Compliance and Governance Law
This domain of the PCCGL exam tests your knowledge of the Gibraltar statutory and regulatory framework for compliance and corporate governance in regulated firms. You must know the roles of the Gibraltar Financial Services Commission (GFSC) and the Gibraltar Financial Intelligence Unit (GFIU), and the key obligations under the Financial Services Act, the Proceeds of Crime Act 2015, and the Data Protection Act 2018.
Regulatory architecture and governance
The GFSC is the single regulator for financial services in Gibraltar, with statutory objectives including market confidence, consumer protection, and financial crime prevention. Regulated firms must maintain robust governance: an adequate board with independent non-executive directors, clear allocation of responsibilities, a compliance function with direct access to the board, and approved persons in controlled functions. The GFSC’s fit and proper test covers honesty, competence, and financial soundness. Senior managers are personally accountable for their areas of responsibility.
Compliance obligations
Firms must operate risk-based AML/CFT systems: customer due diligence, ongoing monitoring, record-keeping, and suspicious activity reporting to the GFIU (not the GFSC). Sanctions compliance is mandatory. Data protection follows the Gibraltar GDPR. Breaches of financial services law can lead to unlimited fines, public censure, or withdrawal of authorisation.
Worked example
A Gibraltar fiduciary firm appoints a new head of compliance without GFSC approval. The board minutes record the appointment as effective immediately. Explain the governance failure and the correct process.
Reasoning: the head of compliance is a controlled function under the Financial Services Act. The firm must first submit a fitness and propriety application to the GFSC and obtain approval before the individual performs the role. The board’s approval alone is insufficient. Immediate effectiveness breaches the approved persons regime, exposing the firm to enforcement action. Correct process: identify the controlled function, complete due diligence, apply to the GFSC, and wait for approval; interim cover must be by an approved person.
Traps
- Confusing the GFSC (prudential and conduct regulator) with the GFIU (financial intelligence). Suspicious activity reports go to the GFIU.
- Assuming UK law applies directly; Gibraltar has its own legislation, although often equivalent.
- Treating compliance as solely the compliance officer’s job; the board retains collective responsibility.
- Forgetting notification requirements for changes in directors, controllers, or senior managers.