AMLG11200 | Guidance for all sectors: Parent undertakings and managing subsidiaries and branches

12. Parent undertakings and managing subsidiaries and branches

If your business operates under a group structure, consisting of a parent undertaking and one or more subsidiary undertakings, or your business has different branches, your risk assessment must fully consider the risks of money laundering, terrorist financing and proliferation financing that may arise across the entire group or network and establish and maintain effective PCPs to manage and mitigate such risks.

The parent undertaking must ensure that the businesses’ PCPs are communicated to, and applied in, all subsidiary undertakings and branches carrying out business in a supervised sector, including those located or established outside the UK.

A parent undertaking must also:

• Put in place PCPs for data protection and information sharing to prevent money laundering, terrorist financing and proliferation financing within other members of the group as well as sharing information about customers, customer accounts, and transactions with other members of the group.

• Regularly review and update all PCPs.

• Keep a written record of all PCPs, any changes made to them and the steps taken to communicate them to its subsidiary undertakings and branches.

• Ensure that information relevant to the prevention of money laundering, terrorist financing and proliferation financing is shared within the group as appropriate, subject to any restrictions on sharing information.

• Ensure that subsidiaries or branches in other countries are complying with the anti money laundering and counter terrorist financing requirements of that country.

• Ensure that subsidiaries or branches in other countries, are applying measures that are equivalent to those required by the UK, even if those jurisdictions do not impose equivalent anti money laundering/counter-terrorist financing requirements as strict as those of the United Kingdom. The only exception to this is where doing so would not be permitted under the law of that third country, in which case you must put in place extra controls to manage this risk and inform HMRC.