COMPLIANCE PROGRAMME

Transcription

1 HyscoBanx Trust Company Kb Anti-Money Laundering And Countering Financing of Terrorism COMPLIANCE PROGRAMME Issued in compliance with the Act on Measures against Money Laundering and Terrorist Financing, 2009 (Sweden) and Finansinspektionen s Regulations and General Guidelines governing measures against money laundering and terrorist financing, 2009 (Sweden) Version 1, Issued by Hyscobanx Trust Company Kb on 1st June 2015 by Jean Pierre Beurton, General Partner. With thanks to Financial Operations Limited for review and advice.

2 Contents General Policy on Anti-Money Laundering and Countering Financing of Terrorism... 3 Customer Due Diligence acceptance of new business... 4 Customer due diligence ongoing relationships, material change to nature or purpose of the business relationship Customer due diligence - account monitoring Customer due diligence - Transaction monitoring Reporting requirements-obligation to provide information and conduct reviews Prohibition of disclosure Money Laundering Reporting Officer Appointment Employee Training Programme Registers Protection of employees Supervision Internal control, compliance and internal information First Money laundering reporting officer Appointment

3 General Policy on Anti-Money Laundering and Countering Financing of Terrorism Policy The company is required to comply with a risk-based approach to anti-money laundering and countering financing of terrorism (AML/CFT) and the company takes these requirements very seriously. In seeking and maintaining critical relationships with the institutions that bank the company and process transactions involving the company, the company is expected to take a pro-active stance on developing and implementing these policies, procedures and controls, and to comply not only with Swedish law but with the policies and practices recognised internationally as minimum requirements in this area. Procedure This programme is developed on the basis of Swedish code of Statues Act on measures against money laundering and terrorist financing, issued on 12 February 2009, a risk-based approach, using the previously completed Risk Assessment that was, after review and professional advice, issued by the company on pursuant to section 3, Chapter 2, Finansinspectionen s Regulatory Code, and as updated from time to time. The company must incorporate its AML/CFT obligations and requirements into its core business systems and controls so that the company can comply effectively and reliably with its obligations in this area, and so that compliance with these obligations can be verified by management and external auditors. The company out-sources the key Customer Due Diligence (CDD) functions to Financial Operations Limited, which provides a reliable and auditable service for enforcing document adequacy, document analysis and PEP/sanctions etc., lookup and screening facilities/services. 3

4 Control When the company is reviewing its Risk Assessment and Compliance Programme as required by law and by this policy, compliance with this policy must also be reviewed. Likewise if the Risk Assessment and Compliance Programme is subject to external audit. The Money Laundering Reporting Officer is responsible for compliance with this policy, and for the effectiveness of the programme as a whole. This programme will be kept up to date as part of Financial Operations Limited outsourced CDD and programme maintenance service that the company subscribes to. Customer Due Diligence acceptance of new business Policy The company does not provide individual transaction services, all services are provided only to customers who have established a business relationship with the company. Basic Customer Due Diligence (CDD) applies unless the customer is exempt under section 5, Chapter 2, of Act on Measures against Money Laundering and Terrorist Financing or if enhanced CDD is required under section 6, Chapter 2 of Act on Measures against Money Laundering and Terrorist Financing. Applicants are classified as follows: 1. Natural person or 2. Legal entity. Natural Person physically present The company shall verify the identity by means of: a) a Swedish driver s licence b) Swedish passport c) identity card issued by a Swedish authority or Swedish certified identity card. 4

5 The company shall verify the identity of those who do not have a Swedish identity document by verifying the passport or other identity document which provides information of citizenship and are issued by an authority or other authorised issuer. A copy of the foreign passport or other foreign identity document shall be kept at all times. If the customer has no identity documents, the company may verify the identity by means of other reliable documents and controls in accordance with the undertaking s established procedures. Natural person not physically present The company shall verify the identity in a non-face-to-face situation by: 1. using the electronic identification in order to create an advanced electronic signature as set forth in the definition in Section 2 of the Electronic Commerce and other information Society Services Act, 2000 or by using any other similar technology for electronic identification. or 2. Ensuring the customer s identity in an appropriate manner by: a) Obtaining information regarding the customer s name, civic registration number or the equivalent as well as the address, b) Verifying the information against external registers, certificates, other documentation, or the equivalent as well as c) Contacting the customer by sending a confirmation to the customer s address in the population register, ensuring that the customer sends a copy of the identification document, or the equivalent. Legal Person In exemptions Where the provisions governing basic measures for customer due diligence do not need to be applied as per Chapter 2, section 5 of the Act on Measures against Money Laundering and Terrorist Financing, (e.g. Swedish authorities) the company shall still verify a customer s identity by: a) Obtaining information regarding the customer s name, civic registration number or the equivalent as well as the address, as well as b) Verifying the information against external registers, certificates, other documentation, or the equivalent. 5

6 Legal Entity The company shall verify the identity of a customer that is a legal person by means of a) a registration certificate, b) corresponding authorising documents if the registration certificate has not been issued for the legal person, or c) make corresponding verification against external registers. The company shall also verify the identity of a representative of a legal person in the as per the policy for natural persons above. Legal person not physically present The company shall verify the identity of a customer that is a legal person by means of: a registration certificate, corresponding authorising documents if the registration certificate has not been issued for the legal person, or make corresponding verification against external registers. The company shall also contact the customer by sending a confirmation to the customer s registered address or take an equivalent measure. The company shall verify the identity of a representative of a legal person by: a) Obtaining information regarding on the person s name, civic registration number or the equivalent as well as the address, as well as b) Verifying the information against the legal person s external registration certificates, external registers, and identity documents for the representative like Swedish driver s licence, Swedish passport, identity card issued by a Swedish authority or Swedish certified identity card, foreign passport or foreign identity card if applicable or the other equivalent and reliable document. 6

7 Legal person in exemptions Where the provisions governing basic measures for customer due diligence do not need to be applied asper Chapter2, section 5 of the Act on Measures against Money Laundering and Terrorist Financing, the company shall still verify a customer s identity in an appropriate manner: a) Obtaining information regarding the person s a) name, b) civic registration number or the equivalent c) the address, b) Verifying the information against the legal person s registration certificates, external registers, and identity documents for the representative like Swedish driver s licence, Swedish passport, identity card issued by a Swedish authority or Swedish certified identity card, foreign passport or foreign identity card if applicable or the other equivalent and reliable document. Verifying the identity of a beneficial owner The company, in situations requiring customer due diligence pursuant to Chapter 2, section 2 of the Act on Measures against Money Laundering and Terrorist Financing, 2009 shall obtain reliable and sufficient information on a beneficial owner s identity by means of public registers, relevant information from the customer or other information that the undertaking has received. Where the customer is a legal person, the company shall verify: 1. direct and indirect natural owners if the holding in the customer amounts to more than 25 percent and 2. the natural persons that exercise a determining influence over the customer. The beneficial owners, signatories, and any other relevant individuals associated with the customer must be adequately identified to the company, so that the company is confident that it knows who the beneficial owner(s) are, and which individuals it is required to identify. 7

8 General policy- acceptance of new business 1. The person or entity may not be a resident, incorporated, formed, or registered in a jurisdiction unacceptable to the company. For this purpose the company will maintain a list of unacceptable jurisdictions. 2. In the case of a financial institution, its licencing, registration, authorisation or approval status must properly cover its financial service activity, with its licence etc. status issued by a financial services authority in a well regulated jurisdiction. The financial institution must be supervised and regulated for AML purposes in its jurisdiction of licencing etc. and its AML compliance programme and controls must be reviewed and accepted by the company as being adequate and effective. The financial institution must be in good regulatory standing with its supervising regulator(s) including its AML supervisor. 3. The company must not establish a business relationship or open an account for a shell bank, and all financial institution customers must have policies prohibiting relationships with shell banks, within the meaning of chapter 5 sec 3 of the Swedish Code of Statues Act on Measures against Money Laundering and Terrorist Financing, Where the company will have a business relationship with a credit institution outside Europe Economic Area with the company, the company must: a) obtaining sufficient information about the other party in order to be able to understand the activities as well as assess the other party's reputation and the quality of supervision, including whether the other party (respondent) has been subject to a money laundering or financing of terrorism investigation or regulatory action; and b) assessing the other party's controls to prevent money laundering and terrorist financing, c) documenting the respective institution's responsibility for taking control measures and the measures that they take, d) obtaining approval from authorised decision-makers, and e) ensuring that the other party has checked the identity of customers that have direct access to accounts at credit institutions and monitor these customers on an ongoing basis and are able to provide relevant customer identification data on request. 8

9 f) The customer should be holding funds and transacting for itself, or only for other persons that the company can adequately identify, verify and accept, and/or within the appropriate regulatory status and AML controls of the financial institution, as applicable. 5. The structure of the legal person must be formed or used for legitimate financial, business, investment, estate planning, tax planning, asset protection, or similar reasons comprehensible to the company and acceptable to it. 6. The nature of the business or investment activity of the customer, and the customer s proposed use of the company s services, must be adequately understood. For this purpose only a general categorisation is required, except for financial institutions where policies 2-4 apply as applicable. 7. Customers who are or who are associated with Politically Exposed Persons can be accepted. But if the customers who are or who are associated with Politically Exposed Persons who is resident abroad shall take enhanced customer due diligence. Where the customer is a financial institution, a more detailed review of the background of the individuals associated with the applicant is required, including appropriate business, professional, credit, criminal record, and character reference checking. The amount of background investigation required depends on the risk level of the customer and the customer s proposed business with the company. The company must be able to satisfy itself that it understands the ML/FT risk associated with the proposed business and that it has established that the risk is acceptable and that the backgrounds of the individuals associated with the customer are reasonably acceptable to the company. The following backgrounds are not acceptable to the company: a) Those with criminal convictions for money laundering offences b) Those with criminal convictions for selling, importing or exporting illegal drugs c) Those with criminal convictions for dishonesty offences within the last 10 years d) Those facing charges relating to the source of wealth that is connected to the funds that are proposed to be, have been, or are likely to be included in the funds that will end up in the customer account. e) Those with a significant number of criminal convictions over a substantial period of time f) Those with a significant history of misleading or deceptive business practices, insider trading, business disputes, bankruptcies etc. sufficient to cast serious doubt over the honesty and character of the person. 9

10 8. Notwithstanding the provision contained in section 5, Chapter 2 (CDD exemptions) the company shall always perform enhanced customer due diligence measures if there is a high risk of money laundering and terrorist financing. Special attention needs to be paid to the risks of money laundering and terrorist financing that may arise from products or transactions that might favour anonymity. If the circumstances of the individual case do not indicate otherwise, enhanced CDD is required: a) When a business relationship is established or an individual transaction is carried out with someone at distance, b) When a business relationship is established or an individual transaction is carried out with a politically exposed person who is resident abroad, and c) For relationship with a credit institution with a place of residence outside the EEA. 9. The customer must not be restricted from having a business relationship with the company based on the country: d) In which the beneficial owners or signatories or persons on behalf of which the customer transacts or holds funds are nationals of or reside in e) In which it carries on business f) In which it invests g) In which its suppliers or customers are based 10. For the purpose of the above policy, the company shall maintain a list of unacceptable countries, and for each country listed as unacceptable a description of the type of connection that is unacceptable and the rationale for the country being restricted in this way. 11. The customer must not be restricted from having a business relationship with the company based on any designation or sanctions or similar restriction applicable. These countries and these restrictions will be maintained in the same list mentioned above. 12. Where there is no policy in relation to any AML/CFT CDD or customer relationship issue, the Money Laundering Reporting Officer is entitled to make any decisions on the case and must have regard to industry practice, legal or AML/CFT advice, supervisor advice if and as available or applicable. Where any exception is required to policy or procedure, this may be approved by the Money laundering reporting officer provided it is not unlawful, and the exception must be recorded in a log in the company s AML/CFT records. 10

11 Procedure To establish a business relationship with the company a customer must apply through standard forms or channels. Any documents or evidence presented that is not in English must have a translation to English performed or certified by an acceptable certifier or other person adequately qualified and independent of the person/company to which the document and the translation relates. Where necessary the certifier or translator should be contacted to verify the authenticity of the certificate or translation. On such application, the authorised processing staff must assess the application as follows. Natural Person 1) The company shall record the customer s name, date of birth, civic registration number (or other ID number) and address in CDD portal system and verify them by means of using: a) For those physically present: i) A Swedish driver s licence, Swedish passport, identity card issued by a Swedish authority or Swedish certified identity card ii) for those who do not have a Swedish identity document, a passport or other identity document which provides information of citizenship and are issued by an authority or other authorised issuer iii) where the customer has no identity documents stated above, the company may verify the identity by means of other reliable documents (e.g. ID cards issued by the banks, residence permit, certified identification cards issued to the employees by the Government authorities or business firms.) The senior management or the money laundering reporting officer can decide on the acceptance of the application in such cases. iv) For those not physically present verifying against external registers, certificates, other documents, or the equivalent b) For those not physically present, the customer s name, civic registration number (or other ID number), and address must verified by checking against external registers, certificates or other documents, and the customer must be contacted, to confirm we are dealing with the named person, by: 11

12 i) Telephone call to the customer using a publically verifiable phone number (e.g. white-pages listing) ii) Skype or other video call (e.g. facebook) where we can verify that the person is the person on the identity document (i.e. the person s appearance matches the identity document) iii) Sending a letter to the person s address in the population register (or equivalent verified official address) 2) The company shall maintain the report of the PEP screening of the customer in CDD portal system. 3) All the verification documents must be uploaded in CDD portal system and must be retained. If the person s identity has been confirmed by using skype or facebook etc. a screen shot must be taken and attached in the CDD system as evidence this step has been done this should show the image of the person s face. 4) All the documents must be certified and must be translated to English if not in English. 5) The company shall also collect the purpose of account and nature of business relationship before the approving the application. 6) Collect the residence and nationality of the customer to ensure that he/she is not from any prohibited or restricted country. a) The company shall maintain a list of high risk as well as prohibited and restricted country according to the Sweden Law. b) The company must do risk assessment for the customer and if the risk assessment is high, the customer shall be subject to the enhanced customer due diligence process. The documentation can be done on the CDD portal for the decision on the same. 7) When a business relationship is established or an individual transaction is carried out with a natural person who is not physically present, the company must do risk assessment process. If the customer is on low or medium risk, they shall be exempt from the enhanced customer due diligence. If the customer is on high risk, the company shall require the customer to fill out the enhanced customer due diligence form and the details obtained from the form can be used to make subjective decision. 8) Customers who are or who are associated with Politically Exposed Persons can be accepted. But if the customers who are or who are associated with Politically Exposed Persons who is resident abroad shall 12

13 take risk assessment process. Politically exposed persons can be considered as who hold or previously held the following positions. a) heads of state or government, ministers and deputy or assistant ministers; b) parliament members; c) judge of the supreme court, judge of constitutional courts or other high level judicial bodies whose decisions are not subject to further appeal, expect in exceptional circumstances; d) higher officials at auditing authorities and members of governing bodies of central bank; e) ambassadors, charges d affaires and high ranking officers in the armed forces; f) members of the administrative, management or supervisory bodies of State owned enterprises. g) Persons who hold or have previously held positions, at Community level and international level, corresponding to those set forth in points 1 5 shall be included, where applicable. Immediate family members pursuant to Chapter 1, section 5, subsection 7 of the Act on Measures against Money Laundering and Terrorist Financing refers to: a) spouse; b) any partner considered by national law as equivalent to the spouse; c) the children and their spouses or partners, and d) the parents. 9) The company must do risk assessment of politically exposed persons who is resident abroad and if they fall into high risk category, it must be reported to the money laundering reporting officer or the senior management. The company shall manually monitor the business relationships with politically exposed persons by checking and documenting the transactions carried out and the source of fund must be clear to the company. The company shall take PEP screening test and the report must be attached to CDD portal. The company shall obtain the approval from senior management or money laundering reporting officer for accepting the politically exposed person s application. Legal Person In exemptions Where the provisions governing basic measures for customer due diligence do not need to be applied asper Chapter2, section 5 of the Act on Measures against Money Laundering and Terrorist Financing (Swedish authorities etc.), the company shall still verify a customer s identity by: 13

14 a) Obtaining information regarding the customer s name, civic registration number or the equivalent as well as the address. b) Verifying the information against external registers, certificates, other documentation, or the equivalent. c) The company shall not verify the legal representative, beneficial owners and not required to send out a confirmation to the customer s registered office address. Legal Entity 1) Collect the customer s legal name, registered office address and company or registration number and record them on CDD portal. a) For those physically present, the company shall verify the identity of a customer that is a legal person by means of: i) a registration certificate, ii) corresponding authorising documents if the registration certificate has not been issued, or iii) make corresponding verification against external registers. b) The company shall also verify the identity of a representative of a legal person as per the policy of natural person physically present. c) For legal entity not physically present, the company shall also verify the customer s legal name, registered office address and company or registration number by using the registration certificate, corresponding authorising documents or equivalent verification against external registers and these must be uploaded to the CDD portal system to confirm we are dealing with the named person as per the procedure of natural person who is not physically present. d) For a representative of a legal person, the company shall collect the customer s name, civic registration number or (other ID number) and verify them against the legal person s registration certificate, external registers, identity documents or other equivalent documents. 2) Upload all the documents/copies relied on to the CDD portal. 3) Perform a PEP check in the Membercheck system and produce the report of the PEP screening of the entity and upload to the CDD portal system. 14

15 4) The company shall also verify all signatories and beneficial owners who holds more than 25% of the total number of shares. Evidence of legal person ownership and control is required for this and must be uploaded into the CDD portal system. 5) The nature of account and purpose of business relationship should be collected and reviewed. 6) The nature of business, products and service provided should be clear to the company. 7) The customer s constitutional documents should also be collected at this stage, to confirm that the ownership and control interests have been identified, generally consisting of: a) Companies/corporations: the constitution or memorandum and articles of association, operating agreement (for LLCs) and any shareholder agreement, as applicable. b) Limited Partnerships and Limited Liability Partnerships: the partnership agreement, and any other agreements or contracts documenting how the partnership business will be operated or how the partners will deal with the partnership business. c) Trusts: the trust deed, any letter of wishes, or the will in the case of a testamentary trust and probate documents if applicable d) Foundations: the foundation charter, and any letter of wishes or bylaws or similar. e) Any other entity: the constitutional document(s), and any operating documents. 8) Where the company will have a business relationship with a credit institution outside Europe Economic Area, the company must: a) gather enough information about the other party to understand fully the nature of their business; b) determine from publicly available information about the reputation of the other party and whether and to what extent the other party is supervised for AML/CFT purposes, including whether the other party has been subject to a money laundering or financing of terrorism investigation or regulatory action; and c) assess the other party s anti-money laundering and countering financing of terrorism controls to ascertain that those controls are adequate and effective (the policies should be checked to confirm that they prohibit direct and indirect services to shell banks); and d) have approval from the company board of directors before establishing a new correspondent banking relationship; and e) document the respective AML/CFT responsibilities of the correspondent and the respondent; and 15

16 f) be satisfied that, in respect of those of the other party s customers who have direct access to accounts of the company, the respondent a) has verified the identity of, and conducts ongoing monitoring in respect of, those customers; and b) is able to provide to the correspondent, on request, the documents, data, or information obtained when conducting the relevant customer due diligence and ongoing customer due diligence; and g) meet any other requirements prescribed by regulations and that apply to correspondent banking relationships. 9) For entities, the purpose or rationale for the structure should be checked for comprehensibility and acceptability. Entities established for financial, business, investment, estate planning, tax planning and/or asset protection reasons are acceptable provided that there is nothing in the application that indicates any unlawful activity or that the proffered reasons are unlikely to be the true reasons for establishing or using the structure. Although confidentiality is an acceptable purpose, care must be taken as to specifics of the situation and the background of the beneficial owner and/or any signatories to ensure that the purpose of the structure or its use is still lawful and acceptable. If the structure s purpose or rationale is not clear, the company must probe and clarify the background of the structure and the people behind the structure to determine whether it cannot be credibly and acceptably explained. If the structure s purpose or rationale cannot be credibly and acceptably explained, the application must be rejected for this reason. 10) For entities, by this point the beneficial ownership and control of the structure should be clear. If not this should be probed and clarified. If the company cannot understand the beneficial ownership and control of the structure the application must be rejected for this reason. 11) The company must do risk assessment for the entity and if the entity is on a high risk, the company must always perform enhanced customer due diligence and make a note regarding the decision on the CDD portal. 12) The company must record the following information on all beneficial owners, and on all signatories on CDD portal: a) Full legal name b) Date of birth c) The person s relationship(s) with the customer, 16

17 d) The person s address e) The person s nationality or citizenship, including all multiple citizenships. 13) The company needs to identify all individuals who are beneficial owners and signatories of the applicant. 14) The company only accepts individuals as signatories. Beneficial owners are those individuals who have more than 25% ownership interest in the structure, or who have effective control of the structure. 15) The company shall ensure that there is adequate evidence of the identities of all signatories and beneficial owners. This includes adequate evidence that all individuals who are beneficial owners have been named, and that all signatories are properly authorised by the customer to transact on its behalf. Identity documents must be certified by an acceptable certifier. One passport or national identity card (with photo) can be sufficient to verify a person s identity. Alternatively more than one form of identity document will be required out of the following: a) Driver licence (photographic) b) Firearms licence (photographic) c) Bank reference d) Bank statement e) Birth certificate f) Professional reference from an accountant or lawyer who has a professional relationship with the person for more than 2 years and who is contactable to verify and all these documents must be uploaded in CDD portal. 16) The company must ensure each person who is required to be identified as a customer, a signatory or a beneficial owner also has provided adequate evidence of address. Generally this should be the person s residential address, however a postal address proof can also be considered, however the rationale for the non-availability of the residential address should be considered carefully. The evidence of the address can be a utility bill, a residential tenancy agreement, property tax/rates notice or bill, evidence of title, bank reference, bank statement, driver licence, or any other acceptable evidence. 17

18 17) Verification of certificates or references is only required where there are additional indicators of business or AML risk, or as part of any research required into the customer s background or proposed business activities. 18) If there is a need of additional verification, the documents of verification must be collected and attached in CDD Portal. 19) Any verification of certifiers and referees needs to meet these standards: a) The identity and standing of the certifier or referee should be confirmed from independent sources. e.g. professional organisation membership list, regulatory licensee list, etc. b) The contact details of the certifier or referee should be obtained from public sources. e.g. white pages, yellow pages to ensure that the person being contacted is the professional or certifier listed. c) The certifier or referee should be contacted by telephone or and requested to confirm the authenticity of the reference given. 20) The following points should be used to determine which individuals are the beneficial owners of the customer, if any a) Ownership interests: i. Companies/corporations: Any individual who singly holds more than 25% of the ordinary shares or membership interest in the company or corporation ii. Partnerships: any individual who singly holds more than 25% of the capital interests in the partnership, or more than 25% of the profit interests in the partnership iii. Trusts: any individual who has a vested interest in more than 25% of the net assets of the trust iv. Foundations: any individual with a vested interest in more than 25% of the net assets of the foundation v. Any other entity: any individual with a legal or equitable right to more than 25% of profits, capital or distributions. b) Control interests: i. Companies/corporations: any individual who is sole director, sole managing member, or who holds more than half of the voting interests in the company or corporation, or who holds the right to appoint more than half of the company s or corporation s directors or managers, or who holds a General Power of Attorney to act for and bind the company or corporation. 18

19 ii. Partnerships: any individual who is the General Partner, or controls a general partner and any individual who holds a General Power of Attorney to act for and bind the partnership. iii. Trusts: any individual who is sole trustee, or is sole managing trustee, or any individual who controls such a trustee. Any individual who holds a General Power of Attorney to act for and bind the Trustee(s) in respect of the trust. Any individual who, under the terms of the trust, has the power to revoke the trust as the settlor of the trust. Any individual who has so many rights or powers under the terms of the trust, e.g. protector, powers to replacement of trustees, powers to determine the investment or operating policies of the trust etc. so as to give that individual effective control over the trust. iv. Foundations: any individual who is sole councillor of the foundation, or who is the managing councillor of the foundation, or holds a General Power of Attorney to act for and bind the foundation. Any individual who, under the foundation charter, has so many rights as protector, replacement of members of the council, or to control investment or operating policies etc. so as to give that person effective control over the foundation. v. All entity types: any other means by which an individual has effective control over the entity. vi. Note: For the purpose of measuring control interests, interests held by any individual in his personal capacity must be aggregated with the same individual s interests held by any trustee or nominee that he is a beneficial owner of, and any other entity of which he is a beneficial owner, e.g. Corporate directors/trustees/general partners. 21) Where the customer is a: a) Trust with more than 10 beneficiaries, or is a discretionary trust, the following information must be obtained: a description of each type or class of beneficiary. Although this information does not need to be verified, the company should already have the trust deed, will, court order or other instrument governing the trust which will provide this information and verify it. b) Charitable trust, the following information must be obtained: the objects of the trust c) Any other trust, the names and dates of birth must be obtained (but need not be identified or verified unless those persons are beneficial owners) 22) Review the customer s proposed business or investment activity. Identify any areas of sensitivity, e.g. cash-intensive business, high risk countries, high risk industries etc. Ensure that the proposed 19

20 business, as represented by the customer, and together with any other information obtained during the assessment, is lawful and acceptable to the company. 23) Review the proposed transactional banking needs as represented by the customer. Assess if the customer is likely to use the company s service for funds or transactions of third parties. If these transactions are likely, review whether these parties can be identified. Assess additional information requirements or acceptability of these transactions as applicable. 24) Submit the application data profile and supporting documents to Financial Operations Limited who will check the documents for adequacy and compliance with policy, and will provide the PEP/sanctions etc. screening service and return any matches or likely matches to the Money laundering reporting officer for review and decision. 25) Review the proposed countries the customer has connections with against the list of unacceptable countries. 26) Determine whether source of funds or source of wealth enhanced customer due diligence is required, and if so, obtain source of funds or source of wealth information and supporting evidence. This is required where: a) The customer is a trust or another vehicle for holding personal assets. b) The customer is a company with nominee shareholders or shares in bearer form. c) The customer is not resident in Sweden and comes from a country that has insufficient anti-money laundering and countering financing of terrorism systems or measures in place. d) risks of money laundering and terrorist financing that may arise from products or transactions that favour anonymity, e) when a business relationship is established or an individual transaction is carried out with someone at a distance, f) when a business relationship is established or an individual transaction is carried out with politically exposed person who is resident abroad, g) for relationship with a credit institution with a residence outside the European Economic Area, h) if the nationalities of the beneficial owners and/or signatories, the countries these people reside in, the location of the customer s business, the industry or business of the customer. 20

21 i) Also, where the Member check result shows adverse background on the customer or any beneficial owners or signatories or associated parties, enhanced customer due diligence is likely to be warranted. 27) Determine if the customer is a financial institution. A financial institution means a person who, in the ordinary course of business, carries on 1 or more of the following financial activities: a) accepting deposits or other repayable funds from the public: b) lending to or for a customer, including consumer credit, mortgage credit, factoring (with or without recourse), and financing of commercial transactions (including forfeiting): c) financial leasing (excluding financial leasing arrangements in relation to consumer products): d) transferring money or value for, or on behalf of, a customer: e) issuing or managing the means of payment (for example, credit or debit cards, cheques, traveller s cheques, money orders, bankers drafts, or electronic money): f) undertaking financial guarantees and commitments: g) trading for the person's own account or for the accounts of customers in any of the following: a) money market instruments (for example, cheques, bills, certificates of deposit, or derivatives): b) foreign exchange: c) exchange, interest rate, or index instruments: d) transferable securities: e) commodity futures trading: h) participating in securities issues and the provision of financial services related to those issues: i) managing individual or collective portfolios: j) safe keeping or administering of cash or liquid securities on behalf of other persons: k) investing, administering, or managing funds or money on behalf of other persons: l) issuing, or undertaking liability under, life insurance policies as an insurer: m) money or currency changing 28) Any financial institution customers and their signatories and beneficial owners and senior management require a more thorough background check. Generally this will include bank and professional references, and may also use credit history checks and criminal records checks, reviews of resumes, and other forms of checking. 21

22 29) Notwithstanding the provision contained in section 5, Chapter2 of the Act on Measures against Money Laundering and Terrorist Financing, 2009, the company shall always perform enhanced customer due diligence measures if there is a high risk of money laundering and terrorist financing. Special attention needs to be paid to the risks of money laundering and terrorist financing that may arise from products or transactions that might favour anonymity. 30) Assess the application as a whole. If there is enough information to accept the customer and the customer is acceptable, accept the customer and open the account(s). If there is indications of higher risk, or if the information provided is inadequate to assess the risk level and to meet legal requirements, advise the customer that more information is required and make a list of all information and evidence likely to be required to assess the application. 31) Assess whether any of the documents or certifiers or referees should be contacted to authenticate the certificates or references given, or to gather more information into the background of the customer and the customer s proposed business or investment activity. 32) When adequate information is received to make a decision on the application, make a decision and communicate this to the customer and ensure that the assessment and basis for the decision, and the supporting documents are properly recorded and filed. 33) For new accounts opened, assign the customer to an expected account turnover band to allow ongoing monitoring of transaction levels. 34) The company must not establish business relationship or perform individual transaction if the customer due diligence has not been satisfactorily completed. If the business relationship has already established, it has to be ended. 35) If the circumstances are such that money laundering or terrorist financing may be suspected, the party engaged in activities shall provide information under Chaper3, section 1 of the Act on the Measures against Money Laundering and Terrorist Financing, ) The company shall apply provisions on customer due diligence and record keeping for its branches and majority owned subsidiaries with a place of residence outside the European Economic Area, unless the laws of the country of residence do not prevent this and the company shall take measures to effectively handle the risk of money laundering and terrorist financing if the provisions cannot be applied and shall notify Finansinspektionen (Financial Supervisory Authority) in writing. 22

23 Legal person in exemptions Where the provisions governing basic measures for customer due diligence do not need to be applied asper Chapter2, section 5 of the Act on Measures against Money Laundering and Terrorist Financing, 2009 the company shall still verify a customer s identity in an appropriate manner. The company shall also verify the identity of a representative of a legal person as per procedure of a natural person who is physically present. a) The company shall verify the information against the legal person s registration certificates, external registers, and identity documents for the representative card pursuant to section2, Chapter 4 of Finansinspektionen s Regulatory Code, 2009 or the other equivalent and reliable document. b) The company shall maintain the record of all the documents of verification in the CDD portal along with PEP screening report. Control The Money laundering reporting officer is responsible for assessing new customer applications and documenting and filing the assessments, and opening the accounts. Financial Operations Limited is responsible for checking document adequacy and compliance with policy and running PEP/sanction etc. screening. The assessment and supporting documents are uploaded to the customer profile in the CDD system that holds the CDD information and records. Exemptions from the provisions on basic measures for customer due diligence Policy The provisions on basic customer due diligence and on the ongoing follow-up of business relationships contained in Sections 3, 4 and 10 do not apply to: 1) Swedish Authorities. 2) the company as referred to in Chapter 1, Section 2, items 1 to 7 and that have a place of residence: 23

24 a) within the EEA, b) in a state outside the EEA if the state has provisions on measures against money laundering corresponding to those prescribed by Directive 2005/60/EC of the European Parliament and of the Council of 26 October 2005 on the prevention of the use of the financial system for the purpose of money laundering and terrorist financing4 and provided that there is supervision of compliance with these provisions, 3) undertakings within the EEA whose transferable securities have been admitted to trading on a regulated market in the sense referred to in Directive 2004/39/EC of the European Parliament and of the Council of 21 April 2004 on markets in financial instruments5 amending Council Directives 85/611/EEC and 93/6/EEC and Directive 2000/12/EC of the European Parliament and of the Council and repealing Council Directive 93/22/EEC, o 4) undertakings outside the EEA whose transferable securities have been SFS 2009:62 admitted to corresponding trading and are subject to disclosure requirements corresponding to undertakings under item 3, 5) life insurance policies if the annual premium amounts to a sum corresponding to no more than EUR 1000 or the single premium amounts to a sum corresponding to no more than EUR 2 500, 6) insurance policies for pensions under Chapter 58, Sections 4 to 16 of the Income Tax Act (1999:1229) that may not be surrendered, 7) pension agreements and pension entitlements for employees or in the insured's activities, provided contributions are made by way of deduction from wages and the assignment of rights is not permitted, 8) electronic money under the Electronic Money Act (2011:755), a) if the monetary value that can be stored on electronic media that cannot be loaded amounts to no more than EUR 150, or b) b) as regards electronic media that can be loaded, the monetary value that is turned over during a calendar year cannot exceed EUR and no more than EUR can be withdrawn in cash during the same period, or 9) as regards the beneficial owner behind joint accounts administered by advocates or other independent legal professionals who have a place of residence: 24

25 a) within the EEA, provided information about the beneficial owner's identity can be made available at the request of the party engaged in activities, or b) in a state outside the EEA, provided information about the beneficial owner's identity can be made available at the request of the party engaged in activities and the advocate or independent legal professional is subject to obligations corresponding to those prescribed by Directive 2005/60/EC of the European Parliament and of the Council of 26 October 2005 on the prevention of the use of the financial system for the purpose of money laundering and terrorist financing6 and provided that there is supervision of compliance with these provisions. Procedure The company need not to do the basic customer due diligence and ongoing follow- up of business relationship with: 1) Swedish Authorities. 2) the company as referred to in Chapter 1, Section 2, items 1 to 7 and that have a place of residence: a) within the EEA, b) in a state outside the EEA if the state has provisions on measures against money laundering corresponding to those prescribed by Directive 2005/60/EC of the European Parliament and of the Council of 26 October 2005 on the prevention of the use of the financial system for the purpose of money laundering and terrorist financing4 and provided that there is supervision of compliance with these provisions, 3) undertakings within the EEA whose transferable securities have been admitted to trading on a regulated market in the sense referred to in Directive 2004/39/EC of the European Parliament and of the Council of 21 April 2004 on markets in financial instruments5 amending Council Directives 85/611/EEC and 93/6/EEC and Directive 2000/12/EC of the European Parliament and of the Council and repealing Council Directive 93/22/EEC, o 4) undertakings outside the EEA whose transferable securities have been SFS 2009:62 admitted to corresponding trading and are subject to disclosure requirements corresponding to undertakings under item 3, 25

26 5) life insurance policies if the annual premium amounts to a sum corresponding to no more than EUR 1000 or the single premium amounts to a sum corresponding to no more than EUR 2 500, 6) insurance policies for pensions under Chapter 58, Sections 4 to 16 of the Income Tax Act (1999:1229) that may not be surrendered, 7) pension agreements and pension entitlements for employees or in the insured's activities, provided contributions are made by way of deduction from wages and the assignment of rights is not permitted, 8) electronic money under the Electronic Money Act (2011:755), a) if the monetary value that can be stored on electronic media that cannot be loaded amounts to no more than EUR 150, or b) b) as regards electronic media that can be loaded, the monetary value that is turned over during a calendar year cannot exceed EUR and no more than EUR can be withdrawn in cash during the same period, or 9) as regards the beneficial owner behind joint accounts administered by advocates or other independent legal professionals who have a place of residence: a) within the EEA, provided information about the beneficial owner's identity can be made available at the request of the party engaged in activities, or b) in a state outside the EEA, provided information about the beneficial owner's identity can be made available at the request of the party engaged in activities and the advocate or independent legal professional is subject to obligations corresponding to those prescribed by Directive 2005/60/EC of the European Parliament and of the Council of 26 October 2005 on the prevention of the use of the financial system for the purpose of money laundering and terrorist financing6 and provided that there is supervision of compliance with these provisions. Control The Money Laundering Reporting Officer and the senior management are responsible to decide on the provisions on the basic customer due diligence and ongoing follow-up of business relationship. 26