Regulation 19 Amendment of Schedule 4I1

Schedule 4 (conditions for permitted disclosure) is amended as follows.

After Part 2 insert—

“PART 2A

Disclosure to a Credit Institution or a Financial Institution

12A.

The credit institution or financial institution maintains appropriate procedures—

(a)

to ensure that an independent person can investigate and audit the measures maintained by that institution for the purposes of ensuring the security of any information disclosed to it; and

(b)

for the purpose of ensuring that it complies with its obligations under the Data Protection Act 1998^f1, or, where the institution carries on business in an EEA State other than the United Kingdom, with its obligations under any other legislation implementing Directive 95/46/EC^f2 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

12B.

The credit institution or financial institution has delivered to the registrar a statement confirming that it is a credit institution or, as the case may be, a financial institution, and that it meets the conditions in paragraph 12A.

12C.

The credit institution or financial institution has delivered to the registrar a statement that it intends to use information only for the purpose of applying customer due diligence measures to the company in relation to which the information is secured, in accordance with the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.

12D.

The credit institution or financial institution has delivered to the registrar a statement that confirms the name and registered number of the company it is entering a transaction with which requires the institution to apply customer due diligence measures under those Regulations.

12E.

The credit institution or financial institution has delivered to the registrar a statement that it intends to take delivery of and to use the information only in the United Kingdom.

12F.

The credit institution or financial institution has delivered to the registrar a statement that it will, where it supplies a copy of the information to a processor for the purpose of processing the information for use in respect of the purpose referred to in paragraph 12C—

(a)

ensure that the processor is one who carries on business in the European Economic Area;

(b)

require that the processor does not transmit the information outside the European Economic Area; and

(c)

require that the processor does not disclose the information except to the credit institution or financial institution.

12G.

The credit institution or financial institution has delivered any information or evidence required by the registrar for the purpose of enabling the registrar to determine in accordance with these Regulations whether to disclose the information.

12H.

The credit institution or financial institution has complied with any requirement by the registrar to confirm the accuracy of the statements, information or evidence delivered to the registrar pursuant to this Part.”.