Understanding risks and taking action for TCSPs

Published 17 August 2020 by HMRC


  1. National risk assessment
  2. Risk characteristics

National risk assessment

The National Risk Assessment 2017 assessed Trust and Company Service Providers (TCSP) as posing a relatively high risk, that risk increasing when provided with other financial, legal or accountancy services.

TCSPs outside of these sectors are assessed as medium risk for money laundering, and low for terrorist financing.

HMRC-supervised TCSPs do not normally provide financial or legal services. Some may provide both TCSP and accountancy services but these will generally be small localised businesses and, overall, we assess our supervised population as medium risk.

However, the range of services offered by the businesses HMRC supervise can include higher and lower risk activities, and it is important that businesses understand and properly appraise the risk presented by each customer or class of customer and properly reflect this in their risk assessment.

It is also important that a business puts in place policies, controls and procedures to assess and address the varying level of risks presented by their customers.

HMRC expects a risk assessment to be more than a ‘tick box’ approach; it should reflect the nature of the services that the business provides and counter any risk that its services could be exploited for money laundering, and/or terrorist financing purposes.

It is also important that a TCSP identifies who their customer and beneficial owner is, as well as identifying the beneficial owner, if different to the customer, and what levels of due diligence are appropriate. Policies, controls and procedures should document the business’ approach when dealing with intermediaries and when placing reliance on third parties or accepting due diligence undertaken by others.

Risk characteristics

Note that brief comments appear in the table and that more substantive comments about each TCSP follow the table.

 TCSP  Higher Risk Characteristics  Lower Risk Characteristics Comment 
Company formation agents Wholesale type sales; sale of ready-made off the shelf companies; supply to off-shore intermediaries Retail sale to UK-based owner-managers; formation to order; supply to UK intermediaries Company only supply, and are not connected to other TCSPs services
Directors services Confidentiality to protect identity of actual owner or controlling interests; acting for multiple companies with common owners Used as an administrative tool acting until all legal requirements are completed and the company is handed to the customer; neutral party to provide separation from interested parties, say, during merger negotiations Acting as or providing someone to act as what is commonly known as a ‘nominee director’. It is technically not possible to act as a nominee director as legal responsibility sits with the named director
Company secretarial services Services to companies with non-UK beneficial owners Provision of services to Public Limited Companies (PLCs); provision of services to large private companies with multiple shareholders/subsidiaries etc A company secretary is responsible for statutory compliance obligations of a corporate entity
Shareholder service providers Providing a degree of confidentiality to the actual owner or controlling interest of the company Administrative purposes during the formation period and transferred when sold; management purposes –investment houses and stock brokers may hold shares for discretionary portfolios Shareholder service providers act as or provide for someone to act as a nominee
Virtual office providers Minimal face-to-face contact; regular forwarding of large volumes of mail; multiple addresses supplied to same and or connected businesses Regular contact with customer(s), physical collection of mail by known person(s); sole contact address; uses premises for meetings with clients The service involves the provision of an official address for a company or other legal entity
Trust service providers Where settlor, beneficiary or other person(s) have significant control over the assets and or income of the trust; when the source of the trust funds is not clear Operate independently of the settlor; services to low risk trusts when source of funds is clear, disabled persons, life interest, charities, share schemes and company pension funds This relates to the provision of professional trustees
Multi service providers When a company is relying on a TCSP to provide more than a single service, for example registered address and nominee services as this creates difficulties in identifying the controlling interest; long-term arrangements with little commercial basis; providing services to offshore beneficial owners and or intermediaries Short-term arrangements while management structures are put in place, providing services to UK-based owner-managed businesses

Company formation agents: further comment

A company formation agent is a business involved in the supply of services of forming companies for, and/or selling formed companies to customers.

Where a formation agent is forming companies for UK-based owner managers and established professionals, they may judge this to be low risk. However, the supply of a large number of companies at the same time, or in close succession, may be indicative of a higher level of risk.

The companies may be being used to open a large number of bank accounts across different jurisdictions to facilitate the movement of funds.

Requests for ‘aged’ companies, as opposed to newly-formed companies, may indicate that they are required to give the impression of an established business that may be used for fraudulent purposes.

When providing UK entities for offshore intermediaries consideration should be given to the location of the intermediary, the frequency of the requests and the commercial purpose of the structures being formed.


Director services: further comment

If being asked to provide director services for a prolonged period of time, not just during the formation period or during a period of change, a service provider will need to be satisfied they know on whose behalf they are acting – who the beneficial owner of the business is.

Service providers should have an understanding of the business they are providing the service to and satisfy themselves that any transactions that they are required to approve as a director are commercially sound and legitimate.

Whilst there may be legitimate reasons why a beneficial owner of a business may want to remain anonymous it can also be part of a process to disguise misuse of funds. There is also a risk that a disqualified director may use another person to act in their place.

As part of your risk assessment you may want to check Companies House’s list of disqualified directors to protect your business from accusations of acting as a ‘sham’ director.

Providing director services for multiple companies with common owners may present a risk in that the beneficial owners may not wish their business relationships to be open to scrutiny.


Company secretarial services: further comment

While the requirement for UK companies to have a Company Secretary has been removed for the majority of countries, and those that do require one or decide to appoint one will generally fall into a low risk category, some jurisdictions still require one.

If asked to provide a company secretarial service to a non-UK-based entity, a service provider would need to consider if it was competent to provide such a service. It would also need to consider what risks arise from not having a locally-based Company Secretary and issues arising because of the jurisdiction where the entity is based.


Shareholder service providers: further comment

If being asked to act as a nominee shareholder for a prolonged period of time, not just during the formation period or for management purposes a service provider will need to be satisfied they know on whose behalf they are holding the shares – who is the beneficial owner of the business.

While there may be legitimate reasons why a beneficial owner of a business may want to remain anonymous, it can also be part of a process to disguise misuse of funds.

Providing director services for multiple companies with common owners may present a risk in that the beneficial owners may not wish their business relationships to be open to scrutiny.


Virtual office providers: further comment

The provision of office services to a business that does not maintain a physical presence at your premises can present a number of risks to your business and it is important that you establish an appropriate risk assessment to monitor and differentiate between the provision of services that are out of scope of the regulations, for example the letting of physical office space where the user is in regular attendance and can be easily contacted and where the user is not in regular attendance and therefore cannot necessarily be easily contacted.

From a risk perspective if you are providing a virtual office service to a local resident who operates a peripatetic business, is known to you and regularly collects post in person, this is a lower risk, than, providing a service to a business where the owners are not known to you, are not local, do not regularly collect their post or the person collecting the post regularly changes.

If the business is operated or owned by a non-UK resident company or person you may need to consider what risk that presents and what is the appropriate level of due diligence in these circumstances.

If you are receiving large volumes of mail for a customer, do you have enough knowledge to judge if this is to be expected for this kind of business, for example mail order services? Virtual office addresses can be used in investment frauds particularly those that are promoted with long term returns.

If you are being asked to supply multiple addresses to the same or connected businesses, does your risk assessment measure if this request has a commercial basis? Use of multiple addresses can be used create an impression that a business is more substantial than it is, or to create an impression that their customers are dealing with a company with a local presence.

If you also supply serviced office space, do your risk assessment and policies, controls and procedures recognise the risk of this service effectively becoming a virtual service and therefore falling within the provision of the regulations?

For example if a customer enters a serviced office agreement, i.e. wishes to operate their business wholly or in part from your premises, but it becomes apparent that they are not utilising the premises for normal business purposes or they only use it for a short period and then effectively use it as a mailbox, either collecting mail or having it forwarded.

The risk for you is that they entered a Serviced Office agreement to avoid due diligence checks. Best practice would be to apply appropriate due diligence checks to everyone who has access to your premises.

If the service you are providing changes, within your policies, controls and procedures the monitoring of the use of the premises by your customers needs to be documented, so that you can recognise that change and assess the risk it presents. It is known that in the early days of certain types of investment fraud there is a great deal of activity, which then lessens and the perpetrators reduce their presence.


Trust service providers: further comment

There is little evidence of UK trusts being used for money laundering or terrorist financing purposes, though there is some evidence of offshore trusts being used for money laundering purposes.

Professional Trustees must assess the extent to which they are free to act in the best interest of the beneficiaries and without undue influence of the settlor or other third party.

They should have proper oversight of the assets to prevent bank accounts etc being used for non-trust purposes.

If acting as the professional trustee of a charity, while generally low risk, appropriate measures should be in place to confirm the nature and purpose of the charity, and if a newly established charity, evidence that it can meet its objectives, the source and control of its funds and that appropriate decision-making processes are in place.


Multi-service providers: further comment

Whilst it is fairly common for the same TCSP to form a company and provide a registered address for the company, the more services it is asked to provide the higher the level of risk.

If a beneficial owner is seeking to use you to provide a range of services that distances them from the legal entity, your risk assessment needs to reflect the increased level of risk that this may bring.

If there is no apparent commercial basis for the structures and services you are providing, particularly if opaque structures are being used to prevent identification of the ultimate owner then this may be indicative of corruption or money laundering.

The risk may significantly increase if you are asked to supply multiple services, on the instructions of non-UK based intermediaries, to their customers. It is important, in these circumstances, that you assess the risk to your business of providing services, taking into account the locations of the intermediaries, their customers and the beneficial owners and the nature of any entities being provided and services required.

The policies, controls and procedures should set out what is required in terms of customer due diligence and ongoing monitoring for both the intermediaries and their customers.

Get the latest news direct to your inbox

Sign up to our mailing list to receive weekly bulletins on all of the latest accounting news.

"*" indicates required fields

This field is for validation purposes and should be left unchanged.