Anti-Money Laundering & the Art Market: Fines & Fine Print

The "Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017" (which we will refer to as the "Regulations") require all 'art market participants' ("AMPs") to comply with a number of rules, including identifying the identity and source of wealth for purchasers of any artwork with a value of €10,000 and over, keeping records, undertaking risk assessments and registering with HMRC.

AMPs are defined as "a firm or sole practitioner who by way of business trades in, or acts as an intermediary in the sale or purchase of, works of art and the value of the transaction, or a series of linked transactions, amounts to 10,000 euros or more", and as such, the Regulations apply to much of the market.

AMPs were required to have registered with HMRC by 10 June 2021, and fines are now being handed down to AMPs who have been trading whilst unregistered. Although HMRC may initially be going after the low hanging fruit of those who have failed to register, it seems that some who have registered in time are already receiving letters from HMRC giving notice of intended audits.

HMRC has set the standard penalty for non-registration to £5,000 per quarter, capped at £100,000, and although the number of fines issued to date are unknown, as of 31 December 2021, the highest fine handed out was £52,000, while the lowest was £1,250. These are not insignificant sums, although fines may be reduced by as much as 50% if an AMP voluntarily declares that they were trading while unregistered, and by 25% if they pay within 30 days.

An AMP includes a company or individual who "acts as an intermediary" in qualifying sales or purchases. It is therefore critical for an intermediary to understand whether they are considered an AMP within that definition.

The term is not defined in the Regulations, but BAMF has confirmed that an 'intermediary' means a person who "by way of business, actively transacts in the sale or purchase of works of art on behalf of a seller or buyer under whose authority they act".  There is also no guidance as to what 'actively transacting' entails, but it is now clear that an intermediary could be an agent, art dealer, gallery, auction house or online sales platform.

BAMF has also confirmed that the Regulations are not intended to apply to:

• framers, shippers or persons solely providing contact information;
• first sales of work by artists, their employees or through artists' own businesses;
• introducers, unless commission is received directly through their active participation in a transaction; or
• artists' estates selling works of a deceased artist.

If an artwork is rented to a third party, the person or entity renting out the artwork could also be required to comply with the Regulations if, for example, the loan agreement stipulates that title in that artwork passes to the customer at the end of a rental period.

Under the Regulations, AMPs are required to carry out customer due diligence ("CDD") on their 'customers'. However, it has been unclear where the obligation to know who you are dealing with stops in a complex transaction involving multiple AMPs.

The BAMF Guidelines have now clarified that the 'customer' of an AMP will depend on the AMP's role in the transaction, but if the AMP is selling or acting as an intermediary in a transaction, the customer will be whoever is paying the AMP for the artwork or services in relation to the transaction.

This means that under the Regulations, CDD may only need to be done in relation to the next AMP in the chain as the AMP conducting the transaction is only required to carry out CCD on their customer, i.e. the person who pays them, whether that is the end purchaser or an AMP intermediary.  

The intention here is to avoid some duplication between AMPs when carrying out CDD in the more complex transactions. However, given that AMPs are also required to adhere to obligations under the Proceeds of Crime Act 2002 ("POCA") and the UK sanctions regime, obligations on AMPs may not change much in practice. To ensure compliance with these provisions, an AMP will need to consider the risk profile of each transaction and undertake further checks to determine the identity of the ultimate customer where appropriate in any event.

It is also worth noting that depending on their role, an AMP may have more than one customer.  For example, if you are selling a work on consignment, your customers are both the consignee and the buyer.

The latest time at which CDD can be carried out is before establishing a business relationship or concluding a transaction. This means, for example, that although you can agree to a sale or purchase before CDD is obtained at an art fair, the artwork cannot be released and title must not pass before all required CDD has been completed. This also applies to auction sales where the conclusion of the transaction is considered to be the release of the artwork.

The Regulations do not only apply to UK-based AMPs. If dealers from outside the UK come to the UK to sell artworks, they will also have to register with HMRC. Where an AMP is a "non-established taxable person (NETP)", which is any person not normally resident in the UK, and they make "any taxable supplies in the UK, regardless of their value", they must register with HMRC and account for VAT. Unfortunately, this requirement may well further deter overseas dealers, already struggling with the realities of dealing post-Brexit, from trading in the UK.

Under data protection laws, namely the Data Protection Act 2018 ("DPA") and the General Data Protection Regulation ("GDPR"), those who obtain, use and hold personal data (referred to as "processing"), can only do so if there is a lawful reason for doing so or if the data subject has given consent for a specific purpose.

AMPs now find themselves holding more personal data on their customers than before as a result of the requirement to carry out CDD checks, and it is important to understand the legal basis on which data is obtained and what can be done with it.  

The BAMF Guidelines remind AMPs that personal data obtained in accordance with the Regulations may only be processed for the purpose of "prevention of money laundering and terrorist financing or where use of the data is allowed by other legislation or after obtaining the consent of the data subject".  This means two things:

1. AMPs are entitled to hold personal data obtained for the purpose of CDD checks without having to obtain consent as they are required to do so to comply with their legal obligations; and
2. Personal data obtained in accordance with the Regulations or POCA cannot be used for any other purpose – it would be a breach of data protection law to use personal data obtained for these purposes for commercial gain. For example, an AMP cannot add names of parties obtained through CDD checks to mailing lists or event invitations, unless they have obtained consent from the data subject to do so.