Monetary Authority & Regulatory Framework

The information provided here is for general informational purposes only and is not intended to constitute legal or professional advice. It is provided 'as is' and should not be considered a substitute for a comprehensive review against the relevant laws and regulations as they apply to your company.

The Proceeds of Crime (Anti-Money Laundering and Anti-Terrorist Financing) Regulations 2008 (POCR) form the statutory backbone of the compliance framework. For regulated entities in Bermuda, you are not merely required to "collect information and documents"; you are legally obligated to know your clients and maintain an active, risk-sensitive defence against financial crime.

We developed our Verify by Tiller platform to provide regulated companies with the necessary ability to capture, verify and assess the information needed to meet your legal obligations.

Core Statutory Obligations (POCR 2008)

The POCR imposes five "Pillars of Compliance" that are non-negotiable. Failure to evidence any of these is a breach of the Regulations. How does Verify by Tiller help you meeting those obligations:

The Business Risk Assessment (Regulation 16)

You cannot treat all clients equally. You must perform a comprehensive Business Risk Assessment (BRA) to identify where your specific business is vulnerable to money laundering.

• Requirement: you must document your inherent risks (Geographic, Product, Customer, Delivery Channel) and assess the effectiveness of you controls to determine our residual risk

• Support: Verify by Tiller allows you to put in place a robust, effective and repeatable customer onboarding process. The digital onboarding process provided by Verify by Tiller allows you to understand and control your risk exposure and easily document and manage that risk

Customer Due Diligence (CDD) (Regulations 5–9)

You must verify the identity of your customers before a business relationship is established.

• Requirement: Identify the identity of customers and understand who you are dealing with and the nature of the business they intend to conduct.

• Screening: Verify by Tiller performs comprehensive screening against international sanction lists, PEP databases, enforcement databases and adverse Media sources, helping you build an accurate risk profile for your client

• Ongoing Monitoring: CDD is not a one-off event. You must monitor your client's behaviour throughout the relationship to ensure they match the client profile establish during onboarding. Verify will rescreen all your clients daily and provide the tools to automatically perform periodic reviews and update expired documentation.

Enhanced Due Diligence (EDD) (Regulation 11)

For high-risk scenarios, standard checks are insufficient.

• Requirement: For Politically Exposed Persons (PEPs), clients from "High-Risk Third Countries," or complex/unusual activities, you must establish their Source of Wealth (SoW), verifying how the client acquired their total net worth, not just the funds in the current transaction.

• Solution: Verify by Tiller will help you identify high-risk scenarios by capturing and verifying country of residence and even geolocation of the individual. It will also fully screen them to identify PEPs from an array of global sources or individuals with adverse media indicating a high-risk profile. The platform also provides customisable digital client forms to aid in the capture of Source of Wealth information and also the upload of required supporting documentary evidence by the client. This allows you to quickly and efficiently perform the more complex checks and record keeping required for EDD.

Record Keeping (Regulation 15)

The regulation imposes a strict statutory duty to retain documents for a specific period to ensure they are available for use in any financial crime investigation.

• Requirement: All CDD documents, risk assessments, and transaction records must be retrievable without delay and must be kept for 5 years.

• Support: Verify by Tiller generates a comprehensive Client Report in PDF format at the end of the onboarding. It contains all information captured during the onboarding including identity documents and selfie images used to verify the person resenting the id document. It also contains the results of all checks performed and the findings as well as the actions taken in response to those findings. This report is clear evidence of the compliance process followed, and it allows you to easily store it for immediate retrieval at any time in the future. The same information can be easily exported via our AOI for inclusion into any of your existing systems to automatically aid in the centralisation of all your records

Internal Controls & Reporting (Regulation 16–18)

• Requirement: Your MLRO must establish a process to receive internal suspicious activity reports (SARs) and, where appropriate, file them with the Financial Intelligence Agency (FIA).

• Support: The Verify by Tiller platform make it significantly easier for your MLRO to be made aware of exceptions during the onboarding process or arising out of ongoing monitoring. It provides all the evidence derived from the information provided by the client and the check and findings that were automatically performed. This makes it easier to collate the supporting information for the SARs report and providing the audit history which may be needed for any follow-up activities.

---

Other Typical Questions

Section 1: Customer Due Diligence (Regs 5, 6 & 8)

Regulation 6(2) requires verification using data from a "reliable and independent source." Does a digital solution satisfy this legal standard?

Yes, provided the source is authoritative. Verify by Tiller satisfies Regulation 6(2) by prioritizing NFC chip extraction from e-Passports. This data is cryptographically signed by the issuing government, making it the most "independent" and "reliable" source available, far exceeding the evidentiary value of a photocopied passport delivered by email.

Regulation 8 mandates verifying identity before the business relationship is established. How does Tiller ensure we don't accidentally onboard someone too early?

POCR imposes a strict chronological order. Verify by Tiller enforces this via "Referal Alerts" in the workflow. You can configure your process so that a client account cannot be opened (or a risk rating finalized) until the ID verification and screening steps are marked as "Complete" or "Accepted". This prevents the operational error of trading with an unverified entity, which is a direct breach of Regulation 8.

We have a lot of non-face-to-face clients. Does POCR Regulation 11 require us to treat them all as high risk?

Historically, yes, but modern technology mitigates this. While Regulation 11(1)(a) requires EDD where the customer is not physically present, Verify by Tiller uses biometric liveness detection to replicate the security of a face-to-face meeting. This allows you to justify treating standard non-face-to-face applicants as "Standard Risk" rather than "High Risk" in your Business Risk Assessment.

Regulation 5 requires us to identify the "Beneficial Owner." Can Tiller handle complex corporate structures?

Although at present Verify by Tiller cannot identify the Beneficial Owner behind a complex corporate structure (however the feature is coming soon in our KYB module), Verify can send individual digital verification links to each UBO already known (e.g., shareholders >10% or 25%), ensuring every controlling individual is verified to the same standard as a retail client.

Section 2: Enhanced Due Diligence & PEPs (Reg 11)

Regulation 11(4) imposes specific duties regarding Politically Exposed Persons (PEPs). How does Tiller prevent us from missing a PEP?

The regulation requires "risk management procedures" to determine if a customer is a PEP. Verify by Tiller screens every applicant against global PEP lists (Tier 1-4) automatically. If a match is found, the system flags the profile for manual review. This ensures you never inadvertently onboard a PEP without the "Senior Management Approval" mandated by law.

POCR requires us to take "adequate measures" to establish Source of Wealth (SoW) for PEPs. How does the platform support this?

For high-risk or PEP clients, Verify by Tiller allows the use of custom digital forms to capture "Source of Wealth" in the onboarding journey. It compels the user to declare the origin of their funds and upload supporting evidence (e.g., sale of shares, inheritance letters) before the application can proceed, ensuring you have the evidence required by Regulation 11(4)(b).

Regulation 11 requires EDD for "complex or unusually large transactions." Can Tiller help if we only use it for onboarding?

While Tiller is an onboarding tool, it sets the baseline for this monitoring. By establishing a robust "Client Profile" (expected activity, turnover, source of funds) at the start, Verify by Tiller provides the benchmark against which your transaction monitoring team can judge if a future transaction is "unusual," as required by Regulation 11(2).

Section 3: Ongoing Monitoring (Reg 12)

Regulation 12(1)(b) requires that documents and data be kept "up to date and relevant." Does Tiller automate this?

Yes. Manual files often go stale. Verify by Tiller has a "expiry management" feature. It tracks the expiry dates of passports or ID cards and can automatically prompt the customer (or your team) to provide a new document before the old one expires, ensuring you remain compliant with Regulation 12 continuously.

Regulation 12A enforces strict compliance with International Sanctions. How often does Tiller screen?

To meet the strict liability of Sanctions laws, Verify by Tiller performs Daily Delta Screening. It can re-screens your entire client base every 24 hours against the latest UK Consolidated List and over 100 other sanction lists and information sourced from over 1,600 official government websites. This ensures that if a client is designated overnight, you know about it immediately, satisfying the requirement to stop dealing with them.

If a client's risk profile changes (e.g., they become a PEP later), does Tiller notify us?

Yes. This is a critical component of Regulation 12 "Ongoing Monitoring." Because Tiller re-screens daily, if an existing client is elected to office or appears in adverse media, the system generates an alert. This allows you to move the client from "Standard" to "High Risk" and apply the necessary EDD retroactively.

Section 4: Record Keeping (Reg 15)

Regulation 15(3) requires records to be "retrievable without undue delay." Can Tiller help with a BMA request?

Absolutely. Digging through paper files or disparate drives causes delays. Verify by Tiller consolidates all ID data, screening results, and risk decisions into a single digital profile. You can export a "Client Report" in seconds, satisfying the "without undue delay" requirement during an FIA investigation or BMA audit. The same information is also made available instantly via our API to any of your other systems

Regulation 15(1) mandates a 5-year retention period. What happens if we delete the app?

Your data obligations persist. Verify by Tiller allows for the secure export/archiving of data to your own servers to meet the 5-year rule post-relationship. The same information is also made available via our API to allow all data to be archived in your core systems.

Section 5: Systems, Controls & Risk Assessment (Reg 16)

Regulation 16 requires us to establish "policies and procedures" for risk assessment. Does Tiller dictate our risk policy?

No, Regulation 16 says you must establish the policy. Verify by Tiller is the engine that executes it. The platform is configurable, allowing you to map your specific Risk Appetite Statement (e.g., "We need to capture SoW") into the workflow logic, ensuring your operational reality matches your written manual.

Regulation 17 covers "Reliance" on third parties. Is using Tiller considered "Reliance"?

No, using Tiller is Outsourcing, not Reliance (which refers to relying on another regulated firm like a bank). Under POCR, you retain responsibility. Verify by Tiller supports this by giving you full visibility and control. It doesn't make the decision for you; it presents the data (matches, ID validity) so your Compliance Officer can make the final decision, keeping you on the right side of the law.

Regulation 18 requires employee training. Does Tiller help with staff competence?

Indirectly, yes. Regulation 18 requires staff to be aware of the laws and procedures. Verify by Tiller helps you standardizes your procedures. By guiding staff through a mandatory, linear workflow (Upload > Screen > Review > Approve), it ensures that even junior staff follow the correct compliant process every time, reducing the risk of human error or "shortcut taking."