PART 1General

Citation, commencement and application

1.-(1) These Regulations may be cited as the Cyber-Attacks (Asset-Freezing) Regulations 2019 and come into force on 11th June 2019.

(2) An offence under these Regulations may be committed by conduct wholly or partly outside the United Kingdom by––

(a)a UK national, or

(b)a body incorporated or constituted under the law of any part of the United Kingdom.

(3) In paragraph (2)––

"conduct" includes acts and omissions;

"UK national" means––

Interpretation

2.-(1) In these Regulations––

"the 2000 Act" means the Financial Services and Markets Act 2000(5);

"the Council Regulation" means Council Regulation (EU) 2019/796 of 17th May 2019 concerning restrictive measures against cyber-attacks threatening the Union or its Member States, and a reference to Annex I to that Regulation is to be construed as a reference to that Annex as amended from time to time;

"designated person" means a person, entity or body listed in Annex I to the Council Regulation;

"document" includes information recorded in any form and, in relation to information recorded otherwise than in legible form, references to its production include producing a copy of the information in legible form;

"relevant institution" means––

(2) The definition of "relevant institution" in paragraph (1) must be read with––

(a)section 22 of the 2000 Act(10) (regulated activities),

(b)any relevant order under that section, and

(c)Schedule 2 to the 2000 Act(11) (regulated activities).

(3) Any expression used both in these Regulations and in the Council Regulation has the meaning that it bears in the Council Regulation.

PART 2Funds and economic resources

Freezing of funds and economic resources

3.-(1) A person ("P") must not deal with funds or economic resources owned, held or controlled by a designated person if P knows, or has reasonable cause to suspect, that P is dealing with such funds or economic resources.

(2) In paragraph (1), "deal with" means––

(a)in relation to funds––

(i)use, alter, move, allow access to or transfer,

(ii)deal with the funds in any other way that would result in any change in their volume, amount, location, ownership, possession, character or destination, or

(iii)make any other change that would enable use, including portfolio management, and

(b)in relation to economic resources, exchange, or use in exchange, for funds, goods or services.

(3) Paragraph (1) is subject to regulation 9 (licences).

Making funds available to a designated person

4.-(1) A person ("P") must not make funds available, directly or indirectly, to a designated person if P knows, or has reasonable cause to suspect, that P is making the funds so available.

(2) Paragraph (1) is subject to regulations 8 (credits to a frozen account) and 9.

Making funds available for the benefit of a designated person

5.-(1) A person ("P") must not make funds available to any person for the benefit of a designated person if P knows, or has reasonable cause to suspect, that P is making the funds so available.

(2) For the purposes of this regulation––

(a)funds are made available for the benefit of a designated person only if that person thereby obtains, or is able to obtain, a significant financial benefit, and

(b)"financial benefit" includes the discharge, in whole or in part, of a financial obligation for which the designated person is wholly or partly responsible.

(3) Paragraph (1) is subject to regulations 8 and 9.

Making economic resources available to a designated person

6.-(1) A person ("P") must not make economic resources available, directly or indirectly, to a designated person if P knows, or has reasonable cause to suspect––

(a)that P is making the economic resources so available, and

(b)that the designated person would be likely to exchange the economic resources, or use them in exchange, for funds, goods or services.

(2) Paragraph (1) is subject to regulation 9.

Making economic resources available for the benefit of a designated person

7.-(1) A person ("P") must not make economic resources available to any person for the benefit of a designated person if P knows, or has reasonable cause to suspect, that P is making the economic resources so available.

(2) For the purposes of this regulation––

(a)economic resources are made available for the benefit of a designated person only if that person thereby obtains, or is able to obtain, a significant financial benefit, and

(b)"financial benefit" includes the discharge, in whole or in part, of a financial obligation for which the designated person is wholly or partly responsible.

(3) Paragraph (1) is subject to regulation 9.

Credits to a frozen account

8.-(1) The prohibitions in regulations 4 and 5 are not contravened by a person who credits a frozen account with––

(a)interest or other earnings due on the account,

(b)payments due under contracts, agreements or obligations that were concluded or arose before the account became a frozen account, or

(c)payments due under judicial, administrative or arbitral decisions rendered in a Member State or enforceable in the UK.

(2) The prohibitions in regulations 4 and 5 do not prevent a relevant institution from crediting a frozen account where it receives funds transferred to the account.

(3) A relevant institution must inform the Treasury without delay if it credits a frozen account in accordance with paragraph (1)(b) or (c) or paragraph (2).

(4) In this regulation, "frozen account" means an account with a relevant institution which is held or controlled (directly or indirectly) by a designated person.

Licences

9.-(1) The prohibitions in regulations 3 to 7 do not apply to anything done under the authority of a licence granted by the Treasury.

(2) A licence must specify the acts authorised by it and may be––

(a)general or granted to a category of persons or to a particular person,

(b)subject to conditions,

(c)of indefinite duration or subject to an expiry date.

(3) The Treasury may vary or revoke a licence at any time.

(4) On the grant, variation or revocation of a licence, the Treasury must––

(a)in the case of a licence granted to a particular person, give written notice of the grant, variation or revocation to that person,

(b)in the case of a general licence or a licence granted to a category of persons, take such steps as the Treasury consider appropriate to publicise the grant, variation or revocation of the licence.

(5) A person commits an offence who, for the purpose of obtaining a licence, knowingly or recklessly––

(a)provides information that is false in a material respect, or

(b)provides or produces a document that is not what it purports to be.

(6) A person who purports to act under the authority of a licence but who fails to comply with any conditions included in the licence commits an offence.

PART 3Offences

Contravention and circumvention of prohibitions

10.-(1) A person who contravenes any of the prohibitions in regulations 3 to 7 commits an offence.

(2) A person commits an offence who intentionally participates in activities knowing that the object or effect of them is (whether directly or indirectly)––

(a)to circumvent any of the prohibitions in regulations 3 to 7, or

(b)to enable or facilitate the contravention of any such prohibition.

Officers of a body corporate etc

11.-(1) Where an offence under these Regulations committed by a body corporate––

(a)is committed with the consent or connivance of any director, manager, secretary or other similar officer of the body corporate, or any person who was purporting to act in any such capacity, or

(b)is attributable to any neglect on the part of any such person,

that person as well as the body corporate is guilty of the offence and is liable to be proceeded against and punished accordingly.

(2) In paragraph (1), "director", in relation to a body corporate whose affairs are managed by its members, means a member of the body corporate.

(3) Paragraph (1) also applies in relation to a body that is not a body corporate, with the substitution for the reference to a director of the body of a reference––

(a)in the case of a partnership, to a partner;

(b)in the case of an unincorporated body other than a partnership––

(i)where the body's affairs are managed by its members, to a member of the body;

(ii)in any other case, to a member of the governing body.

Penalties

12.-(1) A person guilty of an offence under regulation 9 or 10 is liable––

(a)on conviction on indictment, to imprisonment for a term not exceeding seven years or to a fine or to both,

(b)on summary conviction––

(i)to imprisonment for a term not exceeding the relevant maximum; or

(ii)to a fine, which in Scotland or Northern Ireland may not exceed the statutory maximum,

or to both.

(2) A person guilty of an offence under paragraph 1(5) or paragraph 4(1) of the Schedule (information provisions) is liable on summary conviction-

(a)to imprisonment for a term not exceeding the relevant maximum; or

(b)to a fine, which in Scotland or Northern Ireland may not exceed the statutory maximum,

or to both.

(3) For the purposes of this regulation, "the relevant maximum" is––

(a)in England and Wales, twelve months (or, in relation to offences committed before section 154(1) of the Criminal Justice Act 2003(12) (general limit on magistrates' court's power to impose imprisonment) comes into force, six months),

(b)in Scotland, twelve months,

(c)in Northern Ireland, six months.

Proceedings

13.-(1) Proceedings against any person for an offence under these Regulations may be taken before the appropriate court in the United Kingdom having jurisdiction in the place where that person is for the time being.

(2) Proceedings against any person for an offence under these Regulations which cannot be taken under paragraph (1) above may be taken before any appropriate court in the United Kingdom.

(3) An offence falling under these Regulations which is committed wholly or partly outside the United Kingdom may for all incidental purposes be treated as having been committed within the jurisdiction of the court where proceedings are taken.

(4) In England and Wales any information relating to an offence that is triable by a magistrates' court may be so tried if it is laid––

(a)at any time within three years after the commission of the offence, and

(b)within twelve months after the date on which evidence sufficient in the opinion of the prosecutor to justify the proceedings comes to the knowledge of the prosecutor.

(5) In Scotland––

(a)summary proceedings for an offence may be commenced––

(i)within twelve months after the date on which evidence sufficient in the opinion of the Lord Advocate to justify the proceedings comes to the knowledge of the Lord Advocate, and

(ii)not later than three years after the commission of the offence, and

(b)section 136(3) of the Criminal Procedure (Scotland) Act 1995(13) (time limit for certain offences) applies for the purpose of this paragraph as it applies for the purpose of that section.

(6) In Northern Ireland summary proceedings for an offence may be instituted––

(a)at any time within three years after the commission of the offence, and

(b)within twelve months after the date on which evidence sufficient in the opinion of the prosecutor to justify proceedings comes to the knowledge of the prosecutor.

(7) For the purposes of this regulation a certificate of the prosecutor (or in Scotland, the Lord Advocate) as to the date on which such evidence as is referred to above came to their notice is conclusive evidence.

Consent to prosecution

14.-(1) Proceedings for an offence under these Regulations (other than for a summary offence) may not be instituted––

(a)in England and Wales, except by or with the consent of the Attorney General,

(b)in Northern Ireland––

(i)where the offence is committed wholly or partly outside Northern Ireland, except by or with the consent of the Advocate General for Northern Ireland,

(ii)for all other offences, except by or with the consent of the Director of Public Prosecutions for Northern Ireland.

(2) Nothing in paragraph (1) prevents––

(a)the arrest of a person in respect of an offence under these Regulations, or

(b)the remand in custody or on bail of any person charged with such an offence.

PART 4Miscellaneous

Information provisions

15.  The Schedule (information provisions) has effect.

Notices

16.-(1) This regulation has effect in relation to any notice to be given to a person by the Treasury under regulation 9 (licences).

(2) Any such notice may be given––

(a)by posting it to the person's last known address, or

(b)where the person is a body corporate, partnership or unincorporated body other than a partnership, by posting it to the registered or principal office of the body or partnership concerned.

(3) Where the Treasury do not have an address for the person, they must make arrangements for the notice to be given to the person at the first available opportunity.

The Crown

17.-(1) These Regulations bind the Crown.

(2) No contravention by the Crown of a provision of these Regulations makes the Crown criminally liable.

(3) The High Court or, in Scotland, the Court of Session may, on the application of a person appearing to the court to have an interest, declare unlawful any act or omission of the Crown that constitutes a contravention of a provision of these Regulations.

(4) Nothing in this regulation affects Her Majesty in Her private capacity.

(5) Paragraph (4) is to be read as if section 38(3) of the Crown Proceedings Act 1947(14) (meaning of Her Majesty in Her private capacity) were contained in these Regulations.

Regulation 15

SCHEDULE

INFORMATION PROVISIONS

Reporting obligations of relevant institutions and others

1.-(1) A relevant institution or relevant business or profession must inform the Treasury as soon as practicable if-

(a)it knows, or has reasonable cause to suspect, that a person-

(i)is a designated person, or

(ii)has committed an offence under regulation 9 or 10, and

(b)the information or other matter on which the knowledge or suspicion is based came to it in the course of carrying on its business.

(2) Where a relevant institution or relevant business or profession informs the Treasury under sub-paragraph (1), it must state-

(a)the information or other matter on which the knowledge or suspicion is based, and

(b)any information it holds about the person by which the person can be identified.

(3) Sub-paragraph (4) applies if-

(a)a relevant institution or relevant business or profession informs the Treasury under sub-paragraph (1) that it knows, or has reasonable cause to suspect, that a person is a designated person, and

(b)that person is a customer of the institution or relevant business or profession.

(4) The relevant institution or relevant business or profession must also state the nature and amount or quantity of any funds or economic resources held by it for the customer.

(5) A relevant institution or relevant business or profession that fails to comply with any requirement of sub-paragraph (1), (2) or (4) commits an offence.

(6) In this paragraph, a "relevant business or profession" means-

(a)an auditor,

(b)a casino,

(c)a dealer in precious metals or stones,

(d)an estate agent,

(e)an external accountant,

(f)an independent legal professional,

(g)a tax adviser, and

(h)a trust or company service provider,

operating in the United Kingdom.

(7) For the purpose of sub-paragraph (6)-

"auditor" means any firm or sole practitioner who is-

"casino" means the holder of a casino operating licence and, for this purpose, a "casino operating licence" has the meaning given by section 65(2)(a) of the Gambling Act 2005(17) (nature of a licence);

"dealer in precious metals or stones" means a person engaged in the business of making, supplying, selling (including selling by auction) or exchanging-

"estate agent" means a firm or sole practitioner who, or whose employees, carry out estate agency work, when the work is being carried out;

"external accountant" means a firm or sole practitioner who by way of business provides accountancy services to other persons, when providing such services;

"independent legal professional" means a firm or sole practitioner who by way of business provides legal or notarial services to other persons, when providing such services;

"tax adviser" means a firm or sole practitioner who by way of business provides advice about the tax affairs of other persons, when providing such services;

"trust or company service provider" means a firm or sole practitioner who by way of business provides any of the following services to other persons, when that firm or practitioner is providing such services-

(8) In sub-paragraph (7)-

(a)in the definition of "estate agent", "estate agency work" is to be read in accordance with section 1 of the Estate Agents Act 1979 (estate agency work)(18), but for those purposes references in that section to disposing of or acquiring an interest in land are (despite anything in section 2 of that Act) to be taken to include reference to disposing of or acquiring an estate or interest in land outside the United Kingdom where that estate or interest is capable of being owned or held as a separate interest,

(b)"firm" means any entity that, whether or not a legal person, is not an individual and includes a body corporate and a partnership or other unincorporated association.

Powers to request information

2.-(1) The Treasury may request a designated person to provide information concerning-

(a)funds or economic resources owned, held or controlled by or on behalf of the designated person, or

(b)any disposal of such funds or economic resources.

(2) The Treasury may request a designated person to provide such information as the Treasury may reasonably require about expenditure-

(a)by or on behalf of the designated person, or

(b)for the benefit of the designated person.

(3) The power in sub-paragraph (1) or (2) is exercisable only where the Treasury believe that it is necessary for the purpose of monitoring compliance with or detecting evasion of these Regulations.

(4) The Treasury may request a person acting under a licence granted under regulation 9 to provide information concerning-

(a)funds or economic resources dealt with under the licence, or

(b)funds or economic resources made available under the licence.

(5) The Treasury may request any person in or resident in the United Kingdom to provide such information as the Treasury may reasonably require for the purpose of-

(a)establishing for the purposes of these Regulations-

(i)the nature and amount or quantity of any funds or economic resources owned, held or controlled by or on behalf of a designated person,

(ii)the nature and amount or quantity of any funds or economic resources made available directly or indirectly to, or for the benefit of, a designated person, or

(iii)the nature of any financial transactions entered into by a designated person,

(b)monitoring compliance with or detecting evasion of these Regulations, or

(c)obtaining evidence of the commission of an offence under these Regulations.

(6) The Treasury may specify the manner in which, and the period within which, information is to be provided.

(7) If no such period is specified, the information which has been requested must be provided within a reasonable time.

(8) A request may include a continuing obligation to keep the Treasury informed as circumstances change, or on such regular basis as the Treasury may specify.

(9) Information requested under this paragraph may relate to any period of time during which a person is, or was, a designated person.

(10) Information requested under sub-paragraph (1)(b), (2) or (5)(a)(iii) may relate to any period of time before a person became a designated person (as well as, or instead of, any subsequent period of time).

Production of documents

3.-(1) A request under paragraph 2 may include a request to produce specified documents or documents of a specified description.

(2) Where the Treasury request that documents be produced, they may-

(a)take copies of or extracts from any document so produced,

(b)request any person producing a document to give an explanation of it, and

(c)where that person is a body corporate, partnership or unincorporated body other than a partnership, request any person who is-

(i)in the case of a partnership, a present or past partner or employee of the partnership,

(ii)in any other case, a present or past officer or employee of the body concerned,

to give such an explanation.

(3) Where the Treasury request a designated person or a person acting under a licence granted under regulation 9 to produce documents, that person must-

(a)take reasonable steps to obtain the documents (if not already in the person's possession or control);

(b)keep the documents under the person's possession or control (except for the purpose of providing them to the Treasury or as the Treasury may otherwise permit).

Failure to comply with request for information

4.-(1) A person commits an offence who-

(a)without reasonable excuse, refuses or fails within the time and in the manner specified (or, if no time has been specified, within a reasonable time) to comply with any request made under this Schedule,

(b)knowingly or recklessly gives any information, or produces any document, which is false in a material particular in response to such a request,

(c)with intent to evade the provisions of this Schedule, destroys, mutilates, defaces, conceals or removes any document, or

(d)otherwise intentionally obstructs the Treasury in the exercise of their powers under this Schedule.

(2) Where a person is convicted of an offence under this paragraph, the court may make an order requiring that person, within such period as may be specified in the order, to comply with the request.

General power to disclose information

5.-(1) The Treasury may disclose any information obtained by them pursuant to these Regulations to any person for the purpose of facilitating or ensuring compliance with the Council Regulation.

(2) The power in sub-paragraph (1) includes but is not limited to disclosing information to the following persons––

(a)a police officer,

(b)any person holding or acting in any office under or in the service of-

(i)the Crown in right of the Government of the United Kingdom,

(ii)the Crown in right of the Scottish Government, the Northern Ireland Executive or the Welsh Government,

(iii)the States of Jersey, Guernsey or Alderney or the Chief Pleas of Sark,

(iv)the Government of the Isle of Man, or

(v)the Government of any British overseas territory,

(c)any law officer of the Crown for Jersey, Guernsey or the Isle of Man,

(d)the Scottish Legal Aid Board,

(e)the Financial Conduct Authority, the Prudential Regulation Authority, the Bank of England, the Jersey Financial Services Commission, the Guernsey Financial Services Commission, or the Isle of Man Financial Services Authority,

(f)any other regulatory body, including those of Member States,

(g)any organ of the United Nations, or

(h)the Council of the European Union, the European Commission or the Government of a Member State.

(3) The purpose of facilitating or ensuring compliance with the Council Regulation referred to in sub-paragraph (1) includes but is not limited to the following––

(a)monitoring compliance with, or detecting evasion of, these Regulations or the Council Regulation;

(b)giving assistance or co-operation, pursuant to the Council Regulation; or

(c)taking any action with a view to instituting, or otherwise for the purposes of, any proceedings––

(i)in the United Kingdom, for an offence under these Regulations, or

(ii)in any of the Channel Islands, the Isle of Man or any British overseas territory, for an offence under a similar provision in any such jurisdiction.

(4) The Treasury may disclose any information obtained by them pursuant to these Regulations to any person with the consent of a person who, in their own right, is entitled to the information or to possession of the document, copy or extract.

(5) In sub-paragraph (4) "in their own right" means not merely in the capacity as a servant or agent of another person.

Application of provisions

6.-(1) Nothing done under this Schedule is to be treated as a breach of any restriction imposed by statute or otherwise.

(2) But nothing in this Schedule authorises a disclosure that-

(a)contravenes the data protection legislation, or

(b)is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016(19).

(3) Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000(20) by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, sub-paragraph (2)(b) has effect as if it included a reference to that Part.

(4) Nothing in this Schedule is to be read as requiring a person who has acted or is acting as counsel or solicitor for any person to disclose any privileged information in their possession in that capacity.

(5) This Schedule does not limit the circumstances in which information may be disclosed apart from this Schedule.

(6) This Schedule does not limit the powers of the Treasury to impose conditions in connection with the discharge of their functions under regulation 9.

(7) In this paragraph-

"the data protection legislation" has the same meaning as in the Data Protection Act 2018(21) (see section 3 of that Act);

"privileged information" means information with respect to which a claim to legal professional privilege (in Scotland, to confidentiality of communications) could be maintained in legal proceedings.

EXPLANATORY NOTE

(This note is not part of the Regulations)

These Regulations make provision relating to the enforcement of Council Regulation (EU) 2019/796 of 17th May 2019 concerning restrictive measures against cyber-attacks threatening the Union or its Member States (OJ L 129 I, 17.5.2019, p.1) ("the Council Regulation").

The measures include the freezing of funds and economic resources of any persons and entities listed in Annex I to the Council Regulation and ensuring that funds and economic resources are not made available to them or for their benefit.

Regulation 2 defines designated person as any person named in Annex I to the Council Regulation (as amended from time to time).

Regulations 3 to 7 provide prohibitions against dealing with the funds or economic resources of a designated person, making funds or economic resources available, directly or indirectly, to a designated person and making funds or economic resources available for the benefit of a designated person.

Regulation 8 provides an exception to the prohibitions in regulations 4 and 5 where a frozen account is credited for a permitted reason.

Regulation 9 provides a licensing procedure to enable funds and economic resources to be exempted from the prohibitions where this is permitted in the circumstances set out in the Council Regulation and creates offences for providing false information or documents or not complying with conditions included in a licence.

Regulation 10 creates offences where the prohibitions in regulations 3 to 7 are contravened. Regulations 11 to 14 contain provisions about officers of a body corporate, penalties and proceedings.

The Schedule makes provision for information gathering and information disclosure and creates offences for failure to comply with a request for information.

A full impact assessment has not been prepared for this instrument as no, or no significant, impact on the private, voluntary or public sector is foreseen.

Further information is available at H.M. Treasury, 1 Horse Guards Road, London SW1A 2HQ and on H.M. Treasury's website (www.gov.uk/government/organisations/hm-treasury), or by contacting [email protected].