bwin.party digital entertainment plc CQR Payment Solutions

Transcription

1 Joint bwin.party digital entertainment plc CQR Payment Solutions Contribution to the Consultation on the European Commission s report on the application of Directive 2005/60/EC on the prevention of the use of the financial system for the purpose of money laundering and terrorist financing. About bwin.party bwin.party digital entertainment plc (LSE: BPTY) is the world s largest listed online gaming company. The Company was formed from the merger of bwin Interactive Entertainment AG and PartyGaming Plc on 31 March Incorporated, licensed and regulated in Gibraltar, the Group also has licences in France, Italy and Denmark. With offices in Europe, India, Israel and the US, the Group generated total pro forma revenue of 816.0m and pro forma Clean EBITDA of 199.3m in bwin.party commands leading market positions in each of its four key product verticals: online sports betting, poker, casino and bingo with some of the world s biggest online gaming brands including and The Group s scale, technology and strong portfolio of games collectively differentiate its customer offer from those of its competitors. bwin.party is a constituent member of the FTSE 250 Index and the FTSE4Good Index Series, which identifies companies that meet globally recognised corporate responsibility standards. For more information about bwin.party, visit: About CQR CQR Payment Solutions is an authorised payment service institution, providing local and international solutions for card acquiring, alternative payment and card issuing. Through a single-interface online payment platform, CQR offers its partners a choice of over 90 of the world s most commonly used payment options, enhanced by local currency options and full language support. CQR can offer either a technical link to payment providers or a merchant account with a full cash management service. Further information can be found at cqrpayments.com. 1

2 bwin.party is the world s largest listed online gambling operator, licensed in numerous jurisdictions (e.g. Gibraltar, Italy, France, Denmark, Spain) and a genuine pioneer of online gambling entertainment for adults. As such, the bwin.party Group has always been subject to applicable AML regulations in addition to requirements as a company listed at the stock exchange and subject to licensing and other corporate regulations. The bwin.party Group also has a 100% subsidiary that acts as payment service provider (PSP) to bwin.party and to external clients: CQR Payment Solutions GmbH. Via CQR (UK) and Vincento, the bwin.party group holds e-money and payment institute licenses issued by the UK Financial Services Authority as well as VISA and MasterCard licenses, - evidence of the high standards applied with respect to payment transactions in general and AML in particular. Both bwin.party and CQR are strongly affected by the application of the 3 rd Anti-money Laundry Directive (3AMLD) in their daily business, either as an online gaming operator or as a PSP. Consequently, bwin.party and CQR chose to comment on the Commission s report via this joint submission. The following will provide comments from an online gaming operator s perspective as well as from the point of view of a PSP servicing online gaming companies. Online payment services play a crucial role in online gambling As highlighted in the Green Paper Towards an integrated European market for card, internet and mobile payments, online payments play a particularly crucial role with respect to online services. In this regard, online gambling is no exception with the vast majority of transactions to and from customer accounts being effected via credit cards (64-65%1), followed by e-wallets, bank transfers and prepaid cards. At the same time, it has to be underlined that consumers who choose the Internet as their preferred distribution channel to gamble wish to affect related payment transactions as user-friendly and at the same time securely as possible. Consequently, reliable and secure payment services are one of the pillars of a successful and safe online gambling entertainment. In online gambling, however, payment services do not only serve the purpose of allowing customers to deposit and withdraw money to and from their gambling accounts. Payment services also allow to a certain degree to authenticate customers as required under gambling laws and regulations, in particular with regard to the protection of minors and the prevention of fraud. Furthermore, mandatory player accounts are the basis for any reliable fraud prevention and consumer protection measures that rely on the so-called Know-your-customer (KYC) principle. That is why responsible and regulated operators require customers to create a player account by providing a number of key identification data, including the name, place of residence and date of birth. Moreover, customers must not have more than one player 1 Green Paper on on-line gambling in the Internal Market; p. 17 2

3 account with an operator in order to avoid fraud or circumvention of responsible gaming tools, such as self-limits. Not only when it comes to the attractiveness of online gambling services but also with regard to related payment services, consumers just like any other e-commerce consumers do not accept too burdensome registration or verification processes and simply drop out or turn to the black market of unregulated providers, including from outside the EU, if they face too cumbersome processes in an online environment. Consumers searching for online gambling on the Internet and failing to go through a lengthy and burdensome registration process that might even include an offline step will in many cases simply switch to an unlicensed gaming provider that does not have to fulfil the licensing requirements and hence offers a user-friendlier registration and verification process. Increased harmonization needed for multi-licensed operators As the world s leading listed online gaming operator, bwin.party operates under various licenses, e.g. in Gibraltar, France, Italy, Denmark or Spain. Experience in the past decade has shown that there is a large diversity between the local regulations when it comes down to KYC and DD (Due Diligence) requirements, the definition of Politically Exposed Persons (PEPs) and suspicious transactions reporting (both in terms of responsibilities and the means of reporting) as well as conflicts of interest between the regulative bodies on AML and data protection (e.g. in France). These differences render it challenging for multi-licensed operators to comply with all regulations in an efficient way. We trust that not only the online gambling sector, but all businesses covered by the 3AMLD share this experience. We would consequently welcome a more harmonized approach for the 4 AMLD to support operators offering their services cross-border by harmonizing KYC rules in terms of allowing electronic verification of customer details and addresses; clarifying when Simplified Due Diligence (SDD) applies and by which verification measures it is satisfied according to the on-going risk based assessment; defining the thresholds based on on-going monitoring when initial SDD does no longer justify the exclusion of Basic Due Diligence (BDD) and Enhanced Due Diligence (EDD) according to the on-going risk based approach by online gambling operators; clarifying when BDD and EDD shall apply, which measures are to be undertaken and which documentation has to be collected in order to successfully conclude BDD and EDD (e.g. copies of identification documents for BDD, copies of utility bills and proof or origin of funds for EDD); harmonizing the reporting process, e.g. standard templates to be issued by all Financial Investigation Units (FIUs) in the 27 Member States, with English to be fully accepted as reporting language; 3

4 defining whether or not only the FIU of the jurisdiction of the home country of the operator or also the home country of the suspect customer shall be reported to. Online environment allows risk-based profiling Online gaming operators, for various reasons, closely monitor their customers activities to protect themselves from fraudulent behavior and the accompanying financial and reputational risks. Risks include credit card fraud (excessive chargeback schemes by the credit card companies must be satisfied), professional sports betting fraud, problem gambling, potential underage gambling. So as to detect fraud at the earliest stage possible, online gambling operators took advantage of their ability to have every single customer activity logged in their databases (starting with the initial registration, covering first and consecutive deposits, player activity, withdrawal activity, etc.) and traceable at any time, obviously subject to applicable data protection regulations. This empowers them to draft precise customer profiles based on which the risk of individual customers and their activities are evaluated. Monitoring programmes are in place to proceed alerts and reports on customers who display slight or significant changes in their behaviour (such as a change of means of payment, rapid increase of values paid in, change of playing activity, change of gambling product, change of IP-range or even IP-country). Based on such profiles, online gambling operators can take instant decisions on whether SDD, CDD or EDD applies due to customer activity whether the level of DD is still sufficient in case a customer changes his/her activity whether a potential case of money laundering has occurred Operators are required to have Money Laundry Reporting Officers (MLRO), in case of large operators usually supported by team of specialized Anti-Money Laundry Investigators whose responsibility it is to either pro-actively report potential cases of money laundering to the FIUs or to re-actively respond to requests for information from FIUs. Financial burden imposed on multi-licensed operators In this context, it needs to be reminded that this comes at a cost for operators, even though bwin.party believes that the costs for implementing procedures and controls to prevent and/or detect money laundering and financing of terrorism should not be regarded from a P&L perspective, as the protection of the company, the licensor, the financial system and last but not least of society itself is of utmost importance. Nevertheless, we do believe that certain activities could be conducted in a more efficient way, especially for operators and companies operating across borders, without increasing the risk of supporting or not detecting money laundering or the financing of terrorism. One of the major requirements to companies covered by the 3AMLD is to have Money Laundry Reporting Officers (MLRO - also known as Nominated Officers) who are in charge of controlling all AML activity, reporting it to the local FIUs as well as to responding to requests from the latter. Experience has shown that Member States tend to require the 4

5 relevant MLROs based in their home country and FIUs tend to communicate in the local language. Moreover, licensors expect MLROs to have a certain level of seniority, a broad knowledge and sufficient experience of the business at hand and the applicable regulations. On top of this, MLROs are also required to receive qualified external training on an on-going basis (usually once a year at least). Multinational organisations with only a small share of business in one of the EU27 markets consequently face the burden of paying salary to highly skilled staff in various countries, whereas one centralized position (e.g. in the headquarter) to serve all local operations might be more efficient and at the same time sufficient. Eventually, the salary and training cost for having Money Laundry Reporting Officers could be 27 times the amount actually necessary to ensure the required level of control. The initial and on-going screening of customers to check whether they feature on Politically Exposed Persons (PEP) or Sanctions (individuals known or suspected of being members or co-workers of terror organisations) lists can be highly automated thanks to external software providers (e.g. Complinet, Cellent, DowJonesFaktiva) and databases (e.g. WorldCheck), in case the size of a business justifies the acquisition and maintenance of such tools and databases. Since these costs can easily exceed the EUR 100,000 benchmark per year, they might not be affordable for small businesses, which then on the other hand face increased human effort for manually screening their customers. KYC requirements differ from Member State to Member State. Whereas some of them allow or even support electronic verification (e.g. via the services of the GB-Group/UrU), others prefer licensees to proceed a manual verification, e.g. by having customers provide copies of ID documents even in hardcopy form via snail mail or via fax or . Whereas the costs of the first method basically consist of the check against the electronic database (and does on average not exceed EUR 2,50 per check), manual verification imposes huge costs to cover the manual effort by collecting and verifying all these documents by trained staff, let alone the costs of financial losses in case human errors occur. What is more, some data protection authorities have raised concerns about operators proceeding with the collection of customer documents, resulting in an endless communication between lawyers of both sides. The effort for investigation and determination whether a Suspicious Activity Report (SAR) has to be submitted is more or less the same in all jurisdictions. However, the way of how to submit an SAR ranges from full electronic submission (Italy, Alderney), via fax (France) to personal submission at the FIU office (Gibraltar). A harmonization of the templates to be used, common terminology and common language (preferably English) could tremendously improve efficiency and speed of SARs to be submitted and at the same time reduce work effort and related financial burden. 5

6 In the following, we will comment on the European Commission s report chapter by chapter. 2.1 Applying a Risk Based Approach (RBA) FATF publications, Wolfsberg Group papers and the FSA have already produced guidance on this subject. Knowledge of their products, the risks and mitigation factors is something payment services already apply and can review far quicker than Member States which may apply different requirements based on their own country s experiences. Formal assessments undertaken by Member States, supervisors and the regulated sector in addition to individual firms undertaking their own assessments would restrict the ability of payment services to operate under the passporting regime Serious Crimes The primary legislation setting out the criminal law on money laundering should include the all crimes approach as is already the case in countries such as the UK and Germany. The use of a list with a range of serious crimes that are considered to be criminal activities is limiting and leads to different states applying different definitions. 2.4 Customer Due Diligence The thresholds of EUR 15,000 in respect of occasional transactions and EUR 1,000 threshold for electronic fund transfers should remain. If it is decided that the nature of the transaction gives rise to a higher risk of money laundering, then verification of identity is sought. Harmonising the approach to identification and acceptable documents issued by Member States along with the agreed thresholds should avoid the divergences in the application of the directive. The clarification of the obligations on both parties for third-party reliance would be welcomed. With more and more new payment methods being introduced and opportunities for PSPs to introduce a merchant to the company, reliance on due diligence responsibility will need to be clear to all parties. 2.5 Politically Exposed Persons (PEPs) Politically Exposed Persons are considered a higher risk in the regulated environment and would require enhanced due diligence for the business to continue. The interpretation of a PEP differs between Member States as well as regulated companies in the UK, with some already including domestic PEPs in their searches. The definition of a PEP, their family members and close associates requires standardisation regardless of their residence status. We would welcome the clarification of the definition of senior management approval for business to continue with an identified 6

7 PEP. Both of these issues could then be documented accurately in organisations AML polices regardless of group or local applications. The risk based approach to time limits before a public official is considered a PEP and after they cease the official function needs clarifying for a unified approach across industries and Member States. 2.6 Beneficial Ownership Clarifying the definition of beneficial ownership would be welcomed. The OECD states that The notion of ultimate beneficial owner corresponds more to the concept of ownership than to the control concept. In the framework of the OECD Handbook on Economic Globalisation Indicators, the term ultimate beneficial is replaced by the term ultimate controlled or ultimate control unit so that in reality, there could be several ultimate beneficiaries, but only one ultimate control unit. The 25% threshold is sufficient, and lowering this would increase compliance resource requirements. The risk based approach adapted by organisations to those companies that operate in less regulated jurisdictions can show that the appliance of due diligence in assessing the money laundering risk and the appropriate decisions about the individuals identity, should satisfy the different interpretations by member states and solve the issue of transparency of legal persons or arrangements. 2.7 Reporting Obligations The introduction of a requirement for local reporting should be opposed. There are differences in requirements of Member State FIUs and reporting to both home and host state would require additional time and resources for organisations to identify the variations in the interpretations of the predicate offences of money laundering, not to mention the data protection requirements in each Member State. Processes are already in place for the sharing of SARs between Member State authorities. The centralised sharing of SARs by national authorities should not be replaced by requiring additional reporting burdens on individual organisations. 2.8 FIUs If dual reporting is to be introduced, it should be undertaken in a single format, in one language and without having to meet local compliance obligations. We would support the requirement for FIUs to provide timely generic feedback to reporting institutions. 2.9 Group compliance Exemptions to the prohibition of disclosure of the fact that a SAR has been filed or a ML/TF investigation is being carried out should not be extended to include head office independent auditors within the definition of group. For obvious reasons such as 7

8 confidentiality of employees, the risk of tipping off and security, the auditors should look to review controls in place and their effectiveness. It would not be considered unconventional for an auditor to identify unusual and suspicious activity and the internal reporting process could then be tested for deficiencies or weaknesses. Intra-group flows of information on potential suspicious transactions prior to the filing of a report would need to be risk assessed on the nature of the intra-groups business activities and the data protection obligations of the countries they reside in Supervision Conflicts of jurisdiction should be clarified within the new directive with regard to investigative, prosecution and data protection rights in cross-border situations of home and host countries. AML regulation in the Member State where distribution takes place would duplicate the regulatory obligations for companies. It impacts the ability of payment service providers to operate effectively within the Single Market. Companies should not be subject to local AML requirements when passporting on a crossborder basis because the requirements of each local regulator would contradict the provisions objective for Member State cooperation Third Country Equivalence The risk based approach versus the concept of third country equivalence in relation to AML requirements appears to be a conflict between an accepted regulatory route and a voluntary, non-binding measure agreed by Member States within the EU Administrative sanctions for non-compliance with the Directive There should be a common application of the sanctioning regime across Member States so that no one member appears to compare more favourably than another in its application of effective, proportionate and dissuasive penalties. 8