Gazette of. paragraph DECISION. and implementat. and terrorist financing; laundering. financing. appointing and audit.

Transcription

1 NATIONAL BANK OF THE REPUBLIC OF MACEDONIA Pursuant to Article 64 paragraph 1 item 22 of the Law on the National Bank of the Republic of Macedonia ("Official Gazette of the Republic of Macedonia" no. 3/2002, 51/2003, 85/2003, 40/2004, 61/2005 и 129/2006) and Article 46 paragraph 5 of the Law on Prevention of Money Laundering and Other Proceeds of Crime and Terrorist Financing ("Official Gazette of the Republic of Macedonia" no. 4/2008 и 57/2010), the National Bank of the Republic of Macedonia Council adopted the following DECISION on the manner and the procedure for introduction and implementation of the bank's program for prevention of money laundering and terrorist financing ("Official Gazette of the Republic of Macedonia" no. 103/2010) I. GENERAL PROVISIONSS 1. This Decision shalll regulate the manner and the procedure for introduction and implementat tion of the bank's program for prevention of money laundering and terrorist financing (hereinafter referred to as: the Program), which shall include the following: procedures for clients acceptance; procedures for client due diligence; procedures for risk analysis and risk analysis indicators; procedures for assessing the risk of holder of public function; procedures for identification of unusual transactions and suspicion for money laundering and terrorist financing; procedures for keeping data and documents and submission of reports to the Office for Prevention of Money Laundering and Terrorist Financing (hereinafter referred to as: the Office); permanent training plan for the employees in the area of prevention of money laundering and terrorist financing (hereinafterr referred to as: the Training Plan); appointing of responsible person; manner of cooperation with the Office; proceduree and plan for performing internal control and audit on the implementation of the measures and activities. 2. This Decision shall contain the minimum standards the banks should apply in order to establish adequate program, where each bank may include additional elements in its internal acts, depending on the scope and the nature of the activities it performs.

2 3. The bank shall be obliged to ensure compliance with the measures for prevention of money laundering and terrorist financings in force in the Republic of Macedonia also by its subsidiaries, branch offices, or representative offices in the country and abroad, to the level permitted according to the regulations of the country where such subsidiary or branch office is located. The bank shall be required to inform the National Bank of the Republic of Macedonia (hereinafter referred to as: the National Bank) and the Office, if the respective subsidiary or branch office abroad is not in position to adhere to the measures for prevention of money laundering and terrorist financing, when the laws of the country where the subsidiary, branch office or the representative office is located do not allow application of those measures. II. PROCEDURE FOR CLIENTS ACCEPTANCE 4. The bank shall be required to establish procedures for clients acceptance which determine the types of clients that could expose the bank to a risk of money laundering and terrorist financing. 5. The bank shall be required to use the following data and information on the basis of which it can determine which clients could expose the bank to the risk of money laundering and terrorist financing: client's history, if it is an existing client of the bank; type of activity it performs; geographical location of the client and its most significant business partners; relation with public functions and holders of public functions; type of bank products and services the client will use or it already uses; and source of funds, in line with items 12 and 13 of this Decision. III. PROCEDURES FOR CLIENT DUE DILLIGENCE 6. The bank shall be required to perform client due diligence, at least in the manner determined in the Law on Prevention of Money Laundering and Other Proceeds of Crime and Terrorist Financing (hereinafter referred to as: the Law) and this Decision. The client due diligence shall include: identification and verification of the identity of the client, the principal (holder of rights), or the beneficial owner; providing information on the purpose and the intention of the business relation; and ongoing monitoring of the business relation with the client. 1. Identification and verification of the identity of the client, the principal (holder of rights), or the beneficial owner 7. The bank shall identify and verify the identity of the client, principal, or the beneficial owner, at least in a manner and on the basis of the documentation and the data stipulated in the Law, with the bank being required to ensure that: 2

3 it possess accurate sources of information, documentation and data; it possess data on the basis of which it will be able to determine and verify the identity of the beneficial owner of the client, which also includes determining its ownership and management structure; and it possess accurate information on the identity of the principal and the proxy. 8. When identifying and verifying the identity of a foreign client, principal or beneficial owner (nonresident), the bank shall adequately apply the rules valid for the domestic clients. 9. The bank can verify the identity of the client, principal or the beneficial owner also trough some of the following independent sources of data: determining of the permanent address by using other sources of data (telephone bills, electricity, etc., data that are at disposal of the Information Service 188, etc.); contacting the client and the beneficial owner by telephone, letter, or ; contacting the embassy (consulate, liaison office) of the country the nonresident comes from; obtaining the latest financial statement on the operations of the client legal entity, audited by authorized auditor, if possible; using the data that of the public registries (Central Registry, Central Securities Depositary etc.); visiting the client and the beneficial owner, if possible; and verification of the client's status (whether bankruptcy or liquidation procedure was initiated). 2. Providing information on the purpose and the intention of the business relation 10. The bank shall be required to provide data and information on the basis of which it can determine the purpose and the intention for the business relation with the client, which can include data on the nature of its activities, the financial standing, the sources of funds and the most significant business partners. 11. The bank can determine the sources of funds of the client natural person through obtaining data on the following: the amount of the monthly sallary, other additional sources of funds, the property ownership etc., on the basis of which it can get more accurate picture of the business relation with the client. 3. Ongoing monitoring of the business relation and transactions undertaken within that relation 12. The bank shall be required to conduct ongoing monitoring of the business relation with the client and the transactions performed within the business relation in order to confirm that these transactions are in conformity with the purpose and the intention of the business relation and the source of financing of the client. 13. The monitoring of the business relation with the client shall also denote regular update of the documents and the data the bank has on its disposal for that 3

4 client. The bank shall determine the manner and the moment of updating of the data within its internal procedures. IV. PROCEDURES FOR RISK ANALYSIS AND RISK INDICATORS 14. The bank shall be required to develop an internal risk assessment procedure, which should enable creation of risk profile for each client it will establish business relation with and/or it will update the business relation, within which it shall determine and monitor the level of risk of money laundering and financing terrorism arising from the relation with that client. The bank shall be required to determine at least the following in the internal procedure: the manner of creating the risk profile; determining of the risk level; monitoring of the risk level; and transferring of the client from one risk level into another. 15. In instances when there is high risk of money laundering or terrorist financing, the bank shall be obliged to make enhanced client due diligence. 1. Enhanced clients due diligence 16. The bank shall be obliged to make enhanced client due diligence in conformity with the Law and item 15 of this Decision, which pertain at least to these clients: clients that use private banking services; correspondent banks; clients not being physically present at the moment of concluding or performing the business relation; clients coming from risky countries; clients the business relation of which is carried out by using new technologies or developing technologies. The responsible person in the bank for prevention of money laundering and terrorist financing (hereinafter referred to as: responsible person) should be informed on the establishment of business relations with the persons under paragraph 1 of this item, as soon as possible Private banking 17. The banks shall be required to perform enhanced due diligence in case of transactions of socalled private banking, due to which the bank can be exposed to higher risk of money laundering and terrorist financing. The private banking shall include financial services provided to natural persons who mostly invest considerable amount of deposits or other types of assets with the bank. The services that are offered are not part of the regular manner of offering products and retail services, but the business relation between the bank and the client is established directly, in person, through the bank s employees which are responsible for execution of those services (for example, personal banker, private banker or etc.). 4

5 18. Business relation which implies performance of private banking can be established only on a basis of a decision adopted by the person with special rights and responsibilities in the bank, responsible for operations with that type of clients. 19. The bank shall be obliged to ensure efficient identification and monitoring of the clients to which it offers the private banking service and their operating, as well as to ensure this type of business relation to be subject to the internal audit and the control performed by the responsible person Correspondent banks 20. In order to establish and continue the business relation with a correspondent bank which is subject to enhanced due diligence, the bank shall be required to undertake the additional measures prescribed by the Law. The following data shall be taken into consideration: on the persons who would use the account of the correspondent bank opened with a bank in the Republic of Macedonia; on the measures and activities for money laundering prevention and terrorist financing and data on the manner of conducting supervision in the country of the correspondent bank; on the system of control of prevention of money laundering and terrorist financing, as well as the manner of audit of the correspondent bank; assessment of the adequacy of the enhanced due diligence performed by the correspondent bank for clients representing exposure to higher risk of money laundering and terrorist financing; assessment whether the correspondent bank operates with shell banks and (does not) allow/s operating with shell banks; and the legislation that regulates the possibility for exchange of data necessary for implementation of the measures and activities for prevention of money laundering and terrorist financing. The banks can obtain data under paragraph 1 of this item from the correspondent bank (questionnaires, correspondence, etc.), or by using public media (specialized magazines, internet, etc.) Clients not being physically present at the moment of concluding or performing the business relation 21. The banks shall be required to apply additional measures of enhanced due diligence of the clients not being physically present at the moment of concluding or performing the business relation (hereinafter referred to as: clients not being physically present), in conformity with the Law. As clients not being physically present shall be considered those clients with whom the bank realizes the business relation through internet, mail, telephone or other similar means of communication. 22. The bank shall realize the additional measures defined in the Law for operating with clients not being physically present through: 5

6 ensuring and verification of additional documentation, pursuant to the Law; organizing meetings with the client; utilization of data from other institutions that have adequate information on the client, but also with adequate systems for prevention of money laundering and terrorist financing, if it is allowed with the legislation of the country and abroad; and utilization of data available through the public media (specialized magazines, internet, etc.) Risky countries 23. The bank shall be required to pay special attention to the business relations and transactions with clients coming from countries that are on the list of countries published by the Ministry of Finance. If the business relation or transaction have no obvious economic or other evident legal purpose, the bank shall be required to determine the purpose and the intention of the business relation. 24. The banks' employees who directly operate with the clients from item 23 of this Decision shall be obliged to inform the responsible person on each transaction with those clients. In instances of item 23 paragraph 2 of this Decision, the responsible person shall prepare a written report on the purpose and the intention of the business relation, on the basis of the information obtained from the respective organizational units and other bank employees Utilization of new technologies, or developing technologies 25. The bank shall be required to pay special attention to the business relations and the transactions with the clients which are carried out by using new technologies or developing technologies. If the business relation or transaction under paragraph 1 of this item have no obvious economic or other evident legal purpose, the bank shall be required to determine the purpose and the intention of the business relation or the transaction. In instances from paragraph 2 of this item, the employees that directly operate with those clients shall be required to inform the responsible person, who shall prepare a written report on the purpose and the intention of the business relations, on the basis of the information obtained from the respective organizational units and other bank employees. V. PROCEDURES FOR ASSESSING THE RISK OF HOLDERS OF PUBLIC FUNCTIONS 26. The bank shall be required to undertake additional measures determined in the Law, for the holders of public functions. The undertaking of additional measures set forth in the Law shall mean: 6

7 establishing adequate system for timely identification of the holders of public functions; assessment of the risk level the holder of public function impose to the bank; the decision on establishing business relation with the client should be adopted by a person with special rights and responsibilities responsible for the operating of the respective organizational unit in the bank. In instances when the current client becomes holder of a public function, the bank shall adopt decision on (dis)continuation of the business relation with that client, which shall be adopted by the respective person with special rights and responsibilities; determining of the source of funds of the client, in conformity with items 12 and 13 of this Decision; and ongoing monitoring of the business cooperation with these persons. VI. PROCEDURES FOR IDENTIFICATION OF UNUSUAL TRANSACTIONS AND SUSPICION FOR MONEY LAUNDERING AND TERRORIST FINANCING 27. In order to provide efficient identification of the suspicious transactions, the bank shall be required to identify the complex, unusually large transactions, or transactions that are executed in unusual manner, which have no apparent economic justification, or evident legal purpose (hereinafter referred to as: unusual transactions). Unusual transactions can be considered all transactions which are uncommonly large, the character of which fails to correspond to the type of activities the client performs, while the client gives no acceptable explanation why that transaction has been executed (for example, amounts that fail to correspond to the client's regular manner of operating, large turnover on the clients' account failing to correspond to the size of its balance sheet, etc.). The bank shall be required to determine the purpose and the intention of the unusual transactions, about which the responsible person shall prepare a written report, on the basis of the information obtained from the respective organizational units and other bank's employees. 28. On the basis of the client's risk profile and the written report on the unusual transactions, the responsible person shall adopt a decision whether it is a suspicious transaction, i.e. whether there is a suspicion that the client, the transaction, or the beneficial owner are related to money laundering and terrorist financing. 29. The bank shall be required to define at least the following elements in its internal acts: list of indicators for identification of suspicious transactions; the documentation which it has to possess with respect to the transactions which were decided not to be reported; deciding on withholding, rejection, or execution of certain transaction; and the manner of reporting to the bank's managing bodies for transactions that were reported to the Office and the transactions which were decided as nonsuspicious. 7

8 VII. PROCEDURES FOR KEEPING OF THE DATA AND THE DOCUMENTS AND SUBMISSION OF REPORTS TO THE OFFICE 30. The bank shall be required to keep the information and the data obtained during the identification and verification of the client's identity, monitoring of the client and the transactions it executes, at least in the manner and within the deadline set forth in the provisions of the Law referring to the keeping of data. The requirement under paragraph 1 of this item shall refer also to the risk profile, the analyses and the written reports prepared pursuant to the Law and this Decision and the reports submitted to the responsible person, the bank's bodies, the Office, the National Bank and to other competent bodies. VIII. PERMANENT TRAINING PLAN OF THE EMPLOYEES 31. The bank shall be required to determine and to implement annual plan for permanent training of the responsible person and the persons employed in the money laundering prevention and terrorist financing unit, as well as of the employees directly or indirectly included in the operations with clients, or in the execution of transactions. The plan must envisage maintenance of at least three trainings during the year. 32. The organization of the training shall be within the direct competence of the responsible person, who should make estimation of the need for training of the employees and on that basis to prepare an annual training program. The responsible person shall be required to keep a record on the type of the training and the persons included in the training. 33. The training of the bank's employee shall include at least the following: acquainting the employees with all regulations from the area of prevention of money laundering and terrorist financing; informing on the bank's program for prevention of money laundering and terrorist financing; acquainting the employees on the international acts within the domain of prevention of money laundering and terrorist financing (recommendations of the Basel Committee of Banking Supervision, FATF recommendations and documents issued by this organization, recommendations given in the reports of the Committee of the Council Europe etc.). practical training referring to the implementation of the international standards for combating money laundering and terrorist financing; practical training for identification of suspicious transactions; practical training for enhanced due diligence of clients with higher risk for money laundering and terrorist financing within the domain of their identification, verification and monitoring. 34. The training plan for the employees should be regularly updated in order to encompass all internal and external changes (business strategy, regulations, etc.), as well as to include the new employees in the bank. 8

9 The training of the new employees of the bank should be carried out immediately after the employment (maximum during the first six months). IX. APPOINTING OF RESPONSIBLE PERSON 35. Pursuant to the Law, the bank shall be required to appoint responsible person, or to establish special organizational unit responsible for implementation of the Program, as well as for providing fulfillment of the conditions stipulated in the Law. Responsible person can be the person responsible for controlling of the bank s compliance with regulations, or the person who manages the department for control of the bank s compliance with the regulations. 36. The responsible person shall be held liable for its operation to the bank's Board of Directors. 37. The responsible person shall perform at least the following activities: analyze the risks of money laundering and terrorist financing; collect all unusual transactions submitted by different organizational units in the bank, analyze them, prepare written reports and decides whether those transactions have characteristics of suspicious transaction, i.e. it adopts decision on their (non)reporting to the Office; provide information and documentation for all transactions reported to the Office, as well as for all transactions which were decided not to be reported to the Office, including also the reasons for adopting such a decision; give recommendations for amending the bank's program, for its revision and improvement, as well as determine the degree of its compliance with the regulations which pertain to the prevention of money laundering and terrorist financing; report to the Boards of Directors (on a monthly basis) and Supervisory Board (on a quarterly basis). The reporting shall obligatory include data on the business relations concluded with the persons under items 16 and 26 of this decision; advise the management bodies on the measures to be undertaken for compliance with the regulations from the area of prevention of money laundering and terrorist financing, including also monitoring of all amendments to these regulations; organize permanent training of the employees for all aspects significant for appropriate implementation of the process of prevention of money laundering and terrorist financing in the bank and establishing guidelines and instructions for adequate implementation of the regulations from this area; follow up the novelties in the regulations and the international standards for prevention of money laundering and terrorist financing; prepare annual plan for permanent training; maintain regular contacts with other bodies and institutions included in the activities for prevention of money laundering and terrorist financing (the Office, the National Bank, other banks, etc.). 9

10 X. COOPERATION WITH THE OFFICE 38. The bank shall be required to establish regular communication with the Office, which means submission of written reports on suspicious clients and transactions and for exchange of data and information on the clients for the purposes of the prevention of the money laundering and terrorist financing. 39. The bank shall be required to establish internal procedures which will regulate the method of cooperation with the Office, pursuant to the Law. XI. INTERNAL CONTROL AND AUDIT ON THE IMPLEMENTATION OF THE MEASURES AND ACTIVITIES 40. The Internal Audit Department shall perform internal audit on the process of prevention of money laundering and terrorist financing, pursuant to the annual operating plan of the Department. The Internal Audit Department shall be required to perform regular audit on the implementation of the Program, in order to determine the adequacy and the efficiency of that Program and of the operating of the responsible person. 41. The bank shall be required to provide adequate staffing of the Internal Audit Department with individuals having sufficient experience on the systems for prevention of money laundering and terrorist financing and to enable their adequate training for all novelties related to the international techniques of money laundering and terrorist financing. 42. The bank shall be required to establish and to apply procedures for employment of new individuals in the bank which will enable employment of individuals with adequate ethic norms. XII. TRANSITIONAL AND CLOSING PROVISIONS 43. The provisions of this Decision shall be applied adequately to the savings houses and branch offices of foreign banks in the Republic of Macedonia. 44. By entering of this Decision into force, the Decision on the manner and the procedure for implementation and application of the bank's program for prevention of money laundering and terrorist financing ("Official Gazette of the Republic of Macedonia" no. 83/2009) shall become void. 45. This Decision shall enter into force on the eighth day of its publication in the "Official Gazette of the Republic of Macedonia". D. no. 0215/X2/2010 Governor and President Skopje, July 29, 2010 of the National Bank of the Republic of Macedonia Council Petar Goshev, M.Sc. 10