By Xavier Foz and Anton Golovkin*

Transcription

1 By Xavier Foz and Anton Golovkin* General overview of the AML regulations in Europe In order to fight against money laundering and terrorism financing, the European Parliament and the Council of the European Union adopted Directive 2005/60/EC of 26 October 2005 (the AML Directive ), which is still in force until the implementation of the new Directive (EU) 2015/849 of 20 May 2015 on the same matter. The AML Directive, which principally incorporates into European law the Financial Action Task Force ( FATF ) recommendations after their review in 2003, merely establishes a general framework that should not just be implemented but also complemented by the Member States i.e. this should lead to significantly more extensive and detailed national regulations. This implies that the AML Directive does not establish a comprehensive framework of anti-money laundering and terrorism financing that could be used without its further development by national legislation. Moreover, the AML Directive is a de minimis rule, as set forth in its Article 5, that has to be strengthened and extended taking into consideration the specific risks that exist in each particular Member State. Due to the above, the implementation of the AML Directive by the Member States presents relevant differences between each jurisdiction which at the final stage creates additional hurdles for the provision of services and the sale of goods within the European Union, since the obliged entity is required in most cases to comply with the local regulations of the host Member State which, as stated above, may present considerable differences regarding the requirements of the home Member State. Due diligence measures applicable to non-face-to-face transactions in Spain It is a well-known fact that non-face-to-face business relationships or transactions, without certain safeguards such as electronic signatures, are included in the list of the transactions having a higher probability of risk with regard to money laundering and terrorism financing. Accordingly, enhanced customer due diligence should be carried out in order to establish a business relationship with the customer through such means that in most cases are related to online transactions. Having said that, it becomes even more burdensome for the obliged entity carrying out the above type of transactions to comply with all the non-uniform requirements set forth by the Member States.

2 In this regard, in relation to non-face-to-face business relationships or transactions the Spanish AML legislation requires either (i) an electronic signature (which the vast majority of customers do not have) or (ii) that the relationships or transactions satisfy at least one of the following requirements: The customer s first payment is via a transfer made from an account opened in an EU institution (or equivalent third country). The customer is identified by a copy issued by a public authority of his/her correspondent identification document. The customer is identified through any other procedure previously authorized by the Spanish anti-money laundering authority ( SEPBLAC ). In certain business relationships such as those in the financial sector, the obliged subject is the one who makes the first transfer to the customer while the latter is obliged to reimburse the capital to the former at a later stage once the relationship has already been established. With regard to the services sector, a considerable part of the services is charged to the customer once the service has already been provided. Accordingly, the customer s first payment through an EU account mechanism cannot be used in every business relationship. In view of the above, some of the obliged subjects are forced to request the customer s legalized hard copy of his/her identification document, which distorts the nature of the online transactions, or to obtain a specific authorization from SEPBLAC approving the identification procedure in question. Authorisation of the KYC video process In order to overcome this situation, Roca Junyent has advised a German credit mediation platform with regard to obtaining authorisation from SEPBLAC to identify clients in non-face-to-face transactions by using a videoconferencing system, such as the one it uses in Germany. This has led SEPBLAC to recognise for the first time in Spain this KYC video process as a secure client identification procedure, pursuant to Article 21.1.d) of the Spanish AML Regulations. Authorisation for this new client identification system came into effect on 1 March 2016 and it may be used by any person officially requiring such information under

3 the Spanish AML Act (which also includes foreign individuals acting in Spain through branches or agents or under the freedom to provide services program). The requirements set out by SEPBLAC are as follows: Clients need to hold certified documents for formal identification purposes. Prior to implementing this system, a specific risk analysis shall be run and the procedure needs to be documented and have its effectiveness tested. The person officially requiring such information shall be responsible for ensuring that the technical requirements are in place in order to ensure the authenticity, validity and integrity of the identification documents and the correspondence of the holder with the client being the subject whose identification is being confirmed. This identification system needs to be managed by specifically trained personnel. The identification process shall be recorded with proof of date and time; this recording shall be kept for a minimum period of 10 years. The client shall expressly consent to the use of this system and to the process being recorded and kept on file, prior to or during the course of said recording. During the videoconferencing, measures shall be taken to ensure the privacy of the conversation with the client. The client must visibly display the front and back of the document being used for identification purposes. The identification process may not be completed if there is any evidence of falsehood or manipulation of the identification document, or if there is a mismatch between the holder and the client being identified, or in such situations where the circumstances of the communication may prevent or hinder verification of the aforementioned issues. The person officially requiring such information shall obtain and keep a picture or a snapshot of the front and back of the identification document. The quality of the

4 photograph must meet the quality and sharpness requirements needed to allow its use in investigations or analyses. Prior to executing any transactions, it shall be confirmed that the client is not subject to any sanctions or international financial countermeasures. Another interesting aspect of the authorisation granted by the SEPBLAC is that it expressly recognises the possibility of outsourcing the implementation of this identification system, as long as the person officially requiring such information retains full liability for the latter. We understand that this outsourcing is not to be confused with the reliance mechanism set out in Article 8 of the Spanish AML Act, which requires that the entity relied upon also be a person officially requiring such information, such reliance only being recognised for simplified due diligence measures (and not for enhanced due diligence measures as in the case in question). Conclusion To sum up, we are glad to see that the Spanish authorities are starting to realise, as stated by SEPBLAC, that technological innovation in the financial sector may reduce costs, increase competitiveness and provide a better service for clients. We will never achieve real digitization of traditional sectors like banking if we continue using offline procedures that do not fit the needs of new realities such as fintech. In any event, there is no doubt that this shall be implemented without a decrease in client protection levels taking place. SEPBLAC is moving in the right direction and we are proud to have made a contribution together with our client towards to this aim. *Xavier Foz and Anton Golovkin are a partner and an associate respectively in the Banking & Finance and Fintech Practice Group in the Barcelona office of Roca Junyent. Mr. Foz and Mr. Golovkin can be contacted at x.foz@rocajunyent.com and a.golovkin@rocajunyent.com.

5