chambers global practice guides isle of man fintech · • paysafe: online payment processing. •...

ISLE OF MAN

LAW AND PRACTICE: p.3Contributed by Appleby

The ‘Law & Practice’ sections provide easily accessible information on navigating the legal system when conducting business in the jurisdic-tion. Leading lawyers explain local law and practice at key transactional stages and for crucial aspects of doing business.

CHAMBERSGlobal Practice Guides

FinTech

2018

Law & Practice – Isle of ManContributed by

Appleby

ISLE OF MAN

LAW AND PRACTICE: p.3Contributed by Appleby

The ‘Law & Practice’ sections provide easily accessible information on navigating the legal system when conducting business in the jurisdic-tion. Leading lawyers explain local law and practice at key transactional stages and for crucial aspects of doing business.

Law and Practice iSLe OF ManContributed by Appleby Authors: Claire Milne, Katherine Johnson, Sophie Corkish

3

Law and PracticeContributed by Appleby

CONTENTS1. Fintech Market p.4

1.1 The Development of FinTech Products and Services p.41.2 The Key Market Participants in the Specified

Activities p.41.3 FinTech Technologies/Companies p.5

2. regulation p.52.1 Regulatory Regimes for Specified Activities or

FinTech Companies p.52.2 Regulatory or Governmental Agencies for

Specified Activities or FinTech Companies p.52.3 Capital and Liquidity Requirements p.62.4 Change of Control Approval Requirements p.62.5 Recent Developments or Notable Proposed/

Forthcoming Regulatory Changes p.62.6 Burden of Regulatory Framework and Protection

of Customers p.72.7 Foreign FinTech Companies p.7

3. Form of Legal entity p.73.1 Potential Forms of Charter p.73.2 Key Differences in Form p.73.3 Recent Legal Changes p.8

4. Legal infrastructure (non-regulatory) p.84.1 Desirable Changes to Facilitate Specified Activities p.84.2 Special Insolvency Regimes p.84.3 Electronic Signatures p.9

5. data Privacy and cybersecurity p.95.1 Data Privacy and Cybersecurity Regulatory Regimes p.9

6. intellectual Property p.106.1 Intellectual Property Protection Regime p.106.2 Copyrights, Patents, Trade Marks p.116.3 Protection of Intellectual Property or Trade Secrets p.11

7. tax Matters p.117.1 Special Tax Issues, Benefits or Detriments p.11

iSLe OF Man Law and PracticeContributed by Appleby Authors: Claire Milne, Katherine Johnson, Sophie Corkish

4

appleby is one of the world’s leading offshore law firms. The Group has offices in the key offshore jurisdictions of Bermuda, the British Virgin Islands, the Cayman Islands, Guernsey, Isle of Man, Jersey, Mauritius, and Seychelles, as well as a presence in the international financial centres of Hong Kong and Shanghai. Offering strength and depth across these jurisdictions, Appleby gives clients access to impartial offshore business knowledge and experience, as

well as a talented pool of lawyers in each of its locations. This ensures that the most appropriate jurisdiction and team are always available to meet a client’s requirements. Clients in-clude: financial institutions, global corporations, FTSE 100 and Fortune 500 companies and high net worth individuals. Appleby is a member of Terralex, an international associa-tion of law firms, as well as Lex Mundi, a leading network of independent law firms covering 100+ countries worldwide.

authorsclaire Milne, WS, is a partner within the corporate department and team leader for the IP and science and technology teams in the Isle of Man. She has dealt with all aspects of commercialisation of IP rights for businesses and worked on major

bespoke software and hardware development projects, especially for the financial services and gaming sectors. Claire specialises in advising FinTech businesses, online gaming and gambling operators, e-business companies and telecoms companies, and advises on data protection and outsourcing issues. Claire, who was chair of the Isle of Man Gambling Supervision Commission from 2007-12, has a Master’s degree from Johns Hopkins University, Baltimore, and is a member of the Law Society of Scotland (accredited by the Society as a specialist in IP law) and the Society for Computers and the Law, as well as being a Manx advocate and a Writer to Her Majesty’s Signet.

Katherine Johnson practises a broad range of corporate matters, including banking, funds and investment services, and regulatory advice. She also has experience with M&A, insurance, legal due diligence, insolvency and restructur-

ing, and advising upon directors’ duties and shareholder rights. Katherine joined the firm in 2011 as a trainee and was commissioned as an Isle of Man advocate in 2013 after a two-year period of articles and being awarded a com-mendation in the Manx Bar Exams.

Sophie corkish is a trainee advocate with Appleby (Isle of Man) and assists on a wide range of corporate work. She is due to complete her articles in 2017.

1. Fintech Market

1.1 The development of Fintech Products and Services The Isle of Man has been very welcoming to the FinTech sector and has shown enthusiasm for the development of FinTech products. The established finance and e-gaming sectors, along with the technical infrastructure, have made the FinTech market a natural fit in the island. The Isle of Man Government has quickly established regulatory and fiscal control, processes and procedures to allow FinTech businesses to establish themselves in the Island while pro-viding necessary protection for businesses and customers. Alongside this, the continuous investment in the Island’s infrastructure has contributed to the thriving e-business sector already developed in the Isle of Man. Together, the regulation and infrastructure have encouraged the inflow of specialised companies to the Island; both industry partici-pants and their supporting technical ecosystem.

The Isle of Man Government established a regulatory frame-work for digital currencies by introducing anti-money laun-dering and know your customer requirements in 2015 to this sector, one of the first jurisdictions to do so. Having embraced digital currencies, distributed ledger technology, or blockchain, companies working in this area have since begun to arrive in the Island.

In May 2016, a new legislative regime to allow crowdfund-ing platforms to establish their businesses in the Isle of Man came into force. These activities are contained in a new, stan-dalone classification of regulated activity.

1.2 The Key Market Participants in the Specified activitiesLocal success stories in the FinTech sector include the fol-lowing:

•ChainPay: payments processor.•CoinCorner: Bitcoin exchange and web wallet provider.•Credits: blockchain platform provider.


5

•Global Processing Services: transaction processing and programme management environments for payment card programmes.

•Paysafe: online payment processing.•Riva Financial Systems: administrative solutions to the as-

set management industry.

1.3 Fintech technologies/companies Whilst FinTech companies have not displaced traditional financial service providers, the FinTech market is continu-ously developing in the Isle of Man. As FinTech is such a new and evolving sector, it is difficult to measure its influence ac-curately. However, e-business as a whole is the Isle of Man’s fastest-growing sector and now contributes to approximately 28% of GDP, according to the Island’s Department of Eco-nomic Development (DED).

2. regulation

2.1 regulatory regimes for Specified activities or Fintech companiesIn the Isle of Man, financial services are governed principally under the Financial Services Act 2008 (FSA08), which sets out a general prohibition against a person carrying on, or holding themselves out as carrying on, by way of business, in or from the Isle of Man, a financial services activity with-out a licence or in breach of licence conditions unless an exclusion (as set out in the Regulated Activities Order 2011 (as amended) (RAO2011)) or an exemption (as set out in the Financial Services (Exemptions) Regulations 2011 (as amended)) applies.

2.2 regulatory or Governmental agencies for Specified activities or Fintech companiesThe Isle of Man Financial Services Authority (IOMFSA) is the regulator responsible for enforcing compliance with the FSA08. The IOMFSA’s regulatory objectives are to secure an appropriate degree of protection for customers of persons carrying on a regulated activity, to reduce financial crime and support the Island’s economy. A licence to carry out a regulated activity is granted by the IOMFSA. To grant a licence, the IOMFSA must be satisfied that the applicant, any controller, director or other key persons are fit and proper to carry on the regulated activity, having regard to their integ-rity, competence, financial standing, structure and organisa-tion. The IOMFSA must also be satisfied that the activity will be managed and controlled in the Isle of Man and there will be a real presence in the Island.

The RAO2011 sets out those activities that will constitute regulated activities, which consist of:

• class 1 - deposit taking; • class 2 - investment business;

• class 3 - services to collective investment schemes; • class 4 - corporate services (ie, services with respect to the

formation of companies); • class 5 - trust services; • class 6 - crowdfunding platforms; • class 7 - management and administration services; and • class 8 - money transmission services.

Note that there is a distinction in the Isle of Man between de-posit taking and lending, and a person conducting a business of lending money in the Isle of Man is required to register with the Office of Fair Trading (OFT) under the Moneylend-ers Act 1991, unless an exemption applies.

The types of crowdfunding available to businesses in the Isle of Man include loan (or debt) crowdfunding and invest-ment (or equity) crowdfunding. Loan-based crowdfunding offers financial returns to the lender through interest on the amount lent. Investment-based crowdfunding involves the lender receiving investment in the borrower’s business. Op-erating loan-based crowdfunding platforms is licensable as a Class 6 activity under the RAO2011, in particular: (i) the operation of an electronic platform in relation to lending in which the operator of the electronic platform facilitates persons to become lenders or borrowers and (ii) the admin-istration of crowdfunded lending, including the transfer of repayment funds from borrower to lender and debt collec-tion in relation thereto. Class 6 of the RAO2011 also covers the operation of investment-based crowdfunding services, which means the operation of an electronic platform in rela-tion to arranging deals in investments in which the operator of the electronic platform facilitates persons to become is-suers of investments or direct investors. Regulated crowd-funding in the Isle of Man is limited to online crowdfunding portals and the arranging of crowdfunded investments and/or loans. A Class 6 licence does not permit the provision of advice in relation to these matters. In order to advise on crowdfunding opportunities, a business would also need a Class 2 (investment business) licence.

Crowdfunding became a standalone regulated activity in 2016 (under the Regulated Activities (Amendment) Order 2016) and is an example of how the Isle of Man regulatory regime has adapted to accommodate new technologies and forms of financial services business. Operating investment-based crowdfunding platforms was previously captured as a Class 2 (investment business) activity by virtue of “dealing in investments” (which includes shares) and “arranging deals in investments” (also including shares). However, Class 6 of the RAO2011 (as amended) now makes specific provision for operating investment-based crowdfunding platforms. A per-son will now not need to be licensed to carry out investment-based crowdfunding under Class 2 where a licence is held to carry out investment crowdfunding activities under Class 6.


6

Money transmission services are regulated under Class 8 and include the provision and execution of payment services directly or as agent and the issuing of electronic money. The definitions of payment services largely mirror the EU’s Pay-ment Services Directive of 13 November 2007 (2007/64/EC). Operating an automated or robo investment platform in or from the Isle of Man is likely to fall under Class 2 (invest-ment services).

When granting a financial services licence under the FSA08, the IOMFSA, as well as looking at the competency of of-ficers, will consider the ability of the entity to comply with the FSA08, the Financial Services Rule Book 2016 (Rule-book) and any anti-money laundering and countering the financing of terrorism legislation, including the Proceeds of Crime Act 2008 (POCA), the Anti-Money Laundering and Countering the Financing of Terrorism Code 2015 (AML/CFT Code) and the Anti–Money Laundering and Counter-ing the Financing of Terrorism Handbook 2017 (AML/CFT Handbook).

The Isle of Man’s AML/CFT legislation largely conforms to international standards. Although the Isle of Man is not a member of the Financial Action Task Force, the Isle of Man Government has recognised the Financial Action Task Force recommendations. In January 2017 MONEYVAL (the Council of Europe’s Committee of Experts on the Evaluation of Anti-Money Laundering Measures and the Financing of Terrorism) released its Fifth Round Mutual Evaluation Re-port following a visit to the Isle of Man in April-May 2016 to analyse the level of compliance with the Financial Action Task Force 40 Recommendations and the level of effective-ness of the Island’s AML/CFT system. The report is largely positive, although to monitor progress in making improve-ments the Isle of Man is now in ‘enhanced follow-up’. This is not unusual after a Fifth Round Evaluation and 86% of countries assessed so far have been placed in this category.

The Island has had a framework in place to try to combat money-laundering since 1985, when it began to apply the “know your customer” or “customer due diligence” (CDD) principle, which is the term to describe the process of ob-taining, retaining and using information about a customer to verify their identity, personal details and their source of wealth, and to understand their business or transactional activities. Every business regulated by the IOMFSA must conduct CDD checks under the AML/CFT legislation.

In addition to the IOMFSA, the DED assists in the incor-poration of companies through the Isle of Man Companies Registry. The DED promotes and encourages the develop-ment of business in the Isle of Man and works together with local business to meet their needs and help to develop and diversify industries in the Island.

2.3 capital and Liquidity requirementsThe Rulebook sets out a number of financial requirements that licence-holders must comply with that regulates, among other things, the issued share capital, net tangible assets and liquid capital of licence-holders. The specific financial re-quirements for each class of regulated activity depend on the type of regulated activity being carried out. For example, to be licensed under Class 6, a share capital of GBP25,000 (which must not be subject to being crowdfunded) is re-quired and there is a minimum net tangible asset require-ment of GBP50,000. For Class 8 licence-holders, where funds held as client money exceed GBP50 and (i) are held in exchange for electronic money that has been issued, or (ii) are a sum of money from a payment service provider used for the execution of a payment transaction on behalf of the payment service provider or payment service user, the licence-holder must ensure that they safeguard the funds. Safeguarding funds, under the Rulebook, can be achieved by holding the funds in a segregated account with a recog-nised bank that is used to hold segregated funds only and is named in such a way to show that the account is used to safeguard the segregated funds. A Class 8 licence-holder must also ensure that it segregates customers’ money from the licence-holder’s funds and that customer’s money and the licence-holder’s funds do not become intermingled. The licence-holder must at all times show how much money stands to the credit of each person making use of the pay-ment service in the capacity of the payer or payee, a “pay-ment service user,” and electronic money-holder, and that money belonging to one payment service user or electronic money-holder is not used for another.

There are also a number of reporting requirements in the Rulebook that licence-holders must comply with, including the requirement to keep adequate accounting records and provide annual financial returns to the IOMFSA within four months of the licence-holder’s annual reporting date. The annual financial returns should include the latest audited annual financial statements of any subsidiary or associated company of the licence-holder.

2.4 change of control approval requirements Any change of control of a licence-holder must have had the prior consent of the IOMFSA. If a person obtains a control-ling interest in a licence-holder; if any change takes place to an existing controlling interest in a licence-holder that would take that controlling interest from 50% or less to over 50% or from 75% or less to over 75%; or if there is any change in the ownership structure between the licence-holder and its ulti-mate parent company then consent will need to be obtained.

2.5 recent developments or notable Proposed/Forthcoming regulatory changesThe Isle of Man has taken steps to regulate virtual currency businesses, hoping to attract industry by offering the cred-


7

ibility of operating under regulatory oversight. In 2015, Schedule 4 of POCA was amended to bring virtual currency within the definition of undertaking business in the “regu-lated sector” and therefore subject to AML/CFT legislation. Business in the regulated sector now includes “the business of issuing, transmitting, transferring, providing safe custody or storage of, administering, managing, lending, buying, sell-ing, exchanging or otherwise trading or intermediating con-vertible virtual currencies, including crypto-currencies or similar concepts where the concept is accepted by persons as a means of payment for goods or services, a unit of account, a store of value or a commodity.” The Isle of Man Government decided to treat digital currencies as property rather than currency. Digital currencies do not have legal tender but are representations of value that can be traded, functioning as a medium of exchange.

The Designated Businesses (Registration and Oversight) Act 2015 (DBROA) tasks the IOMFSA with monitoring the compliance of designated businesses (such as virtual curren-cy businesses) with the Island’s AML/CFT legislation. The IOMFSA’s role in granting licences for those carrying out regulated activities is separate to its role under the DBROA. Those persons affected by the provisions of the DBROA (such as the virtual currency sector) are not automatically made licence-holders of the IOMFSA, but the IOMFSA oversees the adherence of these businesses to the AML/CFT legislation. The IOMFSA may carry out inspections and investigations at the premises of a designated business to assess the extent to which they meet the requirements of the DBROA, AML/CFT legislation and its own procedures for compliance with them. The IOMFSA can report on its findings following an on-site visit and can issue written di-rections or public statements.

2.6 Burden of regulatory Framework and Protection of customersThere are no specific statutory consumer protection pro-visions in the event of failure of a company carrying out regulated activities, such as crowdfunding and the provision of virtual currency services, as the Isle of Man’s depositor compensation scheme applies to deposit taking only.

However, the Isle of Man Financial Services Ombudsman Scheme, which operates within the OFT, hears complaints relating to financial services regulated under the FSA08. The powers of the Ombudsman are set out in the FSA08 and in-clude the power to refer a complaint to an adjudicator who can award compensation.

2.7 Foreign Fintech companiesForeign companies must register as a foreign company under the Foreign Companies Act 2014 if that company carries on, or is held out as carrying on, business from an “established place of business” in the Isle of Man.

Where a business is operating in or from the Isle of Man, it is likely that there will also be data protection implications. The Isle of Man’s Data Protection Act 2002 (DPA2002) will apply to those data controllers who process “personal data,” who must make and maintain a notification with the Isle of Man Information Commissioner and comply with the eight data protection principles described in 5 data Privacy and cyber Security.

3. Form of Legal entity

3.1 Potential Forms of charterIn the Isle of Man, companies are administered by the DED through the Isle of Man Companies Registry. There are two principal co-existing company regimes: companies incorpo-rated under the Company Act 1931 (CA 1931) and compa-nies incorporated under the Company Act 2006 (CA 2006).

There are a number of types of company available under the CA 1931 and CA 2006; however, the most suitable type of company for FinTech businesses will be a company limited by shares.

3.2 Key differences in FormA company limited by shares incorporated under CA 1931 must have a minimum of two individual directors and a company secretary. There is no residency requirement (other than entities regulated by the IOMFSA) and companies may have a single member. There is no requirement under the CA 1931 to engage the services of a local corporate services provider; however, any company that has not engaged such services and is not otherwise exempt is required to appoint a nominated officer as described further below in 3.3 recent Legal changes. There are a number of corporate documents that are available for public inspection for CA 1931 compa-nies, which include the current directors of the company and the members at the date of the company’s annual re-turn and details of share capital. A company under the CA 1931 can be a public or private company, whereas there is no distinction between public and private companies under the CA 2006.

Under the CA 2006, there is no concept of authorised share capital. Therefore, subject to a company’s articles of associa-tion, the directors may increase the share capital in any way and reduce the share capital by resolution of the directors. This differs from the requirements under the CA 1931 where a reduction of share capital requires a special resolution of the members and the sanction of the court. Companies in-corporated under the CA 2006 can have a sole director, who can be a corporate director if the corporate director holds a Class 4 licence from the IOMFSA (which does not exclude them acting as a director), and a sole member. There is no requirement under the CA 2006 regime to have a company


8

secretary; instead, companies must have a registered agent, licensed by the IOMFSA. The role of the registered agent is to ensure that the company is properly administered and that the statutory registers and documents are kept up to date and maintained at the office of the registered agent. Unlike companies incorporated under the CA 1931, under the CA 2006 only a limited amount of information is available to the public and details of the company’s members and cur-rent directors are only publicly available if the company has elected to file these registers with the Isle of Man Companies Registry. A company incorporated under the CA 2006 will need to make such election if it is to be licensed under the FSA08 and will be subject to additional requirements with regard to the number and residency of directors.

Companies incorporated under the CA 1931 or the CA 2006 would be suitable for FinTech businesses (although discre-tion lies with the IOMFSA), with the CA 2006 having the benefit of greater flexibility, although additional costs in the requirement for a licensed registered agent and some of the benefits of increased privacy will be reduced through licens-ing conditions imposed by the IOMFSA.

3.3 recent Legal changes The Beneficial Ownership Act 2017 (BOA 2017) has recently come into force and requires the DED to maintain a database of beneficial ownership. The BOA 2017 applies to all legal entities incorporated, registered or established in the Isle of Man (and not excluded under the BOA 2017) and requires those legal entities to appoint a nominated officer who is either a natural person resident in the Isle of Man or a local and licensed corporate service provider who must maintain the beneficial ownership information for any entity to which the BOA 2017 applies. The nominated officer must submit details of registerable beneficial owners to the DED to be stored on a central database, which is not publicly available but may be accessed by certain law enforcement agencies within defined parameters.

Beneficial ownership is defined in the BOA 2017 as “a natu-ral person who ultimately owns or controls a legal entity to which the BOA 2017 applies, in whole or in part, through direct or indirect ownership or control of shares or voting rights or other ownership interest in that entity, or who ex-ercises control via other means.” A registerable beneficial owner is defined in the BOA 2017 as being “a beneficial owner who owns or controls more than 25% of the ben-eficial ownership of a legal entity to which the BOA 2017 applies.” Those companies incorporated under the CA 1931 which already had a nominated officer will not have to ap-point an additional nominated officer as long as the current nominated officer continues to act.

4. Legal infrastructure (non-regulatory)

4.1 desirable changes to Facilitate Specified activitiesAs discussed above, there have been recent changes to the regulatory framework in the Isle of Man. These changes have seen crowdfunding brought within the regulatory framework and classified as a regulated activity within the RAO2011 under Class 6. This has provided a further oppor-tunity to the FinTech market in the Island, allowing develop-ment of the Island’s economy while enabling risks to lenders and consumers undertaking crowdfunding to be mitigated.

There have also been amendments to the Isle of Man’s online gambling regulations that allow accounts to be opened with an Isle of Man gambling operator using Bitcoin. The Online Gambling (Amendment) Regulations 2016 provide that an account can be opened with an Isle of Man gambling opera-tor using “a deposit of something which has value in money’s worth.” This includes the deposit of a value in virtual cur-rency or a virtual good.

POCA has been amended to take in the changes to the regu-latory framework for virtual currency. The amendment to POCA means that the money laundering offences of con-cealing, arranging and acquiring criminal property under Part 3 of POCA as well as the offences of failing to disclose and tipping off will apply to virtual currency and other mon-ey transmission services as well as other regulated activities under the FSA2008. This means that those digital currency businesses will need to comply with the AML Handbook and the AML Code in the same way as with other businesses that are regulated under the FSA2008 by the IOMFSA.

The foregoing has contributed to the continued development of e-business in the Isle of Man, which includes, among oth-ers, digital currency, blockchain and crowdfunding. The Isle of Man already has a legislative framework that accommo-dates e-business, which includes the Electronic Transactions Act 2000 (ETA2000) which is described below in 4.3 elec-tronic Signatures.

4.2 Special insolvency regimesThe Isle of Man’s corporate insolvency procedure is governed by the CA 1931 (which applies to CA 2006 companies by vir-tue of Section 182 CA 2006) and the Companies (Winding-up) Rules 1934. Companies may be wound up voluntarily, by order of the Isle of Man courts or subject to the supervision of the courts. The insolvency regime is similar to that in the United Kingdom under the Insolvency Act 1986; however, concepts of administration, examination or company vol-untary arrangements do not exist in Isle of Man law. When determining whether to wind up a company because the company is unable to pay its debts, its contingent and pro-spective liabilities will be taken into account.


9

There are a number of provisions of the CA 1931 that pro-tect the interests of creditors by maintaining the assets of the company pending and during the insolvency procedure. These include, amongst others, that an action may not be brought against the company without leave of the court; in a winding-up by the court, any disposition of the property of the company (including things in action) and any transfer of shares, or alteration in the status of the members of the company, made after the commencement of the winding-up is void; and any transfer of shares made after the com-mencement of a voluntary winding-up or any alteration in the status of members without sanction of the liquidator is void. There are also provisions that govern fraudulent trad-ing, fraudulent assignments and fraudulent preferences.

There is no requirement for insolvency office holders to be formally regulated. Any individual may act as a liquidator in a voluntary liquidation; however, where the court is ap-pointing a liquidator, it is generally reluctant to appoint per-sons who are not known to it and will usually only appoint a liquidator that (i) is resident within the jurisdiction, (ii) has the necessary experience and (iii) holds the necessary levels of insurance. It is possible to have an overseas insolvency practitioner appointed, but the court will usually insist on a joint appointment with a local experienced liquidator. Only individuals can be appointed to wind up Isle of Man compa-nies; however, this does not prevent an officer or employee of a body corporate from being appointed.

4.3 electronic Signatures The ETA2000 provides for the use of electronic signatures. When creating a contract under Isle of Man law, the normal rules of contract law would apply, ie, evidence of intent, sight of relevant terms and conditions prior to contract formation and the need for consideration. Section 1 ETA2000 provides that a transaction will not be invalid merely because it takes place wholly or partly by means of one or more electronic communications. The requirement for a written signature of a person is taken to have been met under the ETA2000 in re-lation to an electronic communication if(i)a method is used to identify him and indicate his approval of that which is communicated, (ii)having regard to all the relevant circum-stances at the time, the method is as reliable as is appropriate for the purpose of the information communicated and (iii) the receiver consents to that method.

The AML Handbook also allows CDD documentation to be obtained electronically. The AML Handbook provides that where CDD is obtained electronically, the authenticity of the electronic document must be verified by appropriate measures. For an identity document, a photograph should be provided that clearly shows the person’s face and the image on the identity document being held in the same picture to demonstrate that it belongs to the customer. A clear scanned copy of the document itself should also be provided and the

documents should be in an image file or tamper-resistant format. The IOMFSA appears to accept the use of electronic documents so long as the guidance is followed. The usual CDD, identity and verification checks as set out in the AML Handbook should be adhered to.

5. data Privacy and cybersecurity

5.1 data Privacy and cybersecurity regulatory regimes The main data protection legislation in the Isle of Man, the DPA 2002, is based upon the United Kingdom’s Data Protec-tion Act 1998 and therefore gives effect to Data Protection Directive 95/46/EC. Although the Isle of Man is not part of the EU, it can choose to implement EU legislation when such is deemed in the Island’s best interests. The DPA2002 encapsulates the eight data protection principles that “data controllers” are obliged to comply with. A data controller under the DPA2002 is a person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data is, or is to be, processed.

The eight data protection principles under the DPA2002 are:

•personal data must be processed fairly and lawfully, and must not be processed unless at least one of the conditions in schedule 2 to the DPA2002 is met and in the case of sensitive personal data, at least one of the conditions in schedule 3 to the DPA2002 is also met;

•personal data must be obtained only for one or more speci-fied and lawful purposes, and must not be further pro-cessed in any matter incompatible with that purpose or those purposes;

•personal data must be adequate, relevant and not exces-sive in relation to the purpose or purposes for which it is processed;

•personal data must be accurate and, where necessary, kept up to date;

•personal data processed for any purpose or purposes must not be kept for longer than is necessary for the purpose or those purposes;

•personal data must be processed in accordance with the rights of individuals who are the subject of personal data under the DPA2002;

•appropriate technical and organisational measures must be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data; and

•personal data must not be transferred to a country or terri-tory outside the Isle of Man unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of


10

personal data. The EU is automatically assumed to have adequate protection.

Data is personal data under the DPA2002 if it is “data which relate[s] to a living individual who can be identified from [that] data, or from [that] data and other information which is in possession of, or is likely to come into the possession of, the data controller and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual.”

The Isle of Man Information Commissioner is an independ-ent supervisory body that promotes and enforces compli-ance with the DPA2002 and deals with complaints made under the DPA2002. The duties of the Information Com-missioner are set out in the DPA2002 and include the duty to “promote the following of good practice by data controllers and, in particular, so to perform his functions under this Act as to promote the observance of the requirements of this Act by data controllers.” The Information Commissioner can also take regulatory action where there has been a breach of the DPA2002.

All data controllers in the Island will need to comply with the DPA2002 and the data protection principles. It is likely that those entities carrying out activities regulated by the IOMFSA will interact with companies and customers on a day-to-day basis and therefore will be using and processing personal data on a daily basis, and so must ensure this is held in compliance with the DPA2002.

The European Commission (EC) determined on 28 April 2004 that the Island’s law ensured an adequate level of pro-tection for personal data that aids with the transfer of per-sonal data in and out of the Island to the European Economic Area (a so-called adequacy finding). The EC further resolved that the legal standards applicable in the Isle of Man cov-ered all the basic principles necessary for an adequate level of protection and the application of these legal standards was guaranteed by judicial remedy and by independent su-pervision carried out by authorities such as the Information Commissioner.

The General Data Protection Regulation (GDPR) is set to come into force in May 2018 and will, amongst other things, impose requirements on certain organisations – including businesses that offer goods and services to individuals res-ident in the EU or businesses that will receive data from EU controllers – to appoint a data protection officer, attach stricter requirements regarding the giving of “consent” for processing of personal data and will provide easier access to information for individuals to show how their data is pro-cessed. The Isle of Man is expected to implement new data protection legislation in line with the GDPR for May 2018.

Whilst complying with the data protection legislation, the holder of a financial services licence, under the Rulebook, must also comply with certain requirements that include keeping and maintaining records of client money received and records to show and explain transactions effected by the licence holder on behalf of its client for six years. In addi-tion, the AML Code requires those who carry out regulated activities to keep customer due diligence for five years from the date of completion of the transaction.

With the expanding e-business economy, the cybercrime threat to businesses is high. The UK’s National Crime Agency has released a Cyber Crime Assessment 2016 and although primarily related to the UK, much of the risks faced and guidance will be the same and will apply in the Isle of Man. The UK Government in light of this has also released guidance on cybersecurity that includes educating and rais-ing awareness to staff and customer, monitoring the risks and having protection and network security in place as well as disaster recovery policies. The Rulebook already imposes requirements on financial services licence holders to have in place effective corporate governance arrangements that will assist in managing all risks, including cybersecurity, and that contains provisions regarding safeguarding data and assets, and ensuring staff are well trained in areas including data protection and cybersecurity. Under the Rulebook, certain matters should be reported to the IOMFSA, including inci-dents involving data or financial loss or any prevented at-tacks of this nature that could help to prevent other attacks. The IOMFSA issued cybersecurity guidance in December 2016 and has reported attacks that have occurred locally, al-though these are anonymised and it is unclear how frequent these attacks are.

FinTech businesses should ensure that they have adequate data protection and cybersecurity controls in place to pre-vent breaches occurring and ensure that they provide ad-equate training to staff.

6. intellectual Property

6.1 intellectual Property Protection regime The Isle of Man’s legislation regarding registered intellec-tual property derives mainly from the intellectual property laws in the United Kingdom. The principal terms of the UK Patents Act 1977 and the UK Trade Marks Act 1994 extend to the Isle of Man under the Patents (Isle of Man) Order 2013 and the Trade Marks (Isle of Man) Order 2013 respectively. The Island has its own copyright legislation, the Copyright Act 1991 and Copyright etc (Amendment) Act 2014 (although this is broadly based on the UK’s Copy-right, Designs and Patents Act 1988), and its own legisla-tion governing database rights, which were introduced by the Copyright (Amendment) Act 1999 and updated by the


11

Database (Amendment) Regulations 2013. Database rights are separate to any copyright and exist where there has been substantial investment in obtaining, verifying or presenting the contents of a database. The Isle of Man does not have its own intellectual property registers for patents, trade marks or designs. Any trade mark registered in the UK and Europe-an Union trade marks will automatically receive protection in the Isle of Man. UK patents and patent applications extend automatically to the Isle of Man and no further formalities or costs are required. It is not clear as yet how (or indeed if) the EU Unitary Patent will be implemented into Isle of Man law.

The Isle of Man’s decision to follow UK and EU law in rela-tion to intellectual property demonstrates adherence to in-ternational standards and shows that the Island has legisla-tion in place that recognises the importance of intellectual property in the FinTech sector.

The Isle of Man is a member of the Berne Convention for the protection of literary and artistic works and the World Trade Organization’s Agreement on Trade Related Aspects of International Property. The Berne Convention imposes minimum standards of protection that the Isle of Man (and each other contracting state) must apply to nationals of all other contracting states.

6.2 copyrights, Patents, trade MarksThe Patent Cooperation Treaty (PCT) and the European Pat-ent Register of the European Patent Office (EPO) are applica-ble to the Isle of Man. The PCT is administered by the World Property Organization and allows the filing of international patent applications that seek patent protection for an inven-tion simultaneously in a large number of countries. The EPO provides a uniform application procedure for those seeking patent protection in up to 40 member countries (note that the EPO is not part of the EU).

The Isle of Man also has the benefit of a number of interna-tional treaties, including the Madrid Protocol, which gives trade mark owners the possibility to protect a trade mark in 88 countries by a single application through registration with the World Intellectual Property Organization.

6.3 Protection of intellectual Property or trade SecretsThe European Union (Customs Enforcement of Intellec-tual Property Rights) Order 2015 applies EU Regulation 608/2013 to the Island, which sets out the powers of customs authorities where goods suspected of infringing intellectual property rights are subject to customs control. The Order makes amendments to the Copyright Act 1991 and the Trade Marks Act 1994 (as it applies to the Island).

7. tax Matters

7.1 Special tax issues, Benefits or detriments The Isle of Man has a separate taxation regime to the United Kingdom, which has contributed to the diverse and develop-ing economy in the Isle of Man and the attraction of FinTech companies to the Island.

Companies that are resident in the Isle of Man are taxed on their worldwide income at 0%, 10% or 20%. Those compa-nies undertaking banking business under a Class 1 licence issued by the IOMFSA or that carry on retail business in the Isle of Man and have taxable profits that exceed £500,000 in one year will attract a corporate income tax rate of 10%. Those companies that derive income from real estate situ-ated in the Isle of Man will be taxed on their income at 20%. All other income that does not fall into the 10% or 20% band will be taxed at 0%.

An Isle of Man resident company must file an annual income tax return and report worldwide taxable profits. Companies that are incorporated outside the Isle of Man but that have a place of business or permanent establishment in the Island will be taxed on their Isle of Man income only.

Individuals resident in the Island for tax purposes also enjoy income tax rates of 10% base rate with a 20% higher rate and a generous personal allowance for 2017-18 of GBP12,500. An individual who is resident in the Isle of Man for tax pur-poses can also elect to apply a tax cap, which will apply for five years once the election is made. The tax cap imposes an upper limit on the income tax liability of an individual in a tax year, which is GBP125,000 for 2017-18. The election to apply the tax cap should be made to the Assessor of Income Tax.

There is no capital gains, inheritance tax or stamp duty taxes in the Isle of Man.

The Isle of Man co-operates with other jurisdictions in re-gard to tax matters and has in place a number of interna-tional agreements that help to provide tax transparency. The island has double taxation agreements with a number of countries, including the UK, Ireland, Guernsey and Jersey. The Isle of Man Government has also implemented poli-cies in the Mutual Administrative Assistance in Tax Matters Convention that has been in force since 1 March 2014, part of the Organisation for Economic Co-operation and Devel-opment Convention that the Isle of Man is a party to, and the Common Reporting Standard for Automatic Exchange of Financial Account Information. The Isle of Man has also signed up to inter-governmental agreements in 2013 to im-prove tax compliance with the UK and USA.


12

The Isle of Man’s VAT register is administered by the Isle of Man Government’s Customs and Excise Division. The Isle of Man, however, largely follows the UK in relation to VAT and has an agreement in place with the UK to share VAT receipts. It is likely that the Isle of Man will follow the UK’s position on VAT in relation to digital currency.

appleby33-37 Athol StreetDouglasIM1 1LBIsle of Man

Tel: +44 (0)1624 647 647Fax: +44 (0)1624 620 992Email: [email protected]: www.applebyglobal.com

chambers global practice guides isle of man fintech · • paysafe: online payment processing. •...

Documents