Cayman Beneficial Ownership platform independently assessed as secure10 Oct 2018
Before the new Cayman Islands (‘Cayman’) Beneficial Ownership Register (‘BOR’) went live, the Cayman Islands Government (‘CIG’) completed a security enhancement and had the air-gapped platform independently evaluated to check for any deficiencies. The result was circulated in an Industry Advisory dated 9 October 2018, confirming that the non-public beneficial ownership platform (‘BOP’) was assessed as secure, with no deficiencies in the air-gapped system.
What is a BOR?
Briefly, certain companies and limited liability companies (‘LLCs’) are required under existing Cayman legislation to provide information on their beneficial ownership to the Beneficial Ownership Competent Authority (‘BOCA’). All directors of all Cayman companies and LLCs should check whether their company or LLC falls within the scope of the legislation and regulations.
What did the assessment say?
The Industry Advisory sets out the assessment by local firm KPMG which was provided in a September 2018 letter to the Cayman Ministry of Financial Services. It advises that KPMG noted that based on its findings following a physical inspection in June 2018 the platform is verified as air-gapped and there are
‘no areas of significant risk in relation to the prevention of unauthorised access, use, disclosure, disruption, modification, inspection, recording or destruction of information held within the BOP system’.
How does the air-gapped system work?
There is a protocol in place by which the corporate service provider (‘CSP’) and their data handlers of a company or LLC should submit beneficial ownership data to the system. This provides that:
Upon arrival at the Government Administration Building, the CSP data handler will notify reception security that they are there to upload BO information. The data handler will be required to provide official identification (Government ID is preferred), which the security officer will check to ensure that it matches the person in from of them. The data handler(s) will then sign his or her name, and note their arrival time, on BOCA’s log (which is separate from the building’s visitor’s log).
The data handler will be escorted by security to the designated room where he or she will submit the BO data. Upon completion, the data handler will be escorted back to the reception area and note the submission completion time on the BOCA log. This will represent the end of the data submission protocol.
Please note that in addition to the BOCA protocol, data handlers will be required to follow the Government Administration Building’s usual sign-in / sign-out visitors protocol.
With the exception of public holidays, data submission can be made between 9am and 3:30pm, Monday to Friday.
There may be occasions when the person who is submitting the data may not have an ID; in those situations please make [note] of this occurrence to the back of the sign in sheet along with the date, time and name of the entity the individual in representing. They would then be allowed to provide the encrypted data to the transfer room.