A Guernsey customer can be rated standard risk and still require enhanced measures. A non-resident investor, a personal asset holding vehicle or a company with nominee shareholders can bring those measures into scope. A checklist that adds checks only after a high-risk rating can miss the requirement.
This guide explains Guernsey AML compliance with a focus on customer due diligence (CDD), often called KYC. It is for compliance teams at funds, administrators, banks, investment businesses, and trust and corporate service providers. It uses the GFSC Handbook dated 7 July 2026, checked against the regulator’s current index on 7 October 2026. For help completing the files, see our Guernsey KYC services.
Start with Schedule 3 and the GFSC Handbook
Schedule 3 to the Criminal Justice (Proceeds of Crime) (Bailiwick of Guernsey) Law, 1999 sets requirements for risk assessment, CDD, monitoring and other controls. The Handbook on Countering Financial Crime (AML/CFT/CPF) explains how the Guernsey Financial Services Commission expects firms to meet those requirements. Appendix G reproduces Schedule 3; the Handbook index also links the relevant enactments.
The Handbook applies to financial services businesses and prescribed businesses. Guernsey has its own framework: a Jersey JFSC checklist or UK AML policy needs a Guernsey-specific assessment before use.
Chapter 1 distinguishes mandatory legislation and Commission Rules from guidance. The Handbook uses “shall” for statutory requirements and “must” for Commission Rules; “should” and “may” identify guidance that allows other effective ways to comply. The workflow recommendations in this guide are AgentKYZ’s suggestions, not additional GFSC rules.
Connect the business risk assessment to each customer file
Chapter 3 addresses money laundering, terrorist financing and proliferation financing risks. The firm must assess its business risks and the risks of individual relationships, taking account of the Bailiwick’s National Risk Assessment and relevant GFSC notices.
The business risk assessments must be reviewed at least annually and more frequently when changes to the business occur. A new service, acquisition, technology or outsourcing arrangement can change the exposure. Record the review and update the assessment and controls where needed.
At file level, explain why the customer’s activity, jurisdictions, delivery channel and structure produce the proposed risk rating. Our recommendation is to link the rating to the evidence and record the policy version used. An unexplained score gives the approver little basis for a decision.
Establish who the customer is and who controls the structure
Chapters 4 to 7 cover CDD, natural persons, identity verification, legal persons and legal arrangements. The work includes identifying and verifying the customer and relevant parties, establishing authority to act, and understanding the purpose and intended nature of the relationship. Collecting identity documents is only part of that work.
For legal persons, Chapter 7 describes a cascading three-step beneficial ownership test: control through ownership, then control through other means where appropriate, then the senior managing official where no individual can be identified through the earlier steps. These are not interchangeable options. Apply the relevant ownership and control tests, including indirect holdings; a simple shareholding-percentage filter can miss control.
Trusts need an assessment of the relevant parties and their roles, including settlors, trustees, beneficiaries and any protector or other person exercising control, under the applicable provisions. Guernsey protected cell and incorporated cell structures also need attention to the particular entity, cell and ownership rights. Chapter 7 addresses these structures specifically.
We recommend attaching each ownership conclusion to its supporting record. If the chain stops at an unexplained holding company, show the gap and the next action in the handover file.
Apply enhanced measures even below a high-risk rating
Chapter 8 separates two obligations under paragraph 5 of Schedule 3.
Enhanced customer due diligence (ECDD) applies to high-risk relationships and occasional transactions. The specified circumstances include foreign PEP relationships and certain correspondent relationships. Measures include the applicable senior-management approvals, source-of-funds and source-of-wealth work, and more frequent and extensive monitoring. Check the exact requirement for the customer and beneficial owners involved.
Enhanced measures apply to specified higher-risk factors, whether or not the relationship is otherwise high risk:
- A customer who is not resident in the Bailiwick.
- Private banking services.
- A legal person or arrangement used for personal asset holding.
- A customer with nominee shareholders, or owned by a legal person with nominee shareholders.
Use Sections 8.9 to 8.12 to select measures that address each applicable factor. Several factors can coexist, and the firm must consider their combined effect on the overall risk. A high-risk relationship with one of these factors requires both ECDD and the enhanced measures needed to address that factor.
Keep source of funds and source of wealth separate in the file. The former explains the origin of money in the relationship or transaction; the latter explains how wealth was accumulated. A payment from an account in the customer’s name does not necessarily establish the underlying origin of the money.
Define the fund, administrator and fiduciary roles
Section 4.8 explains investor CDD for collective investment schemes. For an authorised or registered Guernsey scheme, the board or relevant governing person nominates a firm licensed under the Protection of Investors (Bailiwick of Guernsey) Law, 2020 (the POI Law), contracted to or connected with the scheme as its manager or designated administrator, to meet the investor requirements in addition to its own obligations.
The nominated firm treats investors as its customers for those requirements. Another party can perform CDD work, but the nominated firm remains responsible for ensuring appropriate identification data is held. A firm providing services to the scheme without that nomination has a different customer relationship to assess. Non-Guernsey schemes require their own analysis under the relevant provisions.
For banks and investment businesses, define the account holder or investment client, relevant connected parties, and expected activity. A customer-file review does not by itself cover transaction monitoring, wire-transfer obligations or all correspondent-business controls.
For trust and corporate service providers, use Chapter 7 and the relevant sector guidance in Appendix D. Establish the service, parties, purpose and control of the arrangement before applying a checklist. A trust, company and cell structure should not all receive the same document request.
Review changes in activity as well as documents
Chapter 11 requires ongoing monitoring and risk-sensitive CDD. Section 11.9 describes periodic reviews alongside reviews prompted by trigger events. Set customer review intervals according to risk and track completion against your policy; the annual minimum for business risk assessments is a separate obligation.
Ownership changes, unexplained activity or new information about a customer can require attention before the scheduled review. Review the relationship risk assessment with the new evidence. Chapter 11 also explains that firms need not automatically re-verify identity unless existing information is inadequate for the assessed risk or its accuracy is in doubt.
For a backlog project, we recommend separating outdated information from missing evidence and unresolved risk concerns. Prioritise cases using the firm’s risk assessment and keep transaction-monitoring responsibilities explicit in the scope.
Escalate suspicion and sanctions connections through the right channels
Chapter 13 covers reporting suspicion, including internal reporting to the MLRO. The Guernsey FIU identifies THEMIS as the prescribed facility for submitting suspicious activity reports. Follow the applicable reporting and consent requirements and protect against tipping off. Do not let a routine remediation deadline delay an escalation.
Sanctions obligations are separate from the customer risk rating. Chapter 12 addresses screening and controls to detect and block transactions involving designated persons, including relevant ownership and control connections. The GFSC’s sanctions guidance describes immediate freezing and reporting to the Policy & Resources Committee, as well as reporting to the Commission under the applicable Handbook rule. A SAR is not a substitute for required sanctions reports.
In an operational review, preserve the evidence behind a possible match and escalate it promptly. Human review must resolve the match and the required action; a screening result alone does not complete the assessment.
Keep oversight when KYC work is outsourced
Chapter 2.5 states that the board remains ultimately responsible for outsourced activities and compliance. Before deciding to establish an arrangement, the firm must assess potential ML, TF and PF exposure and record that assessment as part of its business risk assessments. Read the sector-specific outsourcing provisions that apply to the firm as well.
The Handbook describes clear responsibilities, provider due diligence, adequate resources and meaningful reporting. Reports should explain the material reviewed and how conclusions were reached, so the firm can test the work. Required procedures must provide for timely reporting of relevant knowledge or suspicion to the outsourcing firm’s MLRO, subject to the applicable provisions.
Outsourcing work under your policy differs from introduced-business reliance under Chapter 10. Reliance has specific eligibility, certification, access and testing conditions. Receiving another party’s completed KYC file does not establish that those conditions have been met.
Our managed KYC service for Guernsey provides operational file work. It does not appoint us as your MLRO, MLCO or a scheme’s nominated firm, and it does not transfer your compliance responsibilities.
Retain records that explain the decision
Chapter 16 sets different retention rules for different records. Customer CDD records must be retained for five years from the end of the relationship or completion of the occasional transaction, or longer if the Commission directs. For transaction records, the five-year period starts when the transaction and any related transaction are completed. Records relevant to an investigation can require longer retention. Do not apply one deletion date to every record in the file.
For outsourced reviews, agree how the firm can retrieve the evidence during and after the engagement. We recommend an indexed file containing the documents reviewed, ownership analysis, screening dispositions, proposed risk assessment and unresolved exceptions, with the authorised team’s decisions recorded separately. Confirm data protection, access and retention terms before sharing customer information.
Clear the review backlog under your approved policy
Our Guernsey KYC outsourcing and remediation services cover onboarding and periodic or trigger-event reviews for financial services firms. Agents organise documents and perform the first pass; qualified compliance reviewers check the evidence and conclusions. Your authorised team retains acceptance, approval and reporting decisions.
Bring the case count, entity type and target date. We agree the review scope, responsibility for missing evidence, price and delivery schedule before file transfer.