Are you ready for an AML monitoring review?

Transcription

1 Are you ready for an AML monitoring review? Haroulla Arkade Nicolaou Louis Theodotou Kyriacos Karaolis ACCA Senior Practice Reviewers

2 AGENDA 1. Scope of an AML monitoring visit 2. The Prevention and Suppression of Money Laundering Activities Law of The monitoring visit 4. Assessing visit outcomes 5. Risk assessment 6. Common deficiencies on client identification and due diligence 7. Record keeping 8. Recognition and reporting of suspicious transactions 9. Education and training 10. Law on administrative services 11.IESBA Code of Ethics 12. Other ICPAC regulations

3 Scope of an AML monitoring visit Scope of an AML monitoring visit: Primary purpose to verify compliance with ICPAC s Directive on Prevention and Suppression of Money Laundering Activities (Referred to as Money Laundering Regulations or MLRs) Also entails verifying compliance with: Law on administrative services, where applicable Certain other ICPAC regulations (CPD, PII, practice continuity) IESBA Code of Ethics for Professional Accountants 2016 Edition (Code of Ethics) on matters not directly relevant to the audit of annual financial statements e.g. referral fees, client money ACCA

4 The Prevention and Suppression of Money Laundering Activities Law of 2018 Published 3 April Effective immediately Amended Directive to the Members of ICPAC expected to be issued before the end of the year. Guidance in the presentation is based on General Circular 8/2018 produced by ICPAC ACCA

5 Stricter measures and administrative fines imposed if a person subject to supervision does not comply with the provisions of the Law or the Directive issued by each Regulatory Authority. Amendment to the Law The imposition of any measure or administrative fine shall be published on the official website of each Regulatory Authority. (article 59(6)) ACCA

6 MONITORING VISIT Planning the visit: Firm contacted by telephone Information about the firm s clients and services discussed Date of visit agreed and confirmed in writing Site visit: Opening meeting discuss background and determine AML policies, procedures and controls (AML manual) Examination of practice records and client files Closing meeting - discuss and agree the findings, communicate significant and non significant deficiencies and provide guidance on any improvements given Post-visit procedures: Report on visiting findings, conclusion and guidance drafted Internal quality review of draft report/visit papers Report issued to the firm Firm s response received and reviewed Report and firm s response sent to ICPAC, with comments

7 ASSESSING VISIT OUTCOMES Non-significant deficiencies If firm generally in compliance with the MLRs and any deficiencies found are not significant Significant deficiencies Significant deficiencies are found in one or more key requirements of the MLRs Risk assessment, client identification and due diligence and reporting of suspicious transactions or activity ACCA

8 Examples of significant deficiencies No mechanism in place for assessing the ML and TF risk of each client Client identification of UBOs and other relevant persons either not carried out or not appropriate, particularly of those not resident in Cyprus No understanding of the control structure and ultimate beneficial ownership of client entities Failure to conduct of adequate/appropriate client due diligence No policies or procedures on reporting of suspicious transactions/activity.

9 AML Manual Firms are required to monitor the adequacy, effectiveness and relevance of their policies, procedures and controls on compliance with the MLRs at regular intervals Such monitoring can only be properly facilitated if the firm s policies procedures and controls are documented in an AML manual Documented policies and procedures should be relevant to the services provided by the firm ( )

10

11 Risk assessment Extent of client identification and due diligence Geographic risk Client risk Service risk

12 Amendment to the Law High risk third country A black list of high risk countries should be compiled for use by firms for risk assessment. The list should include third countries with strategic shortcomings in their national system for combating money laundering and terrorist financing, which are seen as major threats to the financial systems within the European Union (paragraph 2 of article 9 of the EU Directive)

13 Risk assessment Purpose is to determine the extent to which client identification and due diligence procedures should be applied based on clients potential money laundering and terrorist financing risks. (4.01) Risk assessment should be able to differentiate between clients in a way that matches the risk of their particular businesses and activities. (4.03)

14 Amendments to the Law More emphasis is now placed on risk assessment (Article 58A) Where appropriate with regard to the size and nature of the firm s business, an independent internal audit function should be set up to test and assess the effectiveness of its AML policies, procedures and controls (article 58B) The senior management of the firm should be responsible for approving the policies, procedures and controls to be applied and where necessary, reinforcing the measures taken (article 58C) A member of the Board (where relevant) should be responsible for the implementation of the provisions of the AML Law and the directives and / or circulars and / or regulations issued thereunder, including any relevant acts of the European Union (article 58D)

15 Risk assessment The system should be able to: i. Identify and assess the money laundering and terrorist financing risks of each client taking into consideration appropriate factors including its legal structure and beneficial owners, the integrity of its owners and key personnel, geographical areas of its operations, the mode of its operations and transactions, sources of wealth and income and the services the client requires from the firm. ii. iii. ( 4.04) Manage and mitigate the assessed risks through use of risk profiling and applying appropriate systems and procedures on client identification and due diligence based on each client s category of risk. Determine whether an existing or potential client or its beneficial owner is a politically exposed person (PEP) to ensure that such a client is treated as higher than normal risk.

16 Risk assessment (continued) Risk assessment should consider all relevant risk categories and factors, (Chapter 4 and Appendix C of the directive and Appendix II and III of the new Law) Risk factors should be weighted according to their seriousness to allow for an appropriate risk score and profile to be determined for each client Risk grading system should be used, e.g. a risk matrix System should ensure that some characteristics should immediately treat client as high risk (e.g. PEPs, high risk country clients) (4.16)

17 Risk assessment (continued) lower than normal risk Where a client is considered lower than normal risk, this should be backed up by documentation of how this was evaluated (under new law blanket approach based on the client falling under a certain category not permitted). Lower than normal risk factors suggested in the directive (4.16): Long association with, and detailed knowledge of, client Status of client (e.g. listed, regulated, or government entities)

18 Simplified due diligence procedures Amendment to the Law There is a change to article 63 of the Law (equivalent paragraph 5.48 of current AML directive) which specifies instances where simplified due diligence procedures could be applied. The new provision allows the firm to apply simplified customer due diligence measures, provided that the business relationship or transactions presents a lower than normal risk (article 63) Appendix II of the Law provides further guidance

19 Risk assessment (continued) Clients may be high risk based on factors in Appendix C, although, after adequate review, the firm may determine that they are pursuing a legitimate purpose. Provided that the economic rationale for its structure and transactions can be made clear, the firm may be able to demonstrate that the client is carrying out legitimate operations for which there is a rational and non-criminal purpose Appropriate mechanism should be put in place to monitor transactions to ensure they match the initial risk profile and to trigger revision of the client s risk rating, if this is not the case (4.10 and 4.25)

20 Amendment to the Law A person who sells precious stones and / or precious metals, motor vehicles, works of art and / or antiques in the course of his business activities is prohibited from receiving in cash an amount of 10,000 or more irrespective of whether the transaction is carried out in a single transaction or multiple related transactions (Article 5A(1)) Breach of the above, is a criminal offence resulting in a fine up to 10% of the proceeds (Article 5A(2))

21 Higher risk clients Increased levels of know your client should be performed for high risk clients (enhanced due diligence) Increased awareness across all departments with a business relationship with the client, including enhanced briefing of client teams Escalation of approval process for the establishment of a business engagement, or involvement in the client service. (4.17, 4.20 and 4.21)

22 Enhanced due diligence measures should be applied (article 64): Amendment to the Law (i) when dealing with a natural person or a legal entity established in a high risk third country (ii) when client has cross-border relationship with a third-country credit or financial institution (iii) in transactions or business relationships with a politically exposed person (or a close relative or close associate)

23 Client identification and due diligence

24 Client identification Identification and verification of client identity must be done irrespective of risk based approach extent depends on level of risk. (4.24) The verification requirements are the same, whatever the means by which the firm intends to provide its services to the client. ( 5.11)

25 CLIENT IDENTIFICATION AND DUE DILIGENCE COMMON DEFICIENCIES

26 No evidence in support of client identity and permanent address and not verifying client s signature Evidence in support of each client s ultimate beneficial owners (UBOs) identity and permanent address not obtained prior to acceptance of that client (4.24, 5.37 and 5.38) Identity not verified of all principal directors/ shareholders in the case of unquoted companies (5.52)

27 Definition of an ultimate beneficial owner (UBO) Amendments to the Law Change in threshold percentage of ownership or control from 10% plus one share to 25% plus one share. (article 2(1)) Under certain circumstances, the senior managing official of the client should be considered as a UBO

28 Amendments to the Law UBO A central register of UBOs should be maintained which must include sufficient, accurate and up-todate information. (article 61A) Access to the central register: (a) Without any restriction: Competent Supervisory Authorities The Unit The Customs and Excise Department The Department of Taxation The Police (b) Firms, when required for due diligence measures (c) Persons or bodies demonstrating a legitimate interest

29 Where client (UBOs) resident outside Cyprus and face to face contact made, identity and permanent address not also confirmed with a reputable financial institution or professional adviser based in the client s home country or normal country of residence. (5.41) Not evident whether copies of client identification documents retained are made by the firm from original documents and when.

30 Where no face to face contact, enhanced due diligence not undertaken such as: Obtaining a copy of the client s passport authenticated by an independent reputable attorney, or consulate Confirming the identity and permanent address with a reputable credit or financial institution or professional adviser in the client s home country. Ensuring that the first payment of the operations is carried out through an account opened in the client s name with a credit institution operating in a country within the European Economic Area (5.18 and 5.43)

31 Ownership and control structure of client entities not identified and verified Understanding of client s ownership and control structure not obtained and documented Ownership of the ultimate holding company within the documented client control structure not identified i.e. beneficial owners and any controlling principals Client identity and permanent address of controlling principals other than beneficial owners, within the structure not verified (5.05 and 5.45)

32 Reliance placed on third parties for client identification and due diligence procedures Where the third party is based outside Cyprus, not verified that the third party is licenced, regulated and supervised by a competent authority of its country for the purposes of AML Law, which is equivalent to the requirements of the EU directive

33 Reliance placed on third parties for client identification and due diligence procedures. If AML Law not equivalent of EU Directive, reliance on third party cannot be placed. If AML Law equivalent of EU Directive or third party based in Cyprus and regulated by a competent authority, copies of client identification and due diligence documents obtained, or accepted without: a) assessing third party s systems and procedures for AML and terrorist financing b) verifying that the assessed systems and procedures are implemented in line with the requirements of the AML Law and ICPAC Directive

34 Reliance placed on third parties for client identification and due diligence procedures (continued). c) maintaining a separate file for each third party to store the assessment report and other relevant information d) obtaining approval from the Money Laundering Compliance Officer (MLCO) before starting cooperation with, and accepting the client identification data verified by, the third party. ( ) Reliance placed on third parties can only be placed at the outset of establishing a business relationship or the execution of an occasional transaction for the purpose of verifying the identity of their clients. (5.31)

35 Article 67 Firms are prohibited from relying on a third party located in a high risk third country for client identification and due diligence (subject to certain exceptions) Amendments to the Law Third party should immediately provide the firm with the data, information and identity documents required for customer identification and due diligence process

36 Reliance placed on overseas associated firms (same network) or branches that introduce clients Not confirmed that the group applies common client due diligence and record-keeping procedures Not ascertained that client due diligence and record-keeping procedures of the group are supervised by a competent authority For each client introduced, written confirmation not obtained from the overseas network firm or branch that it has verified the client s identity in accordance with the group s procedures and retained supporting evidence (5.32)

37 Initial client due diligence - Use of inappropriate client acceptance questionnaire Not established sufficient understanding of: i. the client s activities and transactions ii. iii. the client s structure to identify any subsidiaries or related companies that may be included in the clients business relationships the client s source of funds, and where applicable source of wealth; iv. the rationale behind the client s existence and the work and transactions to be undertaken on its behalf, to ensure that it exists for a legitimate trading or economic purpose (4.19 and 5.02)

38 Establishing source of funds (SOF) all clients SOF refers to the origin of particular funds or assets which are the subject of the business relationship between the firm and its client and the transactions the firm is required to undertake on the client s behalf (e.g. the amounts being invested, deposited or remitted) Easier to establish than source of wealth but this should not simply be restricted to knowing from which bank or financial institution it may have been received. Should ensure that the source of funds is logical and backed by supporting documentation (e.g. a deed of sale, salary records, financial statements) Where the funds come from a third party, the risk is even greater and further enquiries should be made about the relationship between the client and the ultimate underlying principal of the funds (i.e. the actual provider of the funds) which should include verifying his or her identity

39 Establishing source of wealth (SOW) PEPs Refers to the origin of the entire body of wealth (i.e. total assets). What is required: Obtain information on net worth, e.g. volume of wealth the client would be expected to have. Obtain information on where that net worth came from i.e. inheritance, employment, business, investment etc. No single source is likely to account for the total value of net worth; but categories are likely to be few and generally well understood. Failure by a client to voluntarily disclose information about how much wealth he or she controls could be a red flag. Verify the information on a risk sensitive basis - Examples: publicly available property registers, land registers, past transactions, internet searches (from reputable sources), confirmation from regulated professionals with knowledge of the client, documents confirming salary, tax returns and bank statements

40 Common deficiencies in establishing SOF and SOW Understanding recorded in CDD questionnaires is limited to some brief and inadequate comments and is not substantiated Accepting client s explanations at face value without further investigation, even where multiple red flags are present Over-reliance on unverified information Procedures followed are not risk-based - applying the same inadequate measures to clients of varying risks Not able to distinguish between a customer s source of funds and source of wealth

41 The definition of PEPs has been extended to specify which persons are considered to hold prominent public function. This includes persons holding specific managerial positions in international organisations. (article 2) Amendment to the Law Where a PEP is no longer entrusted with a prominent public function by a EU member state or a third country, or with a prominent public function by an international organisation, the firm is required for at least 12 months, to take into account the continuing risk posed by that person and to apply appropriate and risk sensitive measures until such time as that person is deemed to pose no further risk specific to PEPs (article 64(1)(c))

42 No/Insufficient on-going due diligence No scrutiny of transactions undertaken throughout the course of the relationship to ensure: a) transactions being conducted are consistent with the firm s knowledge of the clients, their business and risk profile b) where necessary, that the source of funds for the transactions are from legitimate source and in accordance with firm s knowledge of the clients (5.09, 5.13, 5.17(d) and 5.47) No additional and continuous monitoring of transactions from countries with ineffective anti-money laundering and anti-terrorist financing system ( ) No checks performed to assess reason for changes in client s structure or ownership or changes in the nature of transactions (5.47)

43 TRUSTS Identity of all major parties should be verified (5.54). These include: - the trustees - the settlor and - the principal beneficiaries. Amendment to the Law Article 61B - A central register in cases where the trust generates tax consequences in the Republic of Cyprus to be maintained. The register should include sufficient, accurate and up-to-date information including the identity of: the settlor trustees the protector the beneficiaries, and any other natural person who exercises effective control over the trust.

44 LOCAL AUTHORITIES The firm should obtain a copy of the resolution authorising the undertaking of relevant transactions. Evidence that the individual dealing with the firm has the relevant authority to act should also be sought and retained. (5.59)

45 Clubs, societies and charitable institutions Establish the purpose of its operation Verify its legality by examining its constitution and certificate of registration issued by the relevant Government Authority. Verify the identity of all signatories in accordance with established procedures on client identification of natural persons. (5.58)

46

47 Record keeping Records should be sufficient to be able to permit reconstruction of individual transactions (including the amounts and types of currencies) and which is capable of providing evidence of any criminal activity Client identification records copies of original identity documents Initial and on-going due diligence records Including on validation of source of funds and wealth Evidential material supporting transactions undertaken including in respect of instructions received and on source of funds and destination of payments Correspondence with the clients (6.09 and 6.10)

48 Record keeping (continued) An appropriate retention policy should be documented - Retention period in respect of all records should be minimum five years from end of business relationship or last transaction if business relationship not formally ended (6.06, 6.07 and 6.08) Retention policy should be in accordance with GDPR

49 Recognition and reporting of suspicious transactions A Money Laundering Compliance Officer (MLCO) should be appointed and notified to MOKAS (7.10) MLCO should be sufficiently senior to command the necessary authority (7.09) Role and responsibilities of MLCO should be documented (7.11 and 7.12) The MLCO should have timely access to client identification data and other client due diligence information, transaction records and other relevant information (3.02 and 6.11)

50 Recognition and reporting of suspicious transactions (continued) Training and guidance need to be provided to staff on how to recognise suspicious transactions and not to tip-off clients (7.04) Need to establish internal reporting procedures and the method and form of reporting (7.07) Need to provide guidance to staff on their legal obligations failure to report suspicious transactions to MLCO in accordance with internal procedures would be in breach of the AML Law (7.07)

51 Education and training Provision of formal training to all staff on firm s policies and procedures on the compliance requirements of the MLRs In-depth training and understanding of the requirements of the AML Law and ICPAC directive by the MLCO A programme of on-going (refresher) training should be in place (8.01, 8.12, 8.13)

52 Compliance with Law on administrative services (Law 196(I)/2012 consolidated with Laws 109(I)/2013, 117(I)/2014 and 142(I)/2015) to be adopted by ICPAC

53 Compliance with Law on Administrative services (ASP firms) Most requirements on procedures similar to MLRs Written instructions should always be obtained from clients for executing transactions on their behalf (bank administration services) Instructions received from clients should always be validated if not obtained from authorised persons Transactions should be monitored to ensure they are consistent with the data and information held by the firm in connection with the clients

54 Compliance with Law on Administrative services (ASP firms) (continued) Home address should not be used as registered office of clients Not in line with 2014 guidance to ASPs, as someone is not likely to be always present during working hours to accept the correspondence on behalf of the clients Fitness and propriety declarations should be obtained from staff (Article 9 of the Law)

55 2016 IESBA Code of Ethics. Firm receiving referral fees from banks for the introduction of clients. Paragraph of the 2016 Code of Ethics states that accepting a referral fee or commission creates a self-interest threat to objectivity and professional competence and due care. The firm should evaluate the significance of the threat, and apply safeguards necessary to eliminate the threat or reduce it to an acceptable level in accordance with paragraph of the 2016 Code of Ethics, for example, by disclosing to the client any arrangements to receive a referral fee.

56 2016 IESBA Code of Ethics (continued) Client money (paragraphs and 270.2) Should be banked in a separate designated account with the word client in its title Proper books and records should be maintained Regular reconciliations should be carried out

57 Other ICPAC regulations PII Practice contiuity CPD

58 ICPAC regulations Professional Indemnity Insurance (PII) Minimum cover EUR or 7 times the largest group fee, whichever is the greater (Circular 16/2017, dd 30/10/2017 and ICPAC regulation (2)(b) also requirement of 2017 Auditors Law) PII should have an appropriate retroactive date Practice continuity (regulation 1.201, paragraph 18) Ensure in writing with a person/firm that has equivalent qualifications

59 ICPAC regulations (continued) Continuous Professional Development (CPD) Minimum 40 units each year Out of which 21 must be verifiable (regulation 1.109)

60 Any Questions? ACCA

61 Thank you ACCA