MONEY-LAUNDERING AND TERRORISM FINANCING PREVENTION SANTANDER GROUP GLOBAL POLICY June 2010 1
CONTENTS 1. Introduction 2. The concept of money laundering 3. Written anti-money laundering program 4. Customer acceptance policy 5. Know your customer 6. Internal organization for money-laundering prevention 7. Analysis and control of sensitive operations 8. Reporting suspicious activities to the Authorities 9. Preservation and filing of documents 10. Record-keeping and reporting requirements 11. Training of Santander Group personnel 12. Consolidated KYC Risk Management 13. Internal Audit 14. Policy Owner 2
MONEY-LAUNDERING AND TERRORISM FINANCING PREVENTION SANTANDER GROUP GLOBAL POLICY 1. Introduction In response to the international community s growing concern about the problem of money laundering and the financing of terrorism, many countries around the world are enacting or strengthening their laws on the subject. Along with society and the authorities of different countries, the Santander Group recognizes the importance of the fight against money laundering and terrorism financing, since it impacts fundamental aspects of social life. The Santander Group supports the Basle Declaration of 1990 and manifests its complete solidarity and maximum co-operation with the relevant authorities in these matters. The Santander Group understands that the best way to fulfil this commitment is to establish effective internal policies and procedures that are conducive to: Conducting financial activities in accordance with strict ethical standards and current laws and regulations. The implementation of codes of conduct and monitoring and reporting systems to prevent its entities from being used for money laundering and terrorism financing. Ensuring that all employees observe Know Your Customer policies and procedures. Strict compliance with applicable anti-money laundering and terrorism financing laws, as well as the recommendations issued on this subject by the International Financial Action Task Force and domestic and international authorities. As a result, Santander Group management and employees must be vigilant for any suspicious activity and report it immediately to the established internal bodies, in accordance with specified policies and procedures, so that they may in turn notify the relevant authorities. Only through the commitment of all Santander Group executives and employees will it be possible to guarantee that the products being marketed and the services being provided cannot be used for money-laundering or terrorism financing purposes. Adherence to this policy is absolutely fundamental to ensuring that all Santander Group entities, regardless of geographic location, comply fully with anti-money laundering and terrorism financing legislation. They should therefore be actively involved in the policy s implementation and development. This policy establishes minimum standards which Santander Group Units should observe and is defined according to the principles contained in the 49 Recommendations of the International Financial Action Task Force (FATF) and the obligations and principles of European Parliament and Council Directive 2005/60/RC dated 26 th October 2005, regarding the prevention of the use of the financial system for money-laundering and the financing of terrorism. In the event that local laws against money-laundering of terrorism financing establish stricter demands, Santander Group units should observe such laws. 3
If any applicable local laws are in conflict with this policy, Santander Group Units must consult the appropriate Legal Department, which in turn will inform the respective Money Laundering Prevention Officer or Unit. When local provisions prevent its application, the Unit affected should immediately inform the Santander Group s Analysis and Resolution Committee (CAR), by way of the DCPBC (Central Department for the Prevention of Money Laundering) of the reasons why this policy cannot be applied. Compliance with this policy and the standards it sets forth is mandatory for all Santander Group Units worldwide. In this sense, Units are understood as all banks, affiliate companies, departments or branches of the Santander Group, both in Spain and abroad, who in accordance with the criteria set forth in this Manual, are susceptible to the application of internal regulations on anti-money laundering and terrorism financing matters. In the development, implementation, and application of the policies and procedures that comprise the anti-money laundering and terrorism financing programme in each of the Santander Group Units, the policy set forth herein shall be followed, adapting it, to the extent permitted by the country s laws and regulations and nature of the business, to the model developed by the Santander Group in Spain. 2. The concept of money-laundering and terrorism financing Money-laundering is the participation in any activity that seeks to acquire, possess, use, convert, transfer, conceal or disguise the true nature, origin, location, disposal, movement or ownership of assets, in the knowledge that such assets are derived from criminal activity or from participation in criminal activity. Terrorism Financing is defined as the providing, depositing, distribution or collecting of funds, by any means, directly or indirectly, intended to be used, or knowing that they are to be wholly or partially used, for the committing of terrorist acts. Generally speaking, the money laundering process, very closely linked to the financing of terrorism, consists of three stages: Placement Introduction of cash originating from criminal activities into financial or non-financial institutions. Concealment Separating the proceeds of criminal activity from their source through the use of layers of complex financial or non-financial transactions. These layers are designed to hamper the control of the funds, disguise their origin and provide anonymity. Integration Placing the laundered proceeds back into the economy in such a way that they re-enter the financial system as apparently legitimate funds. Financial institutions may be used at any point in the money laundering or terrorism financing process. 4
3. Written Anti-Money Laundering and Terrorism Financing Programme Each Unit must have a written anti-money laundering and terrorism financing program (Money Laundering and Terrorism Financing Prevention Manual) establishing the policies, procedures and internal controls designed to comply with applicable law. The written programs should ensure that Santander Group Units: - Know their customers. - Designate personnel to be responsible for compliance with anti-money laundering and terrorism financing provisions. - Comply with applicable requirements established by law for the obtaining of documents, record-keeping and reporting of transactions. - Develop and implement appropriate methods of control to detect suspicious activity by customers and to take appropriate action. - Report suspicious activity to government authorities in accordance with applicable legislation. - Introduce corporate anti-money laundering and terrorism financing training programs. - Implement internal audit and quality control systems with respect to anti-money laundering and terrorism financing policies and procedures. The Money Laundering and Terrorism Financing Prevention Manuals prepared by each Santander Group Unit must be validated by the DCPBC and approved by the CAR (or in absence of the latter, the most senior management body of the Unit in question). 4. Customer acceptance policy 4.1. Business risk evaluation and management The Santander Group considers that the threat of becoming involved in any money laundering or terrorism financing activity is directly related to the type of business carried out by its units and the products they distribute, and that such threat can be more effectively and efficiently managed if the potential risk linked to the different types of business and products is known beforehand. Classifying its units by risk level will enable the Santander Group to design and implement measures and controls to mitigate such risk. Likewise, it will enable it to focus on those business lines and products that present greater risk. Therefore, all Santander Group units should apply a procedure that will enable them to determine the risk of the business lines in which they participate and the products they distribute, with respect to money laundering or terrorism financing. The criteria and factors to be used for measuring such potential risk should also be identified. 4.2. Customer segmentation by risk In the same sense as the preceding section, risks inherent in money laundering or terrorism financing can be managed more effectively and efficiently if the potential risk linked to the different types of customer and their transactions is known beforehand. 5
Having customers and their transactions identified by risk level will enable the Santander Group institutions to design and implement measures and controls to mitigate such risk. Likewise, it will enable them to focus on those customers and transactions that present the greatest risk. In some cases, such risk may only become apparent once the customer has started to operate the account, such fact making it compulsory for the monitoring of the customer s transactions to be a fundamental component of the riskbased approach. In this sense, all Santander Group units should design a procedure, based on the risk consideration of their own business and the products marketed by them, which will provide an appropriate framework for segmenting their own customers by levels of money laundering or terrorism financing risk. The criteria and factors to be used for making such segmentation should also be identified. 4.3. Prohibited customers or with reinforced acceptance measures For money-laundering and terrorism financing risk control purposes, the Santander Group will not accept the following categories of customers: Persons included in any of the official lists of sanctions ( applicable lists ). Persons about whom information is available indicating possible involvement in criminal activities. Persons with businesses that make it impossible to verify the legitimacy of their activities or the source of funds. Persons who refuse to provide the required information or documentation. Legal entities whose shareholder or control structure cannot be determined. Casinos or gambling/betting establishments that are not officially authorized. Financial institutions resident in countries or territories without being physically present (also referred to as shell banks ) and which do not belong to a regulated financial group. The following will only be accepted as customers with prior authorization from the Analysis and Resolution Committee (CAR) in the relevant country: Customers involved in the production or distribution of weapons and other military equipment. Duly authorised casinos or gambling establishments. Bureaux de change, money transmitters, or other similar entities. Customers who are high-level public officials and their family members, and wellknown personalities wishing to open accounts outside their native countries (PEP s). 5. Know Your Customer The most effective means of preventing the use of the financial system for money laundering or terrorism financing is to identify and know your customers, regardless of whether they are established customers or otherwise. Along these lines, all Santander Group Units should establish regulations, procedures, and internal controls aimed at obtaining effective and complete knowledge of their customers and their activities, in order to: Confirm and document the true identity of customers who maintain any type of banking relationship. 6
Confirm and document any additional customer information commensurate with the assessment of the money laundering and terrorism financing risk. Ensure that Santander Group Units do not do business with any individuals or entities whose identities cannot be confirmed, who do not provide all required information, or who have provided information that is false or that contains significant inconsistencies that cannot be clarified. For customer identification, Santander Group entities shall consider the following criteria: In the case of individuals, an official identification document shall be required to confirm the individual s identity. For corporations and other legal entities, the deed of incorporation must be presented, including information concerning the customer s name, legal form, address, directors, and the corporate bylaws, powers of attorney, entry in the appropriate register or other reliable identifying information. Neither anonymous accounts nor accounts using fictitious names may be opened or maintained. Coded or ciphered accounts may be opened only in those countries where it is legal to do so and when the most senior officer of the Group in the country or the Unit affected has given express authorization in writing. In these cases, all requirements must be fulfilled, including identification of the beneficial owner of the account, in accordance with these regulations and those established by the provisions of the country in which the account is to be opened. The documents evidencing the authority of any person authorizing financial transactions on behalf of the customer shall be required. Santander Group Units shall have procedures for determining that person s identity and relationship to the customer. All necessary measures shall be taken to obtain information about the true identity of the person on whose behalf a relationship is established, an account opened, or a significant transaction conducted (that is, the beneficial owners) whenever the customer is acting on behalf of third parties or in cases where doubts exist as to whether the customer is acting on its own behalf. In the case of legal entities, except for those listed on a regulated market, the individual who ultimately controls, directly or indirectly, a percentage exceeding 25% of its shares, rights or assets, shall be identified. 6. Additional customer information Santander Group Units shall use procedures that enable them to obtain the necessary information at the time of the establishment of a relationship or at the opening of an account, commensurate with the assessment of the money laundering and terrorism financing risks, in order: To establish the customer s source of funds. To establish the nature and extent of the customer s expected use of its products and services. To confirm the information provided by the customer. 7. Customer referrals from Units abroad Santander Group Units shall use procedures in order to check that they have appropriately identified the customers referred to them or concerning whom information has been provided by other Group Units, so they may: 7
Provide documentary evidence that the other Group Unit has knowledge of the customer. Determine that the information and documentation obtained by the Unit referring the customer satisfies its own identification requirements. If the Unit administering the relationship with the customer has the necessary information, it must also make that information available to the Group Units that provide products and services to the customer. If the Unit administering the relationship with the customer does not have the required information, or cannot supply it, the Units that provide products or services shall obtain this information directly from the customer. In any event, Units providing products or services to a customer must have sufficient information to enable them to detect any suspicious activity on the part of the customer. 8. Internal Organization for money-laundering and terrorism financing prevention Santander Group Units shall establish the appropriate internal controls and reporting mechanisms in order to recognize, prevent, and impede illicit transactions related to money laundering or terrorism financing and report to government authorities in accordance with applicable law. These bodies will be subject to local legal and regulatory standards and should adhere to the principles of timeliness, security, efficiency, and coordination, not only with respect to internal reporting but also in the investigation and reporting of operations. An organisation for money laundering and terrorism financing prevention will be established for each country, conforming to the model adopted by the Santander Group in Spain. As a minimum, each Group Unit shall designate a Money Laundering and Terrorism Financing Prevention Officer. The Money Laundering and Terrorism Financing Prevention Units (which are the bodies specializing in these matters) function in connection with all affiliate companies in the respective country. Their responsible officers will be designated by the CAR at the proposal of the respective management bodies, following approval by the DCPBC, to whom they will report functionally. In cases where the size of the business does not justify the existence of a Money-Laundering and Terrorism Financing Prevention Unit, such responsibilities will be assumed by an Officer Responsible for Prevention, as a minimum. The management of the Santander Group in each country will be responsible for assigning the necessary personnel and resources to the respective Money Laundering and Terrorism Financing Prevention Unit. The personnel assigned to money laundering or terrorism financing prevention tasks, according to their organic hierarchy, will report functionally and in all cases to the DCPBC. 9. Analysis and control of sensitive transactions Santander Group Units shall develop and implement procedures for monitoring and immediately investigating sensitive or high-risk transactions relating to money laundering or the financing of terrorism, with the object of detecting suspicious activities. The monitoring procedures implemented should have the appropriate IT applications, 8
bearing in mind the type of transactions, business sector, geographical scope and volume of information involved. The monitoring of high risk customers should be intendified. Each Unit should establish key indicators for such customers and their accounts, considering factors such as country of origin, source of funds, type of transaction and other risk factors. Santander Group Units shall have policies and procedures in place to ensure that once a suspicious transaction or activity is detected, the matter is referred to the person or Unit established by internal regulations. 10. Reporting suspicious activities to the Authorities Santander Group Units in all countries shall have policies and procedures that require the immediate reporting of suspicious activities to internal anti-money laundering bodies, so that they may perform the necessary investigations and issue timely reports or communications of suspicious transactions to the Authorities in compliance with local laws, whenever it is determined that such transactions: could be related to funds derived from criminal activities or be designed to hide or disguise funds or assets derived from such activities; could compromise funds which directly or indirectly are to be used, totally or partially, to commit terrorist activities; are divided or structured to evade the reporting or recordkeeping requirements of the applicable anti-money laundering and terrorism financing laws and regulations; are without a business or apparent lawful purpose after examination of the available facts, including the background and possible purpose of the transaction. When Santander Group Units or employees report suspicious transactions or activities to the internal anti-money laundering units, in accordance with the procedures established by internal policies and procedures, they are strictly prohibited from providing any information internally or externally regarding the customers or transactions to which the information pertains. 11. Preservation and filing of documents Santander Group Units shall maintain the following documents for at least six years, unless local legislation specifies a longer period: Documentation containing information on the identification and knowledge of the customer. Reports made to government authorities concerning suspicious customer activity relating to possible money laundering and/or terrorism financing, together with supporting documents. Records of all courses given on the prevention of money-laundering and terrorism financing. Any other documents or registers required to be retained under applicable antimoney laundering or terrorism financing laws. In Spain, the minimum period for preserving such documents is established at 10 years (article 25, Act 10/2010 of 28 th April). The aforementioned documentation should be appropriately filed so that it may be easily 9
retrieved and its confidentiality guaranteed. 12. Compulsory record-keeping and reporting requirements Santander Group Units shall have procedures for ensuring the enforcement of the requirements established by the laws of the country in question concerning the recording of certain transactions and their compulsory and systematic regular reporting to the authorities, whether they involve cash transactions, funds transfers, or other types of operations. In addition, Santander Group Units must develop and implement appropriate monitoring procedures and systems to detect and prevent the dividing or structuring of transactions aimed at avoiding their recording or reporting to the authorities. Equally, Santander Group Units will develop and implement the necessary controls and systems to enable it to fully comply with local laws, in each case, regarding the blocking of transactions and flow of funds and/or the prohibition to open accounts for those individuals or companies that, as described in such regulations, may be subject to these measures. 13. Training of Grupo Santander personnel A priority objective for the Santander Group is the adoption of necessary measures to enable its personnel to be familiar with the requirements established by anti-money laundering and terrorism financing laws and regulations. A priority objective for the Santander Group is the adoption of necessary measures to enable its personnel to be familiar with the requirements established by anti-money laundering and terrorism financing laws and regulations. Thus, the Human Resources Department of each Unit, under the supervision and coordination of the Training, Knowledge and Development Area of Banco Santander s Human Resources Division in, shall organise yearly training programmes and special courses for management and employees, and specifically for personnel whose positions are suitable for detecting activity or transactions that may be related to money laundering or terrorism financing, and train these employees to detect suspicious activity and to understand the procedure in such cases. The training programs should bear in mind international standards and local legislation to prevent money laundering and terrorism financing, the latest trends in criminal activity, and Santander Group policies and procedures designed to combat money laundering and terrorism financing, including how to recognize and report suspicious activities. The Human Resources Departments of the Santander Group Units, in adapting corporate training plans and programs, should develop similar training programs and determine which personnel require specialized training in view of the risk of money laundering and terrorism financing inherent in their responsibilities or positions. A specific record will be kept of all training activity given, stating the date, place and duration of each course, the number of attendees and the Unit to which they belong. A copy of these records should be sent to the Training Area of Banco Santander in Spain. 10
Apart from general training programs, all Area, Unit, and Branch Money Laundering Prevention Officers should be informed of and should provide on-going updates to the employees under their authority regarding changes in the policies and laws and regulations on this subject, as well as any new methods, techniques, or procedures found to be susceptible to money laundering or terrorism financing. Grupo Santander Units shall establish in writing and apply the appropriate policies and procedures to ensure high ethical standards in the hiring of employees, executives and agents. 14. Consolidated KYC Risk Management Santander Group believes that an efficient way to manage legal and reputational risks associated to being unwittingly used as a vehicle for money laundering or other unlawful activities is the consolidated management of these risks at a Group level, encompassing all branches and affiliates, regardless of their operating jurisdiction. Consolidated KYC risk management will be considered as the process centralised at Banco Santander in order to coordinate and to share information at Group level, in order to identify, monitor and mitigate legal and reputational risks while totally observing all applicable legislations and regulations. Accordingly, all branches and affiliates will immediately submit to Head Office, upon their own initiative, all data associated with relevant high risk customers and activities and, equally, will meet all information requests coming from Head Office regarding information that may help to manage, at Group level and on a consolidated basis, the legal and reputational risks associated to money laundering and the financing of terrorism. Those affiliates holding local or offshore subsidiaries and having responsibilities over their legal and reputational risks shall establish identical channels of information and to create a solid information pyramid in line with Banco Santander. In any case, safeguard measures will be set, in order to guarantee the confidentiality of the information related to customers and transactions, being subject to the privacy legislation in force in the relevant jurisdiction. 15. Internal Audit The internal audit function is necessary to ensure continued compliance with this policy, and its responsibilities include independently supervising the effectiveness of the Santander Group s money laundering and terrorism financing prevention system (which comprises compulsory policies, standards and procedures) to ensure that all Units know their customers and that transactions are performed in conformity with professional ethics and current anti-money laundering and terrorism financing laws. The internal audit function will conduct the necessary audits and reviews for this purpose. 16. Policy Owner The owner of this policy is the Board of Directors of Banco Santander, S.A., and is approved at the proposal of Grupo Santander s Analysis and Resolution Committee (C.A.R). Further amendments to this policy shall be approved by the Board, following the proposal, where applicable, of the C.A.R. 11
The C.A.R. of Grupo Santander is responsible for approving the necessary procedures in order to implement this policy across the Group s Units. 12