Financial crime controls policy

1. Who this policy covers

This policy applies to Preownedbullion Limited (company number 15861411), trading as Bullionex, registered office 115 Merton Road, London SW19 1ED, and to everyone who works for us. It covers every sale to us, every purchase from us and every trade account.

2. Our business, and why it carries risk

We buy gold and silver from UK residents, by post and, by arrangement only, at our office at 34–35 Hatton Garden, London EC1N 8DX. We sell investment gold bars and coins and pre-owned gold, silver, platinum and palladium items online. Precious metal is valuable, portable and easy to sell, so it can be used to launder money or to dispose of stolen goods. We assess these risks and apply this policy to every customer.

3. Our position, and why we have this policy

• No cash, ever. We never pay or accept cash. We pay out only by instant bank transfer to a UK account in the customer’s verified name, and we accept payment only by bank transfer or card (card up to £5,000 per order and per day).
• This policy is voluntary. We are not a high value dealer and are not registered with or supervised by HMRC under the Money Laundering Regulations 2017. Those Regulations cover dealers in goods only when they make or receive cash payments of £10,000 or more (reg 14(1)(a)), and we take and make no cash. We choose to follow MLR-style standards voluntarily, and in some ways more strictly: there is a passed identity check behind every deal, however small.
• Laws that apply to every business, including us:
  • Proceeds of Crime Act 2002: the money laundering offences (ss327–329); authorised disclosures to the National Crime Agency (s338); and the offence of prejudicing an investigation (s342).
  • Terrorism Act 2000: the duty to disclose a belief or suspicion of terrorist financing formed in the course of business (s19).
  • UK financial sanctions law, including the prohibitions on dealing with designated persons.
• Sanctions reporting duty. A person “engaged in the business of making, supplying, selling (including selling by auction) or exchanging articles made from gold, silver, platinum or palladium” is a “relevant firm” for sanctions reporting (Russia (Sanctions) (EU Exit) Regulations 2019 reg 71(1)(g); the same wording appears in, for example, the Counter-Terrorism (Sanctions) (EU Exit) Regulations 2019 reg 22(1)(g)). This does not depend on cash. As a relevant firm, we must tell HM Treasury’s Office of Financial Sanctions Implementation (OFSI) as soon as practicable if, in the course of our business, we know or have reasonable cause to suspect that a person is a designated person or has breached financial sanctions (reg 70(1)), with the information set out in reg 70(2)–(4). Failing to report is an offence (reg 70(6)).

4. Know your customer: individuals

4.1 When. A sanctions and PEP screen when a customer asks for a pack. A full check before an offer can be accepted, before an order is paid for, and before any payment to the customer. Checks are repeated when details change or a deal is unusual.

4.2 How, online. Through our identity-verification provider, Sumsub:

• A photograph of a valid government-issued photo ID (passport, UK driving licence or national identity card), checked for authenticity.
• A liveness check and a face match between the customer’s selfie and the ID photo.
• Screening against UK sanctions lists, politically exposed person (PEP) lists and adverse media.
• Ongoing monitoring against those lists while the customer remains a customer.
• A proof-of-address document.
• Confirmation of the customer’s email address.

The check runs in Sumsub’s Web SDK on the customer’s account page. Sumsub holds the documents and images as our processor; we keep only the result (pass or fail) and Sumsub’s reference.

4.3 How, in person. At our Hatton Garden office (visits by arrangement only), a trained member of staff checks the original photo ID face to face and records the document type, number and expiry date. Screening is run on the confirmed name. This route is also our alternative for anyone who prefers not to use a face match, or who cannot use the online check because of a disability.

4.4 Payment checks. We pay only into a UK bank account in the name confirmed by the check. Any mismatch is held for review.

4.5 Human review. Automated results are never the only basis for refusing a customer. Every failed or uncertain result is reviewed by a member of staff (UK GDPR Arts 22A–22C).

5. Know your business: trade accounts

Before a trade account is opened and trade prices are shown, we check the business (KYB): its legal name, registration number and registered address against Companies House; its directors; and its beneficial owners (anyone owning or controlling more than 25%). We then run the individual checks in section 4 on the person acting for the business and on its beneficial owners, and screen the business itself. Sole traders and partnerships go through the individual checks.

6. Enhanced checks

We ask more questions, and may ask for documents, when:

• the customer is a PEP, or a family member or close associate of one;
• a deal is unusually large for the customer, or several deals look linked;
• an item’s origin is unclear, or it looks like newly produced or unmarked bullion offered by a private seller;
• the customer is acting for someone else, or will not give information;
• a deal is over £25,000 (we ask customers to call before sending more than this).

The questions may cover how the customer came by the items, or where the money for a purchase came from. They are routine, not an accusation. Senior management approves every PEP relationship.

7. Sanctions

We screen every customer, and every trade account’s beneficial owners, at onboarding and then continuously through Sumsub’s ongoing monitoring, so that we are alerted if a customer is later added to a list. We do not deal with designated persons. As a relevant firm, we report to OFSI as soon as practicable if we know or have reasonable cause to suspect that a person is designated or has breached sanctions (Russia (Sanctions) (EU Exit) Regulations 2019 reg 70(1), and the equivalent provisions in other regimes). We do not buy or sell gold that we know or suspect to be of sanctioned origin, including Russian-origin gold covered by UK sanctions.

8. Ongoing monitoring

We watch for unusual patterns, such as frequent or split parcels, a change of bank account or address, or items that do not fit what the customer has told us. We repeat checks when details change.

9. Suspicious activity and voluntary reporting to the NCA

Staff report any suspicion internally to our nominated officer straight away. Where the nominated officer knows or suspects that property is criminal property, we may make an authorised disclosure to the National Crime Agency under POCA 2002 s338. Where we would otherwise risk committing a money laundering offence, we seek consent (a “defence against money laundering”) and do not go ahead until it is given or the statutory notice period ends (POCA 2002 s335). Reports are voluntary in the sense that we are outside the “regulated sector”: the regulated-sector duty to report (POCA 2002 s330) and the regulated-sector tipping-off offence (s333A) do not apply to us, because we are not a high value dealer (POCA 2002 Sch 9 para 1(1)(q)). We still do not tell anyone anything that is likely to prejudice an investigation (POCA 2002 s342), so we may be unable to explain a delay. Terrorist financing suspicions are reported under Terrorism Act 2000 s19, and sanctions suspicions to OFSI (section 3).

10. Our right to refuse or stop a deal

We may refuse any deal, or stop one already under way, without giving reasons. If a check cannot be completed, if we are not satisfied about identity, ownership or source, or if the law prevents us, we do not go ahead. We may have to hold items or funds while the matter is resolved, and we tell the customer as much as the law allows.

11. Records

We keep identity-check results (pass or fail and Sumsub’s reference), screening results and deal records for up to 5 years after our last deal with the customer, and then delete them unless an investigation or legal claim requires us to keep them. Sumsub holds the ID documents, proof of address and biometric data as our processor for the same period. The Money Laundering Regulations do not apply to us, so this period is our own voluntary choice, made under our legitimate interests (UK GDPR Art 6(1)(f)). It sits within the 6-year limitation period for contract claims (Limitation Act 1980 s5) and supports our sanctions reporting duty (Russia (Sanctions) (EU Exit) Regulations 2019 reg 70). The Privacy notice gives the details.

12. Data protection

We use information from these checks only to prevent money laundering, terrorist financing, fraud and sanctions breaches, to meet our legal obligations, and to deal with claims, never for marketing (following the MLR 2017 reg 41 standard voluntarily). The Privacy notice gives the full details, including Sumsub’s role.

13. Responsibility, training and review

• A nominated officer in the business is responsible for this policy, for suspicious-activity reports and for sanctions reports. Contact: hello@bullionex.co.uk, subject “For the nominated officer”.
• Staff who handle customers or parcels must follow this policy and are trained on it.
• We review this policy at least once a year, and whenever the law or our business changes.