ANTI-MONEY LAUNDERING AND COUNTER-TERRORISM FINANCING ACT 2006 AML/CTF PROGRAM

Transcription

1 ANTI-MONEY LAUNDERING AND COUNTER-TERRORISM FINANCING ACT 2006 AML/CTF PROGRAM Glebe Administration Board atf Diocesan Endowment (ABN ) Version: 5 (28 March 2012) Author: Steve Lucas, Manager Legal Services

2 PRELIMINARY The Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) regulates the provision of certain services, known as designated services, that have been determined by the Australian government to be at risk of being used to launder money or finance terrorism. Among other things, the AML/CTF Act requires that each entity that provides designated services adopt an AML/CTF Program that contains risk based systems and controls to counter the risk that those services could be used to launder money or finance terrorism. This Program is divided into two parts, A and B. Part A concerns the identification, assessment and treatment of ML/TF risks for each designated service provided by GAB. It also contains certain mandatory content required to be included in the Program by the AML/CTF Rules. Part B comprises procedures for the identification and verification of customers to whom a designated service is provided by GAB. Definitions The following terms used in this document are defined as follows unless the context suggests otherwise AML/CTF Act means the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth). AML/CTF Rules means the Anti-Money Laundering and Counter-Terrorism Financing Rules as in force from time to time. Board means the board of GAB. Diocese means the Anglican Church of Australia in the Diocese of Sydney. Designated Service means a service designated in the table in section 6 of the AML/CTF Act. FTRA means the Financial Transaction Reports Act GAB means Glebe Administration Board in its capacity as trustee for the Diocesan Endowment, being the endowment of the Diocese. GIA means Glebe Income Accounts, a charitable fundraising scheme operated by GAB. KYC Information means Know Your Client information as defined in the AML Act and Rules. ML/TF Risk means money laundering and terrorism financing risk. Program means this AML/CTF Program. The 1938 Act means the Anglican Church of Australia (Bodies Corporate) Act

3 PART A 1. IDENTIFICATION AND ASSESSMENT OF AML/CTF RISKS 1.1 GAB AND ITS DESIGNATED SERVICES GAB is constituted by ordinance of the Synod of the Diocese under the 1938 Act. It is the trustee of the endowment of the Diocese and its objects are to preserve the real value of that property and provide a reasonable income to the Synod of the Diocese. The designated services provided by GAB are provided in its capacity as trustee of the Diocesan Endowment. GAB does not employ any staff to provide its designated services. Its operations are undertaken by staff of the Sydney Diocesan Secretariat under a service agreement in place with that organisation. The Sydney Diocesan Secretariat is an administrative services organisation of the Diocese. GAB is not an ADI, bank, credit union, building society or other person specified by the AML/CTF Rules. Therefore while, through GIA, it takes money on deposit and enables customers to initiate and receive payments via EFT neither of these constitute a designated service. GAB provides the following designated services (a) Item 6: making loans. These loans are predominantly to (i) (ii) the Anglican Church Property Trust Diocese of Sydney, or Diocesan organisations and schools constituted under the 1938 Act or as companies limited by guarantee under the Corporations Act. Occasionally, and on a limited basis, loans may be made to individuals, companies, other corporations and incorporated associations. Loan moneys are made available by EFT or a non-negotiable cheque. (b) Item 14: GIA providing cheque facilities to (i) (ii) (iii) bodies constituted by ordinance or resolution of the Synod of the Diocese, bodies in relation to whom the Synod is empowered to make ordinances, or a trustee of a trust for the benefit or purposes of the Diocese. 1.2 ML/TF RISK FRAMEWORK The methodology for identifying regulatory and business risks and the systems and controls to be implemented to address those risks is set out in this section of the Program. The risk management framework is based on AS/NZS 4360:2004 Standard for Risk Management (Australian Standard) and AUSTRAC Guidance Note: Risk Management and AML/CTF Programs. In determining and putting in place appropriate risk-based systems and controls, GAB will have regard to the nature, size and complexity of its business. 2

4 1.2.1 REFERENCE TABLES Likelihood scale Frequency: Very likely Likely Unlikely Likelihood of an ML/TF risk Almost certain: it will probably occur several times a year High probability it will happen once a year Unlikely, but not impossible Impact scale Consequence Major Moderate Minor Impact of an ML/TF risk Huge consequences major damage or effect. Serious terrorist act or large-scale money laundering. Moderate level of money laundering or terrorism financing impact. Minor or negligible consequences or effects. Risk matrix Threat level for ML/TF risk Very likely Medium 2 High 3 Extreme 4 Likely Low 1 Medium 2 High 3 Likelihood Unlikely What is the chance it will happen Low 1 Low 1 Medium 2 Minor Moderate Major Impact How serious is the risk? 3

5 Risk score table Rating Impact of an ML/TF risk 4 Extreme Risk almost sure to happen and/or to have very dire consequences. Response: Do not allow transaction to occur or reduce the risk to acceptable level. 3 High Risk likely to happen and/or to have serious consequences. Response: Do not allow transaction until risk reduced. 2 Medium Possible this could happen and/or have moderate consequences. Response: May go ahead but preferably reduce risk. 1 Low Unlikely to happen and/or have minor or negligible consequences. Response: Okay to go ahead REGULATORY RISK Risk Likelihood Impact Risk score Treatment/Action Customer identification not done properly Unlikely Moderate Low AML/CTF compliant application forms. AML/CTF compliant business unit written policies and procedures. Staff training. Regular compliance certification to be provided by senior manager [based on questionnaire completed by relevant staff]. 4

6 Risk Likelihood Impact Risk score Treatment/Action Verification of customer identity not done properly Failure to adequately train staff Unlikely Moderate Low AML/CTF compliant application forms. AML/CTF business unit compliant written policies and procedures. Staff training. Regular compliance certification to be provided by senior manager [based on questionnaire completed by relevant staff] Unlikely Moderate Low Regular compliance certification to be provided by senior manager [based on questionnaire completed by relevant staff]. Failure to screen staff and third party agents in accordance with AML/CTF Program requirements Failure to have AML/CTF Program independently reviewed on a annual basis Failure to report on recommendations arising from review to Board Unlikely Moderate Low Regular compliance certification to be provided by senior manager [based on questionnaire completed by relevant staff]. Unlikely Minor Low Regular compliance certification to be provided by senior manager [based on questionnaire completed by relevant staff]. Unlikely Minor Low Regular compliance certification to be provided by senior manager [based on questionnaire completed by relevant staff]. 5

7 Risk Likelihood Impact Risk score Treatment/Action Failure to undertake risk analysis prior to a change in a designated service that may have a material affect on ML/TF risk Failure to submit AML/CTF Compliance reports to AUSTRAC when required Failure to report a suspicious matter to AUSTRAC (within timeframe) Failure to maintain identification and transaction records for the required 7 year period Unlikely Moderate Low Regular compliance certification to be provided by senior manager [based on questionnaire completed by relevant staff]. AML/CTF business unit policies and procedures requiring ML/TF risk assessment. Annual review of the AML/CTF Program. Unlikely Moderate Low Regular monitoring of AUSTRAC website. Regular compliance certification to be provided by senior manager [based on questionnaire completed by relevant staff]. Unlikely Major Medium Regular compliance certification to be provided by relevant staff. AML/CTF business unit compliant written policies and procedures. Staff training. Unlikely Moderate Low GIA transactions are recorded by Ultradata transaction software. Loans transactions are recorded by the Glebe Mortgage System. Hardcopy files are maintained for each account. GIA applications and identification documents are also retained in electronic form. Regular compliance certification to be provided by relevant staff concerning records retention processes. 6

8 Risk Likelihood Impact Risk score Treatment/Action Failure to report to the Senior Management Team and Board on AML/CTF Compliance Unlikely Minor Low Regular compliance certification to be provided by senior manager [based on questionnaire completed by relevant staff] BUSINESS RISK Risk group: Customers Risk Likelihood Impact Risk score Treatment/Action A customer has no apparent connection to the Anglican church or reason to support the objectives of the Anglican church. A church officeholder misuses designated service for purpose of ML or TF. Unlikely Minor Low A private individual or business may apply for a loan from time to time (usually via a broker). Any such application is carefully scrutinised to ensure it is bona fide. [Note: Even though a product or service may not be made available, a suspicious matter reporting obligation can arise when a person makes an enquiry about a designated service or requests that one be provided. A person with no apparent connection to the Anglican church seeking out GAB s services (apart from loans) may be suspicious and enquiries should be made as to why the person wishes to use the GAB s services]. Unlikely Major Medium Cheques must be countersigned by two signatories. Loans are applied directly towards expense (e.g. property settlement or builder s progress payment) upon a draw down notice being issued by a borrower. Subject to some exceptions, loan moneys are not made available to borrowers directly. 7

9 Risk group: Customers Risk Likelihood Impact Risk score Treatment/Action Person impersonates a church officeholder in order to access a designated service to be used for ML or TF. Person applies in name of a bogus church body in order to access a designated service to be used for ML or TF. Staff member uses their position to open bogus account or facilitate ML/TF by themselves or another. Unlikely Major Medium Identification requirements in AML/CTF Program require Registry officeholder records to be checked. Parish loan applications require signed parish council consent, undertaking from wardens, notice to be posted in the churches of the parish for two weeks and approval from the Regional Bishop. Unlikely Major Medium Identification requirements in AML/CTF Program require Registry database and, in the case of an organisation, constituent ordinance to be checked. Other treatments listed above also apply. Unlikely Moderate Low Staff screening as per AML/CTF Program. The staff member who open accounts/initiates transactions and the staff member who monitors accounts and transactions are not the same person. Draw downs on loans are to be authorised by CEO or senior manager. * Note concerning customer risk: All products and services of the GAB that constitute designated services are only provided to Anglican bodies of the Diocese or affiliated organisations with the exception of commercial loans which may be made to members of the public on a very limited and occasional basis. Risk group: Products and Services Risk Likelihood Impact Risk score Treatment/Action GIA accounts with cheque book facilities Facility used as a means of making payments from the Unlikely Major Medium Risk is predominantly dealt with at the customer level. Cheque transactions above 8

10 account for ML or TF purposes. Loans Loans monies used for ML/TF purposes or repayments made with illegitimate source of funds $9,000 are monitored for suspicious activity as per this AML/CTF Program. Unlikely Major Medium Parish/church loans Loans are applied directly towards expense (e.g. property settlement or builder s progress payment) upon a draw down notice being issued by a borrower. Subject to some exceptions, loan moneys are not made available to borrowers directly. Loans do not have redraw facilities (other than some loans that GAB has made to itself in other trustee capacities). Anglican organisations Loan money is usually paid at the direction of an organisation s solicitor for a property purchase or in payment of an invoice from the builder etc pursuant to a draw down request signed under board authority. In the case of building projects draw down requests must be accompanied by a copy of the invoice and a certificate from a quantity surveyor or architect that payment is in order. Private borrowers Few loans to private borrowers are written. Such loans are carefully scrutinised by the Loans Manager to ensure that the proposed application of borrowings and source of repayments are legitimate. Loan money is not made directly available to the borrower. Risk group: Products and Services Risk Likelihood Impact Risk score Treatment/Action Cheque books issued to account holders by post Cheque books intercepted and Unlikely Moderate Low Cheques require signature by 2 9

11 unauthorised drawings on account made. of the 3 wardens. Face-to-face - loans Actual transactions may be made by cheque or EFT but given the small customer base for each of these products face-to-face meetings are held before loans are made to discuss the arrangements. Note concerning jurisdictional risk: GAB does not have any operations or branches in a foreign jurisdiction. 1.3 REVIEW OF RISK PROFILING AND RISK BASED SYSTEMS AND CONTROLS This risk matrix will be reviewed on an annual basis and on each occasion that additional designated services are proposed to be provided by GAB or where there are changes proposed to an existing designated service that may have a material affect on the AML/CTF risks associated with that service. Such changes include the services/products on offer (e.g. a service discontinued or a new one commenced), the methods by which the service can be accessed (face-to-face, internet, via an agent etc), customer profile (e.g. changes to the customer base to whom the service is offered), changes in organisational structure to the business unit delivering the service, use of agents. Business unit managers are to advise the AML/CTF Compliance Officer of any such changes to a designated service before the change takes effect so that consideration can be given to whether there will be any material change in ML/TF risk. If so appropriate risk based systems and controls are to be devised and implemented jointly by the AML/CTF Compliance Officer and the business unit manager. In addition business unit managers will be asked to complete an annual checklist aimed at identifying any changes to designated services that may cause a material change in ML/TF risk. The AML/CTF Compliance Officer is to ensure that this Program is updated to account for any changes in ML/TF risk and any new risk based systems and controls that have been implemented. 2. AML/CTF RISK AWARENESS TRAINING The senior manager responsible for the investment and banking operations of GAB is to ensure staff (which includes employees, contractors and agents) who are directly involved in the provision of designated services are adequately trained in the following areas GAB s obligations under the AML/CTF legislation, consequences of non-compliance with those obligations, types of risk faced by GAB and consequences of such risk, and 10

12 processes and procedures specified in this Program that are relevant to the work carried out by the employees. Training is to be provided to staff on an annual basis and to new or promoted/transferred staff (as referred to above) upon or shortly after the commencement of their employment. Training may be provided internally or externally or a combination of both. The senior manager must keep records evidencing the training that has been undertaken by their staff. 3. EMPLOYEE AND THIRD PARTY DUE DILIGENCE The senior manager responsible for the investment and banking operations of GAB is to ensure that prospective employees and current employees who are appointed or transferred to positions through which money laundering and terrorism financing could be facilitated via a designated service are to undergo a screening process in accordance with this section of the AML/CTF Program. In this section Low ML/TF Risk means an employee or prospective employee who is not of Medium to High ML/TF Risk, and Medium to High ML/TF Risk means an employee or prospective employee whose access to means to facilitate money laundering or terrorism financing (a) (b) is not subject to supervision by another staff member, and/or would not require the involvement or collusion of another staff member. Low ML/TF Risk Prospective Employees Prospective employees who are deemed to be of low ML/TF risk are to be screened by asking questions of the applicant s referees to ascertain whether any ML/TF concerns arose in the course of their previous employment. If any areas of concern arise the prospective employee should then be considered to be of medium to high ML/TF risk and further screening undertaken in accordance with that risk classification. Existing Employees Existing employees who are deemed to be of low ML/TF risk are only required to be screened by making enquiries with the senior manager responsible for that business unit to ascertain whether any ML/TF concerns or risk factors arose in the course of that position. If an employee is being appointed or transferred within the same business unit the senior manager is to take any ML/TF concerns arising from that employee s existing position into account before making a decision to appoint or transfer the employee. If the senior manager considers that the areas of concern warrant further screening, the employee should be screened in accordance with the procedures for employees of medium to high ML/TF risk set out below. Medium to High ML/TF Risk 11

13 A prospective employee or existing employee who is deemed to be of medium to high risk is to be screened as per the processes for a low-risk employee. In addition the relevant senior manager responsible for the investment and banking operations of GAB is to undertake such further screening as he or she considers to be appropriate in the circumstances. This may include a lifestyle versus income check and/or a criminal records check. Employees who have been previously screened If an existing employee who is transferred or promoted has previously undergone screening in the course of their employment they are not required to be re-screened unless there is reason to suspect that they their has been a material change in the employee s circumstances such that they present a higher ML/TF risk than they did when first screened. Managing Non-complying Employees If an employee fails to comply with any system, control or procedure established in accordance with Part A or Part B of this Program they are to be counselled by their senior manager or, where the non-complying employee is a senior manager, the CEO, in relation to their noncompliance. Depending on the seriousness of the breach, in most cases, if the breach is inadvertent and not a repeat occurrence, the employee is to be given a warning and, if appropriate, required to undertake further training in relation to their obligations and/or such other measures taken as the Senior Manager or CEO considers are warranted. If the breach is serious, not inadvertent and/or is a repeat occurrence more significant discipline may be required, including, potentially, suspension from duties and/or dismissal. Any material breaches are to be reported to the Board at the next meeting of the Board held after the breach has been identified. Third Party Service Providers If GAB proposes to enter into an arrangement with a third party for the provision of designated services and the arrangements present a material ML/TF risk, the senior manager responsible for the investment and banking operations of GAB is to initiate a risk-based due diligence process in relation to the third party to ensure that those risks are appropriately mitigated and managed. This exercise may necessitate that a screening process be undertaken prior to engaging the contractor similar to that outlined above with respect to employees. 4. ONGOING CUSTOMER DUE DILIGENCE 4.1 COLLECTION AND VERIFICATION OF KYC INFORMATION The ML and TF risks posed by the designated services provided by GAB are rated to be either low or medium. Other than the identity information required to be collected and verified under the AML/CTF Rules (as detailed in Part B) no KYC information is required to be collected in respect of any customers for ongoing customer due diligence purposes, and 12

14 KYC information is not required to be updated or verified in respect of its customers for ongoing customer due diligence purposes, except where a suspicious matter arises. In such case the provisions concerning the collection of further KYC information and verification of that information for suspicious matters will apply (see section 8 of Part B). 4.2 TRANSACTION MONITORING PROGRAM See section 8.1 in Part B concerning suspicious matter reporting obligations and procedure for making a report to AUSTRAC. GAB has adopted the following transaction monitoring program for the purpose of identifying suspicious transactions - Electronic Funds Transfers As GAB is not an ADI, bank, credit union, building society or entity specified in the AML/CTF Rules it is not an ordering or beneficiary institution in relation to EFTs into or out of GIA. As such EFTs are not designated services provided by GAB and there is no requirement for GAB to monitor these transactions. Cheque facilities Cheque facilities are limited to accounts held by bodies of the Diocese, bodies to whom the Diocese has power to make ordinances and trustees of trusts for or for the use, benefit or purposes of the Diocese. GAB considers these customers to be of low ML/TF risk. GAB is to monitor these transactions by running a daily report from its banking system of cheques presented of $9,000 and above. These reports are to be manually checked by GAB staff. Potential indicators of suspicious activity are listed in section 8.1 in Part B. Loans The Loan s Manager is to monitor major movements in money loaned out and repaid on a monthly basis. There is no usual pattern of transactions by the GAB s customers. While many loans are paid off via regular scheduled repayments others, particularly parish loans, may be paid off through a series of large irregular payments as fundraising appeals and events are run by the borrower. Loans also do not have redraw facilities. Nonetheless should the Loans Manager or another staff member of GAB have any concerns that a transaction is of an unusual size, unusual pattern or lacks any apparent commercial or operational purpose they are to rise their concerns with the Manager, Legal Services. 4.3 ENHANCED CUSTOMER DUE DILIGENCE PROGRAM The following enhanced customer due diligence program applies when GAB determines that a customer presents a high ML/TF risk or when a reportable suspicious matter arises. See Part 13

15 B, section 8 for information on what constitutes a suspicious matter and list of potential indicators of suspicious matters. Some indicators that individually or collectively may indicate that a customer is of high ML/TF risk include * discrepancies in the identification and/or verification process carried out in accordance with Part B, a customer representing that they are a church officeholder or represent an Anglican organisation but is not verified to be a church office holder on the Registry database and/or by the Rector of the parish concerned, the customer is involved in a complex business ownership structure with no legitimate commercial rationale, the non-individual customer (for example, a trust, company or partnership) has a complex business structure with little commercial justification, which obscures the identity of ultimate beneficiaries of the customer, the customer is in a position which may expose them to the possibility of corruption, the customer is engaged in business which involves significant amounts of cash (but is not a church), there is no clear commercial rationale for the customer seeking the designated service, an undue level of secrecy is requested by a customer regarding a designated service, the source of the customer s funds is difficult to verify, the beneficial owners of a non-individual customer are difficult to identify and/or verify, there is a one-off transaction in comparison with an ongoing business relationship or series of transactions, the customer makes repeated withdrawal, transfer or drawdown instructions by phone or fax, the customer has access to offshore funds and transfers from or to this source, the customer has income which is not employment-based or from a regular known source, the customer purports to be a charity but does not have an ABN or is not registered with the ATO as an income tax exempt charity, and the customer is represented by another person, such as under a power of attorney. * Note: Some customers may have a long-term and active business relationship with GAB and yet posses some of these characteristics by virtue of their history and/or charitable activities. Such a customer should not be treated as a high-risk customer unless there are strong reasons to do so. Should GAB determine that a customer presents a high ML/TF risk or that a suspicious matter reporting obligation has arisen, the relevant staff member, in consultation with their senior manager, is to determine whether in the circumstances further information ought to be sought from the customer or from third party sources in order to o clarify or update the customer s KYC information; 14

16 o obtain any further KYC information*; o clarify the nature of the customer s ongoing business; o consider any suspicion that may have arisen for the purposes of section 41 of the AML/CTF Act; more detailed analysis should be undertaken in respect of the customer s KYC information; KYC information ought to be verified or re-verified in accordance with the customer identification program in Part B; more detailed analysis and monitoring should be undertaken in respect of the customer s transactions both past and future, and/or a suspicious matter report ought to be lodged with AUSTRAC in accordance with the AML/CTF Act. * Note: See Part B for a list of additional KYC information that could be sought from a customer that is deemed to be of high ML/TF risk. 5. REPORTING SUSPICIOUS MATTERS Under the AML/CTF Act GAB has certain obligations to report suspicious matters, in relation to the designated services it provides, to AUSTRAC. A suspicious matter reporting obligation may arise in relation to (a) a customer to whom designated services are being provided (including a pre-commencement customer (that is an existing customer as at 12 December 2007)), (b) a person who requests that GAB provide them with a designated service, or (c) a person who inquires as to whether GAB would be willing to provide them with a designated service. Full details of the matters that constitute suspicious matters can be found in section 41 of the AML/CTF Act, however having regard to the designated services provided by GAB they can be relevantly summarised as arising where GAB suspects on reasonable grounds that (a) (b) (c) a customer or prospective customer (or their agent) is not who they claim to be, information held by GAB in respect a designated service provided or to be provided may be relevant to the investigation or enforcement of a law concerning taxation or the commission of a criminal offence, or a designated service provided or to be provided to a customer may be used or being used to launder money or finance terrorism. Suspicious matters under (a) and (b) in the immediate paragraph above must be reported to AUSTRAC within 3 business days after the day on which the suspicion is formed. Suspicious matters under (c) must be reported within 24 hours after the time that the suspicion is formed. Some potential suspicious matters in relation the designated services provided by GAB may include the nature of, or unusual circumstances surrounding, a transaction; 15

17 the production of seemingly false identification in connection with any transaction, the use of aliases and a variety of similar but different addresses and, in particular, the opening or operating of a false name account (which is an offence in itself)); admissions or statements of involvement in tax evasion or other criminal activities; the behaviour of the person or persons conducting the transaction (e.g., unusual nervousness); structuring of transactions - attempts on the part of an individual or group to avoid the filing of a threshold transaction report for cash transactions by breaking up or structuring transactions so that each is below $10,000; unusual business dealings, particularly where significant amounts of cash are involved in circumstances that are difficult to explain; a customer with an inordinately large number of accounts for the type of business he/she is purportedly conducting; a cheque of an unusual size, an unusual pattern or lack of apparent commercial or operational purpose in relation to the drawing of a cheque, or cheques made out to a business name being deposited into a personal account or cashed over the counter. If a suspicious matter reporting obligation has arisen (or may have arisen) in relation to GAB the Manager, Legal Services should be notified immediately so that steps can be taken to prepare the necessary report to AUSTRAC. 6. THRESHOLD TRANSACTION REPORTS The AML/CTF Act requires reporting entities to report threshold transactions to AUSTRAC within 10 business days of the day on which the transaction occurred. A threshold transaction is a transaction involving the transfer of (a) physical currency, where the total amount of physical currency transferred is not less than AUD10,000, or (b) money in the form of e-currency, where the total amount of e-currency is not less than AUD10,000. The threshold transaction reporting obligation only applies in relation to designated services provided by GAB. However the reporting obligations applicable to cash dealers in the FTRA continue to apply meaning that reportable transactions on all GIA accounts must continue to be reported to AUSTRAC notwithstanding that only cheque accounts are designated services. Physical Currency GAB has adopted the following rules concerning cash (a) (b) (c) Cash deposits may only be made into a GIA account at a bank. Cash deposits can only be made in Australian currency. Cash deposits will not be accepted at GAB offices. Cash withdrawals from a GIA account are not permitted. 16

18 The Head of Investments (or his or her nominee) is to monitor credits to GIA accounts of $10,000 or more on each day that GAB undertakes business. Where the credit consists of a cash transaction, it is to be reported to the AML/CTF Compliance Officer who is to report the transaction to AUSTRAC within 10 business days of the day on which it occurred. Cash transfers of $10,000 and above on loans are also reportable. However as a matter of policy GAB does not allow cash transactions as a means of payment for these products. The reporting process The AML/CTF Rules prescribed mandatory information that must be provided to AUSTRAC in a threshold transaction report (see chapter 19 of the AML/CTF Rules). If less than 50 reports are lodged per year paper reports can be lodged. The paper forms can be ordered from AUSTRAC. E-currency GAB is not involved in a threshold transaction involving e-currency. 7. REPORTING INTERNATIONAL FUNDS TRANSFER INSTRUCTIONS If GAB sends an international funds transfer instruction out of Australia or receives an international funds transfer instruction into Australia it must, within 10 business days after the date on which the instruction was sent or received, report the transaction to AUSTRAC. Relevant staff are to advise the AML/CTF Compliance Officer immediately if GAB sends or receives an international funds transfer instruction and the AML/CTF Compliance Officer is to make the report to AUSTRAC. 8. AML/CTF COMPLIANCE REPORTS GAB must give to AUSTRAC a report relating to its compliance with the Act, the regulations and the AML/CTF Rules during the reporting period specified by AUSTRAC. The report must be lodged within the period, and be in the form, and contain the information, specified by AUSTRAC. To date AUSTRAC has specified that reports are to relate to compliance over a calendar year and be lodged no earlier than the first business day, and no later than 31 March, in the next calendar year. However AUSTRAC could change these arrangements at any time. The AML/CTF Compliance Officer is required to diarise these key reporting dates and is to ensure that the reports are lodged within the reporting period. In the fourth quarter of each calendar year the AML/CTF Compliance Officer is to verify that AUSTRAC has not made any changes to the reporting arrangements and if changes have been made is to ensure GAB complies with the new reporting arrangements. Reports are to be submitted via the AUSTRAC Online portal. 17

19 9. APPROVAL AND OVERSIGHT BY BOARD AND SENIOR MANAGEMENT Part A of this Program has been approved by the Senior Management Team and the Board. Part A is also subject to ongoing oversight through a process of compliance certification provided to the Board by the senior manager responsible for investment and banking operations. 10. APPOINTMENT OF COMPLIANCE OFFICER The Corporate Secretary of GAB will hold the position of AML/CTF Compliance Officer. The AML/CTF Compliance Officer is responsible for monitoring compliance with this Program by GAB and its staff and has such other responsibilities as are provided for in this Program. The AML/CTF Compliance Officer is to report to the Chief Executive Officer directly on matters pertaining to compliance with this Program and the AML/CTF legislation. 11. INDEPENDENT REVIEW The AML/CTF Compliance Officer is to ensure that Part A of this Program is subject to an annual and independent review, whether by an internal or external party. The review is to assess the effectiveness of the Part A program having regard to GAB s ML/TF risks, whether Part A complies with the AML/CTF Rules issued by the CEO of AUSTRAC, whether Part A has been effectively implemented, and whether GAB has complied with Part A. The results of the review, including any report prepared, are to be provided to the Senior Management Team and the Board. The Board is to consider and respond to any recommendations that may arise from the review within 3 months of the recommendations being made by the reviewer. 12. CONSIDERATION OF AUSTRAC FEEDBACK The AML/CTF Compliance Officer is to have regard to any feedback provided by AUSTRAC, whether general or particular, as to GAB s performance in managing its ML/TF risks and will report to the Senior Management Team and the Board with a view to it determining whether the provisions of this AML/CTF Program require any amendment. So far as possible this will occur in conjunction with the AML/CTF Compliance Officer s reporting to the Board but where the circumstances necessitate otherwise consideration will be given sooner. The AML/CTF Compliance Officer will regularly monitor the AUSTRAC website for new AML/CTF rules, guidance notes and legal interpretations. 18

20 PART B CUSTOMER IDENTIFICATION AND VERIFICATION Note that the procedures in Part B do not need to be undertaken in respect to a customer to whom a designated service is already being provided prior to 12 December 2007 (known as a pre-commencement customer ). An exception to this is where GAB suspects on reasonable grounds that a pre-commencement customer is not who they claim to be. See section 8 below concerning suspicious matters. 1. INTRODUCTION These procedures apply in relation to applications for a GIA account which has a cheque facility, or a loan. A business unit may nonetheless determine that it will adopt the identification and verification procedures in the Program across all of its products and services for reasons of expediency. The identification and verification procedures in this document are to be carried out prior to any of the above services being provided. It is for each business unit to determine the manner in which the identity and verification information will be obtained having regard to its business functions. It is expected that each business unit will develop appropriate policies and procedures to meet its obligations under the Program. 2. RECORD KEEPING 2.1. Identification GAB is required to make records of the procedure it undertakes in identifying a customer, and information it obtains in the course of carrying out the procedure. GAB is required to retain those records, and also any copy made of a document that is produced to the member in carrying out the identification procedure, until 7 years have elapsed after the date that designated services cease to be provided to the customer Transactions Records of transactions undertaken in relation to designated services must be retained for 7 years after the transaction record has been made. 19

21 3. CATEGORIES OF CUSTOMER 3.1. Individuals Identification All applications must include at a minimum the customer s full name date of birth and residential address. If the customer is applying for the service in their capacity as a sole trader the customer s full name, date of birth, the full business name under which the customer carries on business, the full address of the principal place of business or customer s residential address, ABN, if issued, must be collected. If a customer is deemed to pose a high ML/TF risk the business unit should consider requiring further Know Your Client information as part of the application process. See Part A, 4.3 Enhanced Customer Due Diligence for a list of indicators that may suggest a customer poses a high ML/TF risk. Additional KYC information may include any or all of the following any other name that the customer is known by; the customer s country(ies) of citizenship; the customer s country(ies) of residence; the customer s occupation or business activities; the nature of the customer s business with the reporting entity including: - the purpose of specific transactions; or - the expected nature and level of transaction behaviour; the income or assets available to the customer; the customer s source of funds including the origin of funds; the customer s financial position; the beneficial ownership of the funds used by the customer with respect to the designated services; and the beneficiaries of the transactions being facilitated by the reporting entity on behalf of the customer including the destination of funds Verification The following process of verification should be undertaken in respect to customers who are individuals 1. Verify the customer s name and either residential address or date of birth, or both, by citing: 20

22 (a) (b) an original or certified copy* of a primary photographic identification document; or an original or certified copy* of a primary non-photographic identification document and secondary identification document, and 2. Ensure that any document produced by the customer has not expired (other than in the case of a passport that has expired within the preceding two years). * See section 6 below for details on the categories of people who may certify identification documentation for the purposes of the AML/CTF Act. No other KYC information is required to be verified unless the KYC information has been obtained because the customer has been deemed to pose a high ML/TF risk, in which case such verification relevant to the basis for the heightened risk is to be undertaken as the staff member processing the application determines to be appropriate in the circumstances. primary photographic identification document means a licence or permit to drive a vehicle issued by a State or Territory authority of equivalent authority of a foreign country that contains a photograph of the person in whose name the licence is issued, a passport issued by the Commonwealth, a passport, other travel document or national identity card issued by a foreign government that contains a photograph and signature of the person in whose name it is issued and which is in English or another language understood by the person citing the document or accompanied by an English translation from an accredited translator, or a proof of age card issued by a State or Territory which contains a photograph of the person in whose name it is issued. primary non-photographic identification document means a birth certificate or birth extract issued by a State or Territory, a citizenship certificate issued by the Commonwealth, a birth certificate or citizenship certificate issued by a foreign government that is in English or another language understood by the person citing the document or accompanied by an English translation from an accredited translator, or a pension card issued by the Department of Human Services that entitles the person in whose name the card is issued, to financial benefits. secondary identification document means a notice issued to the person by the Commonwealth, a State or Territory that o was issued within the preceding 12 months, o contains the person s name and residential address, and o records the provision of financial benefits to the person under a law of the Commonwealth, State or Territory, or a notice issued to the person by the Australian Taxation Office that o was issued within the preceding 12 months, o contains the person s name and residential address, and o records a debt payable by or to the Commonwealth under commonwealth taxation law, or a notice issued to the person by a local government body or utilities provider that o was issued within the preceding 3 months, o contains the person s name and residential address, and o records the provision of services by the local government body or utilities provider that that address or person, or 21

23 in relation to a person under 18 years of age, a notice issued to the person by a school principal that o was issued within the preceding 3 months, o contains the person s name and residential address, and o records the period of time that the person attended the school Companies The term company means a company that is registered under the Corporations Act 2001 (Cth). It is important to note that Anglican bodies established under the Anglican Church of Australia (Bodies Corporate) Act 1938 are not companies for the purposes of the AML/CTF Rules or this Program. These bodies do not fit within any of the categories of customer in the AML/CTF Rules and are dealt with separately below. These procedures only relate to Australian companies. In the unlikely event that GAB receives an application from a foreign company, whether it be registered or unregistered, the responsible member of staff should consult the Manager, Legal Services to determine the identification and verification requirements that apply in relation to the customer Identification All applications made by an Australian company must include at a minimum its full name as registered by ASIC, the full address its registered office, the full address of its principal place of business, the ACN issued to the company, whether it is a proprietary or public company, if proprietary, the name of each director of the company, and if proprietary or private, the name and address of each beneficial owner of the company.* *This information is not necessary if the company is licensed and subject to regulatory oversight by a Commonwealth or State regulator. If a customer is deemed to pose a high ML/TF risk the business unit should consider requiring further Know Your Client information as part of the application process. See Part A, 4.3 Enhanced Customer Due Diligence for a list of indicators that may suggest a customer poses a high ML/TF risk. Additional KYC information may include any or all of the following the full business name (if any) of the company as registered under any State or Territory business names legislation; the date upon which the company was registered by ASIC; the name of any company secretary; and/or the nature of the business activities conducted by the company Verification The following details must be verified in relation to customers who are domestic companies its full name as registered by ASIC, whether it is a proprietary or public company, and the ACN issued to the company by performing a search on the ASIC company database at 22

24 A copy of the ASIC database entry should be printed and kept on the customer s file. No other KYC information is required to be verified unless the KYC information has been obtained because the customer has been deemed to pose a high ML/TF risk, in which case such verification relevant to the basis for the heightened risk is to be undertaken as the staff member processing the application determines to be appropriate in the circumstances. It may be appropriate in such circumstances to undertake a full company search in respect to the customer through a search provider such as Dunn and Bradstreet Corporations established under the Anglican Church of Australia (Bodies Corporate) Act 1938 and the Anglican Church of Australia Trust Property Act 1917 Corporations established under the 1938 Act are established by ordinance of the Synod and the Property Trust is established under the provisions of the 1917 Act. An example of a 1938 Act corporation is the Sydney Anglican Schools Corporation. These corporations do not fall within any of the customer categories in the AML/CTF Rules. They are not individuals, domestic companies or associations. In the interests of giving effect to the spirit of the AML/CTF Rules, and having regard to the ML/TF risk posed by the these bodies, the following procedure for identification and verification has been adopted Identification All applications must include at a minimum the body s full name, and principal place of business. A business unit should also obtain the body s ABN and a list of members of the board should it consider that further identity information is needed to sufficiently establish the identity and status of the body Verification A business unit should verify that the constituting ordinance of the body appears in the list of ordinances for schools and diocesan organisations on the website of the Sydney Diocesan Secretariat, If the constituting ordinance cannot be located on the website, the Manager, Legal Service should be consulted Associations (and other unincorporated Anglican bodies) An association may be incorporated or unincorporated. An example of an incorporated association is an Anglican church affiliated preschool that is incorporated under the Associations Incorporation Act 1984 (NSW). The AML/CTF Act defines the term unincorporated association broadly to include an association that is not incorporated and also a body of persons. The reference to a body of persons in the definition removes the usual requirement for an association to have a defined membership. 23

25 Examples of unincorporated associations are Anglican churches or parishes, Evangelism Ministries, the Anglican Media Council and the Safe Ministry Board. Each business unit must have procedures in place that are designed to enable it to be reasonably satisfied that an association applying for a service exists and that the names of the members of the governing committee have been provided Identification All applications from incorporated associations must include at a minimum the full name of the association, full address of the association s principal place of administration or registered office, any unique identifying number issued to the association upon its incorporation, and the full name of the chairman, secretary and treasurer or equivalent officer. All applications from unincorporated associations must include at a minimum the full name of the association, full address of the association s principal place of administration, the full name of the chairman, secretary and treasurer or equivalent officer, and in respect of the member or members who are applying for the service, the information required to be collected from an individual under the customer identification procedure for individuals (see 3.1 above). In addition to the above, the names of the members of the governing committee of the association are to be sought. In the case of a parish this is the parish council. If a customer is deemed to pose a high ML/TF risk the business unit should consider requiring further Know Your Client information as part of the application process. See Part A, 4.3 Enhanced Customer Due Diligence for a list of indicators that may suggest a customer poses a high ML/TF risk. Additional KYC information may include any or all of the following In respect to an incorporated association the State, Territory or country in which the association was incorporated, the date upon which the association was incorporated, the objects of the association, a certified copy or certified extract of the rules of the association, in respect of any member the information required to be collected from an individual under the reporting entity s customer identification program in respect of individuals, and the full business name, if any, of the association. In respect to an unincorporated association in respect of any member the information required to be collected from an individual under the reporting entity s customer identification program in respect of individuals, the objects of the association, a certified copy or certified extract of the rules of the association, and the full business name, if any, of the association. 24