AML/CFT and Financial Inclusion in SADC

Transcription

1 AML/CFT and Financial Inclusion in SADC Consideration of Anti-Money Laundering and Combating the Financing of Terrorism Legislation in Various Southern African Development Community (SADC) countries South African Country Report Finalised by: Compliance & Risk Resources March 2015

2 Contents SOUTH AFRICA COUNTRY REPORT Changes to the Legal and Regulatory Framework Post August Table 1: South Africa: Legislation, Regulation Guidelines (Post FATF-ESAAMLG Evaluation) Current AML/CFT Legislation and Regulation in Force in South Africa... 7 Table 2: The AML/CFT Regulatory Landscape in South Africa as of June South Africa s Approach to Recommendation 10: Customer Due Diligence (CDD) When is CDD required in South Africa? Identification measures and verification sources Table 3: Identification and Verification Requirements for Natural Persons Set Out in the MLTFCR Timing of verification of identity Risk-based approach to CDD: Simplified Measures and Exemptions Diagram 1: Example of a Risk Matrix Table 4: Suggested Additional Weightings Exemption Diagram 2: Exemption Banks Act Circular 6/2006 on Cell Phone Banking Diagram 3: The Scope of Circular Prepaid Low Value Product Dispensation South Africa s Approach to Recommendation 11: Record Keeping South Africa s Approach to Recommendation 13: Correspondent Banking South Africa s Approach to Recommendation 14: Money Transfer Services South Africa s Approach to Recommendation 15: New Technologies South Africa s Approach to Recommendation 16: Wire Transfers South Africa s Approach to Recommendation 17: Reliance on Third Parties South Africa s Approach to Recommendation 18: Internal Controls South Africa s Approach to Recommendation 20: Suspicious Transaction Reports (STRs) Diagram 5: Content of Guidance Note 4 on Suspicious Transaction Reporting Table 6: Indicators of Suspicious and Unusual Transactions South Africa s Approach to Recommendation 34: Guidance and Feedback High Level Recommendations for South Africa Table 7: High Level Recommendations for South Africa... 34

3 SOUTH AFRICA COUNTRY REPORT FinMark Trust, an independent trust based in Johannesburg, South Africa, was established in 2002, and is funded primarily by UKaid from the Department for International Development (DFID) through its Southern Africa office. FinMark Trust s purpose is Making financial markets work for the poor, by promoting financial inclusion and regional financial integration as well as institutional and organisational development, in order to increase access to financial services for the un-served and under-served. While the underlying focus of this report is on the harmonisation and calibration of provisions found in Anti-Money Laundering (AML) and Countering the Financing of Terrorism (CFT) laws and regulations in the Southern African Development Community (SADC), it is hoped that the country reports will become living documents that will be used as a resource for SADC Member States to make appropriate amendments to their domestic laws and regulations, define the strategic direction to achieve the objectives of Annex 12 of the FIP and prompt further research and other initiatives that will support State Parties in fulfilling their harmonisation objectives. FinMark Trust commissioned Compliance & Risk Resources to conduct the final review of the report and to circulate the report to country stakeholders in order to obtain support and facilitate finalisation. The initial research that informed this country report was conducted and prepared by Sarah Langhan and Associates. Raadhika Sihin assisted in reviewing and editing the initial research and country report. She was assisted by a panel of technical experts comprising of Ben Musuku (World Bank), Tom Malikebu (ESAAMLG) and Prof Louis de Koker (Deakin University, School of Law, Faculty of Business and Law) who reviewed and provided guidance on the content for the initial edited research report. The authors are grateful for the level of cooperation and assistance provided by all persons consulted during the research phase of the project. We especially acknowledge the willingness of those who made themselves available, often at very short notice, in all participating countries to answer questions, provide numerous documents and generally provide the information that was requested. In this regard, we acknowledge and thank all those who assisted.

4 1. Changes to the Legal and Regulatory Framework Post August 2008 South Africa was evaluated by a joint Financial Action Task Force - Eastern and Southern Africa 'Anti-Money' Laundering Group (FATF-ESAAMLG) evaluation team from the 4 th to the 15 th of August 2008, and the final report was adopted and published 6 months later in February Since August 2008, South Africa has passed the Prevention and Combating of Trafficking in Persons Act, , amended the Companies Act through the promulgation of the Companies Amendment Act, and issued Companies Regulations in Stakeholders have been invited to comment on the new Criminal Law (Sexual Offences and Related Matters) Amendment Bill, 2013 by the Portfolio Committee on Justice and Constitutional Development. 4 South Africa is widely considered to set the benchmark in the SADC region with respect to creating a special dispensation for financial inclusion in terms of the Financial Intelligence Centre Act, In an unprecedented move in 2010, South Africa issued a proven low risk dispensation for a prepaid instrument that meets strict criteria and conditions of usage. This was gazetted in Gazette on the 25 th June The aforementioned is discussed in detail in section of this report. The Money Laundering and Terrorist Financing Control Regulations, 2002 were amended in 2010 and published in Gazette No. R. 867 and in Gazette GN1107. Since August 2008, the Financial Intelligence Centre (FIC) has published two additional Guidance Notes, Guidance Note 5 (undated) and Guidance Note 3A. Guidance Note 5 provides guidance on section 28 of the Financial Intelligence Centre Act, 2001 and Guidance Note 3A, guidance for accountable institutions, on client identification and verification and related matters. The Guidance Notes are published by the FIC under section 4(c) of the Financial Intelligence Centre Act, 2001 to assist accountable institutions and the relevant supervisory bodies with the practical application of certain client identification and client verification requirements of the Financial Intelligence Centre Act, It must however be stressed that both Guidance Notes and documents included in the Public Compliance Communication series (PCC) are issued for information purposes only. In this regard, the FATF-ESAAMLG Mutual Evaluation Report states however that, the introduction of each Guidance Note states that, although they are authoritative, the Guidance Notes are intended for information purposes only. The Notes have been issued by a competent authority, in this case the Centre under the authority of the Financial Intelligence Centre Act, There is no specific range of sanctions associated with non-compliance, although the Banking Supervision Department (BSD) of the South African Reserve Bank (SARB) checks for compliance with these Notes and exercises its supervisory authority to request information. However, it is insufficient to consider any of the Guidance Notes to be legally enforceable. The Registrar of Banks has also indicated that the Circulars issued by the SARB are not considered to be legally enforceable. Nevertheless, the authorities advise that, in practice, the banks do comply with these instruments and the BSD checks for compliance with these Guidance Notes and exercises its supervisory authority to request information. On the 22 nd February 2010, the FIC launched the PCC series. The PCC series provides guidance under section 4(c) of the Financial Intelligence Centre Act, 2001, on the Centre s interpretation of the relevant legislation. This form of guidance has the same legal status as the guidance notes 1 See Joint Financial Action Task Force (FATF) - Eastern and Southern Africa Anti-Money Laundering Group (ESAAMLG) 2009 Mutual Evaluation Report Anti-Money Laundering and Combating the Financing of Terrorism: South Africa. 2 Act 7 of Act 3 of The closing date for submissions was the 26 th July Act 38 of In South Africa exemptions are always Gazetted.

5 issued by the FIC. 6 To date, 30 PCCs have been issued covering several important issues. Those particularly relevant to the financial inclusion agenda are: (PCC 02) which covers the period for record keeping of matters reported to the Financial Intelligence Centre (2010), (PCC 12) which deals with the outsourcing of compliance activities to third parties (2012), (PCC 14) client identification and verification requirements when a person acts on the authority of another (2012), (PCC 15) the acceptance of a Smart Card Identification Document issued by the Department of Home Affairs for client identification and verification purposes (2013) and (PCC 21) on the scope and application of Exemption 17 in terms of the Financial Intelligence Centre Act No. 38 of Table 1: South Africa: Legislation, Regulation Guidelines (Post FATF-ESAAMLG Evaluation) Year In-country Assessment August 2008 Adopted 2009 Legislation, Regulation and PCCs Enacted and Issued Post FATF-ESAAMLG Evaluation Prevention and Combating of Trafficking in Persons Act 7, 2013 Companies Amendment Act 3, 2011 Companies Regulations, 2011 Criminal Law (Sexual Offences and Related Matters) Amendment Bill, 2013 Gazette Financial Intelligence Centre Act (38/2001): Exemptions in terms of the Act (Prepaid Products), 25 June 2010 Gazette No. R. 867 Financial Intelligence Centre Act (38/2001): Amendment of Money Laundering and Terrorist Financing Control Regulations, 2010 Guidance Note 5: On section 28 of the Financial Intelligence Centre Act, Act 38 of 2001 (undated) to assist accountable institutions and reporting institutions meet their reporting obligations Guidance Note 3A: Guidance for accountable institutions on client identification and verification and related matters (2013) PCC 01 Establishment of the Public Compliance Communication Series (2010) PCC 02 Period for Record Keeping of Matters Reported to the Financial Intelligence Centre (22 February 2010) PCC 03 Identification and Verification Matters Relating to Account Opening Procedures for Asylum Seekers and Refugees in Terms of the Financial Intelligence Centre Act, (Act 38 of 2001) (28 May 2010) PCC 03A Reissued - Supplementary Information Applicable to PCC 03 (2012) PCC 04 Obligations Arising from the Financial Intelligence Centre Act Pertaining to the Voluntary Disclosure programme (2 November 2010) PCC 05 Registration of Accountable and reporting Institutions with the Financial Intelligence Centre (9 December 2010) PCC 06 Clarity on Item 2 of Schedule 1 of the Financial Intelligence Centre Act, 2001 (23 March 2011) PCC 07 Definition of a Motor Vehicle Dealer for the Purpose of Schedule 3 of the Financial Intelligence Centre Act, 2001 (2 September 2011) PCC 08 Duties of Estate Agents Including Provisions of Exemption 11 in terms of the Financial Intelligence Centre Act, Act 38 of 2001 (18 November 2011) PCC 09 Identification and Verification of Loyalty Programme Members in the Casino Industry in terms of the Financial Intelligence Centre Act, 2001 (2011) PCC 10 The Client of an Estate Agent (18 November 2011) 6 See FIC Press Release Available at:

6 PCC 11 The Closing of a Client's Account by an Accountable Institution Amounts to a Transaction in terms of the Financial Intelligence Centre Act No. 38 of 2001, (10 January 2012) PCC 12 Outsourcing of Compliance Activities to Third Parties (25 January 2012) PCC 13 Scope of Item 12 of Schedule 1 to the Financial Intelligence Centre Act, No. 38 of 2001, in Relation to Registered Auditors (25 January 2012) PCC 14 Client Identification and Verification Requirements when a Person Acts on the Authority of Another (25 January 2012) PCC 15 The Acceptance of a Smart Card Identification Document Issued by the Department of Home Affairs for Client Identification and Verification Purposes (22 January 2013) PCC 16 Interpretation of the Term "readily Available" for the Purpose of Cash Threshold Reporting in Terms of Section 28 of the Financial Intelligence Centre Act, 2001, (12 March 2013) PCC 17 Definition of Kruger Rand Dealer for the Purpose of Schedule 3 to the Financial Intelligence Centre Act, (13 March 2013) PCC 18 Training and Appointment of a Compliance Officer by Accountable Institutions in terms of Section 43 of the Financial Intelligence Centre Act 38 of 2001 (28 March 2013) PCC 19 Formulation and Implementation of Internal Rules for Different Accountable Institutions within a Complex Group Structure (28 March 2013) PCC 20 Client Identification and Verification for Non-Face-to-Face Online Betting Clients (28 March 2013) PCC 21 On the Scope and Application of Exemption 17 in Terms of the Financial Intelligence Centre Act No. 38 of 2001 (28 March 2013) PCC 22 Client Identification and Verification Requirements in Relation to International or Foreign Privacy and Data Protection Laws (27 August 2013) PCC 23 The Scope and Meaning of Item 11 of Schedule 1 to the Financial Intelligence Centre Act 38 of 2001 (12 September 2013) PCC 24 Verification Requirements of South African Companies and Close Corporations in terms of the Financial Intelligence Centre Act No 38 of 2001 (12 September 2013) PCC 25 Scope of Item 12 of Schedule 1 to the Financial Intelligence Centre Act No 38 of 2001 (13 February 2014) PCC 26 Single Client View (13 February 2014) PCC 27 Status of Expired Documents Relating to Client Identification and Verification Requirements for Asylum Seekers and Refugees in terms of the Financial Intelligence Centre Act 38 of 2001 (19 March 2014) PCC28 Terrorist Property Reporting Obligations for Financial Institutions in terms of the Financial Intelligence Centre Act 38 of 2001 (27 March 2014) PCC 29 Application and use of Exemption 4 of the FIC Act (18 July 2014) PCC 30 Customer identification and verification of casino junket agents and their underlying clients in terms of the FIC Act (28 November 2014)

7 2. Current AML/CFT Legislation and Regulation in Force in South Africa Table 2 below provides a schematic representation of the current laws, regulations, exemptions, guidelines and guidance notes in force in South Africa as of June The legislation is broken up into primary legislation (having a direct bearing on AML/CFT), additional relevant legislation (this covers laws and regulations that impact upon the AML/CFT legal and regulatory framework), laws and regulations applicable to banks, non-bank financial institutions (NBFIs), designated nonfinancial businesses or professions (DNFBPs) and non-profit organisations. The primary pieces of AML legislation in force in South Africa are the Financial Intelligence Centre Act, and the Prevention of Organised Crime Act, The Financial Intelligence Centre (FIC) is currently working on an Amendment Act to bring the Financial Intelligence Centre Act, in line with the revised Financial Action Task Force (FATF) Recommendations (2012). A separate Act, the Protection of Constitutional Democracy Against Terrorist and Related Activities Act specifically provides for measures to prevent and combat terrorist and related activities. The Money Laundering and Terrorist Financing Control Regulations (MLTFCR), 2002 are comprehensive and contain the following chapters: Chapter 1: establishment and verification of identity (regulations 2 to 19); Chapter 2: record keeping (regulation 20); Chapter 3: client profile (regulation 21); Chapter 4: reporting of suspicious and unusual transactions (regulations 22 to 24); Chapter 5: internal rules (regulations 25 to 27, including 27A, 27B & 27C); and Chapter 6: miscellaneous (regulations 28 to 30). These regulations have been amended twice in 2005 and 2010 respectively. Table 2: The AML/CFT Regulatory Landscape in South Africa as of June 2014 Core Acts Financial Intelligence Centre Act 38 of 2001 Issued Under the Act Gazette 7541 No R 1595 Regulation in Terms of the Financial Intelligence Centre Act, 2001 (Money Laundering and Terrorist Financing Control Regulations, 2002) Gazette No. R 456 Amendment of Money Laundering Control Regulations, 2005 Gazette No. 867 Financial Intelligence Centre Act (38/2001): Amendment of Money Laundering and Terrorist Financing Control Regulations, 2010 Gazette R Exemption in Terms of the Financial Intelligence Centre Act 2001 (2004) Exemption 17 Gazette Financial Intelligence Centre Act (38/2001): Exemptions in terms of the Act, 2004 Gazette Exemption in terms of s74 Financial Intelligence Centre Act 2001 (2004)(Exemption for Management Companies of Collective Investment Schemes from s21(2) of the Act) Gazette No. 560 Financial 7 Act 38 of 2001 as amended by the Financial Intelligence Centre Amendment Act 11 of Act 121 of Act 38 of Act 33 of 2004.

8 Prevention of Organised Crime Act 121 of 1998 Protection of Constitutional Democracy Against Terrorist and Related Activities Act 33 of 2004 Intelligence Act (38/2011) Exemptions in Terms of the Act (2010) Prepaid Instruments Banks Act Circular 6/2006 Cell Phone Banking (issued under the Banks Act and renamed in 2008 as a guidance note) Guidance Note 1: General Guidance Note Concerning Identification of Clients (Undated) Guidance Note 2: Guidance to Financial Services Industries Regulated by the Financial Services Board Concerning the Meaning of the Word Transaction (2004) Guidance Note 3: Guidance for Banks on Customer Identification and Verification and Related Matters (2005) Guidance Note 3A: Guidance for Accountable Institutions on Client Identification and Verification and Related Matters (2013) Guidance Note 4: Suspicious Transaction Reporting (2008) Guidance Note 5: On Section 28 of the Financial Intelligence Centre Act 38 of 2001 (Undated) PCC Series (PCC01 to PCC30) Gazette Proclamation R. 51 (2006) Gazette Proclamation R.14 (2006) Gazette Proclamation R.13 (2006) Additional Relevant Legislation Prevention and Combating of Corrupt Activities Act 12 of 2004 Criminal Procedure Act 51 of 1977 South African Police Services Act 68 of 1995 Prevention and Combating of Trafficking in Persons Act 7 of 2013 Criminal Law (Sexual Offences and Related Matters Amendment Act 32 of 2007 Currency and Exchanges Act 9 of 1933 Exchange Control Regulations, 1961 Customs and Excise Act 91 of 1964 Companies Act 71 of 2008 Companies Regulations, 2011 Non-Proliferation of Weapons of Mass Destruction 87 of 1993 International Cooperation in Criminal Matters Act 75 of 1996 Extradition Act 67 of 1962 Legislation Applicable to Banks South African Reserve Bank Act. 90 of 1989 Regulation 808 South African Reserve Bank Act 90 of 1989: Regulations relating to the South African Reserve Bank. 13 September 2010 Banks Act, 94 of 1990 Banks Amendment Bill, 2012 Basel III Regulations: Government Gazette No , published 12 December 2012

9 Conditions for the Conducting of the Business of a Bank by a Foreign Institution by Means of a Branch in the Republic. No Regulations Relating to Representative Offices of Foreign Banking Institutions. Government Gazette No Financial Markets Act 90 of 2012 National Payments System Act78 of 1998 Directive No. 1 of 2007: Directive for conduct within the National Payment System in Respect to Payments to Third Persons Directive No. 2 of 2006: Directive for Conduct within the National Payment System: In Respect of Banks Involved in the Collection of Payment Instructions in the Early Debit Order (EDO) Payment Clearing Houses (PCHs) Directive No. 2 of 2007: Directive for Conduct with in the National Payment System in Respect of System Operators Legislation Applicable to NBFI s Short-Term Insurance Act 53 of 1998 Long-Term Insurance Act 52 of 1998 Financial Advisory and Intermediary Services Act 37 of 2002 Collective Investment Schemes Control Act 45 of 2002 Securities Services Act 36 of 2004 Pension Funds Act 24 of 1956 Legislation Applicable to DNFBPs and NPO s Casinos National Gambling Act 7 of 2004 Lawyers Attorneys Act 53 of 1979 Precious Metals and Stones Dealers Diamonds Act 56 of 1986 Precious Metals Act 37 of 2005 Estate Agents Estate Agency Affairs Act, 1976 NPO s Non-Profit Organisations Act 71 of 1997 Precious Metals Regulations The South African regulatory authorities have recognised the need to make changes to the Financial Intelligence Centre Act 38, 2001, and related legislation to move towards the implementation of a full AML/CFT risk-based approach, as envisaged in the FATF Recommendations. It is noted that this could represent a fundamental change to the applicable regulatory and supervisory framework, and this report would need to be revised once this has been completed.

10 3. South Africa s Approach to Recommendation 10: Customer Due Diligence (CDD) CDD requirements are set out in section 21 of the Financial Intelligence Centre Act, and detailed in Regulations 2 to 19 of the Money Laundering and Terrorist Financing Control Regulations The following Guidance Notes specifically relate to the identification and verification of clients (issued by the Financial Intelligence Centre (FIC)) - Guidance Note 1: General Guidance Note Concerning Identification of Clients (undated); Guidance Note 3A: Guidance for accountable institutions on client identification and verification and related matters. In addition, six PCCs in the Public Compliance Communication (PCC) series specifically cover CDD measures and related requirements. These are: (PCC 03) Identification and Verification Matters Relating to Account Opening Procedures for Asylum Seekers and Refugees; (PCC 12) - Outsourcing of Compliance Activities to Third Parties (2012); (PCC 14) - Client Identification and Verification Requirements when a Person Acts on the Authority of Another (2012); (PCC 15) - The Acceptance of a Smart Card Identification Document Issued by the Department of Home Affairs for Client Identification and Verification Purposes (2013); and (PCC 21) - On the Scope and Application of Exemption 17 in Terms of the Financial Intelligence Centre Act No. 38 of 2001 (2013). 3.1 When is CDD required in South Africa? Section 21(1) of the Financial Intelligence Centre Act, 2001 prohibits accountable institutions from establishing a business relationship or concluding a single transaction with a client unless the accountable institution has taken the prescribed steps to: 12 Establish and verify the identity of the client; 13 If the client is acting on behalf of another person, to establish and verify the identity of that other person and the client's authority to establish the business relationship or to conclude the single transaction on behalf of that other person; 14 and If another person is acting on behalf of the client, to establish and verify (i) the identity of that other person; and (ii) that other person's authority to act on behalf of the client Act 38 of Schedule I of the FICA contains a list of accountable institutions which includes banks, non-bank financial institutions and designated non-financial businesses and professions. These are: attorneys, a board of executors or a trust company or any other person that invests, keeps in safe custody, controls or administers trust property, estate agents, financial instrument traders, management companies, banks, mutual banks long-term insurers, persons who carry on a business in respect of which a gambling licence is required to be issued by a provincial licensing authority foreign exchange dealers, money lenders that carry on the business of lending money against the security of securities, investment advisers or investment brokers services, public accountants, persons who issue, sell or redeem travellers' cheques, money orders or similar instruments, the Postbank, members of a stock exchange, the Ithala Development Finance Corporation Limited, persons who has been approved or who fall within a category of persons approved by the Registrar of Stock Exchanges, persons who has been approved or who fall within a category of persons approved by the Registrar of Financial Markets and money remitters. 13 Section 21(1)(a) of Act 38 of Section 21(1)(b)(i) and (ii).

11 Section 21(2) of the Financial Intelligence Centre Act, 2001 requires accountable institutions that had an already established business relationship with a client before the Act took effect not to conclude a transaction in the course of the business relationship, unless the accountable institution has taken the prescribed steps to: Establish and verify the identity of the client; 16 If another person acted on behalf of the client in establishing the business relationship, to establish and verify the identity of that other person and that other person's authority to act on behalf of the client; 17 If the client acted on behalf of another person in establishing the business relationship, to establish and verify the identity of that other person and the client's authority to act on behalf of that other person; 18 and Trace all accounts at the accountable institution which was involved in transactions concluded during the course of that business relationship. The wording of section 21 of the Financial Intelligence Centre Act, 2001 does not specifically address the carrying out of an occasional transaction above an applicable designated threshold (USD/EUR 15,000). This includes situations where the transaction is carried out in a single operation or several operations that appear to be linked, to carrying out occasional transactions that are wire transfers in the circumstances covered by Recommendation 16, where there is a suspicion of money laundering or terrorist financing, regardless of any thresholds or exemptions, or where financial institutions have doubts about the veracity or adequacy of previously obtained customer identification data. Regulation 2 of the Money Laundering and Terrorist Financing Control Regulations 2002 prohibits accountable institutions from knowingly establishing or maintaining a business relationship, or conducting a single transaction with a client who is entering into that business relationship or single transaction under a false name. 3.2 Identification measures and verification sources FATF Recommendation 10 requires financial institutions to identify the customer and verify the customer s identity using reliable, independent source documents, data or information; to identify the beneficial owner and take reasonable measures to verify the identity of the beneficial owner, understand and, as appropriate, obtain information on the purpose of the intended relationship; and to conduct ongoing due diligence on the business relationship and scrutinise transactions throughout the course of the relationship to monitor that they are consistent with the institution s knowledge of the customer, their business and risk profile, including, where necessary, the source of the funds. The requirements for natural persons (South African citizens and residents, and foreign nationals) are comprehensively dealt with in Regulations 3 to 6 of the Money Laundering and Terrorist Financing Control Regulations, 2002 and are set out in Table 3 below. The information requirements and verification sources for close corporations and South African companies are found in Regulations 7 and 8; information concerning foreign companies and verification of such information in Regulations 9 and 10; and information concerning other legal persons and the 15 Section 21(1)(c)(i) and (ii). 16 Section 21(2)(a). 17 Section 21(2)(b)(i) and (ii). 18 Section 21(2)(c)(i) and (ii).

12 verification of such in Regulations 11 and 12. Partnerships are covered in Regulations 13 and 14, and Trusts in Regulations 15 and 16. Table 3: Identification and Verification Requirements for Natural Persons Set Out in the MLTFCR Reg. Category Requirements 3 Information concerning South African citizens and residents An accountable institution must obtain from, or in respect of, a natural person who is a citizen of, or resident in, the Republic, that person's Full names [Regulation 3(1)(a)]; Date of birth [Regulation 3(1)(b)]; Identity number [Regulation 3(1)(c)]; Income tax registration number, if such a number has been issued to that person [Regulation 3(1)(d)]; and Residential address [Regulation 3(1)(e)]. In the case where the accountable institution is aware or ought to be reasonably aware that the person does not have the legal capacity to establish a business relationship or conclude a single transaction without the assistance of another person, the accountable institution must, in addition to obtaining the particulars of the person, obtain from, or in respect of, that other person His or her full names [Regulation 3(2)(a)]; His or her date of birth [Regulation 3(2)(b)]; His or her identity number [Regulation 3(2)(c)]; His or her residential address [Regulation 3(2)(d)]; and His or her contact particulars [Regulation 3(2)(e)]. Although Regulation 3(1)(d) of the South African Money Laundering and Terrorist Financing Control Regulations, 2002 requires an accountable institution to obtain from, or in respect of, a natural person who is a citizen of, or resident in, the Republic, that person's income tax registration number, if such a number has been issued to that person, Exemption 6(2) exempts all accountable institutions from doing so Verification of information concerning South- Verification of full names, date of birth and ID number An accountable institution must verify the full names, date of birth and identity number of a natural person by comparing these particulars with: 19 See de Koker L and Symington J 2011 Conservative Compliance Behaviour Drivers of Conservative Compliance Responses in the South African Financial Services Industry 17 where the authors state that, the regulations also require institutions to obtain the income tax number (if issued) of a customer, but, simultaneously with the release of this requirement, an exemption [Exemption 6(2)] was issued that exempted institutions from obtaining the tax number.

13 African citizens and residents An identification document of that person (Regulation 4(1)(a)(i)); 20 or In the case where that person is, for a reason that is acceptable to the institution, unable to produce an identification document, another document issued to that person, which, taking into account any guidance notes concerning the verification of identities which may apply to that institution, is acceptable to the institution and bears: o A photograph of that person [Regulation 4(1)(a)(ii)(aa)]; o That person's full names or initials and surname [Regulation 4(1)(a)(ii)(bb)]; o That person's date of birth [Regulation 4(1)(a)(ii)(cc)], and o That person s identity number [Regulation 4(1)(a)(ii)(dd)]; and Any of these particulars with information which is obtained from any other independent source, if it is believed to be reasonably necessary taking into account any guidance notes concerning the verification of identities which may apply to that institution [Regulation 4(1)(b)]. Verification of income tax registration number An accountable institution must verify the income tax registration number by comparing this number with a document issued by the South African Revenue Service bearing such a number and the name of the natural person [Regulation 4(2)]. 21 Verification of residential address An accountable institution must verify the residential address referred to by comparing these particulars with information which can reasonably be expected to achieve such verification and is obtained by reasonably practical means, taking into account any guidance notes concerning the verification of identities which may apply to that institution [regulation 4(3)]. 5 Information concerning foreign nationals An accountable institution must obtain from, or in respect of, a natural person who is a citizen of another country and is not resident in the Republic, that person's: 20 PCC 15 The Acceptance of a Smart Card Identification Document Issued by the Department of Home Affairs for Client Identification and Verification Purposes states that, identification smart cards issued by the DHA bear the same weighting as that of the typical green bar coded identification document issued by the DHA prior to the pilot project being launched, and can therefore be construed as an official identity document. As the identification smart card is in effect the new form of an official identity document an accountable institution may accept the DHA identification smart cards for the purposes of client identification and verification. 21 This requirement is however neutralised by Exemption 6(2).

14 Full names [Regulation 5(1)(a)]; Date of birth [Regulation 5(1)(b)]; Nationality [Regulation 5(1)(c)]; Passport number [Regulation 5(1)(d)]; South African income tax registration number, if such a number has been issued to that person [Regulation 5(1)(e)]; and Residential address [Regulation 5(1)(f)]. In the case where the accountable institution is aware or ought to be reasonably aware that the person does not have the legal capacity to establish a business relationship or conclude a single transaction without the assistance of another person the accountable institution must, in addition to obtaining the particulars from that person, obtain from, or in respect of, that other person His or her full names [Regulation 5(2)(a)]; His or her date of birth [Regulation 5(2)(b)]; His or her nationality [Regulation 5(2)(c)]; His or her passport number [Regulation 5(2)(d)]; His or her residential address [Regulation 5(2)(e)), and]his or her contact particulars [Regulation 5(2)(f)]. 6 Verification of information concerning foreign nationals Verification of identification An accountable institution must verify the particulars obtained, in terms of the Regulations, from or in respect of a natural person who is not a citizen of the Republic and not resident in the Republic, by comparing those particulars with an identification document of that person [Regulation 6(1)]. Verification of income tax registration number An accountable institution must verify the income tax registration number obtained from or in respect of a natural person who is not a citizen of the Republic and not resident in the Republic, by comparing those particulars with a document issued by the South African Revenue Service bearing such a number [Regulation 6(2)]. Verification of information An accountable institution must verify information which is obtained from any other independent source, if it is believed to be reasonably necessary, taking into account any guidance notes concerning the verification of identities which may apply to that institution [Regulation 6(2)(3)]. Paragraph 7 of Guidance Note 3: For Banks on Customer Identification and Verification and Related Matters clarifies that the address slip found in the ID documents issued by the Department of Home Affairs do not provide adequate proof of verification of residential address. Paragraph 11 lists examples of acceptable documents that can be used to verify the residential address of a natural person. These should be less than three months old and include: A utility bill reflecting the name and address of the person;

15 A bank statement from another bank reflecting the name and residential address of the person; A recent lease or rental agreement reflecting the name and residential address of the person; A municipal rates and taxes invoice reflecting the name and residential address of the person; A telephone or cellular account reflecting the name and address of the person; A valid television license reflecting the name and residential address of the person; and A recent long-term or short-term insurance policy document issued by an insurance company, and reflecting the name and residential address of the person. From a financial inclusion perspective, it is important to note that paragraph 11 of Guidance Note 3 states further that: If none of the above is available, banks may explore other means to verify a client s address such as an affidavit containing the following particulars from a person co-habiting with the client or an employer of the client: Name, residential address, identity number of the client and the deponent of the affidavit; Relationship between the client and the deponent of the affidavit; and Confirmation of the client s residential address. There is no explicit requirement in the Financial Intelligence Centre Act, 2001 for accountable institutions to conduct on-going due diligence on business relationships, although elements of such a requirement can be found in the MLTFC Regulations. 22 Regulation 19 of the Money Laundering and Terrorist Financing Control Regulations, 2002, requires accountable institutions - in respect of an existing business relationship - to maintain the correctness of particulars that are susceptible to change. Guidance Note 3 recommends that for the ongoing maintenance of client information, the following may be considered: Applying their know-your-customer (KYC) procedures to existing customers on the basis of materiality and risk, and conducting due diligence reviews of such existing relationships at appropriate times; Undertaking regular reviews of their existing customer records. An appropriate time to do so is when a transaction of significance takes place or when there is a material change in the way the account is operated; or If a bank were to become aware at any time that it lacked sufficient information about an existing customer, it would then take steps to ensure that all relevant KYC information is obtained as quickly as possible Timing of verification of identity Section 21 of the Financial Intelligence Centre Act, requires accountable institutions to establish and verify a customer s identity before establishing a business relationship. If the business relationship was established before the Act took effect, accountable institutions are instructed not to conclude a transaction in the course of the business relationship, unless the accountable 22 Joint Financial Action Task Force (FATF)-Eastern and Southern Africa Anti-Money Laundering Group (ESAAMLG) 2009 Mutual Evaluation Report Anti-Money Laundering and Combating the Financing of Terrorism: South Africa Paragraph 14 of Guidance Note Act 38 of 2001.

16 institution has taken the prescribed steps to identify and verify the identity of the customer as per the requirements set out in section 21(2) of the Financial Intelligence Centre Act, Neither the Financial Intelligence Centre Act, nor the Money Laundering and Terrorist Financing Control Regulations, 2002 make any reference to the FATF requirement whereby if a financial institution is unable to comply with the applicable CDD requirements, that it should be required to, amongst others, terminate the business relationship and consider making a suspicious transaction report in relation to the customer. The requirements specified in section 21(1) of the Financial Intelligence Centre Act, 2001, specify that an accountable institution may not establish a business relationship or conclude a single transaction with a client unless the accountable institution has taken the prescribed steps to establish and verify the identity of the client. This implies that an accountable institution should not be in a position where it has to terminate a business relationship due to the fact that a client s identity has not been established and verified. However, due diligence deficiencies may be recognised once a business relationship has been established, or changed circumstances relating to the client may mean that the initial due diligence is no longer adequate. 3.4 Risk-based approach to CDD: Simplified Measures and Exemptions The Financial Intelligence Centre Act, 2001 is purely a rules-based Act. It does not contain any direct provisions on the adoption of a risk-based approach. Like most jurisdictions in the SADC region, South Africa started with a rules-based approach and has slowly introduced the concept of a risk-based approach through regulations, exemptions, guidance notes and PCCs. The Money Laundering and Terrorist Financing Control Regulations, 2002 however, state several times that accountable institutions must verify certain particulars against information which can be reasonably expected to achieve such verification and is obtained by reasonably practical means, taking into account any guidance notes concerning the verification of identities which may apply. This means that in these specific instances, an institution must assess what information may be necessary in order to achieve verification of the particulars in question and the means by which it can be obtained. The institution must then exercise its judgment and decide what the appropriate balance is between the level of verification and the most practical means to obtain such verification. 27 Guidance Note 1 issued by the FIC in April 2004 implies that an accountable institution can make an informed decision on the basis of its risk assessment as to the appropriate methods and levels of verification that should be applied in a given circumstance. Guidance Note 1 further states that the assessment of these risk factors should best be done by means of a systematic approach to determine different risk classes and to identify criteria to characterise clients and products. In order to achieve this, an accountable institution would need to document and make use of a risk framework. Such a risk framework should preferably form part of the accountable institution s internal policies and procedures to address money laundering and terrorist financing. Diagram 1 25 Nevertheless, Exemption 2 allows some flexibility around the timing of verification. An accountable institution may accept a mandate (or take similar preparatory steps) from a prospective customer, with a view to establishing a business relationship or concluding a single transaction, before the customer s identity has been verified on condition that the accountable institution will have completed all necessary steps to verify the customer s identity before concluding a single transaction. However, there is no obligation to identify the beneficial owner before or during the course of establishing a business relationship or conducting transactions for occasional customers, (FATF-ESAAMLG, 2009). 26 Act 38 of FIC (2004) Guidance Note 1: General Guidance Note Concerning Identification of Clients.

17 below is reproduced directly from Guidance Note 1 and provides an example of a risk matrix applicable to banking services. Low risk classes score between 10 and 29, medium risk classes between 30 and 39 and high risk, 40 and higher. Diagram 1: Example of a Risk Matrix Country classification A: Members of FATF, except USA and UK B: Non-Members of FATF + USA and UK C: NCCT listed Risk classes 10-29: Low 30-39: Medium 40 and higher: High Table 4: Suggested Additional Weightings The Guidance Note also suggests that additional weightings be applied based on client attributes, the nature of the product, source of funds, client conduct and country classification. These suggested additional weightings are indicated in the table to the left. A client on the UN list would be given an additional weighing of +50, where as a client with whom the bank had had a 1 5 year relationship would be given an additional weighting of +15. Credit products with a term less than 6 months, and products that facilitate the cross-border movement of funds, should be given an additional weighting of +30 and +20 respectively. Unusual or suspicious client behavior is also given additional weighting. Examples of this behavior include an unusual concern for secrecy and a lack of concern for high risks or transaction costs. Guidance Note 3: Customer Identification and Verification and Related Matters applies to Banks, Mutual Banks, the Postbank and the Ithala Development Finance Corporation Limited. Guidance Note 3 provides guidance on the practical implementation of Guidance Note 1 in respect of applying

18 a risk-based approach. The note emphasises the fact that while banks are required to identify all their clients, they are not required to follow a one size fits all approach and need to differentiate between high risk, medium risk and low risk clients. This differentiation should be done on the basis of product type, business activity, client attributes, source of funds, jurisdiction of client, transaction value and type of entity. 28 Paragraph 4 of Guidance Note 3 specifically covers client profiling procedures for high risk clients and sets out a number of factors that may indicate that a business relationship or a single transaction poses a high risk of facilitating money laundering activities. Unfortunately, the Guidance Note does not set out any factors that may indicate that a business relationship or a single transaction poses a low risk and as such, should be subject to simplified CDD measures. Guidance Note 3A: Guidance for Accountable Institutions on Client Identification and Verification and Related Matters has recently been issued by the FIC. 29 This Guidance Note updates Guidance Note 3 and applies to all accountable institutions that are referred to in Schedule 1 of the Financial Intelligence Centre Act, , and not just to banks as was the case with Guidance Note 3. The CDD measures discussed in sections to above, in the most part, refer to the measures that must be taken with respect to standard customer relationships and transactions. The FATF however permits countries/accountable institutions, through the application of a risk based approach, to apply simplified measures where there is a lower risk of money laundering and terrorist financing. South Africa s approach to providing for proven low risk exemptions and the application of simplified CDD measures in lower risk scenarios has not been to amend the Financial Intelligence Centre Act, 2001 or the MLTFCR, but instead to issue a number of separately gazetted exemptions to sections of the Financial Intelligence Centre Act, Exemption 17 The most commonly referred to exemption is Exemption 17. Exemption 17 applies to Banks, Mutual Banks, the Postbank, the Ithala Development Finance Corporation and money remitters, but only in respect of domestic transactions. 31 These specified entities are exempted from: Obtaining from a natural person who is a citizen of or resident in South Africa, the persons income tax registration number [Regulation 3(1)(d)) and residential address 3(1)(e)]; Obtaining the residential address and contact particulars of a person assisting another person who does not have the legal capacity to establish a business relationship or conclude a single transaction [Regulation 3(2)(d) and 3(2)(e)]; Verifying the income tax registration number referred to in regulation 3 (1) (d) by comparing this number with a document issued by the South African Revenue Service bearing such a number and the name of the natural person [Regulation 4(2)]; Verifying the residential address referred to in regulation 3 (1) (e) or 3 (2) (d) by comparing these particulars with information which can reasonably be expected to achieve such verification and is obtained by reasonably practical means, taking into account any guidance 28 Paragraph 3, Guidance Note Issued by the Director Financial Intelligence Centre on the 28 th of March Act 38 of An amendment was made to Exemption 17 in This broadened the application of the Exemption to include money remitters in respect of remittances that originate and terminate in South Africa.

19 notes concerning the verification of identities which may apply to that institution. [Regulation 4(3)]; When establishing a business relationship or concluding a transaction with a client, whether the transaction is a single transaction or concluded in the course of a business relationship which that accountable institution has with the client, they need to keep record of- o The identity of the client; o If the client is acting on behalf of another person - The identity of the person on whose behalf the client is acting; and the client's authority to act on behalf of that other person; o If another person is acting on behalf of the client The identity of that other person; and that other person's authority to act on behalf of the client; o The manner in which the identity of the persons referred to in paragraphs (a), (b) and (c) [of section 22(1) of the FIC Act] was established; o The nature of that business relationship or transaction; o The name of the person who obtained the information referred to in paragraphs (a), (b) and (c) on behalf of the accountable institution; and o Any document or copy of a document obtained by the accountable institution in order to verify a person's identity in terms of section 21 (1) or (2) [Section 22(1)(a);(b)(i) and b(ii);(c)(i) and c(ii); (d);(e);(h) and (i)]. As depicted in Diagram 2 below, Exemption 17 applies to business relationships (accounts) and single transactions with strict transaction limits. Clients may only withdraw, transfer or make payments of an amount not exceeding R5, per day, may not exceed R25, in accumulated transactions during any particular month, and may not effect transfers of funds outside of South Africa. The balance maintained in that account may not exceed R25000,00 at any time, and clients may also not simultaneously hold two or more accounts which meet the criteria and which are similar in nature with the same accountable institution This was clarified in PCC No. 21 on the Scope and Application of Exemption 17 in terms of FICA.