The Basel Committee on Banking Supervision

The Basel Committee on Banking Supervision Introduction The Basel Committee on Banking Supervision, established in 1974 by the central bank governors of the Group of Ten (G-10) countries, promotes sound supervisory standards worldwide. The Committee is the primary global standard-setter for the prudential regulation of banks and provides a forum for cooperation on banking supervisory matters. Its mandate is to strengthen the regulation, supervision, and practices of banks worldwide to enhance financial stability. The Committee is best known for its landmark publications on capital adequacy (Basel I, Basel II, and Basel III). The Committee’s Secretariat is located at the Bank for International Settlements in Basel, Switzerland, and it is staffed mainly by professional supervisors on temporary assignment from member institutions. MEMBERS OF THE BASEL COMMITTEE ON BANK SUPERVISION Country Institution Argentina Central Bank of Argentina Australia Reserve Bank of Australia Australian Prudential Regulation Authority Belgium National Bank of Belgium Brazil Central Bank of Brazil Canada Bank of Canada Office of the Superintendent of Financial Institutions China People’s Bank of China China Banking Regulatory Commission European Union European Central Bank European Central Bank Single Supervisory Mechanism France Bank of France Prudential Supervision and Resolution Authority Germany Deutsche Bundesbank Federal Financial Supervisory Authority (BaFin) Hong Kong Special Hong Kong Monetary Authority Administrative Region (SAR, China) India Reserve Bank of India Indonesia Bank Indonesia Indonesia Financial Services Authority Italy Bank of Italy Japan Bank of Japan Financial Services Agency Republic of Korea Bank of Korea Financial Supervisory Service Luxembourg Surveillance Commission for the Financial Sector Mexico Bank of Mexico Comisión Nacional Bancaria y de Valores Netherlands Netherlands Bank Russia Central Bank of the Russian Federation Saudi Arabia Saudi Central Bank Singapore Monetary Authority of Singapore South Africa South African Reserve Bank Spain Bank of Spain Sweden Sveriges Riksbank Finansinspektionen Switzerland Swiss National Bank Swiss Financial Market Supervisory Authority FINMA Turkey Central Bank of the Republic of Turkey Banking Regulation and Supervision Agency United Kingdom Bank of England Prudential Regulation Authority United States Board of Governors of the Federal Reserve System Federal Reserve Bank of New York Office of the Comptroller of the Currency Federal Deposit Insurance Corporation OBSERVERS OF THE BASEL COMMITTEE ON BANK SUPERVISION COUNTRY Chile INSTITUTION Central Bank of Chile Banking Financial Institutions Supervisory Agency Malaysia Central Bank of Malaysia United Arab Central Bank of the United Arab Emirates Emirates History of the Basel Committee Banking supervisors are generally not responsible for the criminal prosecution of money laundering in their countries. However, they play an important role in ensuring that banks have procedures in place, including strict AML/CFT policies, to avoid involvement with drug traffickers and other criminals, as well as generally promoting high ethical and professional standards in the financial sector. The Bank of Credit and Commerce International (BCCI) scandal in the early 1990s, the indictments and guilty pleas of former officials of the Atlanta branch of the Italian Banca Nazionale del Lavoro in 1992, and other international banking scandals prompted banking regulators in the richest nations to agree on basic rules for the supervision and operation of multinational banks. In 1988, the Basel Committee issued a Statement of Principles, called Prevention of Criminal Use of the Banking System for the Purpose of Money Laundering, in recognition of the vulnerability of the financial sector to misuse by criminals. This was the Committee’s first AML/CFT commitment and a step toward preventing the use of the banking sector for money laundering. The statement set out principles with respect to: • Customer identification • Compliance with laws • Conformity with high ethical standards and local laws and regulations • Full cooperation with national law enforcement to the extent permitted without breaching customer confidentiality • Staff training • Recordkeeping and audits These principles preceded AML legislation regarding the disclosure of customer information to enforcement agencies and protection from civil suits brought by customers for breach of confidentiality. Therefore, these principles stressed cooperation within the confines of confidentiality. Since 1988, the Committee has continued to publish papers in support of these commitments. In 1997, the Basel Committee issued its Core Principles for Effective Banking Supervision, a basic reference for authorities worldwide. It stated that, “Banking supervisors must determine that banks have adequate policies, practices, and procedures in place, including strict ‘know-your-customer’ rules that promote high ethical and professional standards in the financial sector and prevent the bank being used, intentionally or unintentionally, by criminal elements.” It also urged nations to adopt FATF’s 40 Recommendations. The Core Principles were prepared with the assistance of 15 non-G-10 nations, including Brazil, Chile, Hong Kong Special Administrative Region (SAR, China), Mexico, Russia, Singapore, and Thailand. The Core Principles for Effective Banking Supervision has been periodically updated. The update in 2012 combined the core principles content with the assessment methodology to create a more comprehensive document. It also revised the structure of the 29 core principles, dividing them more clearly between principles for banking supervisors and for banks. The revised standards include a core principle (BCP 29) that specifically addresses the abuse of financial services and emphasizes the need for adequate policies and procedures, including CDD rules. The Basel Committee’s KYC guidance centers on the use of due diligence requirements to mitigate the dangers of corrupt customers. Without due diligence, banks can be subject to reputational, operational, legal, and concentration risks, which can result in significant financial cost. Sound KYC policies and procedures are critical to protecting the safety and soundness of banks, as well as the integrity of banking systems. The Committee has addressed the importance of KYC standards for supervisors and banks, essential elements of KYC standards, the role of supervisors, and implementation of KYC standards in a cross-border context. Specific issues emphasized include: • • The four key elements of a KYC program: o Customer identification o Risk management o Customer acceptance policy o Ongoing monitoring Banks should not only establish the identity of their customers, but they should also monitor account activity to identify transactions that do not conform to the normal or expected transactions for that customer or type of account. “To ensure that records remain relevant, there is a need for banks to undertake regular reviews of existing records. An appropriate time to do so is when a transaction of significance takes place, when customer documentation standards change substantially, or when there is a material change in the way that the account is operated.” • Numbered accounts should not be prohibited, but they should be subjected to exactly the same KYC procedures as other customer accounts. KYC tests may be carried out by select staff, but the identity of customers must be known to an adequate number of staff if the bank is to be sufficiently diligent. “Such accounts should in no circumstances be used to hide the customer identity from a bank’s compliance function or from the supervisors.” • Specific customer identification issues related to high-risk customers include: o Trust, nominee, and fiduciary accounts o Corporate vehicles, particularly companies with nominee shareholders o Introduced businesses o Customer accounts opened by professional intermediaries, such as or entities with shares in bearer form pooled accounts managed by professional intermediaries on behalf of entities such as mutual funds, pension funds, and money funds • o PEPS o Non–face-to-face customers (i.e., customers who do not present o Correspondent banking themselves for a personal interview) Banks should develop customer acceptance policies and procedures that describe the customer’s background, country of origin, business activities, and other risk indicators. They also should develop clear and concise descriptions of who is an acceptable customer. • Private banking accounts should under no circumstances be allowed to escape KYC policies. • Banks should make every effort to know the identity of corporations that operate accounts and, when professional intermediaries are involved, should verify the exact relationship between the owners and intermediary. • Banks should use standard identification procedures when dealing with non–face-to-face customers and should never agree to open an account for persons who are adamant about anonymity. • Periodic bank-wide employee training should be provided that explains the importance of the KYC policies and AML requirements. • Internal auditors and compliance officials should regularly monitor staff performance and adherence to KYC procedures. • Continued monitoring of high-risk accounts by compliance personnel should be conducted to obtain a greater understanding of the customers’ normal activities and enable the updating of identification papers and detection of suspicious transaction patterns. • Bank regulators should ensure that bank staff follow KYC procedures, review customer files and a sampling of accounts, and emphasize that they will take appropriate action against officers who fail to follow KYC procedures. Customer identification is an essential element of an effective CDD program, which banks need in order to guard against reputational, operational, legal, and concentration risks. It is also necessary to comply with AML legal requirements and identify bank accounts related to terrorism. In February 2003, the Committee issued account opening and customer identification guidelines and a general guide to good practices based on the principles of the Committee’s paper, Customer Due Diligence for Banks. This document, which was developed by the working group on cross-border banking, does not cover every eventuality; rather, it focuses on some of the mechanisms that banks can use to develop an effective customer identification program. The need for rigorous CDD standards is not restricted to banks. The Basel Committee recommends that similar guidance be developed for all nonbank financial organizations and professional intermediaries of financial services, such as lawyers and accountants. In October 2004, the Committee released another important publication on KYC, Consolidated KYC Risk Management, as a complement to its Customer Due Diligence for Banks issued in October 2001. The 2004 paper examines the critical elements of effective management of KYC risk throughout a banking group and addresses the need for banks to adopt a global approach and apply the elements necessary for a sound KYC program to both the parent bank or head office and all of its branches and subsidiaries. These elements consist of risk management, customer acceptance and identification policies, and ongoing monitoring of high-risk accounts. Recent guidance In January 2014, the Basel Committee issued guidelines on Sound Management of Risks Related to Money Laundering and Financing of Terrorism that superseded previous publications on customer due diligence for banks and know-your-customer risk management. The goal of the guidelines was to support banking supervisors and banks in the implementation of the FATF Recommendations concerning AML/CFT within the wider context of banking supervision standards, drawing from the expertise of both organizations and working to avoid duplication. The guidelines on management of risks related to money laundering and the financing of terrorism describe how banks should include these risks within their overall risk management framework. The guidelines state that prudent management of these risks, together with effective supervisory oversight, is critical in protecting the safety and soundness of banks and the integrity of the financial system. Failure to manage these risks can expose banks to serious reputational, operational and compliance risks among others. The guidelines discuss the following controls for banks to implement: • Risk analysis and governance: The first step in managing money laundering risks is to identify and analyze them, which leads to the design and effective implementation of appropriate controls. The analysis should include appropriate inherent and residual risks at the country, sector, bank, and business relationship levels, among others. The assessment of risk should be documented and made available to authorities, such as supervisors. This assessment is also useful in scheduling discussions with other parties in the bank to help them see the risks and design the appropriate controls to mitigate them. • Proper governance arrangements create a culture of compliance, with a strong compliance tone from the top. The board of directors plays a critical oversight role; as the senior-most management of the bank, the board should approve and oversee policies for risk, risk management, and compliance. To make informed decisions, the board also should have a clear understanding of the money laundering risks, including timely, complete, and accurate information related to the risk assessment. Along with senior management, the board should appoint a qualified chief AML officer with overall responsibility for the AML function. The board should provide this senior-level officer with sufficient authority so that, when issues are raised, they get the appropriate attention from the board, senior management, and business lines. This AML officer becomes the board’s proxy for driving the day-to-day success of the bank’s AML efforts. As such, the board should provide the AML officer with sufficient resources to execute his responsibilities to oversee compliance with the bank’s AML program. • Three lines of defense: The Committee describes three lines of defense in a bank’s AML efforts: the line of business, compliance and internal control functions, and internal audit. 1. The line of business, or the first line of defense, is responsible for creating, implementing, and maintaining policies and procedures, as well as communicating them to all personnel. It must also establish processes for screening employees to ensure high ethical and professional standards. It must deliver appropriate training on AML policies and procedures based on roles and functions performed so employees are aware of their responsibilities. To facilitate this, employees should be trained as soon as possible after being hired, with refresher training provided as appropriate. 2. The AML compliance and internal control functions, as well as the larger compliance function and human resources and technology departments, comprise the second line of defense. In all cases, the AML officer is responsible for ongoing monitoring for AML compliance, including sample testing and review of exception reports, to enable the escalation of identified noncompliance and other issues to senior management and, when appropriate, the board. The AML officer should be the contact point for all AML issues for internal and external authorities and should be responsible for reporting suspicious transactions. To enable the successful oversight of the AML program, the AML officer must have sufficient independence from the business lines to prevent conflicts of interest and unbiased advice and counsel. The officer should not be entrusted with the responsibilities of data protection or internal audit. 3. The audit function, or the third line of defense, should report to the audit committee of the board of directors (or a similar oversight body) and independently evaluate the risk management and controls of the bank. This is accomplished through periodic assessments, including the adequacy of the bank’s controls to mitigate the identified risks, effectiveness of the bank’s staff’s execution of the controls, effectiveness of the compliance oversight and quality controls, and effectiveness of the training. The audit function must have knowledgeable employees with sufficient audit expertise. Audits should be conducted on a risk-based frequency; periodically, an enterprisewide audit should be conducted. Audits should be properly scoped to evaluate the effectiveness of the program, including where external auditors are used. Auditors should proactively follow up on their findings and recommendations. • Customer due diligence and acceptance: Banks should develop a customer acceptance policy to identify customers that are likely to pose a higher money laundering risk (e.g., PEPs) and relationships the bank will not accept (e.g., shell banks and those prohibited under economic sanctions, such as those imposed by the US Office of Foreign Assets Control). Banks should apply basic due diligence to all customers and increase the level of due diligence as the risks increase. Some customers may be eligible for simplified due diligence when the money laundering risk is low, in accordance with applicable law. When collecting information, a third-party database, or “KYC utility,” can be particularly useful for gathering information on customers, especially assessing risk indicators. The Committee highlights several factors that banks should consider when using a utility to perform due diligence, including: o The utility specifies the date of the last update and when the information was last confirmed with the source. o The utility clearly specifies the source of the information (e.g., the customer itself, a public registry). Banks’ CDD policies should address customer and beneficial owner identification, verification, and risk profiling. As part of this, banks should identify customers and verify their identities, as well as those of any beneficial owners. There are four main steps for verifying customers: (1) identification of the customer (whether an individual or a legal person) and any beneficial owners or authorized signatories; (2) assessment of the customer’s risk profile information; (3) verification of the identity of the customer and any beneficial owners or authorized signatories, as required by applicable law, using reliable documentary and/or nondocumentary sources; and (4) further risk-based verification, such as verifying source of wealth and source of funds. The minimum information to be collected on individuals includes the legal name, residential address, unique identification number or other identifier, and date and place of birth. Other potential information to be collected, based on risk, can include other names used, residency status, and business address. In order to accurately assess customer risk, certain information should be collected, such as occupation, income, expected use of the account, and products requested. Banks can use documentary and nondocumentary means to verify the information provided by the customer. Documentary methods can include using an unexpired government-issued photographic identification document or confirming a residential address on a utility bill or bank statement. Nondocumentary methods include using public registers, private databases, and other reliable and independent sources. Finally, further verification should be performed when a customer is considered high risk, such as verification of income sources, verification of employment, or a personal reference. Banks should not establish a relationship or carry out transactions until the customer’s identity has been verified, unless doing so would interrupt the normal conduct of business, in which case the bank should develop appropriate controls while verification and CDD are performed. Verification of identity should be accomplished through reliable means. For beneficial ownership, banks may use a written declaration from the customer, but they should not rely solely on such declarations. When CDD cannot be performed or a customer’s identity cannot be verified, the bank should not open an account or should close such opened accounts and consider reporting the activity as suspicious to appropriate authorities. This applies to anonymous accounts as well; these should not be opened. If a bank allows for numbered accounts, these should not be allowed to serve as anonymous accounts; sufficient personnel should have full access to the information to ensure appropriate CDD on and oversight over these accounts. • Transaction monitoring systems and ongoing monitoring: Because the transaction monitoring system is key to mitigating money laundering risk within a bank, the Committee recognizes that AML risks require more than just appropriate policies and procedures; banks must have adequate and appropriate monitoring systems. For most banks, this will involve an automated transaction monitoring system. If the bank does not believe it needs an automated transaction monitoring system, it should document the rationale for why it does not need one. The monitoring system should cover all accounts and transactions of the bank’s customers, enable a trend analysis of activity, and identify unusual business relationships and transactions, particularly with regard to changes in the transactional profile of customers. The transaction monitoring system should allow the bank to gain a centralized knowledge of information, for example, organized by customer, by legal entity within a larger group, and/or by business unit. Although the guidance indicates a bank must have a system, it should be understood that this does not mean that there can only be one IT tool that will do all of the monitoring. Rather, the tools must be able to work together to enable the bank to gain an enterprise-level view of money laundering risk across the bank. A critical way to mitigate money laundering risk is to use the transaction monitoring system to conduct ongoing monitoring of customer activity, building on the information from risk assessments and customer profiles. This enables banks to satisfy their obligation to identify and report suspicious activity. Monitoring systems should be adapted to the risks present in the bank, such as if the bank identifies a particular money laundering typology occurring within its jurisdiction. • Management of information: Because one of the primary purposes of AML rules is to create records that enable law enforcement to trace financial transactions back to the people who conduct them, banks should retain records. Banks should record the documents they are provided when verifying customer and beneficial ownership identity, whether a photocopy of the document or information from a nondocumentary source, and enter all CDD information into their IT systems. The CDD information should be kept up-to-date and accurate, which will mean periodically assessing the information, generally on a risk-based frequency. Banks should also document decisions related to investigations of unusual activity, whether or not a decision is made to file a SAR. Banks should maintain all of these records, as required by law, for at least five years after closing the account. If an ongoing investigation is occurring, relevant CDD records should not be destroyed merely because the record retention period has expired. • Reporting of suspicious transactions and asset freezing: Ongoing monitoring of accounts and transactions enables banks to identify unusual activity, refer unusual activity to an internal review function, eliminate falsepositive alerts, and report suspicious activity in a timely and confidential manner. This process should be clearly described in policies and procedures and communicated to appropriate staff. When suspicious activity has been reported, the bank should take appropriate action regarding the customer, including raising the risk rating of the customer and/or deciding whether to retain the relationship (either the account or the entire relationship). In some cases, it might be appropriate to close out one account, but not the whole relationship, such as when a customer has both a checking account and an outstanding loan. Banks should screen new customers against applicable sanctions lists and the existing portfolio against changes to the sanctions list to identify relationships that may need to be frozen. Banks should have a means of properly freezing any assets identified as part of this process. The guidelines have been updated since their publication in 2014. In 2020, new text was added that set out specific principles and examples of effective cooperation between prudential and AML/CFT supervisors. In many jurisdictions, prudential and AML/CFT supervision are handled by different authorities. For example, in the United Kingdom, prudential supervision is performed by the Prudential Regulation Authority, while AML/CFT supervision is performed by the Financial Conduct Authority. This situation can make cooperation on ongoing supervision and enforcement difficult to maintain. The 2020 update directly addresses this concern by sharing mechanisms on facilitating better cooperation at the domestic and international levels.