The Twelve Principles for Licensed Firms and the Systems and Controls GFSO Expects

Summary

• GEN Chapter 2 sets out twelve Principles for Licensed Firms (GEN 2.2.1–2.2.12) and six Principles for Approved Persons (GEN 2.4.1–2.4.6). The Principles "have the status of Rules" and apply "also in new or unforeseen situations which may not be covered elsewhere by a specific Rule" (GEN 2.1, Guidance 1).
• Breaching a Principle "makes a Licensed Firm liable to disciplinary action, and may indicate that it is no longer fit and proper" to hold a licence (GEN 2.1, Guidance 2).
• GEN Chapter 3 converts Principle 3 into detailed requirements: apportionment of responsibilities (3.2), and systems and controls covering organisation, risk, compliance, internal audit, business planning, staff, conflicts, information barriers, outsourcing, business continuity, records, financial crime, governance and remuneration (3.3).
• GEN 3.4 requires every Licensed Firm to have written whistleblowing policies and to keep records of Protected Disclosures for at least six years.
• GEN Appendix 1 (A1.1 and A1.2) sets out best practice on corporate governance and remuneration that firms may adapt but must be able to justify departing from.
• The Principles do not apply to Representative Offices, and a Credit Rating Agency is exempt from Principles 6 to 9 (GEN 2.1.1).

What the Principles are

The Financial Services Act 2025 gives GFSO, the Gelephu Financial Services Office, a general rule-making power (s. 3). The General Rulebook (GEN, Version 1.0, dated 7 May 2026) is the core rulebook made under it. GEN applies "to every Person to whom FSA or MIR applies" but not to Remote Bodies (GEN 1.1.1). A Licensed Firm is a firm holding a Financial Services Licence from GFSO.

Chapter 2 opens with the Principles. GEN's Guidance describes their function precisely: they "are a general statement of fundamental regulatory requirements which apply alongside the other Rules and also in new or unforeseen situations which may not be covered elsewhere by a specific Rule. Rules in other areas of the Rulebook build upon these fundamental principles" (GEN 2.1, Guidance 1). In other words, a firm that complies with every detailed Rule may still breach a Principle, and a firm facing a novel situation is expected to reason from the Principles.

The enforcement consequence is stated in the same Guidance: breach "makes a Licensed Firm liable to disciplinary action, and may indicate that it is no longer fit and proper to carry on a Regulated Activity or to hold a Financial Services License", and GFSO "may consider withdrawing" the licence on that basis (Guidance 2). The onus is on GFSO "to show that the Licensed Firm has been at fault in some way" (Guidance 3). Under the Act, a contravention of the Rules is a contravention of the Act (s. 218(1)(d)), attracting public censure (s. 231), financial penalties (s. 232) and licence suspension (s. 233).

The twelve Principles for Licensed Firms (GEN 2.2)

The titles below are as they appear in GEN 2.2; the descriptions summarise the rule text.

Scope of application

The Principles apply to every Licensed Firm, with two carve-outs: they do not apply to a Representative Office, and a Credit Rating Agency need not comply with Principles 6, 7, 8 and 9 (GEN 2.1.1(2)–(3)). They apply to a firm's "Activities", defined to include Regulated Activities, activities carried on in connection with them and activities held out as being for their purpose (GEN 2.1.2(1)). Principles 3 and 4 also apply in a Prudential Context to all of a firm's Activities and take into account other Group members (GEN 2.1.2(2)–(3)); Principles 10 and 11 apply to all Activities so far as they concern disclosure to GFSO (GEN 2.1.2(4)).

Territorially, the Principles apply to Activities "carried on from an establishment maintained by it in GMC" (GEN 2.1.3(1)), but Principles 1, 2 and 3 apply in a Prudential Context wherever Activities are carried on, Principles 4 and 11 apply wherever they are carried on, and Principle 5 applies to Activities outside GMC that "might reasonably be regarded as likely to have, a negative effect on confidence in the GMC Financial System" (GEN 2.1.3(3)–(5)).

The six Principles for Approved Persons (GEN 2.4)

The Principles for Approved Persons apply "to every Approved Person and in respect of every Controlled Function" (GEN 2.3.1). An Approved Person is an individual approved by GFSO under s. 43 of the Act to perform a Controlled Function (see our guide to Approved Persons and Controlled Functions). The six Principles are:

1. Integrity (2.4.1), "high standards of integrity and fair dealing in carrying out every Controlled Function".
2. Due skill, care and diligence (2.4.2).
3. Market conduct (2.4.3), "proper standards of conduct in the GMC Financial System".
4. Relations with the Regulator (2.4.4), open and co-operative dealing and appropriate disclosure.
5. Management, systems and control (2.4.5), for those with significant responsibility, reasonable care to ensure the business "is organised so that it can be managed and controlled effectively".
6. Compliance (2.4.6), for those with significant responsibility, reasonable care to ensure the business "complies with any Regulations or Rules".

Breach "may indicate that an Approved Person is no longer fit and proper", and GFSO may suspend or withdraw Approved Person status (GEN 2.3, Guidance 2). The Guidance also expects the firm itself to consider suspending or withdrawing the individual's status and whether disciplinary action is warranted (Guidance 4).

GEN Chapter 3: management, systems and controls

Chapter 3 "applies to every Licensed Firm with respect to the Regulated Activities carried on in or from GMC", and in a Prudential Context to a Domestic Firm's activities wherever carried on (GEN 3.1.1). It does not apply to a Representative Office, and the internal audit rules (3.3.13–3.3.15) do not apply to a Fund Manager of a Venture Capital Fund (GEN 3.1.1(4)–(5)). Its purpose is to make the Governing Body and senior management "take direct responsibility" for the firm's arrangements (GEN 3.1, Guidance 1).

Allocation of significant responsibilities (GEN 3.2)

A Licensed Firm "must apportion significant responsibilities among the members of its Governing Body and its senior management" so that the apportionment meets the governance requirements in 3.3.41, is appropriate to the nature, scale and complexity of the business and the ability of the individuals, makes "clear who is responsible for which matter", and allows the business to be "adequately monitored and controlled" (GEN 3.2.1). The functions of dealing with apportionment and overseeing the establishment and maintenance of systems and controls must be allocated to the Senior Executive Officer (or equivalent) or the Governing Body (GEN 3.2.2).

The firm must keep "an up-to-date record" of these arrangements, showing that the individuals "are aware of and have accepted the responsibilities apportioned", how shared responsibilities are split, and retain it for six years (GEN 3.2.3). This responsibilities map is one of the first documents GFSO is likely to request, and it is the document on which individual accountability will be assessed.

Systems and controls (GEN 3.3)

GEN 3.3.1 is the general requirement: systems and controls, "including but not limited to financial and risk systems and controls", that ensure the firm's affairs are managed effectively and responsibly by senior management, with regular reviews. The Guidance confirms proportionality, GFSO "will take into account" the nature, scale and complexity of the business, but adds that these factors do not relieve any firm "from compliance with its regulatory obligations". The specific requirements are:

Corporate governance (GEN 3.3.41 and 3.3.41A)

Every Licensed Firm must have a Governing Body that is "clearly responsible for setting or approving" business objectives and strategies and providing effective oversight, that comprises "an adequate number and mix of individuals" with the relevant knowledge, skills, expertise and time, and that has adequate powers and resources (GEN 3.3.41(2)). Senior management must be "clearly responsible for the day-to-day management" in accordance with those strategies (GEN 3.3.41(3)).

For Banks, Insurers (other than Captive Insurers and Licensed ISPVs) and any other firm GFSO designates by written notice, GEN 3.3.41A adds hard requirements: "A majority of the Governing Body must be Non-Executive Directors, and at least one of those Non-Executive Directors must be an Independent Non-Executive Director"; the chair must be a Non-Executive or Independent Non-Executive Director; and GFSO may require audit, risk, nomination and remuneration committees with prescribed composition. The Guidance is candid that a small, tightly held firm or an early-stage subsidiary may not be able to meet all of this and "should apply for a waiver or modification" with justification (Guidance 7), while a firm "with no regulatory track record" may be expected to appoint "an independent Director (who has relevant regulatory experience)" (Guidance 8). A Group member may adopt Group-wide standards if its Governing Body considers them appropriate (Guidance 9), and a Branch may generally rely on head-office practices (Guidance 10).

Remuneration (GEN 3.3.42)

The Governing Body must ensure the remuneration structure is consistent with business objectives and risk parameters, aligns risk outcomes with roles, covers at a minimum the Governing Body, senior management, Persons Undertaking Key Control Functions and "Major Risk-Taking Employees", and is implemented and monitored (GEN 3.3.42(1)). Sufficient information must be provided to GFSO and stakeholders to demonstrate this (3.3.42(2)); the Guidance expects it in the annual report, including the decision-making process, the main elements of the structure and aggregate quantitative information (Guidance 4), and expects significant changes to be notified to GFSO before implementation (Guidance 5).

Whistleblowing (GEN 3.4)

GEN 3.4.1 requires every Licensed Firm to "implement and maintain appropriate and effective arrangements" to facilitate persons making Protected Disclosures, to assess and where appropriate escalate the concerns raised, and to "protect the identity of a person who makes a Protected Disclosure", proportionate to the size and complexity of the business. The arrangements "must be set out in written policies and procedures" (GEN 3.4.2) and periodically reviewed (GEN 3.4.3).

Records are mandatory: each Protected Disclosure and supporting documents, and the firm's investigation, assessment and determination, must be kept in writing (GEN 3.4.4) "for a period of at least six years from the date that determination of all matters relevant to the Protected Disclosure have been completed and closed" (GEN 3.4.5).

The statutory anchor is s. 101 of the Act. A disclosure that meets three conditions "is not to be taken to breach any restriction on the disclosure of information": the information causes the discloser to know or suspect, or gives reasonable grounds for suspecting, that another person has engaged in Market Abuse; it came to the discloser in the course of trade, profession, business or employment; and it is made to the Regulator or to a "nominated officer" as soon as practicable (s. 101(1)–(4)). A nominated officer is a person nominated by the employer to receive disclosures under a procedure the employer has established (s. 101(5)). GEN 3.4 is, in effect, the requirement to have that procedure. The audit committee best practice in Appendix 1 also assigns the committee responsibility for reviewing the arrangements by which staff may "in confidence, raise concerns about possible improprieties" (A1.1, para. 9A(d)(vii)).

Appendix 1: best practice on governance and remuneration

GEN Appendix 1 is Guidance rather than Rules, but a firm that departs from it must be able to show GFSO "what the deviations are and why such deviations are considered ... appropriate", and should periodically review its governance against the best practice (GEN 3.3.41, Guidance 11). A1.1 covers:

• the Governing Body's role in setting objectives and risk strategies, "tone at the top", codes of ethics, and at least annual review of objectives (A1.1, paras. 1–3);
• objective performance goals for the Governing Body and senior management (para. 4);
• regular stress testing of credit, operational, market and liquidity risks, reviewed annually (para. 5);
• internal governance: formal nomination, selection and removal processes, terms of office, succession planning, regular meetings and a schedule of reserved matters (paras. 6–7);
• committees, audit, risk, nomination, remuneration and ethics/compliance, with defined mandates and the responsibilities listed in para. 9A;
• independence criteria: a Non-Executive Director is not independent if, among other things, he has been an Employee within the last five years, has had a material business relationship within the last three years, receives remuneration beyond a director's fee, is connected to the external auditor, has close family ties with advisers or senior Employees, or represents a significant shareholder (para. 11); and
• the Governing Body's powers, including direct access to senior management and Persons Undertaking Key Control Functions (para. 12).

A1.2 sets out corresponding best practice on remuneration.

How GFSO supervises against these standards

Several statutory and GEN mechanisms convert the Principles into supervisory practice. GFSO may require information (s. 201) and commission reports by Skilled Persons (s. 203). GEN 8.10.6 requires a firm to advise GFSO "immediately" of, among other things, its failure to satisfy fit and proper requirements, a significant breach of a Rule, "any significant failure in the Licensed Firm or Recognised Body's systems or controls, including a failure reported ... by its auditors", and any Approved Person who is no longer fit and proper, each of which maps onto a Principle. Principle 10 (relations with Regulators) makes the duty of candour a freestanding obligation, so a firm that has a control failure and fails to report it faces two breaches rather than one.

In an emergency outside its control, a firm is not in contravention of a Rule to the extent compliance is impractical, provided it notifies GFSO as soon as practical and takes all practical steps to deal with the consequences (GEN 4.3.1). And where a Rule does not fit a business model, GEN 8.2 provides a waiver and modification process (see our guide to waivers and modifications).

Practical checklist: building a GEN Chapter 3 compliant control framework

1. Prepare the responsibilities map under GEN 3.2.3, signed by each member of the Governing Body and senior management, and diarise its six-year retention.
2. Document the organisation chart, reporting lines and segregation of duties (GEN 3.3.2–3.3.3), and publish client-facing Employees where GEN 3.3.2(3) applies.
3. Appoint the risk adviser required by GEN 3.3.6 and, for banks and non-captive insurers, a Senior Manager other than the SEO for that role.
4. Resource the Compliance Officer with independence and unrestricted access (GEN 3.3.9–3.3.10), and set up breach monitoring and a breach register (GEN 3.3.11–3.3.12).
5. Establish an independent internal audit function unless the VC fund manager exemption applies (GEN 3.3.13).
6. Write a twelve-month business plan and a management information pack (GEN 3.3.16–3.3.17).
7. Adopt conflicts, information barrier, outsourcing, business continuity, records and financial crime policies that track GEN 3.3.21–3.3.40, and notify GFSO of material outsourcing.
8. Constitute the Governing Body to GEN 3.3.41, and to 3.3.41A if you are a bank or insurer, or apply for a waiver.
9. Adopt a written whistleblowing policy with a nominated officer, identity protection and a six-year record (GEN 3.4; s. 101).
10. Benchmark the whole framework against Appendix 1 and record any deviations and the reasons.

Frequently asked questions

Are the Principles legally binding or just guidance?

They are Rules made under the Act rather than provisions of the Act itself. GEN 2.1 Guidance 1 states the Principles "have the status of Rules". A breach is a contravention of the Act under s. 218(1)(d) and exposes the firm to censure, penalties and licence suspension under ss. 231–233.

Do the twelve Principles apply to a Representative Office?

No. GEN 2.1.1(2) disapplies the Principles for Licensed Firms for a Representative Office, and GEN 3.1.1(4) disapplies Chapter 3. Representative Offices are governed by GEN Chapter 9 instead.

Does a small advisory firm need a board with independent directors?

GEN 3.3.41 requires every firm to have a Governing Body with an adequate number and mix of individuals, proportionate to its business. The majority non-executive and independent director requirements in GEN 3.3.41A apply only to Banks, non-captive Insurers and firms GFSO designates by notice. GEN's Guidance notes that arranging- or advising-only firms may have "less extensive and simpler" governance.

What must a whistleblowing policy contain?

Arrangements to facilitate Protected Disclosures, to assess and escalate them, and to protect the discloser's identity, set out in writing and reviewed periodically (GEN 3.4.1–3.4.3). Records of each disclosure and its investigation must be kept for at least six years after closure (GEN 3.4.4–3.4.5). Section 101 of the Act protects disclosures about Market Abuse made to GFSO or a nominated officer.

Can we outsource compliance or internal audit to a group company?

GEN 3.3.31 permits outsourcing, including within the Group, but the firm "is not relieved of its regulatory obligations" and the function "shall be deemed as being carried out by the Licensed Firm itself". Material outsourcing must be notified to GFSO and documented in a written contract giving GFSO information and access rights (GEN 3.3.32). The Compliance Officer must still be an Approved Person resident in GMC/Bhutan unless GFSO grants a waiver (GEN 5.5.2).

Key takeaways

• The twelve Principles in GEN 2.2 are Rules, apply in unforeseen situations, and are the basis on which fitness and propriety is judged.
• Approved Persons carry six Principles of their own (GEN 2.4), with personal consequences for breach.
• GEN 3.2 requires a signed, six-year responsibilities map; GEN 3.3 requires documented systems across risk, compliance, audit, conflicts, outsourcing, continuity, records and financial crime.
• Banks and insurers face majority non-executive boards and independent directors under GEN 3.3.41A; others must be proportionate but complete.
• Whistleblowing arrangements are mandatory, written and recorded for six years (GEN 3.4), anchored in s. 101 of the Act.

This article is general information about the law of the Gelephu Mindfulness City Special Administrative Region as at the date above. It is not legal advice and does not create a lawyer–client relationship.

You may contact Basnet Law at basnet@basnetgmc.com or office@basnetgmc.com for any legal queries related to GMC.

References

• Financial Services Act 2025 (Law No. 5 of 2025), ss. 3, 43, 101, 201, 203, 218, 231, 232, 233
• GEN Rulebook 2026 (Version 1.0), Rules 1.1.1, 2.1.1–2.1.3 (and Guidance), 2.2.1–2.2.12, 2.3.1 (and Guidance), 2.4.1–2.4.6, 3.1.1, 3.2.1–3.2.3, 3.3.1–3.3.42, 3.3.41A, 3.4.1–3.4.5, 4.3.1, 5.5.2, 8.2, 8.10.6; Appendix 1 (A1.1, A1.2)