Know Your Customer

Know Your Customer Customer Due Diligence A sound CDD program is one of the most effective ways to prevent money laundering and other financial crimes. Knowledge is what the entire AML/CFT compliance program is built upon. The more an organization knows about its customers, the greater chance of preventing money laundering abuses. In fact, the US Federal Financial Institutions Examination Council (FFIEC) described the cornerstone of a strong AML compliance program as the adoption and implementation of comprehensive CDD policies, procedures, and processes for all customers, particularly those that present a higher risk for money laundering and terrorist financing. In most cases, the typical and basic CDD collected is sufficient. In other cases, further due diligence is required and could be extensive. The organization’s CDD program must have a process in place to consider each level of due diligence that might be necessary, as well as who is responsible for collecting, verifying, and keeping the information updated and accurate. According to the FFIEC, the objective of CDD should be to enable the financial organization to predict with relative certainty the types of transactions in which a customer is likely to engage. These processes assist the financial organization in determining when transactions are potentially suspicious. CDD is Recommendation 10 in FATF’s updated Recommendations. FATF recommends that financial organizations be required to undertake CDD measures when: • Establishing business relationships • Carrying out occasional transactions under certain circumstances • There is a suspicion of money laundering or terrorist financing • The financial organization has doubts about the veracity or adequacy of previously obtained customer identification data Main Elements of a Customer Due Diligence Program FATF recommends that organizations incorporate the following four measures into their CDD programs: 1. Identify the customer and verify the customer’s identity using reliable, independent source documents, data, and information. 2. Identify the beneficial owner and take reasonable measures to verify the identity of the beneficial owner. 3. Understand and, as appropriate, obtain information on the purpose and intended nature of the business relationship. 4. Conduct ongoing due diligence on the business relationship and scrutinize transactions undertaken throughout the course of the relationship to ensure that the transactions being conducted are consistent with the organization’s knowledge of the customer, their business, risk profile, and, when necessary, the source of funds. A sound CDD program should include the seven elements outlined in the table below. Elements of a Sound CDD Program Element Description Customer Obtain full identification of customer and business identification entities, including source of funds and wealth, when appropriate. The organization should ensure there is a process in place to update and maintain current customer information. Profiles Develop transaction and activity profiles for each customer. Profiles should contain sufficient information to allow for reviews of anticipated versus actual account activity and to otherwise enable the organization to identify suspicious activity based on comparing the activity with what it knows about the customer. Customer Define and accept the customer in the context of acceptance their use of specific products and services, which may differ among customers and geographic markets. Risk rating Assess and grade risks presented by the customer’s account relationship. Numerous factors should be considered when determining risk, including customer type, products and services, transactional activity, and geographic locations. No single factor should be used to determine risk, with the exception of a factor that constitutes an impermissible activity, such as violating economic sanctions or illegal activity. Monitoring Monitor accounts and transactions based on the risks presented. Investigation Investigate and examine unusual customer and account activity, which should be consistent with the anticipated activity for each customer, based on occupation or type of business. Documentation Document findings as evidence or to provide a record of actions performed. “If it is not documented, it never happened.” Enhanced Due Diligence In its interpretive note to Recommendation 10, FATF acknowledges that there are circumstances in which the risk of money laundering or terrorist financing is higher and EDD measures must be taken. Risk factors that warrant EDD measures include: Customer risk factors • Unusual circumstances regarding how the business relationship is conducted, such as significant, unexplained geographic distance between the financial organization and the customer • Nonresident customers • Legal persons or arrangements that are personal asset-holding vehicles • Companies that have nominee shareholders or shares in bearer form • Cash-intensive businesses • Unusual or excessively complex appearance of the ownership structure of the company, given the nature of the company’s business Country or geographic risk factors • Countries identified by credible sources, such as FATF’s mutual evaluations and detailed assessment reports, as not having adequate AML/CFT systems • Countries subject to sanctions, embargoes, and similar measures issued by, for example, the United Nations • Countries identified by credible sources as having significant levels of drug trafficking, corruption, financial crimes, or other criminal activity • Countries or geographic areas identified by credible sources as providing funding or support for terrorist activities, or that have designated terrorist organizations operating within them • Countries that share a common border and are known to have physical cross-border transactional activity • Geographic areas identified as having a higher risk of money laundering or financial crimes, such HIFCAs and HIDTAs in the United States Product, service, transaction, and delivery channel risk factors • Private banking • Anonymous transactions (which might include cash) • Non-face-to-face business relationships and transactions • Payment received from unknown or unassociated third parties The Basel Committee, in its Sound Management of Risks Related to Money Laundering and Terrorist Financing states that EDD may be essential for individuals planning to maintain a large account balance and conduct regular, cross-border wire transfers and individuals who are PEPs. Enhanced Due Diligence for High-Risk Customers Customers that pose higher money laundering and terrorist financing risks present increased exposure to financial organizations. High-risk customers and their transactions should be reviewed even more closely at account opening and more frequently (e.g., annually) during their account relationships. A financial organization should consider obtaining additional information from high-risk customers, such as: • Source of funds and wealth • Identifying information on individuals with control over the account, such as signatories and guarantors • Occupation or type of business • Financial statements • Banking references • Domicile • Proximity of the customer’s residence, place of employment, and place of business to the bank • Description of the customer’s primary trade area and whether international transactions are expected to be routine • Description of the business operations, the anticipated volume of currency and total sales, and a list of major customers and suppliers • Explanations for changes in account activity For high-risk customers, both Wolfsberg’s Correspondent Banking Principles and FATF recommend obtaining the approval of senior management to commence or continue the business relationship, as well as requiring the first payment to be carried out through an account in the customer’s name with a bank subject to similar CDD standards. Account Opening, Customer Identification, and Verification A sound CDD program should have reliable customer identification and account-opening procedures that allow the financial organization to determine the true identity of customers. Organizations should also set identification standards tailored to the risk posed by specific customers. In some countries, authorities have issued specific regulations and laws that detail what organizations are required to do regarding customer identification. The Basel Committee’s Sound Management of Risks Related to Money Laundering and Financing of Terrorism states that a bank should establish a systematic procedure for identifying and verifying its customers and, when applicable, any person acting on their behalf and any beneficial owners. Although the committee focused on banks, its recommendations can apply to any financial organization that opens accounts. A bank should not establish a banking relationship or carry out any transactions until the identity of the customer has been satisfactorily established and verified in accordance with FATF Recommendation 10. The identity of customers, beneficial owners, and persons acting on their behalf, should be verified using reliable, independent source documents, data, and information. Regulated organizations should recognize that some identification documents are more vulnerable to fraud than others. For those that are most susceptible to fraud, or when there is uncertainty concerning the validity of the documents presented, the verification requirements should be enhanced, and the information provided by the customer should be verified through additional inquiries and other sources of information. The Basel Committee provided guidelines for account opening and customer identification in Annex IV General Guide to Account Opening. This document does not address every eventuality; rather, it focuses on some methods banks can use to develop effective customer identification and verification programs. The annex divides customers into two groups—natural people seeking to open an account and legal people and legal arrangements—and addresses what types of information should be collected and verified for each. Each new customer who is a natural person that opens a personal account should be asked for the following information: • Legal name (first and last) and any other names used (e.g., maiden name, former legal name, or alias) • Complete residential address and, on the basis of risk, also the business address or post office number • Landline or mobile telephone numbers and email address • Date and place of birth • Gender • Nationality and residency status • Occupation, position held, and name of employer • An official personal identification number or other unique identifier • Type of account and nature of the banking relationship • Signature The organization should verify this information using reliable, independently sourced documents and data. Documentary customer verification procedures include: • Confirming the identity from an unexpired official document that bears a photograph of the customer • Confirming the date and place of birth from an official document • Confirming the validity of the official documentation through certification by an authorized person • Confirming the residential address Nondocumentary customer verification procedures include: • Contacting the customer by telephone or letter to confirm the information supplied after an account has been opened • Checking references provided by other financial organizations • Using an independent information verification process, such as by accessing public registers, private databases, and other reliable independent sources In some jurisdictions, other documents of an equivalent nature may be offered as satisfactory evidence of a customer’s identity. Particular attention needs to be focused on customers who are assessed as having high-risk profiles. Additional sources of information and enhanced verification procedures may include: • Confirming an individual’s residential address on the basis of official papers, a credit reference agency search, or through home visits • Checking prior bank reference (including banking group reference) and contacting the bank regarding the customer • Verifying income sources, funds, and wealth identified through appropriate measures • Verifying employment and public positions held • Obtaining a personal reference from an existing customer of the financial organization If national law allows for non-face-to-face account opening, financial organizations should take into account the specific risks associated with this method. Customer identification and verification procedures should be equally effective and similar to those implemented for face-to-face interviews. As part of broader CDD measures, the organization should consider, on a risk-sensitive basis, whether the information regarding sources of wealth, funds, and destination of funds should be corroborated. For legal people that are not natural people or legal arrangements, the following information should be obtained: • Name, legal form status, and proof of incorporation of the legal person • Permanent address of the principal place of the legal person’s activities • Mailing and registered address of legal person • Identity of natural people who are authorized to operate the account; in the absence of an authorized person, the identity of the relevant person who is the senior managing official • Contact telephone numbers • Official identification number • Powers that regulate and bind the legal person • Identity of the beneficial owners • Nature and purpose of activities of the legal entity and its legitimacy • Financial situation of the entity • Expected use of the account—amount, number, type, purpose, and frequency of the transactions expected—on the basis of risk; sources of funds paid into the account; and destination of funds passing through the account The bank should verify the identity of the customer using reliable, independent source documents, data, or information. Documentary verification methods include: • Obtaining a copy of the certificate of incorporation, memorandum and articles of association, partnership agreement, or any other document certifying the existence of the entity • For established corporate entities, reviewing a copy of financial statements (audited, if available) Nondocumentary verification methods include: • Undertaking a company search and/or other commercial inquiries to ascertain that the legal person has not been, or is not in the process of being, dissolved or terminated • Using an independent information verification process, such as by accessing public corporate registers, private databases, or other reliable independent sources (e.g., lawyers and accountants) • Validating the legal entity identifier and associated data in the public access service • Obtaining prior bank references • Visiting the corporate entity, when practical • Contacting the corporate entity by telephone, mail, or email The organization should verify that any person purporting to act on behalf of the legal person is so authorized. If so, the organization should verify the identity of that person as well. They should also take reasonable steps to verify the identity of the beneficial owners. However, the exact account-opening procedures and customer acceptance policies will depend on the type of customer, risk, and local regulations. After collecting and verifying customer information, the organization needs to implement processes to maintain updated and accurate customer information, as well as determine who is responsible for these processes, such as the relationship manager. Outdated and inaccurate information can affect key processes, such as EDD reviews, watchlist screening, and transaction monitoring. Beneficial ownership structure example ID&V (Case example: Danske Bank) In 2007, Danske Bank acquired Finnish Sampo Bank and its Estonian branch. Between 2007 and 2015, the Estonian branch expanded its nonresident portfolio. Nearly all of its customers were offshore and shell companies, many with links to high-risk countries. The parent bank was unaware of the structure of the client portfolio, because there was no integrated client list, and it relied on the information provided by the Estonian branch. Over an eight-year period, approximately US$200 billion in transactions were processed by the Estonian branch, most of which later were deemed suspicious by regulators. The Estonian branch was closed in 2019 by order of the Estonian Financial Supervisory Authority (FSA). Danske Bank violated AML/CFT regulations in multiple areas. After the acquisition of Sampo Bank, the Estonian branch was never integrated into the group’s IT compliance infrastructure. The group-wide AML and KYC policies and procedures were not shared with the Estonian branch. This omission led to a fragmented and inconsistent KYC implementation within Danske Bank. Investigators discovered that the Estonian branch employees’ understanding of money laundering risks was limited, and there were significant deficiencies in their AML controls. The Estonian branch performed limited KYC, focused solely on credit risk. They did not identify money laundering, terrorist financing, sanctions, or tax evasion risks and the KYC, AML, and risk management units were not integrated with the group. Danske Bank failed its legal obligations and underestimated the risk of its customer portfolio. It also failed to apply EDD measures consistent with laws and regulations and its group-wide requirements. For example, it did not screen incoming payments for sanctions, performed no PEP screening, and failed to respond to suspicious customers and transactions. The suspicious criminal activity was escalated to Danske Bank’s senior management but an internal audit conducted by the bank did not find suspected money laundering and no further action was taken by the bank. AML officers must integrate their organization’s AML/CFT and KYC frameworks across their companies, including branches and subsidiaries. They should conduct a thorough risk assessment and ensure that appropriate customer risk-rating methodology is implemented. Policies and procedures must be implemented organization-wide to ensure AML/CFT and KYC processes are robust and consistent, including the application of EDD, when appropriate. IT systems that screen customers and identify suspicious activity need to be integrated to support processes and risk management, including a holistic risk view. Key takeaways • Organizations must integrate the AML/CTF and KYC frameworks of new acquisitions immediately with a thorough risk assessment. • Organizations should apply AML/CTF and KYC policies and procedures organization-wide. • Organizations need to have a consistent customer risk-rating methodology. • Organizations need to have robust and consistent KYC processes, including EDD. • Dedicated AML teams should operate independent from the business. • A strong AML culture should be embedded across the organization with clear oversight and direction from senior management. Consolidated Customer Due Diligence A fragmented CDD program can significantly increase the level of money laundering and terrorist financing risk a financial organization faces. One way to ensure that financial organizations implement a strong CDD program is to consolidate and streamline account opening and ongoing monitoring processes across the organization, both domestically and globally, when applicable. Intergovernmental bodies have recognized the importance of implementing a consolidated CDD process and provided specific guidance to financial organizations. According to the Basel Committee, a global risk-management program for CDD should incorporate consistent identification and monitoring of customer accounts globally across business lines and geographical locations, as well as oversight at the parent level, in order to capture instances and patterns of unusual transactions that might otherwise go undetected. Such comprehensive treatment of customer information can significantly contribute to a organization’s overall reputational, concentration, operational, and legal risk management through the detection of potentially harmful activities. Financial organizations should aim to apply their customer acceptance policy, procedures for customer identification, process for monitoring high-risk accounts, and risk-management framework on a global basis to all of their offices, branches, and subsidiaries. The organization should clearly communicate these policies and procedures through ongoing training and regular communications, and it should conduct monitoring and testing to ensure compliance with the policies and procedures. Each office, branch, and subsidiary should be capable of complying with the minimum identification and accessibility standards applied by the parent. However, some differences in information collection and retention may be necessary across jurisdictions to conform to local regulatory requirements and relative risk factors, such as areas that pose higher levels of risk related to money laundering, terrorist financing, and corruption. When the minimum CDD standards of the home and host countries differ, offices in host jurisdictions should apply the higher standard of the two. When this is not practical, the organization should confer with its home office and attorneys to implement appropriate and effective CDD standards.