FMA seeks clarity on data protection following new VFSC questionnaire

In August, the VFSC asked every Financial Dealers Licence holder to complete a risk assessment questionnaire, as part of Vanuatu’s preparation for the upcoming APG/FATF Mutual Evaluation.

The questionnaire is quite extensive, in seven parts with about 780 questions, and licensees had to return it by 21 August. It asks about customers, products, the countries a firm deals with, how customers are onboarded and how money moves, exposure to financial crime, governance, and compliance. Many of the answers contain information that firms would not normally share with anyone.

For that reason, the Association wrote to the Commissioner on 31 August, asking who would get to see this information, where it would be kept, and what would be shared outside the Commission.

The Commissioner replied on 3 September. In short, he confirmed the following.

Inside the VFSC, detailed licensee information will only be seen by staff who are authorised to see it, and only for regulatory, supervisory or related official work.
The VFSC does not intend to make commercially sensitive information about individual licensees available to competitors, customers or the public.
The information is being collected for the sector risk assessment. The VFSC will seek to present it in a combined or anonymised form, so that sensitive information about individual firms is not disclosed unnecessarily.
For the APG/FATF review, the VFSC will try to use combined or anonymised information wherever that is enough. It cannot promise in advance that information about an individual licensee will never be needed or shared if there is a lawful and legitimate regulatory reason. If that happens, it follows the law and the usual confidentiality rules.
The information will be kept and processed on the Commission’s own secure systems. The VFSC will not knowingly make confidential licensee information public through artificial intelligence or other outside platforms.
If a licensee later finds an honest mistake in its answers, it should tell the VFSC. The Commission will look at it reasonably and in context, and an honest mistake will not automatically be treated as a breach. This does not cover information that is materially false or misleading.

We thank the Commissioner and his team for a quick and clear reply, and we thank our members for the work they put into completing the questionnaire. If you find a mistake in what you sent, please tell the Commission now rather than wait.

Both letters are below in full, together with the original VFSC circular and the questionnaire itself (reformatted from an Excel file).