of Regulation 58A of the MLRs and/or that it will comply with the relevant obligations for the purposes of Regulation 59(1)(e)(i) of the MLRs. In addition, the Authority was not satisfied that Mr Osunkoya is a fit and proper person for the purposes of Regulation 58A of the MLRs and/or that he will comply with the relevant obligations for the purposes of Regulation 59(1)(e)(ii) of the MLRs. Probity[11]The concerns expressed by the Authority in the Decision Notice regarding Mr Osunkoya’s probity arose out of the fact that, as revealed in an interview he gave to the police in 2018 who were investigating possible money laundering breaches, he misled three banks as to the true nature of Gidiplus’s business. He acknowledged that he had deliberately not informed the first two banks that Gidiplus was a CATM 5 business on the basis that, if he had done so, the accounts would have been shut down immediately. When he moved Gidiplus’s banking arrangements to another bank the account was opened on the basis that Gidiplus was an events business. The Authority says that Mr Osunkoya therefore deliberately chose not to inform the bank that Gidiplus was a CATM business and instead advised that the firm was involved in a different type of activity. In addition, Mr Osunkoya stated to the Authority that certain payments had been mis-marked as stock orders and events catering in keeping with what he had told the banks about the nature of the business.[12]The Decision Notice says that Mr Osunkoya also informed the Authority that he faced difficulties in trying to obtain a bank account for his CATM business. However, notwithstanding these difficulties, the fact that he deliberately misled the banks regarding the nature of his business activities, effectively in order to circumvent the banks’ systems and controls in relation to cryptoasset businesses, raises, in the Authority’s view, serious questions about his fitness and propriety. Furthermore, the Authority understands that Mr Osunkoya has not sought to correct this situation by informing his latest bank of the true nature of Gidiplus’ business activities. Risk Assessment[13]As regards Mr Osunkoya’s knowledge, skills and experience, the Authority’s assessment based on the documents submitted as part of Gidiplus’s application and Mr Osunkoya’s responses at the Interview was that he lacked sufficient experience and training to undertake the roles of Nominated Officer and senior manager responsible for compliance, not having undertaken any significant compliance role before and that he had only completed 1.5 hours of training in anti-money laundering and anti-bribery in June 2020.[14]As noted in the Decision Notice, Regulation 18 of the MLRs requires relevant firms to take appropriate steps to identify and assess the risk of money laundering and terrorist financing to which its business is subject. The Authority considered that Gidiplus’s AML CTF Policy was superficial and did not analyse how the generic risks referred to in the document apply to its own business. The Authority identified that a key risk so far as Gidiplus is concerned is that its CATMs provide an opportunity for individual customers to exchange cash (either in commonly-used low denominations or larger denominations) deriving from criminal activity and/or for the purposes of terrorist financing for cryptoassets. That risk was not recognised in the documents submitted by Gidiplus with its application and, of further concern, Mr Osunkoya specifically did not know what was meant by the term “smurfing” during the Interview. Smurfing is a term used to describe a money laundering typology whereby individuals break down a large sum of cash into multiple smaller transactions to avoid regulatory reporting limits and detection. The Authority said that it would expect Mr Osunkoya, as Nominated Officer at Gidiplus, to be familiar with this term and understand what smurfing entailed. When this money laundering methodology was explained to him, he claimed that it was inconceivable that any such activity could be conducted through his CATMs. 6[15]The Authority considered that Mr Osunkoya’s responses at the Interview also failed to demonstrate that he has a meaningful understanding of the money-laundering and terrorist financing risks facing Gidiplus and how it should mitigate these risks. Accordingly, the Authority was not satisfied that Gidiplus had taken appropriate steps to identify and assess the money laundering and terrorist financing risk that its business faces having regard to the nature and size of its business in accordance with Regulation 18 of the MLRs. Customer Due Diligence[16]The Authority considered that the lack of customer due diligence conducted by Gidiplus in respect of customers who could convert up to £250 per day, and £1,000 per month without any identity checks beyond the provision of a mobile telephone number and the automated taking of a “selfie” photograph by the CATM was in direct contravention of Regulations 27 and 28 of the MLRs. Regulation 27 requires cryptoasset firms to apply customer due diligence measures and Regulation 28 sets out the obligations to identify the customer and verify the customer’s identity, and to assess, and where appropriate obtain information on, the purpose and intended nature of the business relationship or occasional transaction.[17]The Authority also found that there was no reference in Gidiplus’s AML CTF Policy to the need to assess, and where appropriate obtain information on, the purpose and intended nature of the business relationship or occasional transaction in accordance with Regulation 28 (2) (c) of the MLRs.[18]As regards the requirements to undertake enhanced due diligence in accordance with Regulation 33 of the MLRs, for example where there is an unusual pattern of transactions or the transactions have no apparent economic or legal purpose, the Authority considered that Gidiplus had no documented means of identifying a higher risk of money laundering and/or terrorist financing in relation to its customers who are not politically exposed persons, are UK based and operate within the fixed financial thresholds. Transaction monitoring[19]Regulation 28(11) of the MLRs requires firms to conduct ongoing monitoring of a business relationship, which includes scrutinising transactions undertaken throughout the course of the relationship to ensure that these transactions are consistent with the relevant person’s knowledge of the customer, the customer’s business and risk profile.[20]The Authority found that there was no detailed written approach or set of procedures that Gidiplus follows in respect of monitoring transactions. It also considered that Mr Osunkoya provided little detail as to how he examined transaction patterns to identify suspicious activity, noting also that Gidiplus is unable to undertake meaningful transaction monitoring in relation to a proportion of its transactions because Gidiplus does not attempt to assess the purpose and intended nature of the business relationship at the point of onboarding. 7[21]Accordingly, the Authority was not satisfied that Gidiplus was able to comply with its transaction monitoring obligations.[22]The Decision Notice records that Gidiplus acknowledged in its representations to the Regulatory Decisions Committee that the Authority had identified a number of issues which must be remediated to ensure it complies with its relevant obligations for the purpose of the MLRs. In its representations, Gidiplus said that it had prepared a remediation plan which shows its roadmap, outlines its understanding of the issues, and details its proposed actions for resolving each area of concern. It said it was engaging third party compliance consultants to assist it in identifying and rectifying the issues identified and any other issues. It said its aim was to have all its improved controls in place before 31 March 2022 and will regularly share its progress on the remediation with the Authority. It also said that it planned to hire new skilled and qualified management staff, including a Money Laundering Reporting Officer. Relevant law and issues to be determined[23]Pursuant to Rule 5(5) of the Rules the Upper Tribunal has the power to direct that the effect of the decision in respect of which the reference or appeal is made (in this case the giving of the Decision Notice) is to be suspended pending the determination of the reference:
“…. if it is satisfied that to do so would not prejudice – (a) the interests of any persons (whether consumers, investors or otherwise) intended to be protected by that notice; (b) the smooth operation or integrity of any market intended to be protected by that notice; or (c) the stability of the financial system of the United Kingdom.”
[24]It was common ground that the conditions to be met before the Tribunal can grant a suspension under Rule 5 (5) are those set out in Sussex Independent Financial Advisers Limited v FCA [2019] UKUT 228 (TCC) (“Sussex”) at [14] and [15] as follows (with citations omitted): “14…(1) The Tribunal is not concerned with the merits of the reference itself and will not carry out a full merits review but will need to be satisfied that there is a case to answer on the reference…;(2) The sole question is whether in all the circumstances the proposed suspension would not prejudice the interests of persons intended to be protected by the notice…;(3) Detriment to the applicant, such as it being deprived of its livelihood, is not relevant to this test.;(4) The burden is on the applicant to satisfy the Tribunal that the interests of consumers will not be prejudiced…; and 8(5) So far as consumers are concerned, the type of risk the Tribunal is concerned with is a significant risk beyond the normal risk of a firm that is doing business in a broadly compliant manner…. The reference to consumers should for such purposes have the same meaning as in section 1G of Financial Services Markets Act 2000 (“FSMA”) which defines consumers to mean person who use, have used, or may use among other things regulated financial services…[15]Additionally, as noted in the [cited] decisions, even if satisfied that granting a suspension would not prejudice the interests of consumers, the Tribunal is not obliged to grant a suspension. The use of the word "may" in Rule 5(5) means that it is a matter of judicial discretion as to whether or not a suspension should be granted. It is necessary for the Tribunal to carry out a balancing exercise in the light of all relevant factors and decide whether in all the circumstances it is in the interests of justice to grant the application. The power is a case management power, which in accordance with Rule 2 (2) of the Rules must be exercised in accordance with the overriding objective to deal with the matter fairly and justly…”[25]As Mr Temple submitted, in a case such as this, relating to registration under the MLRs, the Decision Notice was issued with the intention of protecting against the risk of money laundering and terrorist financing (money laundering for short). Accordingly, it is issued by the Authority because it was of the view that it was necessary to refuse Gidiplus’s application for registration in order to:(1) protect those who are intended to be protected by the MLRs (the public in general, and in particular potential victims of criminal activity which may be facilitated or incentivised by a criminal’s ability to launder money); and(2) the integrity of the UK financial system, in preventing it from being used to launder money.[26]Assuming that the Tribunal can be satisfied that there is a case for Gidiplus to answer on the appeal (which I consider below), the essential question for the Tribunal is whether it can be satisfied that if the Suspension Application is granted there will be no significant risk beyond the normal risk of a firm that is undertaking business in a broadly compliant manner. I would therefore need to be satisfied that if a suspension were granted, Gidiplus would, pending the determination of its appeal, carry out its activities in a manner which was broadly compliant with the MLRs. Basis for the Suspension Application[27]The basis on which Gidiplus argues for a suspension direction has changed significantly since it made the Suspension Application, and subsequently filed reasons for its application and evidence in support in accordance with the Tribunal’s directions in that regard.[28]Originally, Gidiplus put forward arguments which were focused entirely on the substantive appeal, in effect arguing that the Decision Notice ought not to have been 9 issued. Those arguments were only relevant to the Suspension Application insofar as they seek to establish that there was no case to answer in response to the appeal.[29]No arguments or evidence were put forward as to the question as to whether Gidiplus would carry on its business in a broadly compliant fashion were the Suspension Application to be granted and no such information was provided in the witness statement provided by Mr Osunkoya, which in essence complained about his treatment by the Authority during the regulatory proceedings at a time when he was suffering from ill health.[30]However, shortly before the hearing of the Suspension Application Mr Osunkoya instructed Mr Mupara to represent Gidiplus at the hearing. Mr Mupara filed a skeleton argument in which, in addition to submitting that there was no case to answer on the reference also submitted that there was no significant risk to the public which is beyond the normal risk of doing business in a broadly compliant manner.[31]In support of those submissions, Mr Mupara referred to evidence that had not been covered in Mr Osunkoya’s witness statement. Accordingly, I permitted Mr Osunkoya to give limited oral evidence in chief and for Mr Temple to cross examine Mr Osukonya on those matters. I was satisfied that it was in the interests of justice to take that exceptional course, bearing in mind my obligation to give effect to the overriding objective by avoiding unnecessary formality and seeking flexibility in the proceedings, in the light of the fact that Mr Osunkoya had not had the benefit of legal advice when he prepared his evidence. I was also satisfied that the Authority would not be prejudiced by that course being taken due to the limited nature of the material in question and Mr Temple’s overall familiarity with the matter.[32]In summary, Mr Mupara submitted:(1) There was no case to answer in response to the appeal. At best the evidence is tenuous and/or inconsistent in nature. Mr Osunkoya had been interviewed by the police in relation to money laundering in 2018 and answered all questions truthfully. The police did not arrest, charge, caution or warn Mr Osunkoya as to his future conduct which is conclusive evidence that there is no case to answer. The Authority interviewed Mr Osunkoya for several hours and found no evidence of Gidiplus’s platform being used by criminals. Its case is based on the perceived potential risk and there is no real evidence of quantifiable risk.(2) Mr Osunkoya was candid in his interview with the Authority and his answers were consistent with the police interview in 2018.(3) Once the term “smurfing” had been explained to him, Mr Osunkoya gave a clear and cogent explanation of how the risk of “smurfing” on his CATMs was low.(4) Gidiplus’s operation is very small. Its CATMs have a maximum capacity of 600 banknotes. These machines only receive and never dispense banknotes. 10(5) The machines are located in off-licence shops on busy high streets. Anyone or any group of individuals seeking to spend a long time making numerous transactions will draw unwanted attention to themselves. If that ever happens, the shop owner would ring Mr Osunkoya to report such suspicious activities. Users are limited to purchase bitcoin to the value of £250 per day, regardless of how many machines operated by Gidiplus that they use.(6) Before a transaction is initiated, the user has to register with a mobile telephone. Machines only accept pay monthly contracts.(7) The user has to use a photo ID by scanning it on the camera. Only a driving licence is accepted because this shows both a photograph and the address of the individual. Gidiplus checks the ID manually and uses Alaco Analytics and the General Bytes proprietary software to check if the person is a politically exposed person, a person with serious criminal convictions, a person on any terrorist watchlist et cetera and if there are any red flags the registration is declined.(8) The Authority found no evidence that Gidiplus’s platform posed a significant risk beyond that would be faced by any financial services business.(9) The Authority waited until 30 December 2021 to inform Gidiplus when the effect of the Decision Notice took effect. If Gidiplus’s platform posed such a grave risk, the Authority would not have taken such a lackadaisical approach to regulating it.(10) There are no grounds to question Mr Osunkoya’s probity. He was truthful in his interviews, has no criminal convictions other than a speeding ticket and no convictions for dishonesty. Gidiplus has appraised its bank about the nature of its business and the bank knows that it is a crypto currency business. Findings of fact[33]I make some limited findings of fact from the documents that were provided to me by the Authority and arising out of Mr Osunkoya’s evidence. I have tried to be careful not to make definitive findings on disputed matters which will be explored in more detail on the hearing of the substantive reference. I have therefore tried only to make findings which are directly relevant to the Suspension Application.[34]I am also proceeding on the basis that what Mr Osunkoya said in his evidence as to certain aspects of Gidiplus’s business and the manner in which it was intended to be carried on, as set out at [35] and [36] below, is correct. That is without prejudice to the position that may be established after full consideration of all the evidence following the hearing of the substantive reference.[35]Therefore, I am proceeding on the basis that Gidiplus operates 13 CATMs in total. These machines are situated in various locations in London, Kent, Nottingham and Sheffield and are situated in off-licence shops on busy high streets.[36]Customers are limited to depositing £250 per day, regardless of the number of Gidiplus’s machines that they use. The identification process starts with the taking of 11 an automatic photograph and before a transaction is initiated, the user has to register a mobile telephone which is the subject of a monthly contract.[37]I can make no findings as to the extent to which the Alaco Analytics and the General Bytes proprietary software is used by Gidiplus to conduct enhanced due diligence. Mr Temple challenged Mr Osunkoya’s assertion as to whether this software was capable of producing suspicious activity reports. Mr Osunkoya has not provided any evidence to support his assertion and accordingly this is not a matter that can be resolved at this time.[38]As regards the provision of identification in the form of a driving licence, Mr Osunkoya accepted that he had told the Authority in January 2021 that the only identification provided was that of the “selfie” and mobile telephone contract. Mr Osunkoya’s evidence was that the position changed after Gidiplus became subject to the Authority’s regulation following the temporary registration, but since that time photo ID in the form of a driving licence was required.[39]I have seen two videos provided to the Authority by Gidiplus showing a demonstration of its due diligence process. These videos appear to have been created after Gidiplus became subject to the Authority’s registration requirements. The first video demonstrates a customer seeking to deposit no more than £250 and it shows that the production of a driving licence was not necessary. All that was required was the customer’s mobile phone number. It is only in relation to transactions which exceeded the daily limit of £250 where, as demonstrated in the second video, it was necessary to produce photo ID in the form of a driving licence. Since the Decision Notice, which found that no identification beyond the “selfie” and telephone contract was required, Gidiplus has not provided any documentation to the Authority establishing that it has procedures in place to obtain identification in the manner that is now envisaged. Mr Osunkoya said that because of his health issues he had not had time to provide the documentation. I therefore find that Gidiplus did not require the production of a driving licence for transactions not exceeding the daily limit of £250 during the period that its temporary registration was in force and it has not provided evidence as to how that identification would be provided if I were to grant the Suspension Application.[40]Mr Temple referred Mr Osunkoya to a publication issued in 2020 by Elliptic, which was described as “Financial Crime Typologies in Cryptoassets – the Concise Guide for Compliance Leaders in which Elliptic was described as the global leader in cryptoasset risk management solutions for crypto businesses and financial institutions worldwide and was said to have assessed risk on transactions worth several trillion dollars. That helpful publication highlighted what red flags to look out for. The publication gave as examples of “smurfing” under the heading “Red Flags for Mule Activity involving Cryptoasset ATMs” where a single individual making multiple deposits at a cryptoasset ATM each day up to the standard deposit limit or at frequent intervals for amounts consistent with “smurfing” activity and where numerous individuals with common addresses, mobile devices, nationalities or other similar identity indicators sign up for accounts within a short period for ambiguous reasons. 12 Under this heading, the publication also identified as a red flag inconsistent or improbable reasons customers provided for the transactions they were undertaking.[41]Mr Osunkoya said that he had not read this publication. He said that criminals would not undertake transactions of the type described above because of the low daily limit of Gidiplus’s CATMs. He provided no evidence that he had carried out any training beyond the 1 ½ hours training referred to in the Decision Notice, citing his illness as the reason. He was not able to provide any evidence that Gidiplus’s procedures asked customers as to the reasons they were undertaking transactions with Gidiplus and stated that he did not approach every customer as if they were a criminal and a £250 limit meant there was no significant risk of the kind referred to in the Elliptic publication.[42]Mr Osunkoya asserted that he had agreed to engage compliance consultants and that Gidiplus had agreed to take on a duly qualified compliance officer, who he named. He confirmed that no evidence of these agreements have been provided to the Authority. He was referred to the remediation programme that he provided during the course of his representations to the RDC and confirmed that Gidiplus continued to put this in place but just needed more time to do so. There was no evidence of any updates of the progress of this plan having been provided to the Authority, as it envisaged.[43]As regards his dealings with his various banks, as described to the police in 2018 and to the Authority in 2020, Mr Osunkoya confirmed that what he said in those interviews was correct. In particular, he had told his current bank that he was running an events business rather than a cryptoasset firm because he knew that if it was told the true position the bank would not open an account for Gidiplus. He defended that position on the basis that the industry was in its infancy at that time, and he did what others did at the relevant time, when there were no regulations governing the position. Mr Osunkoya was unable to provide any evidence to support the assertion made in Mr Mupara’s skeleton argument to the effect that his current bank had been told of the true position regarding Gidiplus’s business. He did, however, indicate that he was in talks with another bank which had a large presence in the cryptoassets sector and had told that bank the true nature of Gidiplus’s business. In the absence of any corroborative evidence, I can make no finding as to whether those assertions are correct, but I think it is quite likely that if Gidiplus’s current bank had been told the true position, then they would have closed the account, on the basis of the false information that had been previously provided. Discussion[44]As set out at [15] of Sussex, quoted at [24] above, it is necessary for me to carry out a balancing exercise in light of all relevant factors and decide whether or not a suspension should be granted.[45]As was emphasised in Sussex, the burden is on the applicant to satisfy the Tribunal that the interests of the public in being protected from the risk of money laundering and the integrity of the UK financial system, in preventing it from being 13 used to launder money, will not be prejudiced if the application was granted. Therefore, for an application of this nature to have a chance of being successful the applicant must make detailed evidence available to the Tribunal as to how its business will be carried on in a broadly compliant fashion during the period up to the hearing of the appeal.[46]I start by considering whether I can be satisfied that there is a case to answer on the appeal. Although I am not concerned with the merits of the appeal itself, were I of the view that the Decision Notice did not make findings which were capable of demonstrating that Gidiplus has not met the conditions for registration as a crypto asset business contained in the MLRs then it would be possible for the Tribunal to take the view that granting the application would not result in a significant risk of money laundering.[47]Mr Mupara based his submission that there was no case to answer in respect of the appeal solely on the basis that Mr Osunkoya had given truthful answers to both the police and the Authority in his interview regarding the police enquiries into possible money laundering in 2018, that he had no criminal convictions and that no evidence of any wrongdoing or quantifiable risk existed.[48]However, that submission misses the point. I accept that Mr Osunkoya gave honest answers to both the police and the Authority in relation to the questions that were put to him as to the way that his bank accounts had been operated. He was candid in admitting that the various banks had been misled into believing that Gidiplus carried on an events business and that he did not tell them that Gidiplus’s true business was carrying on the business of a cryptoassets exchange because he knew those banks would have refused to provide Gidiplus with banking services.[49]Nevertheless, the fact that Mr Osunkoya misled the banks in that way gives rise to serious concern. He acted dishonestly in giving the banks the impression that Gidiplus carried on an events business. By so doing, he prevented the banks from meeting their know your customer obligations on the basis of the correct information and thereby put at risk their own compliance with the money laundering regulations. He compounded the situation by seeking to disguise the nature of the transactions that went through Gidiplus’s accounts.[50]A further concern is that Mr Osunkoya does not appear to accept what he did was wrong. In his oral evidence, he justified what he did on the basis that it was usual practice at a time when cryptoasset firms were not subject to regulation, the business was in its infancy and the banks were not as a matter of policy generally wishing to take on those firms. That is clearly an unacceptable reason, and that approach raises further concerns as to whether, as of today, Mr Osunkoya fully understands his responsibilities to prevent money laundering. He appeared to believe that it was acceptable for him to decide for himself whether there is a money laundering risk in his firm’s business rather than to give the institution with whom he was seeking to establish a relationship the full information that would enable that institution to make its own informed judgment. Moreover, as I have said at [43] above, there is 14 insufficient evidence for me to conclude that Gidiplus’s current bank has even now been told of the true nature of its business.[51]Although the concerns regarding Mr Osunkoya’s probity which arose out of Gidiplus’s relationship with its banks is not the sole reason why Gidiplus’s application for registration was refused, and the Authority has not given any indication that in itself this issue is fatal to the application, in my view it is a very serious factor to be taken account in the Authority’s overall assessment and a very strong factor weighing in the balance against me granting the Suspension Application.[52]Furthermore, Gidiplus itself, in its representations to the RDC, clearly accepted that in relation to the other matters that the Authority relied on in refusing the application that there was more work to be done before it was able to meet the conditions for registration and proposed a remediation plan to address them, a plan which it does not appear has yet been implemented. The fact that those matters only relate to potential risks of money laundering and are not quantifiable does not lessen the concern. In my view, all of those other matters relied on by the Authority, taken together with the concerns regarding Mr Osunkoya’s probity lead me to conclude that there is a serious case to answer on the appeal.[53]I now turn to the question as to whether I can be satisfied that there is no significant risk of money laundering beyond the normal risk of a firm that is doing business in a broadly compliant manner if Gidiplus’s business is permitted to be carried on pending the determination of the appeal.[54]In that regard, Mr Mupara’s submissions are directed primarily to the point that this is a very small business, with a limited number of CATMs and because of the current limitation of £250 per customer per day there is no significant risk to the public because the business is too small to make it worthwhile for criminals to engage in money laundering through the CATMs.[55]Again, that submission misses the point. There is no exception from the requirements of the MLRs, in particular those that relate to customer due diligence, enhanced due diligence, and understanding the purpose for which customers are undertaking the transactions through the firm, simply because the firm is a small one and the transactions which the customer undertakes are also relatively small.[56]As I have said, the burden is on Gidiplus to satisfy me that if I were to grant the Suspension Application the business would be carried on in a broadly compliant manner. In that regard, I would need to be satisfied as to what arrangements would now be in place to meet the requirements of the MLRs.[57]In that respect, the evidence does not appear to have moved on significantly since the Decision Notice and Gidiplus’s commitment to execute the remediation plan it submitted to the Authority. I accept that implementation of that plan may have been delayed due to Mr Osunkoya’s health issues, but it appears that no evidence of Mr Osunkoya’s current health position has been submitted to the Authority and Mr 15 Mupara made no submissions that would indicate that at the current time Mr Osunkoya is unable to perform his responsibilities for health reasons.[58]No documentary evidence has been provided to the Authority as to the implementation of the remediation plan. Mr Osunkoya made assertions as to the employment of compliance consultants and a Money Laundering Reporting Officer but provided no evidence to back up those assertions. As I have found, there is no evidence that since Gidiplus was subject to the Authority’s regulation it had implemented satisfactory customer identification procedures.[59]There is also no evidence that Mr Osunkoya has taken serious steps to improve his skills and knowledge. He admitted that he had not read the Elliptic report. Had he done so, he would have appreciated that “smurfing” can be a significant risk, even where the transactions undertaken are relatively small, and the importance of obtaining information on the purpose and intended nature of the business relationship with the firm’s customers, as required by the MLRs.[60]I do not see any force in Mr Mupara’s admission that the Authority’s delay in informing Gidiplus of the reasons why the Decision Notice took immediate effect demonstrates that the Authority did not consider that Gidiplus posed any significant risk. It was indeed unfortunate that at the time it issued the Decision Notice the Authority did not appear to understand the requirement of the MLRs to give reasons for why the Decision Notice took immediate effect, but it was clear from the covering letter sent with the Decision Notice that it was to take immediate effect. There was therefore no delay in that decision being implemented.[61]Accordingly, I cannot be satisfied on the basis of the evidence currently available to me, that if I were to grant the Suspension Application, that Gidiplus would, until its appeal is determined, carry out its business in a broadly compliant fashion. Conclusion[62]In conclusion, given the serious concerns identified in the Decision Notice and the lack of evidence as to how Gidiplus would undertake its business in a broadly compliant fashion pending determination of its appeal, I cannot be satisfied that allowing Gidiplus to continue to carry on its activities pending the determination of this appeal will not prejudice those who are intended to be protected by the Authority’s decision to refuse Gidiplus’s application for registration under the MLRs. In those circumstances, I must dismiss the Suspension Application. 16 Signed on Original JUDGE TIMOTHY HERRINGTON UPPER TRIBUNAL JUDGE RELEASE DATE: 16 February 2022

Cited in 4 later judgments