GENERAL RISK MANAGEMENT POLICIES FOR MONEY LAUNDERING AND TERRORIST FINANCING NOVO BANCO GROUP February 2021 BEST – Banco Electrónico de Serviço Total, S.A. ● Praça Marquês de Pombal, 3 - 3.º, 1250-161 Lisboa www.bancobest.pt ● Tel. (+351 218 505 775 (dias úteis, das 8h às 22h) Registado na Conservatória do Registo Comercial de Lisboa - 1.ª Secção, com o n.º 505 149 060 de pessoa coletiva e de matrícula e o capital social de 63.000.000,00 EUR CONTENTS: 1. GOALS .................................................................................................................................... 5 2. ACRONYMS ............................................................................................................................ 5 3. LEGAL AND REGULATORY FRAMEWORK ............................................................................... 6 3.1. COMPANY INFORMATION ..................................................................................................... 6 3.2. INTERNATIONAL STANDARDS AND RECOMMENDATIONS ................................................... 7 3.3. DOMESTIC REGULATIONS AND LEGISLATION ....................................................................... 8 3.4. REGULATORY STANDARDS OF SECTORAL AUTHORITIES .................................................... 10 4. RISK MODEL (MLTF) ............................................................................................................ 12 4.1. COMPLIANCE RISK ASSESSMENT ......................................................................................... 14 5. CUSTOMER ACCEPTANCE POLICY ....................................................................................... 14 6. RISK FACTOR MITIGATING PROCESSES AND CONTROLS (MLTF .......................................... 15 6.1. KNOW YOUR CUSTOMER (KYC) - COUNTERPARTY ANALYSIS (ACCOUNT OPENING, EQUITY STAKE MANAGEMENT, COUNTERPARTY ASSESSMENT AND RMAs) .......................................... 16 6.1.1. POTENTIALLY HIGHER RISK FACTORS AND TYPES ....................................................... 16 6.2. TERRORIST FINANCING........................................................................................................ 16 6.3. CORRESPONDENT BANK RELATIONS ................................................................................... 17 6.4. OWN OPERATIONS .............................................................................................................. 18 6.5. POLITICALLY EXPOSED PERSONS (PEPs), FAMILY MEMBERS AND ASSOCIATES OF PEPs AND OTHER HOLDERS OF POLITICAL OR PUBLIC POSITIONS (OHPPP)................................................ 19 6.6. CUSTOMER RISK ASSESSMENT AND SCORING MODELS ..................................................... 21 6.7. INFORMATION UPDATING .................................................................................................. 22 6.8. KNOW YOUR TRANSACTIONS (KYT) - MONITORING ........................................................... 23 6.9. SUSPICIOUS ACTIVITY REPORTS (SARs) ............................................................................... 23 6.10. COOPERATION WITH AUTHORITIES ............................................................................ 24 6.11. KNOW YOUR PROCESS (KYP) ....................................................................................... 24 6.11.1. RISK MODEL MANAGEMENT ....................................................................................... 24 6.11.2. HIGH-RISK CUSTOMERS ............................................................................................... 25 6.11.3. CONSIDERATION OF COMPLIANCE RISK ..................................................................... 25 6.11.4. CLOSING OF ACCOUNTS BY COMPLIANCE DEPARTMENT REQUEST ........................... 25 6.12. APPROVAL OF NEW PRODUCTS AND SERVICES – SIGN-OFF PROCESS ....................... 26 7. PENALTIES AND RESTRICTIVE MEASURES – FILTERING ....................................................... 27 7.1. WOLFSBERG AML QUESTIONNAIRE .................................................................................... 29 7.2. USA PATRIOT ACT CERTIFICATE ........................................................................................... 29 February 2021 General Risk Management Policies for Money Laundering and Terrorist Financing Page 2 of 48 BEST – Banco Electrónico de Serviço Total, S.A. ● Praça Marquês de Pombal, 3 - 3.º, 1250-161 Lisboa www.bancobest.pt ● Tel. (+351 218 505 775 (dias úteis, das 8h às 22h) Registado na Conservatória do Registo Comercial de Lisboa - 1.ª Secção, com o n.º 505 149 060 de pessoa coletiva e de matrícula e o capital social de 63.000.000,00 EUR 8. TRAINING ............................................................................................................................. 29 9. CODE OF CONDUCT, POLICIES FOR CONFLICTS OF INTEREST, RELATED PARTIES AND ANTI- CORRUPTION - WHISTLEBLOWING POLICY ................................................................................. 29 10. MONITORING OF BRANCHES AND SUBSIDIARIES ............................................................... 31 10.1. APPLICATION TO NOVO BANCO GROUP ENTITIES ...................................................... 31 10.2. COORDINATION MODELS ............................................................................................ 31 11. INFORMATION RETENTION ................................................................................................. 31 12. DATA PROTECTION .............................................................................................................. 31 13. INTERNAL CONTROL AND AUDITS (INTERNAL AND EXTERNAL) ......................................... 32 14. PARTICIPATION IN SECTORAL WORKGROUPS .................................................................... 32 15. NBG STRATEGIC PROJECTS .................................................................................................. 32 15.1. DIGITAL BANK PROJECT ............................................................................................... 33 15.2. 2018-2021 TALENT AND MERIT PROJECT ................................................................... 33 15.3. APIC PROJECT .............................................................................................................. 34 16. CRITICAL ANALYSIS OF MLTF MODEL IMPLEMENTED – FUTURE GOALS ............................ 34 17. GENERAL RISKS ASSOCIATED WITH CASH TRANSACTIONS ................................................. 35 18. MLTF PREVENTIVE DUTIES - BANK AND EMPLOYEES .......................................................... 35 18.1. OBLIGATION OF CONTROL .......................................................................................... 36 18.2. OBLIGATION OF IDENTIFICATION AND DUE DILIGENCE ............................................. 36 18.3. OBLIGATION OF COMMUNICATION ............................................................................ 36 18.4. OBLIGATION TO ABSTAIN ............................................................................................ 37 18.5. OBLIGATION OF REFUSAL ............................................................................................ 37 18.6. OBLIGATION OF RETENTION ....................................................................................... 37 18.7. OBLIGATION TO INVESTIGATE ..................................................................................... 37 18.8. OBLIGATION OF COOPERATION .................................................................................. 38 18.9. OBLIGATION OF NON-DISCLOSURE ............................................................................. 38 18.10. OBLIGATION OF TRAINING .......................................................................................... 38 19. DOCUMENT MANAGEMENT ............................................................................................... 39 19.1. ADEQUACY, INTERPRETATION, VALIDITY AND PERIODIC REVIEW.............................. 39 19.2. MANAGEMENT OF RELATED DOCUMENTS ................................................................. 39 February 2021 General Risk Management Policies for Money Laundering and Terrorist Financing Page 3 of 48 BEST – Banco Electrónico de Serviço Total, S.A. ● Praça Marquês de Pombal, 3 - 3.º, 1250-161 Lisboa www.bancobest.pt ● Tel. (+351 218 505 775 (dias úteis, das 8h às 22h) Registado na Conservatória do Registo Comercial de Lisboa - 1.ª Secção, com o n.º 505 149 060 de pessoa coletiva e de matrícula e o capital social de 63.000.000,00 EUR ANNEXES: A. LIST OF NON-COOPERATING COUNTRIES PUBLISHED BY FATF........................................... 41 B. THIRD COUNTRIES WITH STRATEGIC DEFICIENCIES IN MLTF, NON-COOPERATING TAX JURISDICTIONS AND OFFSHORE LEGAL SYSTEMS ....................................................................... 42 C. LIST OF POLITICALLY EXPOSED PERSONS (PEPs) AND LIST OF HOLDERS OF OTHER POLITICAL OR PUBLIC POSITIONS ................................................................................................................. 46 D. ANNEX III TO LAW NO. 83/2017 OF 18 AUGUST - NON-EXHAUSTIVE LIST OF POTENTIALLY HIGHER RISK FACTORS AND TYPES, IN ADDITION TO SPECIFIC SITUATIONS PROVIDED FOR BY LAW …………………………………………………………………………………………………………………………………..…..47 February 2021 General Risk Management Policies for Money Laundering and Terrorist Financing Page 4 of 48 BEST – Banco Electrónico de Serviço Total, S.A. ● Praça Marquês de Pombal, 3 - 3.º, 1250-161 Lisboa www.bancobest.pt ● Tel. (+351