BY HAND BERMUDA MONETARY AUTHORITY 17 2015 BMA HOUSE 43 Victoria Street Hamilton HM 12 Bermuda Appleby Serwces (Bermuda) Ltd. BOX 2447 Canon?s Court Hamilton HMJX Bermuda 22 Victoria Street tel: {441) 295 5278 fax: {441} 292 7471 email: info@bma.bm website: Hamilton, HM EX For the Attention of the Board of Directors Dear Sirs, RE: Appleby Services (Bermuda) Ltd. (the ?Company?) Ref: 2014 On-site Visit The Bermuda Monetaly Authority conducted the Company?s on?site review of the Company?s conduct 011 the 7th to 14'? October 2014. The purpose of the visit was to enable the Authority to review the Company?s compliance with the Trusts (Regulation of Trust Business) Act 2001 (?Trust Act?), Trusts (Regulation of Trust Business) Code of Practice, the Proceeds of Crime (Anti?Money Laundering and Anti-Terrorist Financing) Regulations 2008 (?the Regulations?), and Trusts (Regulation of Trust Business) Corporate Governance Policy. As part of the visit the team reviewed the Company?s compliance with its policies and procedures, as well as the processes that its Senior Management has put in place to monitor and control key risks within the business. Speci?c areas reviewed included organisational structure and strategy; high level controls, risk management, risk tolerance and risk appetite; compliance; corporate governance; new business acceptance; business planning and budgeting; information technology; business interruption and disaster recovery; and a review of the remediation points from the 2013 On?site Report. The draft on-site report was provided on 23rd December 2014 for review and comment, which was responded to by the Company on 131]] January 2015. The ?nal report takes into consideration our observations and recommendations along with the Company?s comments and discussions in meetings with the Company held on 23rd February 2015 and 5th March 2015. The comments in the ?Management Response? column of the report re?ect responses submitted to the Authority on 13th January 2015, and do not take into consideration the subsequent meeting discussions. Our conclusions are based solely upon discussions with, and information supplied by management in accordance with the agreed scope of our work. This report is addressed to the Board of the Company. It is understood that the Company may wish to make it available to other parts of their group. The Authority has no objection to the report, or parts thereof, being shared in this way, but does not accept any liability or responsibility for conclusions drawn by those parties. The report, or parts thereof, must not be shared with third parties (other than the Company?s external auditors) without the prior written permission of the Authority. Whilst we performed limited sampling of ?les, we do not carry 0th any of the checks and tests that would be appropriate to an audit inspection, and therefore may not identify all the control deficiencies in the areas we reviewed. It remains the responsibility of the Board and management to ensure that adequate controls are in place and working effectively. Whilst the complete report is attached, we take the opportunity to highlight some or the highest priority issues in the following paragraphs. The Company should be aware that one of tire key issrres arising tram the 2014 ou-site report is its failutc to implement the rr rg fmtu the Authotlty's 2013 orr.site report The Company did not develop a renredration plarr loltowing the 2013 arr--site review control. compliance monitoring and over-sight weaknesses were repeated as high risk findings in both the 2013 and 2014 alt-site reports. 11 was noted that during the 2014 on.site visrt that the Compliance Department was trot providing a suitable assessment on the adequacy or the Company's systenrs and controls have heightened the Authority's concern shout the til'ln's regulatory compliance and coirtrol environment, and its failure to demonstrate a cooperative approach to the Authority's mandated remediation initiatives, These issues will be escalated witlilri the Authority tor consideration or enforcement action as indicated in the cover letter-and drait report provided on 23'd Decetnbel 20141 With regard to compliance with the AMUATF Regulations, there was no evidence ofa documented entity risk assessment at tile ottlre 2014 on-site and the documents that the Compliance Manager submitted following the 23'" Feta-nary meeting were not adequate. Risk reviews tlrat were being conducted were not being prior ized based on the risk rating or die trust. One or the tiles reviewed highlighted that a trust's isk rating was lowered tiuln a high risk ratitrg to a low risk rating as the Compliance Manager concluded that the settler was no longer a politically exposed per-son ("111m") World Compliance slrowetl the settler as a PEP attire time orthe 2014 on.sire. Tire reduced risk rating resulted in no entranced ongoing monitoring being carried otrt on tlte trust, with regard to compliance with Trusts Regulations, the Company must ensure Source oannds forms are completed for new additions to trusts; must track the resolution of the issues during the trust mvicw plncess; must establish a service level agreement with Appleby Bermuda Limited tor the services provided: and must formalin its risk appetite in writing and that it is approved by the Board ora committee ofthe Bu These main issues are further detailed in the remit together with the recommended actions. _We have indica timelirres for addressing the atoremerrtioned issues and thus we remind you that it the respons try at the Heard and Senior Management to ensure that the implementation of the issues are conducted within the allotted time tia.nre We therelore ask that we be provided with evidence ofthe satire at the appropriate time In the meantime, if on have an tiestinns or require please do not hesitate to fit or Yours faithfully, For an on trelraltotthe Benn da Monetary Authority Mfil ia oult'idge-Al Iwood Trust. Corporate Services as investment