AML/CFT - What you DO need to Know. Trust Special Interest Group 14 November 2017

Transcription

1 AML/CFT - What you DO need to Know Trust Special Interest Group 14 November 2017 S

2 It Isn t Rocket Science The regime is risk based. You can t monitor everything done by every member of staff at all times. Your risk assessment is an analysis of your business to identify areas of vulnerability. Your AML/CFT programme sets out how you will manage those risks.

3 Timelines for Phase 2 Late 2017 for: Sector risk assessment (legal) Regulations first have been released and consultation period has closed. Guidance for lawyers (limited to what is assessed as most necessary) Early 2018 for: Roadshows Progressive updates to existing guidance including accountants Sector risk assessment and guidance for accountants

4 Does It Happen in Law and Accountancy? Gatekeepers - add respectability and legitimacy to transactions Risk services asset purchases; structuring of businesses; trusts or shell companies Transactions without economic purpose; overly complex.

5 It Isn t Relevant to Me Civil Liability Acts Failure by reporting entity to comply with any of the AML/CFT requirements, including failure to conduct CDD, adequately monitor transactions, establish, implement and maintain an AML programme Formal warnings, enforceable undertakings, performance or restraining injunction, civil proceedings for pecuniary penalty Fine up to $200k in the case of an individual and up to $2 million in the case of a body corporate 5 Criminal Offences Reporting entity that knowingly or recklessly engages in conduct constituting a civil liability act commits an offence Specific offences: failure to report a suspicious activity or a prescribed transaction; providing false or misleading information; unlawfully disclosing reports; not keeping records; obstruction; related to reporting and structuring of cross-border transportation of cash Up to two years imprisonment and a fine of up to $300k in the case of an individual Fine of up to $5 million in the case of a body corporate

6 Reputational Damage/Fines International Examples Amex 2007 $USD 65 million $USD 1.9 billion HSBC investigation into adequacy of controls 6 Standard Chartered ; ongoing $USD nearly 1 billion PNB Paribas 2014 $USD 8.9 billion

7 Obligations in a Nutshell Appoint an AML Compliance Officer Draft a risk assessment Establish and implement a programme Register for goaml

8 Are you captured? Things to think about. What is in and what isn t? Section 6 states Act applies only to the extent that the activities carried out by the business fall within the activities described in the section 5(1) definition of DNFBPs. So, mergers and acquisitions, acting as a registered office or representative, setting up trusts or other legal entities all clearly in, but at what stage is advice on this captured? Acting as a corporate trustee, nominee director or shareholder, in; also managing client funds, accounts, securities or other assets. Grey areas - Estate management and litigation settlements. Ordinary course of business

9 Risk Assessment (section 58) Mandatory considerations; written; current; guidance. Risk areas client, services and transactional; geographic; internal. Potential Indicators Sector risk assessments; FIU typology reports; APG and FATF guidance.

10 Programme (Section 57) Must be in writing based on the Risk Assessment Adequate and effective procedures, policies and controls including for: Vetting and training appropriate staff Customer due diligence (including use of third parties) Investigations Reporting SARs and PTRs Record keeping Managing and mitigating risks and monitoring and managing compliance with your programme

11 Customer Due Diligence What it involves Collection and verification of prescribed information Simplified, standard and enhanced Who it involves Every customer of a reporting entity A beneficial owner of a customer Any person acting on behalf of a customer How it is conducted Documentary face to face verification Documentary verification using certification Electronic identity verification

12 Who is your customer? A new or existing customer Includes: a facility holder a person conducting or seeking to conduct an occasional activity or transaction Occasional transaction is $10k cash or more occurring outside a business relationship Occasional activity is an activity specified in DNFBP definition not involving a business relationship

13 Types of Due Diligence Standard Due Diligence Obtain full name, date of birth, relationship to customer if not the customer, address or registered office, company /registration number. Take reasonable steps to satisfy this information is correct Take reasonable steps, based on level of risk, to verify any beneficial owner or person acting on behalf of the customer Verification must be carried out before entering a business relationship or conducting an occasional transaction or activity Also obtain information on nature and purpose of the business relationship and sufficient other information to determine whether EDD necessary. Simplified Name, date of birth and relationship to customer for persons acting on behalf of the customer Verification of identity and that person s authority to act according to level of risk Enhanced always for trusts or vehicles for holding assets, PEPs, wire transfers, SARs. Information as per standard plus information relating to the source or the funds or the wealth of the customer Information on beneficiaries

14 Beneficial Owners and acting on behalf of Beneficial owner means an individual who: Has effective control of a customer or a person on whose behalf the transaction is conducted (e.g. trust beneficiaries) Owns 25% of more of the customer or person on whose behalf the transaction is conducted Acting on behalf of supervisor guidance but likely to include those with authority to sign, amend account holder details, signatories to accounts, power of attorneys.

15 CDD - Trusts On the trust: Full name, address Name and date of birth of beneficiaries (subject to regulation requirements) Source of funds or wealth Nature and purpose of the business relationship On the beneficial owners (e.g. trustees, protector, special trustee): Full name, date of birth and address On persons acting on behalf of (e.g. trustees, anyone with authority to manage assets): Full name, date of birth and address Relationship to customer; company identifier where applicable Include individuals representing corporate trustee or agent

16 CDD Trusts cont. Source of funds/wealth original settlement; income Notes on beneficiaries: Discretionary or charitable trusts or trusts with more than 10 beneficiaries a description of the class or type of the beneficiary and if charitable, the objects of the trust For all other trusts as per above, the name and date of birth of each beneficiary. Level of verification Identity same as for standard due diligence Source of wealth/fund according to level of risk Beneficiary details - simply says must verify

17 Verification Identity Code of Practice Documentary face to face or certified Electronic Biometrics or similar DIA position Safe Harbour section 67 can use alternative effective means to comply but can t rely on as a defence to breach unless have advised supervisor accordingly.

18 Suspicious Activity Reports No definitive list of what is considered a suspicious transaction or activity Suspicion doesn t require certainty of a predicate offence although awareness of potential may be the trigger No tipping off but must conduct EDD. Must report to FIU through goaml (electronic) within three days of forming a suspicion Legal Professional Privilege

19 Prescribed Transaction Reports 2015 Amendment Act came into force 1 July 2017 Regulations come into effect on 1 November 2017 for first phase reporting entitied in respect of international wire transfers and domestic cash transactions! Information on FIU website regarding obligations and exemptions FMA interpretation October 2017 awaiting DIA

20 What should you be doing now? Pre Christmas Recommend assessing the level to which your business activities are captured and first draft of risk assessment. Think about your AML Compliance Officer and sign up to goaml; initial training to staff. Consider best CDD solution fit for your business New Year Review existing processes and policies; assess what is needed Draft programme; AML CO training Need to allow time to bed in processes and test.

21 Challenges Timing of CDD For lawyers - professional privilege (and STR timing) In or Out EDD for an SAR Instructions from overseas firms Exiting a relationship Occasional transactions/activities Regulatory fatigue