ANTI MONEY LAUNDERING PROCEDURE

Transcription

1 2015 ANTI MONEY LAUNDERING PROCEDURE DFCC Vardhana Bank PLC DVB COMPLIANCE Original: April 2008 Updated: Sept 2011 Reviewed: Jan 2015

2 1 PROCEDURES FOR PREVENTION OF MONEY LAUNDERING & FINANCING OF TERRORISM Table of Contents 1. THE THREE STATUTES COVERED BY AML 2 2. FINANCIAL TRANSACTIONS REPORTING ACT (FTRA) NO.6 OF RESPONSIBILITY FOR IMPLEMENTATION OF FTRA OF THE MAJOR COMPONENTS OF THE FTRA NO.6 OF CUSTOMERS AML RISK PROFILE (PROFILE BUILDING) S 5 (B) OF THE FTRA RISK CATEGORIZATION OF ACCOUNTS (AML) S 5 (B) OF THE FTRA REPORT TRANSACTIONS TO FIU REPORTING SUSPICIOUS TRANSACTIONS IMPOSITION OF PENALTIES ON NON COMPLIANCE WITH FTRA EXAMPLES OF SUSPICIOUS TRANSACTIONS RECOGNIZING SUSPICIOUS TRANSACTIONS SUSPICIOUS SETTLEMENTS STR FORMAT EFFECTS OF NON-COMPLIANCE/VIOLATION OF ABOVE 3 ACTS PREVENTION OF MONEY LAUNDERING 24 (PMLA) ACT NO. 5 OF 2006 (CERTIFIED ON 6 TH MARCH 2006) CONVENTION ON THE SUPPRESSION OF TERRORIST FINANCING ACT (STFA) NO. 25 OF THE GAZETTE OF THE DEMOCRATIC SOCIALIST REPUBLIC OF SRI LANKA CUSTOMER ADDRESS VERIFICATION DOCUMENTS THE AUTOMATED ANTI MONEY LAUNDERING MONITORING SYSTEM 40

3 2 1. THE THREE STATUTES COVERED BY AML FINANCIAL TRANSACTIONS REPORTING ACT (FTRA) NO.6 OF 2006 (Certified on 6 th March 06) PREVENTION OF MONEY LAUNDERING ACT (PMLA) NO.5 OF 2006 (Certified on 6 th March 2006 ) CONVENTION ON THE SUPPRESSION OF TERRORIST FINANCING ACT (STFA) NO. 25 OF 2005

4 3 2. FINANCIAL TRANSACTIONS REPORTING ACT (FTRA) NO.6 OF 2006 (Certified on 6 th March 06) AN ACT TO PROVIDE FOR THE COLLECTION OF DATA RELATING TO SUSPICIOUS FINANCIAL TRANSACTIONS TO FACILITATE THE PREVENTION, DETECTION, INVESTIGATION AND PROSECUTION OF THE OFFENCES OF MONEY LAUNDERING AND THE FINANCING OF TERRORISM RESPECTIVELY; TO REQUIRE CERTAIN INSTITUTIONS TO UNDERTAKE DUE DILIGENCE MEASURES TO COMBAT MONEY LAUNDERING AND THE FINANCING OF TERRORISM; TO IDENTIFY THE AUTHORITY WHICH WILL BE RESPONSIBLE FOR MONITORING THE ACTIVITIES OF ALL INSTITUTIONS TO WHOM THIS ACT APPLIES; AND TO PROVIDE FOR MATTERS CONNECTED THEREWITH OR INCIDENTAL THERETO

5 4 3. RESPONSIBILITY FOR IMPLEMENTATION OF FTRA OF ) All staff members in relevant departments must ensure that they comply with Gazette notification dated 28 th March 2011 (Page 32 43) which is in accordance with Section 2 of the FTRA. This would also cover all banking operations, beginning with the opening of Bank accounts, to any other banking transactions including those carried out by non account holders in respect of over the counter transactions such as purchase of Travelers Cards, Refunds, issue of pay orders, Treasury Bill transactions, inward & outward remittances etc. Where address verification is required the guidance provided by dated 22 nd of May 2007 annexed below must be complied with by all members of staff. 2) All staff members in the relevant department when opening any type of account for a customer especially at the branch level are responsible for Risk Categorization of Accounts (AML) (page 12) and Profile Building (page 11) of the customer 3) As per FTRA Section 14 (1) a) Compliance Officer shall ensure the Banks compliance with the FTRA. 4) As per FTRA Section 14 (1) b (vi) HR department will be responsible to screen all employees before hiring them. This would also include obtaining a declaration that the prospective employee has neither committed nor has been convicted of any criminal or unlawful activity. 5) The Compliance Officer or delegated officer shall be responsible for making officers and employees of the Bank aware of the laws relating to Money Laundering & Financing of Terrorism.

6 5 4. THE MAJOR COMPONENTS OF THE FTRA NO.6 OF 2006 (Certified on 6 th March 06 Know Your Customer - Section 2 Maintenance of Records - S 4 Due Diligence and Scrutiny of Customers - S 5 (a) Customer Profile Building - S 5 (b) Customer Risk Categorization - S 5 (b) Report Transactions to FIU - S 6 Reporting Suspicious Transactions - S 7 & 8 Non Disclosure of Reporting to FIU - S 9 & 10 Staff Protection - S 12 (1) Compliance Officer, Screening of Employees and Internal Audit Function - S 14 Imposition of Penalties to Enforce Compliance with FTRA - S 19 Know Your Customer (KYC) Section 2(1) of FTRA Not to maintain accounts or facilitate transactions wherein the holder cannot be identified, or is identified only by a number. Not to maintain anonymous or fictitious accounts (false names etc).

7 6 S 2(2) Take meaningful measures to identify the customer and to verify identification data or information relating to a customer. S 2(5)(c) For each existing customer ( pre ) the Bank has to obtain their complete respective KYC details within a period of three years (Effective from March 6, The full KYC, AML requirement applies to all accounts opened since then) S.3 If the identity cannot be satisfactorily ascertained, to report to the FIU under S 7 as a suspicious transaction and not proceed with transactions. (The FIU may instruct the bank to continue with the transaction and monitor the account in certain cases) FIU Guidelines of states as per KYC The Money Laundering Regulations require us to obtain sufficient evidence of the identity of any client who comes into contact with the Bank and to be able to show that the client is who he claims to be Part VI of the FTRA S 28 (6) states A person who opens, operates or authorizes the opening or the operation of an account with an Institution in a fictitious or false name is guilty of an offence and shall be punishable on conviction to a fine not exceeding one hundred thousand rupees or imprisonment of either description for a term not exceeding one year, or to both such fine and imprisonment.

8 7 Below are steps (though not exhaustive) that can be taken to ensure compliance with FTRA S 2 (1) 1. NIC,D/L, Passport for individual ID 2. Utility bills for verification of residential addresses if the address given differs from NIC 3. Company, Partnership etc documentation including above verification for the persons involved 4. Sending registered welcome letters etc for residential verification where there is cause to do so. 5. Extreme care to be taken on Trust, NGOs, Associations, clubs etc as they are one of the main channels via which money has been laundered in the past. Bank has to monitor these organizations and identify the individuals, beneficiaries and the bona fides of the operation with special emphasis on the source of funds. 6. Special care also must be taken where accounts are opened of behalf of others i.e. Power of Attorney, Escrow Accounts. 7. Obtain references. Referee must be known to the individual for at least one year and should preferably be an existing customer of the bank. 8. Internationally, opening of accounts for Politically Exposed Persons (PEPs) are dealt with the utmost caution and with the approval of the Management only. These accounts are monitored separately.

9 8 Financial Intelligence Unit (FIU) Guidelines of also states in relation to KYC The following situations will usually give rise to the need for additional enquiries: (a) A personal client for whom verification of identity proves unusually difficult and who is reluctant to provide details. (b) A corporate customer where there are difficulties and delays in obtaining copies of the accounts or other documents of incorporation. (c) A customer with no logical reason for using the bank s service e.g. customers with distant addresses who could find the same service nearer their home base; customers whose requirements are not in the normal pattern of the bank s business which could be more easily serviced elsewhere. (d) A customer introduced by an overseas bank, affiliate or other customer, both of which are based in countries where production of drugs or drug trafficking may be prevalent. (e) Any transaction in which the counter party to the transaction is unknown. Maintenance of Records S 4(1) (a) Bank to maintain all records of transaction/correspondence relating to all reports for 6 years from date furnishing to FIU. (Longer duration may be required by the FIU in certain specific cases) (b) Maintain all KYC documents/records for six years from date of closure of account or cessation of business relationship.

10 9 FIU Guidelines of states as per maintenance of Records For the avoidance of doubt, for each transaction the bank should retain a record of: 1. The name and address of its customers 2. The name and address (or identification code) of its counter party 3. The transaction/investment dealt in, including price and size 4. Whether the transaction was a purchase or a sale 5. The form of instruction or authority 6. The account details and the form in which the funds were paid to the bank(including, in the case of cheques, sort code, account number and name) 7. The form and destination of payment made by the bank to the customer 8. Whether the investments were held in safe custody by the bank or sent to the customer or to his order, and if so to what name and address Special care must be taken to keep all records relating to over the counter transactions ie encashment/purchase of travelers financial instruments, currency purchases/sales etc plus on one off transactions and on all other similar transactions such as pawning etc. Due Diligence and Scrutiny of Customers S 5 -To comply with due diligence on business relationships with customer and continue to monitor account on an on-going basis to ensure matching to customer profile, source of funds etc. In order to comply with above (Due Diligence) the bank would have to ascertain a profile of the customer at the inception ie when account opened. (See S 5(b) below) This would entail (not exhaustive) 1. Estimating volume and value of transactions passing through account after discounting other factors such as seasonal trade etc 2. Establish the standing of the individual/company and match to above 3. Comparison of actual activity of the account perhaps on a monthly basis to the estimated activity constructed when opening the account 4. Comparison of month on month activity of the account for major variances 5. Ascertaining that the source of funds are in fact from the expected sources

11 Customers AML Risk Profile (Profile Building) S 5 (b) of the FTRA Based on the knowledge of customer gleaned and evidence produced of his source of income and expenditure, estimated in/out details are obtained on which the profile is built This is compared to the actual activity of the account and variances are spelt out in exception reports to various levels of sophistication for Compliance Officers further action. See section below on Monitoring of Accounts Voluminous and un-useful information is avoided 4.2. Risk Categorization of Accounts (AML) S 5 (b) of the FTRA Based on information obtained above (Profile Building) the system will categorize the customers normally into three groups (High / Medium / Low) depending on their status and income generation etc on pre determined parameters. For example PEPS, Casino/Night Club owners, NGOs etc could/should be High Risk. Lawyers, Accountants, Company executives etc could /should be Medium Risk Pensioners, Housewives, Non- Exec Employees etc could /should be Low Risk From this categorization more time, resources, monitoring etc are automatically dedicated to the High Risk categories and less to the other two categories 4.3. Report Transactions to FIU S 6 - Report to FIU cash and electronic transactions exceeding a prescribed amount as prescribed by the Minister. FIU requires the Banks to report all cash and electronic transactions -other than inter Bank transactions- exceeding Rs.1,000,000 to the FIU on a two weekly basis.

12 Reporting Suspicious Transactions S 7 (1) & 8 Provide a Report within TWO working days to FIU of any suspected transaction or attempted transaction connected with any unlawful activity & Terrorism See Page below for examples of Suspicious Transactions(ST) S 7 (2) (b) The report (STR) must be in format prescribed by the FIU and within one working day sent to the Compliance Officer who must within one working day of the receipt of information communicate it to the FIU FIU Guidelines of states The first key to recognition (suspicious transaction) is knowing enough about the customer and the customer's business to recognize that a transaction, or series of transactions, is unusual. Questions that should be considered when determining whether an established customer's transaction might be suspicious are: Is the size of the transaction consistent with the normal activities of the customer? Is the transaction rational in the context of the customer's business? Has the pattern of transactions conducted by the customer changed? Where the transaction is international in nature, does the customer have any obvious reason for conducting business with the other country involved?

13 12 SEE BELOW FOR EXAMPLES AND RECOGNITION OF SUSPICIOUS TRANSACTIONS Note: A financial institution would not be expected to know the exact nature of the criminal activity concerned, or that the particular funds passing through the account are definitely those arising from the crime. S 28(1) A person who makes a false/misleading report or omits details from any statement on any matter or thing under S 6,7 & 8 is guilty of an offence punishable by a fine of not more than Rs.100,000 or imprisonment for a term not exceeding one year or both. Non Disclosure of Reporting to FIU S 9(1) Not to disclose to any person the reporting to FIU on transaction under S 7 Not to disclose to any person that any suspicion has arisen in relation to any transaction. S 10 Not to disclose the identity of the person who has handled, prepared or reported such suspicious transactions, or the person who attended to functions under the Act or contents of a suspicious transactions report in relation to S 7. S 28(2) A person who prejudices an investigation under S 9 (1) and 10 (1) is guilty of an offence not exceeding Rs. 500,000 or imprisonment of not more than 2 years or both. Staff Protection S 12 (1) No civil, criminal or disciplinary proceedings can be taken against a director, an officer or employee who executes his obligations under the FTRA in good faith or under directions given by the FIU under this Act.

14 13 S 14 (1) Every Institution shall be required to; a) appoint a Compliance Officer who shall be responsible for ensuring the Institution s compliance with the requirements of the FTRA b) establish and maintain procedures and systems to i) implement the customer identification requirements under S 2. ii) implement procedures for the record keeping and retention requirements under S 4. iii) implement the process of monitoring required under S 5 re account activity etc on an on going basis to FIU. iv) implement the reporting requirements under S 6,7,8 to FIU. v) make its officers and employees aware of the laws relating to money laundering and financing of terrorism, and vi) screen all persons before hiring them as employees. c) establish an audit function to test its procedures and systems for the compliance with the provisions of this Act. d) train its officers, employees and agents to recognize suspicious transaction.

15 4.5. Imposition of Penalties on Non Compliance with FTRA 14 S 19(1) For person who is required to conform to the Act and who fails to do so will be liable for a penalty not exceeding Rs. 1 Mn Double the penalty for continuing non-compliance on each occurrence thereafter. S 19(5) Directors, General Manager, Secretary on other similar officers of the bank have personal liability of above amounts unless he is able to prove he was not aware of any act of non-compliance, or that he exercised due diligence to ensure compliance. S 19(4) Additional measures may be taken by supervisory authorities, regulatory bodies i.e. Banking License could be cancelled. S 19(6) FIU may direct the adoption of measures to ensure compliance S 22 There are further obligations cast on supervisory authorities and auditors who must report suspicious transactions per PML and FTRA to the FIU. S 23 Supervisory Authorities (CBSL) shall verify via regular examination compliance of the FTRA by the institution and report any non-compliance to the FIU.

16 Examples of Suspicious Transactions Large volume exchange of small denomination notes (Rs50, Rs 100 and Rs 500) for large denomination notes (Rs1,000) Movements of very large amounts of cash by a customer with no legitimate source; use of unusually large amounts in traveler s cheques/foreign Currency OTC large cash transactions buying T/Cs, Foreign currency, FDs etc Amounts that seem large in the context of that particular customer. unusual or irregular transfers of funds overseas, for example: SWIFT/telegraphic transfers involving payment in unusually large sums of cash; accounts used as a temporary depository for funds regularly transferred offshore; and loans and securities dealings that appear to be a device to disguise the transfer of funds; international transfers that are loss-making regular large cash transactions by a non-customer; accounts receiving frequent deposits of bearer instruments (for example, bank cheques, money orders, bearer bonds) in amounts just below the reporting threshold currently at Rs 1,000,000 Movements of money that incur bank charges, apparently needlessly unusual use of night deposit boxes or safe deposit boxes especially where cash is involved in large quantities. Unusual account holdings, for example; a customer with an inordinately large number of accounts for the type of business he or she is purportedly conducting, accounts under one or more names with regular inter-account transfers of aggregated funds not related to any legitimate business or commercial purpose and an account in which many different persons, perhaps in different places are depositing cash. A defensive reaction to questioning on KYC, source of funds etc

17 Recognizing Suspicious Transactions Dealing Patterns -FIU Guidelines of (a) A large number of financial transactions across a number of jurisdictions. (b) Transactions not in keeping with the customer's normal activity, the financial products in which the customer is active and the business which the customer operates. (c) Buying and selling of a security or other instrument with no discernible purpose or in circumstances, which appear unusual, e.g. account churning at the client's request. (d) Low-grade securities purchased in an overseas jurisdiction, sold and highgrade securities purchased with the proceeds. (e) Bearer instruments held outside a recognized custodial system. Abnormal Transactions (a) A number of transactions by the same customer in small amounts of the same instrument each purchased for cash and then sold in one transaction, the proceeds being credited to an account different from the original account. (b) Any transaction in which the nature, size or frequency appear unusual, e.g. early termination of packaged products at a loss due to front end loading; early cancellation, especially where cash had been tendered and/or the refund cheque issued to a third party. (c) Transfer of funds or other financial instrument to the credit of apparently unrelated third parties. (d) Transactions not in keeping with normal practice in the market place to which they relate, e.g. with reference to market size and frequency, or at offmarket prices. (e) Other transactions linked to the transaction in question which could be designed to disguise the origin of the money and divert it into other forms or other destinations or beneficiaries.

18 Suspicious Settlements (a) A number of transactions by the same customer in small amounts of the same instrument each purchased for cash and then sold in one transaction. (b) Large transaction settlement by cash. Note: Payment by way of third party cheque or money transfer where there is a variation between the account holder, the signatory and the prospective investor must give rise to additional enquiries. Delivery (a) Settlement to be made by way of bearer instruments from outside a recognized clearing system. (b) Allotment letters for new issues in the name of persons other than the client. Disposition (Payments) (a) Payment to a third party without any apparent connection with the customer. Settlement either by registration or delivery of instruments to be made to an unverified third party. (C) Abnormal settlement instructions including payment to apparently unconnected parties.

19 STR format SUSPICIOUS TRANSACTIONS REPORT (STR) IN TERMS OF FINANCIAL TRANSACTIONS REPORTING ACT NO. 6 OF 2006 Please note that to be accepted as a STR, this form must be completed in all material detail. a. This report is made pursuant to the requirement to report suspicious transactions under the Financial Transactions Reporting Act No.6 of 2006 (FTRA). b. Under section 12 of the FTRA, no civil, criminal or disciplinary proceedings shall be brought against a person who makes a report unless it was made in bad faith. In accordance with Section 7 of the Financial Transactions Reporting Act No. 6 of 2006, the reporting entity is obliged to report suspicious transactions as soon as is practicable but no later than 2 working days to the Financial Intelligence Unit. Please take note of the following prior to completing the Suspicious Transaction Report ( STR ) Provide a clear and concise description of the STR, and state all available information. Document in detail why the transaction is considered extraordinary, irregular or suspicious. Provide supporting documents where it is necessary to explain the STR. Indicate if the potential violation is an initial report or if it relates to a previous transaction or transactions reported. Complete this STR in Block letters. Take reference to the explanatory notes at page 5.

20 19 CONFIDENTIAL (The format prescribed by FIU for Reporting Suspicious Activity (Page 12) Kindly fill in CAPITAL. Read the instructions before filling the form. PART A: DETAILS OF REPORT 1.1 Date of sending report D D M M Y Y Y Y 1.2 Is this a replacement to an earlier report? No Yes (Tick as applicable) 1.3 Date of sending original report if this is a replacement report D D M M Y Y Y Y PART B: INFORMATION ON CUSTOMERS a) Account Holder 1. Name in full (if organization, provide registered business/organization name) 2. NIC No./ Passport No./Nationality/Business Registration No. 3. Gender Male Female 4. Country of Residence 5. Business/ Employment Type 6. Occupation (Where appropriate, principle activity of the person conducting transaction 7. Occupation Description 8. Name of Employer (Where applicable) 9. Residential/Registered Address 10. Country 11. Details of Other Business/Related Accounts Existing A/c. Date Opened Balance D D M M Y Y Y Y 12. Telephone No. 13. Date of last review of customer details Brief description of customer s relationship with the bank D D M M Y Y Y Y b. Person conducting suspicious transactions (If not, the holder in what capacity) 14. Name in Full (If organization, provide registered business/organization name) 15. NIC No./ Passport No./Nationality/Business Registration No. 16. Gender Male Female 17. Country of Residence 18. Business/ Employment Type 19. Occupation (Where appropriate, principle activity of the person conducting transaction 20. Occupation Description 21. Name of Employer (Where applicable) 22. Residential/Registered Address 23. Town 23. District

21 Details of Other Business/related Accounts Existing A/c. Date Opened Balance 25. Account Number 26. Account Type 27. Branch 28. Branch Address PART C: TRANSACTION DETAILS 30. Frequency Single Multiple 31. Date of Transaction D D M M Y YY Y 31. Total Amount LKR 32. Amount in Foreign Currency Currency 33. Beneficiary of Transaction 34. Type of Suspicious Transaction PART D: DESCRIPTION OF SUSPICIOUS TRANSACTION 35. Ground for suspicion (Please mark where relevant Activating of dormant account Large/Unusual cash deposit/withdrawal not consistent with the known pattern of transaction Frequent transactions below the mandatory reporting threshold level (LKR 500,000) Customer suspected of having terrorist links. Funds originating from a suspicious organization/individual/(known terrorist front organizations, shell companies etc.) Reluctance to divulge identification and other information. Regular unusual offshore activity. Large/Unusual inward/outward remittance Transaction without an economic rationale Others (please specify). 36. Give details of nature and the circumstances surrounding it: (Could be included as additional attachments)

22 21 PART E: DETAILS OF REPORTING OFFICER & COMPLIANCE OFFICER 37. Date of Reporting: D D M M YY Y Y Reporting Officer:... Name: Name of Compliance Officer Designation:.. Address: Contact No Fax.. Receiving Officer Date Received: D D M M Y Y Y Y PART E: FOR FIU OF SRI LANKA USE ONLY. Signature of Compliance Officer STR No: Date of Acknowledgement: D D M M Y Y Y Y FIU ACKNOWLEDGEMENT Received by the Financial Intelligence Unit of the Central Bank, STR No. dated 200 from. Director/FIU

23 22 INSTRUCTIONS FOR STR IN TERMS OF FTRA NO 6 OF 2006 GENERAL INSTRUCTIONS Under the FINANCIAL TRANSACTIONS REPORTING ACT, NO. 6 OF 2006 (FTRA), every reporting institution shall furnish details of suspicious transactions defined in Section 7 (1) of the FTRA Act. 7 (1) Where an Institution - (a) has reasonable grounds to suspect that any transaction or attempted transaction may be related to the commission of any unlawful activity or any other criminal offence; or (b) has information that it suspects may be relevant --- (i) to an act preparatory to an offence under the provision of the Convention on the Suppression of Financing of Terrorism Act, No. of (ii) to an investigation or prosecution of a person or persons for an act constituting an unlawful activity, or may otherwise be of assistance in the enforcement of the Money laundering Act. No.5 of 2006 and the Convention on the Suppression of Terrorist Financing Act, No. 25 of How to submit Every institution must submit this form to the Director, FIU only through the Compliance Officer of the reporting institution designated under the FTRA. In urgent cases, the form should also be sent by fax: Address: Director Financial Intelligence Unit Central Bank of Sri Lanka 30, Janadhipathi Mawatha Colombo 1. Fax EXPLANATION OF SPECIFIC TERMS PART A: DETAILS OF REPORT 1.1 Date of sending report is the date on which the compliance officer sends the report to Director (FIU). 1.2 Replacement report is a report submitted in replacement of an earlier STR. When a replacement report is submitted, date of submitting original STR may be mentioned and the complete STR has to be submitted again. PART C: TYPE OF TRANSACTION- WHETHER DEPOSIT OR WITHDRAWAL IN CASH ETC. Reasons for suspicion Reasons Examples of suspicious transactions Identity of False identification of documents clients Identification of documents which could not be verified within reasonable time. Accounts opened with names very close to other established business entities Background Suspicious background or links with of client known criminals. Multiple accounts Activity in accounts Nature of transactions Value of transactions Large number of accounts having a common account holder, introducer or authorized signatory with no rationale. Unusual activity compared with past transactions. Sudden activity in dormant accounts. Unusual or unjustified complexity No economic rationale or bona fide purpose. Frequent purchases of drafts or other negotiable instruments with cash. Nature of transactions inconsistent with what would be expected from declared business. Value just under the reporting threshold amount in an apparent attempt to avoid reporting. Value inconsistent with the client s apparent financial standing. ALL ANNEXURES MUST BE ENCLOSED Account opening mandate Statements evidencing suspicious transactions Detailed description of circumstances surrounding transaction. All other relevant documentation. PART B (24) List out all related/connected accounts where links are evident. PART E: DETAILS OF COMPLIANCE OFFICER Compliance officer is the officer designated by the reporting institution under the FTRA.

24 Effects of non-compliance/violation of above 3 Acts 1. Directors, Staff liable to penal sanctions-fines and/or jail terms 2. Cancellation of Banking license S 19(4) 3. Reputational risk- (Ex: BCCI) 4. Freezing of NOSTRO accounts especially in USA re Patriot Act 5. Tarnish integrity/reputation of financial system 6. Compromise financial stability, undermine legitimate trade/commerce, affect economic growth

25 24 5. PREVENTION OF MONEY LAUNDERING (PMLA) ACT NO. 5 OF 2006 (Certified on 6 th March 2006) S 3 (1) - The offence of Money Laundering relates to Any person who engages in any transaction in relation to any property which is derived or realized directly or indirectly from any unlawful activity or from proceeds of any unlawful activity, or receives, possesses, conceals, disposes of, or brings into Sri Lanka, transfers out of Sri Lanka, or invests in Sri Lanka, any property which is derived or realized, directly or indirectly, from any unlawful activity, or from the proceeds of any unlawful activity, knowing or having reason to believe that such property is derived or realized, directly or indirectly from any unlawful activity or from the proceeds of any unlawful activity, shall be guilty of the offence of money laundering. Unlawful Activity Any act which constitutes an offence under a) the Poisons, Opium and Dangerous Drugs Ordinance (Chapter 218) b) any law or regulation for the time being in force relating to the prevention and suppression of terrorism (Convention or the Suppression of Terrorist Financing Act No. 25 of 2005) c) the Bribery Act (Chapter 26) d) the Firearms Ordinance (Chapter 182), the Explosives Ordinance (Chapter 183) or the Offensive Weapons Act No. 18 of e) The Exchange Control Act (Chapter 423) f) an offence under section 83c of the Banking Act. No. 30 of 1988 (Pyramid Scheme) g) any law for the time being in force relating to transnational organized crime. h) any law for the time being in force relating to cyber crime i) any law relating to offences against children j) any law for the time being in force relating to offences connected with The trafficking of persons and) an offence under any other law for the time being in force which is punishable by death or with imprisonment for a term of seven years or more. This is an omnibus clause intended to incorporate all other acts.

26 25 Section 3(2) Persons who attempts or conspires to commit the offence of money laundering, or aids and abets shall be guilty of the offence of money laundering. Punishment for contravention for above two S 3(1) & (2) is fines in between the value of property in respect of which an offence is committed or three times its value or not less than 5 years and not exceeding 20 years rigorous imprisonment or both. S 4 It must be deemed / presumed that cash/property is acquired by a person via unlawful activity until the contrary is proved ie that he had known income etc to match such assets S 5 Any person who has information obtained by him through the engagement of his vocation, that any property has been derived or realized from any illegal activity, shall (notwithstanding the existence of secrecy provisions-s 5 (4) in various laws) disclose such information to the Financial Intelligence Unit (FIU). Failure to provide information (without reasonable grounds for non disclosure) shall be an offence. S 6 Any person who knowing that an investigation into Money Laundering has commenced or is about to commence, divulges such information (other than for purpose of carrying out a duty under the Act) to any person knowing that such disclosure would prejudice the investigation, or disclosures the identity of the person who is being investigated, or knowingly falsifies, conceals or destroys any material relevant to the investigation commits an offence. Punishment for contravention of S 5 & 6 is fines not exceeding Rs.50,000 or imprisonment not exceeding 6 months, or both.

27 26 S 7 & 8 - Freezing Orders A Police Officer (SP and above) may make an order prohibiting any transaction in relation to any account, property or investment, which may have been used, is being used or may be used in relation to money laundering. Such order shall be initially valid up to 7 days. For the order to be valid thereafter, it has to be confirmed by the High Court (HC). HC may however, permit essential transactions to be made. Such confirmation issued by the HC shall be extended for up to 1 year. If indictment is filed prior to expiry of 1 year, the order shall be in force till the conclusion of the trial. If convicted, until the determination of the Appeal. Transactions in contravention of a Freezing Order shall be null and void. HC may appoint a Receiver to deal with the property during the operational period of the Freezing Order. S 7 & S 8 - Punishment for contravention; Fines not exceeding Rs.100,000, or one and a half times the value of the money in the account whichever is higher, or imprisonment not exceeding one year, or both.

28 27 6. CONVENTION ON THE SUPPRESSION OF TERRORIST FINANCING ACT (STFA) NO. 25 OF 2005 S 3 (1) States that any person who collects funds knowing that it would be used in terrorist activities as described in schedule 1 to the STFA or any other act which may cause death, injury etc. shall be guilty of the offence of financing of terrorist or terrorist organizations. S 3 (2) Any person who aides or abets the commission of above will be guilty of an offence under this act. S 3 (3) Where S 3 (1) or (2) is committed by a body of person the Director, Manager, Secretary, Officer or servant will be guilty of an offence under the act unless it can be proved that they were not aware of the offence or that they exercised due diligence to prevent such an offence. S 3 (4) Punishment for above offence is between fifteen to twenty years imprisonment and liable to a fine.

29 28 7. The Gazette of the Democratic Socialist Republic of Sri Lanka (Published by Authority) L.D B 3/2006. PART I: SECTION (I) GENERAL Central Bank of Sri Lanka Notices FINANCIAL TRANSACTIONS REPORTING ACT, No. 6 OF 2006 RULES made by Financial Intelligence Unit under subsection (3) of section 2 of the Financial Transactions Reporting Act, No. 6 of th March, 2011, Colombo Rules 1. These Rules may be cited as the Licensed banks and Registered Finance Companies [Know Your Customer (KYC) and Customer Due Diligence (CDD)] Rules, No.1 of These Rules shall apply to every Licensed bank and Registered Finance Company (hereinafter referred to as the Financial Institution ). 3. Every Financial Institution shall take such measures as may be specified in these Rules for the purpose of obtaining the customer identification data or information relating to its customers who may be natural or legal persons. A. Natural Persons PART I GENERAL 4. Every Financial Institution shall, obtain from natural persons, the following information:- (a) Full name and any other names used (such as maiden name); (b) Male/female; (c) Permanent address (the full address should be obtained; a post office box number is not sufficient); (d) Telephone number, fax number, and address; (e) Date of birth; (f) Place of birth; (g) nationality or citizenship(s) ; current / previous (add period) ; (h) an official personal identification number or any other identification (e.g. passport, national identity card, driving license) that bears a photograph of the customer; (i) occupation, public position held and/or name of employer ; (j) type of account. 5. Every Financial Institution shall verify the above information submitted to it, in any one of the following ways- (a) confirming the date of birth from an official document (e.g. birth certificate, passport, national identity card);

30 29 (b) confirming the permanent address (e.g. utility bills, tax assessment, bank statement, a letter from a public authority, Certificate of a Grama Niladhari or electoral register); (c) contacting the customer by telephone, by letter or by to confirm the information supplied after an account has been opened or conduct a field visit to verify the information given. If the confirmation of information reveals a disconnected phone, returned mail, or incorrect address, then the Financial Institution shall carry out further investigation; (d) confirming the validity of the official documentation provided through certification by an authorized person. Note : The instances mentioned above are some of the available methods to verify the information, but there may be other documents or information of an equivalent nature which may be produced as satisfactory evidence of customer s identity. 6. Every Financial Institution shall apply effective customer identification procedures in the case of both customers who are available for interview as well as to those customers who are not so available. 7. Every Financial Institution shall make an initial assessment of a customer s risk profile. Particular attention needs to be focused on the customers identified as having a higher risk profile. In such cases additional inquiries shall be made or information shall be obtained, in respect of such customers, including the following:- (a) evidence of the customer s permanent address sought through independent verification by field visits; (b) personal reference (i.e. by an existing customer of the same institution) ; (c) prior bank reference regarding the customer and the customer contact with the Financial Institution; (d) the customer s source of wealth; (e) verification of details relating to employment, public position previous/present, if any (where appropriate), supplied by the customer. 8. Every Financial Institution shall with regard to one-off or occasional transactions where the amount of the transaction or series of linked transactions does not exceed the amount prescribed under paragraph (a) of section 6 of the Act, obtain the minimum information specified in rule 4 of these rules. B. Partnerships 9. In the case of a partnership, every Financial Institution shall verify the identity of each partner of such partnership and also verify the details of immediate family members who have ownership or control thereof. 10. The provisions contained in rule 4 to rule 8 shall mutatis mutandis be followed in respect of partnerships. C. Institutions 11. The customer identification rules shall in relation to the different types of institutions be applied with particular attention being given to the different levels of risk involved. 12. The provisions contained in rule 4 to rule 8 shall mutatis mutandis, be followed in respect of Institutions. C1. Corporate Entities 13. For corporate entities, the principal guideline is to inquire about the background of the entity to identify those who have control over the business and the entity s assets, including those with whom the control and management finally rests. Particular attention shall be paid to shareholders, signatories, or others who invest a significant proportion of the capital or financial support or otherwise exercise control. Where the owner is another corporate entity or trust, the objective is to undertake reasonable measures to inquire about the background of the company or entity and to verify the identity of its principals.

31 30 For the purpose of this Rule control means the nature of a corporate entity, and those who are mandated to manage funds, accounts or investments without requiring further authorization, and who would be in a position to override internal procedures and control mechanisms. Where a corporate entity is listed on the stock exchange, or is a subsidiary of such a company, then the company itself may be considered to be the principal to be identified. However, consideration shall be given to whether there is effective control of a listed company by an individual, small group of individuals or another corporate entity or trust. Under these circumstances those controllers shall also be considered to be principals and identified accordingly. 14. Every Financial Institution shall, obtain the following information from corporate entities:- (a) name of corporate entity ; (b) the certified copy of the Certificate of Incorporation ; (c) the certified copy of Article of Association ; (d) the resolution of the Board of Directors to open an account and identification of those who have authority to operate the account; (e) nature and the purpose of the business of such corporate entity and its legitimacy; (f) principal place of business operation/activity of the corporate entity ; (g) details of previous areas or locations where the corporate entity carried out its business operation activities, with duration; (h) the mailing address of the corporate entity ; (i) the contact telephone and Facsimile numbers ; (j) any official identification number, if available (e.g. company registration number, tax identification number). 15. Every Financial Institution shall verify the above information in any one of the following ways: - (a) carrying out a review of the latest financial statements (audited, if available) of the corporate entity; (b) conducting an enquiry through a business information service, or an undertaking from a reputable firm of lawyers or accountants confirming the documents submitted; (c) undertaking a company search or other conducting enquiries as to the financial stability of the corporate entity, to verify to that the corporate entity has not been, or is not in the process of being, dissolved, struck off, wound up or terminated; (d) utilizing an independent information verification process, such as by accessing public and private databases; (e) obtaining prior bank references ; (f) visiting the corporate entity, where practical ; (g) contacting the corporate entity by telephone, mail or Every Financial Institution shall also take reasonable steps to verify the identity and reputation of any agent that opens an account on behalf of a corporate customer, if that agent is not an officer of the corporate customer. C2. Pension Programs or Retirement Benefit Programs 17. In the case of pension programs or retirement benefit programs trustee and any other person who has control over the relationship (e.g. administrator, program manager, and account signatories) shall be considered as the principal and the Financial Institution shall take steps to verify their identities. The provision contained in rule 4 to rule 8, shall mutatis mutandis, be followed in respect of such program. C3. Societies and Cooperatives 18. In the case of societies and cooperatives the principal shall be those exercising control or significant influence over the organization s assets. This wil1 often include board members and executives and account signatories.

32 31 C4. Charities, Clubs and Associations 19. In the case of charities, clubs, and associations, every Financial Institution shall take reasonable steps to identify and verify at least two signatories along with the institution itself. The principal shall be those exercising control or significant influence over the organization s assets. This will often include members of a governing body or committee, the President/Chairman, the members of the Board of Directors, or managing body, the treasurer, and all signatories. 20. In all cases independent verification shall be obtained that the persons involved are true representatives of the institution. Independent confirmation shall also be obtained of the objective of the institution. D. Trusts, nominee and fiduciary accounts 21. Every Financial Institution shall establish whether the customer is taking the name of another customer, acting as a front or acting on behalf of another person as trustee, nominee or other intermediary. If so, the receipt of satisfactory evidence of the identity of any intermediaries and of the persons upon whose behalf they are acting, as well as details of the nature of the trust or other arrangements in place specifically, the identification of a trust shall include the trustees, settlers, grantors and beneficiaries, shall be an initial requirement. 22. Every Financial Institution shall take reasonable steps to verify the trustee, the settler of the trust (including any persons settling assets into the trust) any protector, beneficiary, and signatory. Beneficiaries shall be identified where they are defined. 23. In the case of a foundation, every Financial Institution shall verify the founder, the managers, directors and the beneficiaries. E. Beneficial Owners 24. Every Financial Institution shall be able to justify the reasonableness of the measures taken to identify the beneficial owners, having regard to the circumstances of each case. Every Financial Institution may also consider obtaining an undertaking or declaration from the customer, on the identity of, and the information relating to, the beneficial owner. F. Professional Intermediaries 25. Every Financial Institution shall identify every single client on behalf of whom a professional intermediary such as a lawyer, notary, other independent legal professional or accountant opens a client account. Where funds held by the intermediary are not co-mingled but where there are sub-accounts which can be attributable to each beneficial owner, all beneficial owners of the account held by the intermediary shall be identified. Where the funds are co-mingled, the Financial Institution shall look through to the beneficial owners; however, there may be circumstances which should be set out in supervisory guidance where the Financial Institution may not need to look beyond the intermediary (e.g. When the intermediary is subject to the same due diligence standards in respect of its client base as the Financial Institution). 26. In the above circumstances where an account is opened for an investment company, unit trust or limited partnership and the same due diligence requirements are applicable to Financial Institution are applicable in respect of its client base, the following shall be considered as principals, and the Financial Institution shall take steps to identify: (a) the fund itself ; (b) its directors or any controlling board where it is a company ; (c) its trustee where it is a unit trust ; (d) its managing (general) partner ; (e) account signatories; (f) any other person who has control over the relationship (e.g. fund administrator or manager). 27. Where other investment methods are involved, the same steps shall be taken as in rule 25 where it is appropriate to do so. In addition all reasonable steps shall be taken to verify the

33 32 identity of the beneficial owners of the funds and the identity of those who have control of the funds. 28. Every Financial Institution shall treat intermediaries as individual customers of such Institution and shall verify separately the standing of the intermediary. The provision of rule 10 and rule 11 shall mutatis mutandis apply in this instance. G. Other Types of Institutions 29. For the categories of accounts referred to in the headings under B, C l - C4, D, E and F of these Rules, the following information shall be obtained in addition to the requirements needed to verify the identity of the principal :- (a) name of account ; (b) mailing address ; (c) contact telephone and fax numbers ; (d) any official identification number, if available (e.g. company registration number, tax identification number); (e) description of the purpose/activities of the account holder (e.g. in a formal constitution); (f) copy of documentation confirming the legal existence of the account holder (e.g. registration document of charity). 30. Every Financial Institution shall verify this information in any one of the following ways:- (a) obtaining an independent undertaking from a reputable firm of lawyers or accountants confirming the documents submitted; (b) obtaining prior bank references ; (c) accessing public and private databases or official sources. H. Introduced Business 31. No Financial Institutions shall rely on introducers who are subject to weaker standards than those governing the Financial Institutions own KYC procedures or those who are unwilling to furnish copies of their own due diligence documentation. 32. Every Financial Institution that relies on an introducer shall always carefully assess whether the introducer is a fit and proper person who exercises the necessary due diligence in accordance with the standards set out in these Rules. 33. Every Financial Institution shall use the following criteria to determine whether an introducer can be relied upon: (a) complying with the minimum customer due diligence practices set out in these Rules; (b) adapting the same customer due diligence procedures which a Financial Institution shall observe with respect to customer identification; (c) satisfying itself as to the reliability of the system put in place by the introducer to verify the identity of the customer; (d) reaching agreement with the introducer that it will be permitted to verify the due diligence undertaken by the introducer at any stage; (e) all relevant identification data and other documentation pertaining to the customer s identity shall be immediately submitted by the introducer to a Financial Institution who shall carefully review the documentation provided. Such information shall be available for review by the supervisory authority and the Financial Intelligence Unit; and (f) conducting periodic reviews to ensure that an introducer whom/which it relies on, continues to conform to the criteria set out above. PART II REQUIREMENTS 34. Every Financial Institution shall comply with such requirements as specified below:-