AML, CTF & Sanctions Guidance Published by the NVB 15 July 2019 NVB AML, CTF & Sanctions Guidance 2 Content Chapter 1 9 Risk-based approach 9 1.1 Introduction and legal obligations 9 1.2 Risk assessment 10 1.3 Risk assessment – identification and assessment of business risks 11 1.4 A risk-based approach – Design and implement controls 14 1.5 A risk-based approach – customer risk assessments 17 Annex 1-I Considerations in assessing the level of ML/TF risk in different jurisdictions 34 Annex 1-II Illustrative risk factors relating to customer situations 42 Annex 1-III Considerations in the treatment of politically exposed persons for anti-money laundering purposes 49 Annex 1-IV Considerations in keeping risk assessments up to date 54 Chapter 2 56 Customer due diligence 56 2.1 Meaning of customer due diligence measures and ongoing monitoring 56 2.2 Timing of, and non-compliance with, CDD measures 58 2.3 Application of CDD measures 60 2.4 Private individuals 79 2.5 Customers other than private individuals - entities 83 2.6 Multipartite relationships, including reliance on third parties 116 2.7 Identification and verification by third parties (outsourcing /introduction) 122 2.8 Monitoring customer activity 123 Annex 2-I Examples of supporting documents to evidence of funds/wealth 138 Annex 2-II Ownership and control structures 140 Decision tree EDD measures on complex structures 140 Examples of situations where ownership does not equal control 141 Examples of complex structures 144 Chapter 3 146 Suspicious activities, reporting and data protection 146 NVB AML, CTF & Sanctions Guidance 3 3.1 Evaluation and determination by the nominated officer / identified staff 146 3.2 External reporting 147 3.3 Data Protection - Subject Access Requests, where a unusual report has been made 149 Chapter 4 152 Sanctions 152 Chapter 5 155 Staff awareness and training 155 Chapter 6 158 Record Keeping 158 Glossary of terms 166 Annex I - List of Recognised Exchanges 176 Methodology 176 Annex II - List of Recognised Regulators 180 Methodology 180 NVB AML, CTF & Sanctions Guidance 4 Preface These guidelines have been developed by the Dutch Bankers Association (Nederlandse Vereniging van Bank, hereinafter NVB) to set out risk factors that banks must consider when assessing the money laundering (“ML”), terrorist financing (“TF”) and sanction risk associated with a customer relationship or occasional transaction. These guidelines also provide an outline how banks can adjust the extent of their customer due diligence (“CDD”) measures in a way that is commensurate to the ML/ TF and/or sanction risk they have identified. The factors and measures described in these guidelines set out minimum requirements on the basis of the applicable regulatory framework and are not exhaustive. Banks must consider other factors and measures as appropriate. Given the widespread use of the Guidance of the Joint Money Laundering Steering Committee (“JMLSG”), the NVB made use of the set-up and text in the Guidance of the JMLSG when writing these guidelines. JMLSG consists of the leading UK Trade Associations in the Financial Services Industry. Its aim is to promote good practice in countering ML and to give practical assistance in interpreting the UK Money Laundering Regulations. Regulatory framework The guidelines are primarily based on Dutch legislation. The Netherlands has had a long- standing obligation to have effective procedures in place to detect and prevent ML/TF and sanction violations. These procedures fall primarily within the scope of the following legislation and guidance: • Anti-Money Laundering and Counter-Terrorist Financing Act1 (“Wet ter voorkoming van witwassen en financieren van terrorisme (Wwft)”); • The Sanctions Act 19772 (“Sanctiewet (Sw)”); • The Financial Supervision Act3; • The Trust Offices Supervision Act4; • Dutch Economic Offences Act5; • DNB Guidance on Anti-Money Laundering and Counter Terrorism Financing Act and Sanctions act; • Ministry of Finance 2013 Guidance on Wwft and Sw 1977. Furthermore, the NVB also took into account the following European or international legislation and Guidance papers: • Directive (EU) 2015/849; 6 • ESA Joint Guidelines under Articles 17 and 18(4) Directive (EU) 2015/849; ........................ 1 Wet ter voorkoming van witwassen en terrorismefinanciering (Wwft) 2 Sanctiewet 1977 (Sw). The Dutch sanctions guidelines are based on the Sanctions Act 1977. This is a framework act. Its application is governed by sanctions measures imposed by the EU. The EU has laid down sanctions measures in regulations and these have direct effect in all EU countries 3 Wet op het financieel toezicht (Wft) 4 Wet toezicht trustkantoren (Wtt) 5 Wet op de Economische Delicten (WED) 6 Directive (EU) 2018/843 – Will be included when transposed into national law. NVB AML, CTF & Sanctions Guidance 5 • Wire Transfer Regulation on information accompanying transfers of funds (Regulation (EU) 2015/847); • ESA Joint Guidelines under Article 25 of Wire Transfer Regulation; • EU Sanctions Regulations; • FATF 40 Recommendations; • United Nations Security Council Resolutions; • The Office of Foreign Assets Control (“OFAC”); • Basel Committee and its Core Principles; • UK Joint Money Laundering Steering Committee (“JMLSG”) and its recommendations. Please note that Dutch banks are obliged to apply the legal provisions for the prevention of ML/TF violations in branches and majority-owned subsidiaries, insofar as the law of the jurisdiction concerned does not stand in the way of this. Should the law of the jurisdiction concerned prevent the application of the statutory regulations, the bank will notify the Dutch Central Bank (“DCB”) and take measures to effectively manage the risk of ML/TF. Purpose of this Guidance The purpose of this Guidance is to: • Outline the legal and regulatory framework for anti-money laundering (AML), countering terrorist financing (CTF) and sanction requirements and systems across the financial services sector; • Interpret the requirements of the relevant law and regulations, and how they may be implemented in practice; • Indicate good industry practice in AML/CTF procedures through a proportionate, risk- based approach; and • Assist banks to design and implement the systems and controls necessary to mitigate the risks of the bank being used in connection with ML/, TF and sanction violations. Scope of Guidance The Guidance sets out what may be expected in relation to the prevention of ML, TF and sanction violations, but banks are ultimately responsible as to how they apply the requirements of the Dutch AML/CTF regime and sanction requirements in the particular circumstances of the bank, and its products, services, transactions and customers. By performing a Systematic Integrity Risk Assessment (“SIRA”), banks are expected to ensure sound and honourable business operations. The SIRA provides essential information about the activities of the different business operations and if applicable majority owned group entities. The outcome of the SIRA will constitute the basis for the AML/CTF control measures and must be reviewed regularly. This Guidance however does not deal with the specific requirements related to performing a SIRA. The Guidance relates solely to how banks are expected to fulfil their obligations under the AML/ CTF and sanction law and regulations. The Guidance covers the prevention of ML/TF and sanction violations. ML/TF risks are closely related to the risks of other NVB AML, CTF & Sanctions Guidance 6 financial crime, such as fraud and other predicate offences underlying ML and TF.7 Predicate offences are not dealt with in the Guidance. The Guidance does, however, apply to dealing with any proceeds of crime that arise from these activities. And finally, specific requirements in relation to systems and tooling for client filtering, transaction filtering and transaction monitoring falls outside the scope of these guidelines. How should this Guidance be used? Clearly, it is not the intention that the Guidance be applied unthinkingly, as a checklist of steps to take. Banks should encourage their staff to ‘think risk’ as they carry out their duties within the legal and regulatory framework governing AML/CTF. Banks must address their management of risk in a thoughtful and considerate way, and establish and maintain systems and procedures that are appropriate, and proportionate to the risks identified. This Guidance assists banks in doing this. When provisions of the statutory requirements and of other regulatory requirements are referred to in the text of the Guidance, it uses the term must, indicating that these provisions are mandatory. In other cases, the Guidance uses the term should to indicate ways in which the statutory and regulatory requirements may be satisfied, but allowing for alternative means of meeting the requirements. References to 'must' and 'should' in the text should therefore be construed accordingly. The content of the Guidance These guidelines are divided into two parts: • Part I is general and applies to all banks. It is designed to equip banks with the tools they need to make informed, risk-based decisions when identifying, assessing and managing the ML/TF and sanction risk associated with individual customer relationships or occasional transactions. • Part II is sector-specific and complements the general Guidance in Part I.8 It sets out risk factors that are of particular importance in certain sectors and provides Guidance on the risk-sensitive application of CDD measures by banks in those