Document Properties
- Type of Publication: Guideline
- Category: Sound Business and Financial Practices
- Date: December, 2008
- No: B-8
- Audiences: Banks / FBB / T&L / Life
INTRODUCTION
The fight against financial crime is an ongoing priority for governments
around the world. The ability of criminals and criminal organizations
to use financial institutions to launder funds, along with the potential
risk to their reputations, and ultimately to their safety and soundness,
continues to be a concern for financial and other regulators. Over
the past several years there has been extensive action in many countries
to implement permanent measures to fight money laundering and terrorist
financing. This action has been driven largely by the leadership
of the FATF, of which Canada is a founding member.
The FATF is the intergovernmental body that develops, monitors
and evaluates country AML/ATF standards. These standards as set
out in its 40 AML Recommendations and 9 ATF Recommendations establish
a strong AML/ATF framework and permit a risk-based approach to the
implementation of preventative measures.
The Government of Canada, led by the Department of Finance, has
established a private/public sector advisory committee to gather
information, on an ongoing basis, on how Canada’s AML/ATF regime
can be continuously reviewed. The federal Government also implemented
significant changes to the PCMLTFA and PCMLTFR in 2007/2008 to ensure
that the AML/ATF legislative framework is in line with international
standards.
OSFI’s mandate includes supervising financial soundness and promoting the adoption of policies and procedures designed to mitigate risk. OSFI believes that the risk management outcomes identified in this Guideline will further reduce the susceptibility of FRFIs to being used by individuals or organizations to launder funds and fight terrorist financing, thereby reducing their exposure to damage to their reputation, a key asset in the financial services industry.
To the extent possible, OSFI has aligned this Guideline to the
framework of AML/ATF preventative measures set out in the FATF Recommendations.
OSFI believes this will help focus attention on the principal goals
of risk-based deterrence and detection.
Compliance with this Guideline
FINTRAC is responsible for ensuring compliance with Part 1 of
the PCMLTFA, and the PCMLTFR. These prescribe a compliance program
with a risk-based component designed to ensure effective control
over ML and TF risks.
This Guideline does not create any new regulatory requirements.
It is intended to assist FRFIs in identifying and complying with
applicable AML/ATF requirements and measures contained in the PCMLTFA
and the PCMLTFR. This Guideline is also aimed at helping institutions
meet OSFI's governance and control expectations.
Effective control over ML and TF risks, and related regulatory,
operational and reputation risks, is essential.
In order to achieve effective control, FRFIs will adopt different
approaches to their AML/ATF programs that take into account the
nature, scope, complexity and risk profile of their institution.
FRFIs are expected to take into account the contents of this Guideline
when implementing their AML/ATF programs. OSFI's AML/ATF assessment
program, which aims to assist OSFI in evaluating the effectiveness
of controls, takes the foregoing into consideration in the assessment
of individual institutions.
The OSFI Act enables OSFI and FINTRAC to exchange information
on FRFIs’ compliance with Part 1 of the PCMLTFA. To this end, on
June 14, 2004, OSFI and FINTRAC signed a Memorandum of Understanding
for exchanging information. FRFIs should also be aware that in December
2008, FINTRAC will be able to impose administrative monetary penalties
against its reporting entities, including FRFIs, for violations
of prescribed provisions of the PCMLTFA and PCMLTFR.
FRFIs should note that FINTRAC, as the agency responsible for
ensuring compliance with Part 1 of the PCMLTFA, and the PCMLTFR,
publishes and maintains its own Guidelines on compliance with the
PCMLTFA and the PCMLTFR. OSFI has made every effort not to duplicate
in substance FINTRAC guidance. This Guideline should therefore be
read in conjunction with FINTRAC’s Guidelines, as appropriate. Where
we do refer to matters touched on in FINTRAC’s Guidelines, we have
conformed references to those used by FINTRAC.
“Fit & Proper” requirements for significant
owners, directors and senior officers of FRFIs
The FATF Recommendations include measures to mitigate the risk
that criminals and other inappropriate persons might take over ownership
of, or unduly influence the management of, financial institutions.
OSFI screens all persons who own or control, directly or indirectly,
significant interests in FRFIs. This screening is done prior to
the approval of a new FRFI and when ownership interests change.
In addition, OSFI screens directors and senior officers who will
be in place when a FRFI commences operations. However, OSFI seeks
to rely on FRFIs’ internal processes for assessing the ongoing suitability
and integrity of directors and senior officers who are appointed
after the FRFI’s initial start up.
OSFI’s expectations of FRFIs’ internal processes for screening
directors and senior officers post- authorization are set out in
OSFI Guideline E-17 “Background Checks on Directors and Senior Management
of FREs”. A risk-based approach to assessing the FRFI’s own screening
processes is applied by OSFI where warranted. Compliance with Guideline
E-17 in pertinent respects will be included in OSFI’s AML/ATF assessment
methodology.
Guidance on Designated Name Searching and
Sanctions
Certain provisions of the PCMLTFA and the Criminal Code give
both FINTRAC and OSFI responsibility for dealing with issues related
to the financing of terrorist activities.
FINTRAC’s objectives include the prevention, detection, and deterrence
of the financing of terrorist activities, while OSFI’s role is that
of a central reporting channel for the aggregate reporting requirements
outlined in subsection 83.11(2) of the Criminal Code.
With respect to FRFIs’ terrorist property reporting obligations,
OSFI posts on its Internet site (www.osfi-bsif.gc.ca) lists of terrorist
individuals and organizations, and will continue to receive monthly
reports from FRFIs on the findings of their continuous searching
for and freezing of terrorist assets as required by the regulations
under the United Nations Act or by subsection 83.11(1)
of the Criminal Code in respect of designated entities.
In addition, FINTRAC and a number of international organisations
have published information related to terrorist financing activities.
FINTRAC has also issued a guideline on Submitting Terrorist Property
Reports.
Over the past few years, Canada has implemented several new economic
and anti-proliferation (of weapons of mass destruction) sanctions
against a number of countries, entities and designated persons.
In addition, the FATF has issued guidance documents on a number
of these and related matters. The array of obligations imposed on
FRFIs by the reporting requirements, sanctions and related procedural
actions merits dealing with designated name searching, listings,
reporting, economic and anti- proliferation sanctions in a separate
Guideline. OSFI anticipates that this Guideline will be issued in
2009.
Legislative Compliance Management
The components of the FRFI’s AML/ATF program that are designed
to comply with the PCMLTFA and PCMLTFR should be incorporated into,
or referenced by, the FRFI’s LCM framework. Although the chief compliance
officer is responsible for the LCM framework generally (Guideline
E-13: Legislative Compliance Management), the AML/ATF components
of the LCM framework should be the responsibility of the CAMLO.
AML/ATF Guidance Issued by FATF and International
Supervisory Bodies
The FATF, the Basel Committee on Banking Supervision and the International
Association of Insurance Supervisors have each issued risk-based
AML/ATF guidance directed at the financial sector. FRFIs should
consult the appropriate guidance issued by these bodies for more
information on risk assessment and effective controls.
THE RISK BASED APPROACH IN THE CONTEXT OF
THE PCMLTFA AND PCMLTFR
The basic principle underpinning OSFI’s Supervisory Framework is that FRFIs must develop and implement effective risk management
controls to manage their exposure to financial risk and ultimately
their financial stability and soundness.
This Guideline aims to assist FRFIs in their development and implementation
of effective AML/ATF controls to manage their exposure to ML and
TF risks.
The PCMLTFA and PCMLTFR prescribe various outcomes that FRFIs
must achieve to detect and deter ML and TF. These outcomes are set
out as regulatory requirements which, in the aggregate, form the
compliance regime to be embedded in FRFIs’ AML/ATF programs. Examples
of regulatory requirements include: the identification of clients;
the appointment of a CAMLO; determining whether a client is a PEFP;
the prohibition on dealing with shell banks. Some requirements feed
into broader outcomes; others are themselves outcomes.
In all cases, the manner in which these outcomes may be achieved
is prescribed. Generally, there are three ways in which the PCMLTFA
and the Regulations prescribe how an outcome is to be achieved:
- 1. By one or more Prescriptive Measures
In these situations, one or more measures are prescribed. All
of the prescribed measures must be followed. An example is PEFP
determination - if a client is determined to be a PEFP, certain
prescribed measures must be taken.
- 2. By a choice of Prescriptive Measures
In these situations, a choice of alternative measures is prescribed.
These measures offer FRFIs flexibility in achieving the prescribed
outcome. Aside from selecting which option to choose, no other options
or alternatives are available to the FRFI. Examples include prescribed
types of acceptable identification documentation for individuals
and prescribed sets of alternative measures for the identification
of credit card clients in non-face-to face situations.
- 3. By Reasonable measures
In these situations, the PCMLTFA and PCMLTFR allow FRFIs more
flexibility to determine for themselves how to achieve the prescribed
outcomes, provided that the measures chosen are “reasonable”. To
be reasonable, the measures used must achieve the prescribed outcome.
An example is reasonable measures to determine the source of funds
for certain high risk clients.
This Guideline identifies measures that OSFI has found to be reasonable
when applied effectively – i.e., when they achieve prescribed outcomes.
The measures, which are drawn from a wide base of sources, including
the FATF, should not be treated as checklists.
As noted below, OSFI expects FRFIs to have AML/ATF programs in
place that include measures which are not expressly addressed by
the PCMLTFA and PCMLTFR, but which are consistent with other OSFI
Guidance and OSFI’s Supervisory Framework.
AML/ATF PROGRAM
The AML/ATF program is the key vehicle for establishing and maintaining
effective control over ML and TF risks in all relevant areas of
the FRFI enterprise.
The following is a more detailed description of OSFI’s expectations
and prescribed content of the AML/ATF program:
Principal Elements of AML/ATF Program
FRFIs should ensure that their AML/ATF programs include the following
elements, each of which is expanded upon in this Guideline. Elements
required by the PCMLTFA and the PCMLTFR are marked with an asterisk:
-
Senior Management Oversight, including *Reporting
to Senior Management;
-
*An appropriate individual responsible for implementation
of the program.
See further, “CAMLO”;
-
*Assessment of inherent ML and TF risks.
See further, “Assessment of Inherent Risks”;
-
*Written AML/ATF policies and procedures that are kept up
to date. See further,
“Control Policies and Procedures”;
-
*Written ongoing training program.
See further, “Ongoing Training”;
-
Self Assessment of controls. See further, “Self Assessment
of Controls”; and
-
*Effectiveness testing.
See further, “Effectiveness Testing”.
Scope
The AML/ATF program should implement a corporate standard of inherent
risk assessment and risk control measures, across all relevant business
areas of the FRFI.
The formality and sophistication of the AML/ATF program should
be commensurate with the size and complexity of the FRFI and its
businesses. As a general principle, the corporate standard should
be consistent with Canadian regulatory requirements.
The PCMLTFA requires that standards consistent with s. 6, 6.1 and 9.6 of the
PCMLTFA be applied in respect of wholly owned subsidiaries and branches
in countries that are not members of the FATF where the laws of
such countries permit it. FRFIs should ensure that unless there
is an explicit prohibition, such standards are applied.
FRFIs should notify OSFI if a country explicitly prohibits compliance
with s. 9.7 or 9.8 of the PCMLTFA, to assist OSFI in analysing the
situation in respect of that country.
SENIOR MANAGEMENT OVERSIGHT
Senior Management should have responsibility and accountability for: directing day-to-day implementation and management of the AML/ATF program; ensuring that it is adequate to mitigate ML and TF risk; that it complies with the PCMLTFA and PCMLTFR as required; and that it is implemented effectively in all relevant business areas.
Senior Management should ensure that:
- The CAMLO is appropriately qualified and has clear and documented
authority and accountability for the design of the AML/ATF program;
- The CAMLO does not report to the Auditor or revenue-producing
businesses, in order to avoid potential conflicts of responsibilities.
In smaller FRFIs, where functional segregation may be difficult
to achieve, compensating controls should be established to meet
this goal. Consideration should be given to outsourcing the CAMLO
function if compensating controls are not practical or possible.
- Qualified individuals have clear and documented responsibility
and accountability for AML/ATF program implementation in all relevant
business areas of operation, and sufficient resources to manage
program implementation effectively;
- The CAMLO and the Auditor have adequate resources in terms
of people, data management systems and budget to implement and
administer the AML/ATF program requirements effectively and to
offer objective opinions or advice to Senior Management;
- All significant recommendations in respect of AML/ATF program
issues and controls made by the CAMLO, the Auditor and Senior
Management are acted upon in a timely manner.
Reporting
Senior Management should ensure they receive sufficient pertinent
information from the CAMLO, the Auditor and other sources as appropriate,
to enable them to ensure the overall adequacy and effectiveness
of the AML/ATF program.
The PCMLTFR prescribe timing and content of written reports on effectiveness
testing, including reporting on any updates made to AML/ATF policies
and procedures and the status of the implementation of such updates.
In larger, more complex, FRFIs, AML/ATF reports on effectiveness
testing made at different times (for example, during audits of different
business areas) should be collated and consolidated periodically.
This will support the goal of assessing overall adequacy and effectiveness.
FRFIs should ensure that AML/ATF reporting to Senior Management by the CAMLO and by the Auditor is not unduly commingled, in order to differentiate the contents and purpose of the reporting.
The reports from the CAMLO should include information about: the
FRFI-wide scope of the assessment of inherent risks including: significant patterns or trends; the self assessment of controls and material
changes thereto; and remedial action plans or recommendations, if
any, with milestones and target dates for completion. Where appropriate,
the CAMLO should draw conclusions, offer advice or make recommendations
about the overall structure and scope of the AML/ATF program.
Please refer to OSFI’s Corporate Governance Guideline for OSFI’s expectations of FRFI Boards of Directors in regards to operational, business, risk and crisis management policies.
CAMLO
Introduction
Whether or not the broader risk management structure of the FRFI
is decentralized, responsibility for implementation of the enterprise
AML/ATF program should be assigned to the CAMLO, who should be one
person positioned centrally at an appropriate senior corporate level
of the FRFI. For the purposes of this Guideline, FRFIs should treat
the CAMLO as an independent oversight function as described in OSFI’s
Corporate Governance Guideline.
The CAMLO is expected to be responsible both for the regulatory
compliance component and the broader prudential
risk management component of the AML/ATF program.
Mandate
FRFIs should ensure that the CAMLO has clear and documented responsibility
and accountability for AML/ATF program content, design and enterprise-wide
implementation. In particular, the CAMLO’s mandate should include
accountability for:
- oversight of AML/ATF control activity in all relevant business
areas for the purposes of establishing a reasonable threshold
level of control consistency throughout the enterprise;
- keeping the AML/ATF program current relative to the FRFI’s
identified inherent risks (clients and business relationships,
products and delivery channels, geographic locations of activity
and any other relevant factors);
- developing and implementing an assessment of inherent ML and
TF risks, including but without prejudicing the generality of
the foregoing, being satisfied that new product/service/business
acquisition processes are subjected to timely inherent risk analysis
and appropriate measures are developed to control identified risks.
See further, “Assessment of Inherent Risks”;
- being satisfied that systems resources, including those required
to identify and report suspicious transactions and suspicious
attempted transactions, are sufficient in all relevant areas of
the FRFI;
- developing and implementing a self assessment of controls;
see further, “Self Assessment of Controls”;
- written AML/ATF policies and procedures that are kept up to
date and approved by a senior officer;
- written ongoing training programs for Senior Management, employees,
agents and other persons authorized to act on the FRFI’s behalf;
- ensuring that the Auditor is aware of the requirement in the
PCMLTFR for effectiveness testing of the AML/ATF program at least
every two years;
- being satisfied that systems and other processes that generate
information used in reports to Senior Management
are adequate and appropriate, use reasonably consistent reporting
criteria, and generate accurate information; and
- reporting to Senior Management pertinent information
about AML/ATF program adequacy and issues.
If the CAMLO delegates or assigns duties to other individuals,
or if the FRFI assigns some elements of the AML/ATF program to business
areas that do not report to the CAMLO, the CAMLO should take reasonable
measures to be satisfied that such elements are implemented satisfactorily.
Reasonable measures to achieve this could include:
- where those responsible for filing STRs do not report to the
CAMLO, being satisfied that threshold-based criteria are consistent,
that reporting is accurate and timely, and ensuring the CAMLO
receives regular summary reports on STR filings from such areas
of the FRFI; and
- Establishing a management committee to coordinate the implementation
of the AML/ATF program.
FRFIs should ensure that the CAMLO has:
- unfettered access to, and direct communications with, Senior
Management and the Board; and
- unfettered access to all pertinent information, records and
personnel throughout the FRFI.
Qualifications
Responsibility for the implementation of the AML/ATF program requires
that the CAMLO have a thorough working knowledge of ML/TF risks
and controls in the FRFI and AML/ATF regulatory requirements; a
broad knowledge of the operations of the FRFI; and appropriate professional
qualifications, experience and strong leadership skills.
Consideration should be given to these factors when FRFIs consider
the seniority and reporting relationship of the CAMLO.
ASSESSMENT OF INHERENT RISKS
The PCMLTFA requires that the compliance program include the development and
application of policies and procedures to assess, in the course
of a FRFI’s activities, the risk of a ML or a TF offence.
The PCMLTFR requires that the following categories of ML and TF risk be covered
in a FRFI’s assessment of inherent risk:
- the clients and business relationships of the FRFI;
- the products and delivery channels of the FRFI;
- the geographic location of the activities of the FRFI; and
- any other relevant factor.
For the purposes of item (iv) above, FRFIs should take into account
transaction risk factors, for example, structured or otherwise complex
transactions, and factors that may fall into more than one of the
other three categories.
Assessment of inherent risks refers to a process that:
- identifies current and emerging ML and TF risks inherent in
activities of the FRFI without reference to any controls over
them and whether or not the activities in which they reside are
considered material in dollar terms;
- assesses the relative seriousness of the identified risks;
and
- highlights the higher risks among them.
In considering ML and TF risks, consideration should be given
to what, if any, pertinent changes have occurred since the assessment
of inherent risks was last performed. Reasonable measures to accomplish
this could include:
- consideration of factors that led to the filing of suspicious
transaction reports and any patterns or trends in these; and
- consideration of external factors such as regulatory developments,
ML or TF typologies and regulatory Notices and Advisories.
Regular assessment of inherent ML and TF risks enables FRFIs to
tailor or adjust corporate control measures to identified risk,
which in turn facilitates the allocation of more risk management
resources to areas of greater vulnerability. See further, “Self
Assessment of Controls” below.
The following sections discuss the methodology and desired outcomes
of the process used to analyse inherent ML and TF risks.
Methodology
There is no single prescribed or universally used methodology
for inherent ML/TF risk assessment. However, the methodology used
should assess the risk of ML offences or TF offences across the
FRFI and include the categories of risk identified in p. 71(1)(c)
of the PCMLTFR.
The outcome of the methodology should be a rational, well-organized
and well-documented inherent risk analysis.
Reasonable measures to include in the methodology used would include
consideration of:
- the business lines and other operations of the FRFI;
- cross-border and international operations, if any, and linkages
among these;
- typologies of how financial institutions have been abused;
and
- any other relevant information that is available to the FRFI.
Risk Categories
Inherent risk assessment should address the different categories
of risk exposure to ML and TF. The PCMLTFR requires that inherent risk assessment address the following specific
categories of risk. In each category, OSFI has indicated types of
risks.
Client Risk:
This is risk associated with types of clients that buy or use
the FRFI’s products and services. Categories of clients that may
indicate a higher risk could include:
- politically exposed persons;
- clients conducting their business relationship or transactions
in unusual circumstances, such as geographic distance from the
FRFI for which there is no reasonable explanation;
- clients whose nature, structure or relationship make it difficult
to identify the ultimate beneficial owner(s) of significant or
controlling interests, including clients that are corporations
with the ability to issue bearer shares;
- cash (and cash equivalent) intensive businesses including:
- Money services businesses (for example, remittance houses,
foreign exchange businesses, money transfer agents, bank note
traders, cash couriers or other businesses offering money
transfer or movement facilities);
- Casinos, betting and other gaming-related businesses;
- Businesses that, while not normally cash-intensive, generate
substantial amounts of cash for certain lines of activity;
and
- charities and other non-profit organizations that are not monitored
or supervised (for example, not registered with CRA).
Business relationship risk:
This is risk associated with the client’s stated purpose in dealing
with the FRFI. Categories of business relationships that may indicate
a higher risk could include:
- intermediary structures, such as holding companies, numbered
companies or trusts, that have no apparent business purpose or
that make beneficial owners difficult to identify;
- accountants, lawyers or other professionals holding commingled
funds accounts where the beneficial ownership of the funds may
be difficult to verify; and
- use of the FRFI’s products or services by clients of clients,
for example, clients of correspondent banks.
Product/Service Risk:
This is risk associated with FRFI products/services that enable
clients to move funds. Categories of products and services that
may indicate a higher risk could include:
- deposit-taking, especially cash, and insurance products that
allow large one-time or regular payments, pre-payments or deposits,
to be made and subsequently withdrawn from deposit or deposit-like
accounts (for example, side accounts);
- “free look” or “cooling off” periods coupled with premium refunds,
for example, in some life insurance products;
- cash values, early cash surrender and loan provisions, and provisions
for deposit, accumulation and withdrawal of funds with relative
ease and speed, for example, non- registered segregated funds;
- trade finance services where
- the FRFI is not able to assess whether the values of goods
or services being imported or exported are reasonable; or
- FRFIs confirm, advise or make payments under letters of
credit for purposes of their clients’ buying or selling goods
internationally.
- credit accounts in respect of which large credit balances are
allowed to be maintained, for example, some credit and corporate
card products;
- payable through accounts that permit clients of a foreign correspondent
bank to draw drafts (or cheques) on Canadian-based accounts;
- lock boxes for the use of clients of foreign correspondent
banks that permit such banks to collect payments due from their
clients domiciled in Canada; and
- pouch services and similar international commercial payment
services.
Delivery Channel Risk:
This is risk associated with how FRFIs’ products/services are
delivered to clients including services delivered to clients non-face-to-face.
Categories of delivery channels that may indicate a higher risk
could include:
- use of intermediaries or introducers (for example, mortgage
and deposit agents and brokers), that may not be subject to AML/ATF
laws and measures and who are not adequately supervised;
- the Internet, telephone and mail when used as a complete substitute
for face to face interaction with the client in delivering banking
services; and
- transfers payable upon presentation of identity (PUPIDs).
Geographic location risk:
This is risk associated with places in which FRFI activities are
carried out. Where FRFIs have subsidiaries or branches in such places,
this may mitigate or elevate the risk. Categories of countries that
indicate a higher risk include countries:
- subject to Canadian or other national sanctions, embargoes
or similar measures, such as the Special Economic Measures
Act or measures prescribed under the USA PATRIOT Act;
- subject to United Nations Security Council (UNSC) sanctions
(in Canada, UNSC sanctions are applied by regulations issued under
the United Nations Act);
- identified by credible sources as providing funding or support
for terrorist activities or the proliferation of weapons of mass
destruction;
- identified by credible sources as having significant levels
of corruption or other criminal activity;
- that are not members of the FATF, and in particular, countries
that are subject to monitoring by the FATF or otherwise identified
by the FATF as lacking appropriate AML/ATF regulatory requirements;
and
- where legislation prohibits or unduly restricts access to client
information by the CAMLO.
Other relevant factors:
FRFIs should ensure that they take any other relevant factors
into consideration in an inherent risk assessment, including transaction
risk factors and combinations of factors that may fall within more
than one of the other three categories.
Rating and Ranking
An appropriate methodology should assign appropriate ML and TF
risk levels to the pertinent activities of the FRFI and in so doing,
identify the higher risks to which enhanced due diligence and ongoing
monitoring must be applied.
The criteria used for rating and ranking should have a rational
basis in ML and TF risk and address ML and TF risk factors that
are unique to specific business lines, areas and jurisdictions,
and also more general risk factors.
Finally, the methodology should enable FRFIs to comply with the
regulatory requirement to identify higher risk clients activity for purposes
of establishing a threshold level of enhanced due diligence that
is appropriate in the circumstances. See “Customer Due Diligence”
below.
Using Assessment of Inherent Risks as the
Basis for Risk Controls
Results of the assessment of inherent risks should inform the
development of risk controls, and the allocation of resources, commensurate
with levels of ML and TF risk in the enterprise.
Certain risk control measures are prescribed by regulatory requirements.
These cannot be qualified or bypassed by inherent risk assessments.
They include, for example:
- client identification and ascertaining identity (subject to
prescribed exemptions);
- determining under prescribed circumstances whether a client
is a PEFP or is acting on behalf of a third party;
- reporting suspicious transactions and suspicious attempted
transactions, large cash transactions and large EFTs; and
- record keeping.
CONTROL POLICIES AND PROCEDURES
Control policies and procedures should identify and implement
measures designed to control inherent risks.
FRFIs should ensure that control policies and procedures are kept
up to date to mitigate risks. They must also comply with other regulatory
requirements: for example, the PCMLTFR requires that written compliance policies and procedures form part
of the AML/ATF compliance program and be approved by a senior officer.
Control policies and procedures should be embedded in business
areas commensurate with the risks they are intended to mitigate,
and otherwise tailored to the particular circumstances in which
they operate.
Policies
AML/ATF policies should set risk management standards to govern
the approach of the FRFI to deterring and detecting ML and TF, and
should ensure regulatory compliance.
Policies setting a corporate standard should be approved by Senior Management and implemented consistently across the enterprise. They should establish clear and definitive requirements throughout the organization.
In keeping with the general principle that the corporate standard
should be consistent with Canadian regulatory requirements (see
"Policies" above), policies should implement the corporate standard,
at least, of AML/ATF program requirements in wholly owned subsidiaries
and branches outside Canada to the extent that laws of the foreign
jurisdictions permit it. Policies should also reflect that unless
there is an explicit prohibition, the corporate standard, at least,
should be applied.
It should be noted that differences in local market conditions
are not a sound basis for lowering or eliminating enterprise standards.
In such cases, FRFIs should ensure that a specific risk assessment
is made to determine whether operating in such markets would result
in an unacceptable ML or TF risk to the FRFI.
Examples of topics that should be covered by policies are:
- what money laundering is. FRFIs should ensure that their policies
and procedures adequately address their exposure to the stages
of money laundering (placement, layering and integration) and
are not unduly limited to anti-placement measures (for example,
prohibitions or restrictions on the acceptance of cash);
- objectives of the AML/ATF program;
- key areas of inherent risk;
- Client due diligence standards reflecting:
- minimum acceptable client identification requirements, verification
standards, information gathering and monitoring;
- prohibition on entering client relationships or processing
transactions if identity cannot be ascertained;
- appropriate or prescribed restrictions on entering client
relationships or processing transactions before identity is
established; the types of clients considered higher risk or
not acceptable;
- a definition of enhanced due diligence applicable to such
higher risk clients; reporting; and
- records retention;
- dealing with clients who exhibit levels of risk that are unacceptable
to a FRFI;
- identification of clients whose accounts were opened prior
to the coming into effect of the 2002 regulatory requirements
and the PCMLTFR, and who have not been identified in accordance
with the PCMLTFR, if such clients or their activities are assessed
as being high risk;
- business rules defining what are unusual transactions and which
unusual transactions are suspicious; and
- the mandates of key risk management control functions such as
the Board, Senior Management, the CAMLO, the Auditor, and others.
Procedures
Procedures are the tools FRFIs use to translate AML/ATF policies
into practice. Therefore, it is essential that procedures state
clearly what actions are to be taken, by whom, where and when (noting
pertinent regulatory deadlines as appropriate).
The evolving nature of AML/ATF regulation and changes to a FRFI’s
business require that procedures be updated on a regular basis to
ensure their continued effectiveness. Should a FRFI’s procedures
allow for permitted exceptions, the procedures should include authorization
processes and associated enforcement mechanisms to oversee such
exceptions.
CLIENT DUE DILIGENCE (CDD)
CDD is comprised of client identification, information gathering,
ascertaining identity and ongoing monitoring. These components must
comply with applicable regulatory requirements, and must be enhanced
for higher risk situations . The extent of CDD performed should correspond to the relative
level of assessed ML and TF risks in the circumstances. See “Specific
Higher Risks” below.
As a general principle, a business relationship should only be
entered into or maintained with a client if the FRFI is satisfied
that the information it has gathered demonstrates that the FRFI
knows the client (i.e. the client has disclosed his or her true
identity and a legitimate purpose for entering or maintaining the
business relationship with the FRFI). DTIs are required to keep
a record of the intended use of each account opened, other than
a credit card account .
The prescribed rules comprising CDD requirements do not permit
FRFIs to establish anonymous accounts for clients. If FRFIs provide services (such as account
numbering or coding services) that effectively shield the identity
of a client for business reasons (for instance, in a corporate acquisition
where the premature circulation of information could jeopardize
the transaction), or where client identity is withheld for proprietary
reasons, FRFIs must ensure that they have appropriately ascertained
the identity of the client and that this information is accessible
by the CAMLO.
Where the regulatory requirements prescribe a determination of
the status of a client, for example, the determination of whether
a client is a PEFP, there must actually be a determination and FRFIs
should ensure that a determination is made based on an assessment
of the information received.
Nature and Amount
The nature and extent of CDD measures should be appropriate for
the nature of, and proportional to the level of, the ML and TF risk
that is posed by the client in the circumstances. See ”Inherent
Risk Assessment”, above. At a minimum, CDD measures must comply
with the requirements of the PCMLTFA and PCMLTFR. CDD standards
should provide that where there are doubts about the veracity or adequacy of previously
obtained client identification and verification data, enhanced CDD
must be performed.
FRFIs should enhance CDD measures if standard measures produce
inconsistent, otherwise uncertain or doubtful results. The level
of such enhanced due diligence should be sufficient to mitigate
the inconsistencies, uncertain or doubtful results.
Client Identification and Ascertaining of
Identity
FRFIs may have clients whose identities have not been ascertained
in accordance with the PCMLTFR on account of having become clients
prior to the AML/ATF requirements coming into force in 2002, or
having purchased products that the PCMLTFR exempt from client identification
requirements. FRFIs should ensure that if such clients subsequently
purchase products to which client identification requirements apply,
they are subject to appropriate client identification measures.
Reasonable measures to ensure that such clients are appropriately
identified could include:
- ascertaining the identity of the client in respect of each product
purchased; and
- establishing systems that flag otherwise unidentified clients
who purchase products subject to prescribed client identification
requirements.
The PCMLTFR specifies the originals of prescribed valid documents
(or types of valid documents) that may be inspected to ascertain
the identity of individuals and the existence of entities in face
to face and non face to face scenarios, and the timing for doing
so. A FRFI’s CCD policy should provide clear direction that complies
with the PCMLTFR, (where applicable) on:
- when a client’s identity must be ascertained (timing);
- how to ascertain the identity of the client, when the client
is present or not present; and
- which original and valid identification documents should be
used to ascertain identification and what information is to be
recorded from them.
While identification and verification standards and policies must
meet the minimum prescribed requirements, FRFIs may consider that
the assessment of inherent risk justifies the application of additional
identification requirements to some categories of client.
For example: the PCMLTFR prescribes the use of valid government-issued
documents to be used to ascertain the identity of a client. These
include, inter alia, birth certificates. The PCMLTFR permits
Social Insurance Number (SIN) cards to be used to ascertain the
identity of a client. Where a birth certificate or a SIN card is
the only document available to ascertain identity, and the assessed
ML or TF risk of the client is other than minimal, FRFIs should
consider applying additional identification measures. Such additional
measures could include viewing the original of other acceptable
government-issued identification documents, including government-issued
photo identification, or, if these are not available, other credible
evidence supporting the identity of the client such as a property
tax or utility bill.
For persons without acceptable Canadian identification documents,
comparable or equivalent foreign identification documents may be
acceptable if they can be read and assessed as valid identification
documents (for example, by reference to publicly available information)
and can be understood by the FRFI.
Identifying a client that is a corporation or other entity may
involve the collection of substantial information in some cases.
In addition to confirming the existence of the entity, FRFIs must take reasonable measures
to obtain the names and occupations of its directors and the names,
addresses and occupations of individual(s) who are the ultimate
beneficial owners of 25% or more of the entity . Reasonable
measures to obtain this information could include:
- requesting it from the entity;
- consulting a credible public or other database; or
- a combination of both.
Where a FRFI is required to obtain the occupation of a person
(for example, a director of a client entity), the FRFI should ensure
that the occupation obtained is the person's principal occupation
and not merely the person's title in the client entity.
The measures applied should be commensurate with the level of
assessed risk.
DTIs must also ascertain the identity of every person who signs
a signature card in respect of a business account, except that where
the signature card is signed by more than three authorized individuals,
the identities of at least three of them must be ascertained. The requirements of identification
of individual clients are applicable. Life insurance companies should
adopt a similar practice as a matter of prudent risk management
because the inherent risk of not identifying signing officers for
business accounts is similar.
The PCMLTFA and PCMLTFR prohibit FRFIs from opening accounts in
prescribed circumstances if the FRFI cannot establish the identity
of the client in accordance with prescribed measures.
FRFIs must also take reasonable measures, at times prescribed
by the PCMLTFR, to determine whether the individual
client is acting for or on behalf of a third party. Reasonable measures
could include:
- asking the question on a product application; or
- including a negative assurance statement above the client's
signature line on the application or other purchase document.
Life Insurance Companies
Life insurance companies are not required to ascertain the identity
of, or obtain the identification information of, a person where
there are reasonable grounds to believe that the person’s identity
has been ascertained in the prescribed manner by another life insurance
company or life insurance broker or agent in respect of the same
transaction or of a transaction that is part of a series of transactions
that includes the original transaction. For these situations, life insurance
companies should therefore develop and implement policies and procedures
designed to ensure that:
- they perform appropriate initial and ongoing due diligence
on other life insurance companies, life insurance brokers or agents;
and
- there are reasonable grounds to believe that the client identification
and verification procedures used by such other life insurance
companies, life insurance brokers or agents comply with the PCMLTFA
and PCMLTFR and with the life insurance company’s own policies
and procedures.
OSFI understands that with respect to individual products, in
practice life insurance companies do receive information about the
identity of the client on application forms submitted by life insurance
agents or brokers. This practice enables life insurance companies
to periodically determine that the grounds for relying on such agents
are reasonable.
Source of Accumulated Funds or Wealth
FRFIs should satisfy themselves that, in appropriate circumstances,
the amount of clients’ accumulated funds or wealth appears to be
reasonable and consistent with the information provided. Doubts
about the origin of such funds or wealth should be satisfied before
proceeding with the relationship or permitting transactions to occur.
Reasonable measures to implement this requirement could include:
- obtaining and evaluating more detailed information from the
client; and
- verifying information obtained from other financial institutions
or references.
Where doubts persist, consideration should be given to not proceeding
with the relationship or transaction.
In cases where a client is assessed as higher risk and the source of accumulated funds or wealth does not appear
to be reasonable, or is inconsistent with the information provided
despite taking reasonable measures to resolve the inconsistency,
the FRFI should consider declining to enter the business relationship,
or terminating it, and consider filing a suspicious attempted transaction
report.
Monitoring
Standard
FRFIs must be able to identify suspicious transactions, or suspicious
attempted transactions, and report these to FINTRAC. Further, FRFIs
must take reasonable measures to ascertain the identity of every
person with whom the FRFI conducts a transaction that is determined
by the FRFI to be suspicious.
These obligations imply that the activities of all clients, regardless
of their risk ranking, must be subject to some form of ongoing monitoring
to detect transactions or attempted transactions that are potentially
suspicious.
Reasonable measures for such monitoring could include:
- Identification and review of types of transactions or attempted
transactions (defined by size, frequency, geographical location,
delivery channel, business relationship or other factors) that
appear to be inconsistent with the intended purpose of the account
or the circumstances; and
- Changes in transaction activity that may on their own or in
conjunction with recorded changes in client information, be indicative
of a change in the nature of a client's business or intended use
of the account.
FRFIs should conduct feasibility studies, as appropriate, to determine
whether transaction volumes merit the application of information
technology solutions to transaction monitoring.
Monitoring should identify information, transactions or attempted
transactions that are unusual or potentially suspicious and that
require further analysis. Monitoring criteria should cover all relevant
indicators. Relevant indicators could include:
- frequent and unexplained movement of accounts to different
financial institutions;
- frequent and unexplained movement of funds between different
financial institutions in various geographic locations;
- client information about or explanations for the source of
transaction funds or accumulated wealth that is not clearly reasonable
or credible;
- transactions that are structured or otherwise complex, or unusually
large relative to the size and business of the client or the geographical
location of the transaction;
- types of transactions, or patterns of transactions, inconsistent
with the purpose of the account or the business of the client;
and
- transactions that have no apparent economic or visible lawful
purpose.
Enhanced
The PCMLTFA and PCMLTFR provide that where a FRFI determines that
the risk of a ML or TF offence is high, FRFIs must take prescribed
special measures for identifying clients, keeping records and monitoring
financial transactions in respect of the activities that pose the
high risk. The prescribed
special measures include: reasonable measures to determine whether
the high risk client is a PEFP;
keep client identification information and the information referred
to in PCMLTFR s. 11.1 up to date;
conduct ongoing suspicious transaction and suspicious attempted
transaction monitoring ;
and generally mitigate the high risk.
FRFIs should consider creating more than one category of higher
risk client, and more than one category of enhanced due diligence,
if the nature, scope, complexity and risk profile of the financial
institution merit such action. Each level of enhanced monitoring
should reflect the assessed level of risk appropriately.
Reasonable measures for applying enhanced monitoring could include:
- More frequent reviews of client activity and types of activity;
- More frequent updates or reviews of client information;
- The application of additional client identification measures;
- The gathering of information from public or open sources such
as commercial databases;
- More frequent flagging of unusual transactions or other information;
and
- Referral of client activity and transactions to a more senior
officer in the FRFI for review.
Additional measures that could be taken to strengthen the monitoring
of high risk activities include:
- Review of business reports, including exceptions reports, generated
by management information systems (for example, anti-fraud systems),
for possible indicators in them of unusual or suspicious activity.
- Analysis of STR information for trends and other indicators
of suspicious activity to aid the development of appropriate risk-based
controls in businesses that indicate such activity.
SPECIFIC HIGHER RISKS
This section discusses OSFI’s expectations and prescribed measures
in respect of enhanced due diligence and related controls applicable
to areas of identified higher risk.
Use of Agents or Mandataries
Many FRFIs rely on introducers, intermediaries or other third
parties for client information gathering and verification purposes. These
include, for example, deposit and mortgage brokers and solicitors.
ML and TF risk mitigation can be compromised where FRFIs do not
ensure that appropriate client identification standards are applied
by the introducers, intermediaries or other third parties.
With one exception for life insurance companies referred to above,
accountability for ascertaining the identity of the client and obtaining
the information used to identify the client remains with the FRFI
when it uses a third party to ascertain the identity of clients.
In respect of this accountability, FRFIs must have an agreement
or arrangement in writing with the agent or mandatary if such person
is to be responsible for client identification and verification.
The provisions of this arrangement or agreement must conform to
the requirements of the PCMLTFR and it should obligate the agent or mandatary to:
- apply the DTI’s or life insurance company’s client identification
and verification requirements (which must comply with the regulatory
requirements);
- ensure that, where the client is present at the time client
identification is ascertained, the agent or mandatary applies
client identification procedures that include viewing original
identification documents;
- ensure that, where the client is not present at the time client
identification is ascertained, the agent or mandatary applies
prescribed non-face-to-face identification requirements ;
and
- provide the client identification information to the DTI promptly
after obtaining it.
DTIs and life insurance companies should also:
- ensure that if the agent or mandatary is responsible for collecting
the information required to make a third party determination or
a PEFP determination, these responsibilities are also documented;
- Ensure they receive client identification information in the
required timeframes; and
- periodically review, in a systemic manner, the quality of client
information gathered and documented by the agent or mandatary
to ensure that it continues to meet their requirements.
Documentation of relationships and communications with, and client
due diligence work of, agents and mandataries, should be complete
and current, and client information should be placed in the client’s
record promptly upon receiving it. See further, “Record Keeping
and Retention”, below.
FRFIs should consider terminating relationships with agents or
mandataries that do not comply with agreed upon client identification
responsibilities or provide the DTI or life insurance company with
the requisite client information on a timely basis.
Contracts with agents and mandataries should be reviewed and updated
as necessary to ensure compliance with the PCMLTFR regarding the use of agents and mandataries.
The extent of the DTI’s or life insurance company’s exposure to
the agent or mandatary for the results of client due diligence should
be addressed expressly in the DTI’s or life insurance company’s
inherent risk assessment.
Fraud with respect to Mortgage Loans and
other Products
Fraudulent misrepresentation in respect of FRFIs' products takes
many forms that could include:
- Forged or falsified employment letters or references, or misrepresented
self-employment;
- Forged or falsified pay stubs, T4 slips, and CRA Notices of
Assessment;
- Forged or falsified personal identification documents;
- Use of "straw" (i.e., non-existent) individuals;
- False or falsified credit records;
- Concealed legal or beneficial ownership;
- Concealed sources of down payment; and
- Inflated assets.
FRFIs should ensure their client acceptance and due diligence
processes address the risk of fraud, a predicate offence for money
laundering. FRFIs should take reasonable measures to address the
risk, which could include:
- Applying enhanced client identification measures such as viewing
a second piece of identification, or viewing government-issued
photo identification;
- Having an agent or mandatary apply enhanced non-face-to-face
client identification measures;
- Ensuring that legal and/or beneficial ownership of property
or business is understood and documented;
- Satisfying themselves that the amount of clients' accumulated
funds or wealth appears to be reasonable and consistent with the
information provided (see further, "Source of Accumulated Funds
or Wealth" above);
- Training staff, agents or mandataries in the recognition of
valid identification documents and signs of falsification of documents;
- Obtaining corroboration of information in employer letters,
references, pay stubs or credit records, as appropriate; and
- Corroborating the existence and value of stated assets.
Life insurance companies should ensure that mortgage loans are
subject to the AML/ATF program.
PEFPs
The FATF Recommendations state that PEPs are potentially more
susceptible to financial crime than other clients of financial institutions.
In Canada, the PCMLTFA requires FRFIs to determine, in prescribed
circumstances, whether they are dealing with PEFPs and also prescribes
mandatory enhanced due diligence measures to be taken in respect
of PEFPs in prescribed circumstances.
A PEFP is defined in the PCMLTFA as an individual who holds or
has ever held prescribed offices or positions in or on behalf of
a foreign state or is a prescribed member of the family of such
a person.
For purposes of the foregoing, the term "foreign state" should
be interpreted to include the principal political subdivisions of
foreign countries when applying the PEFP definition.
Once the determination is made, prescribed actions must be taken
within minimum time periods.
Timing of PEFP determination - DTIs
There are three situations that trigger the requirement for DTIs
to determine whether a client is a PEFP:
- when an account is opened;
- when an existing client is deemed to be high risk;
and
- when a client initiates or receives an EFT of $100,000 or more .
The determination and approval by a senior officer to keep the
account open must be made no later than 14 days from account activation or within
14 days of the EFT being received or sent.
There is no specific time period in respect of determination as
a result of a risk assessment. FRFIs should ensure that the PEFP
determination required when an existing account is deemed to be
high risk is made no later than 14 days thereafter, to be consistent
with other prescribed requirements.
Timing of PEFP determination – Life Insurance Companies
Life insurance companies must take reasonable measures to determine
if a person who makes a lump-sum payment of $100,000 or more in
relation to an immediate or deferred annuity or life insurance policy
on their own behalf or on behalf of a third party is a PEFP .
Such person may not be the policy holder.
The determination must be made within 14 days of the payment transaction .
Points to Consider in Making a PEFP Determination
The PCMLTFA and PCMLTFR require that FRFIs take “reasonable measures”
to make the PEFP determination. Reasonable measures could include:
- Asking the individual for information that could indicate PEFP
status, such as existing or previous connections to the prescribed
relationships;
- Screening the individual’s name and other personal information
against a commercially or publicly available database to gather
more information about the individual; or
- a combination of both.
About asking the Client
If FRFIs choose to ask the individual for information, FRFIs should
keep in mind that clients should not be expected to know the criteria
that determine whether they are PEFPs. FRFIs should also note that
there is no obligation imposed on FRFIs to disclose to a client
that a determination must be made, or needs to be made.
A reasonable approach would be to ask the client if the client
has or has ever had a prescribed connection to a foreign state,
government, military or judiciary. The questions could be expanded
to cover family members with any similar connections. If the responses
are not clear or inconclusive, additional assessment or due diligence
may be necessary before finalizing the determination. The additional
measures could range from asking the applicant for more information,
to internet searches, to running the individual(s’) name(s) against
a public database.
FINTRAC has published a pamphlet that FRFIs can use to explain
to their clients, if necessary, why they need to enquire about their
background. This pamphlet can be viewed at FINTRAC’s Internet site.
About consulting a commercial database
FRFIs that choose to screen names and other personal information
against a commercial or publicly available database should ensure
they:
- Determine whether the provider identifies in the database individuals
who fit the definition of PEFPs in the PCMLFTA and PCMLTFR. Most
of these databases are built using open source (i.e. public) information.
If the family members of a PEFP are not well known, there is no
guarantee that a database will know about them.
- Establish the frequency and methodology used to update the
information in the database, including whether the provider removes
names from the database when officeholders leave office or die.
If names are removed, the database may not capture persons who
“have ever been” PEFPs.
- Establish a process to discard false positive hits, and identify
other steps to be taken if the information in the database is
inconclusive.
- Are able to screen the names of clients in all business lines
against this list, especially if the FRFI has manual procedures,
legacy systems, or uses the database to screen for the names of
designated persons under anti-terrorist regulations.
OSFI does not expect FRFIs to depend on a client database in making
a PEFP determination where the information obtained from the client
shows that the client is a PEFP. Clients, who initially provide
information that clearly establishes them to be PEFPs, must be determined
to be PEFPs and need not be scrubbed through databases unless it
is done merely to obtain background or additional information.
Refer to the discussion about “reasonable measures” in "Client
Due Diligence", above. FRFIs should ensure a determination is made
based on an evaluation of the information received from a client
or a database.
FRFIs should also ensure that, where a client is determined to
be a PEFP, and the FRFI is aware that the client has family members
who are also PEFPs by reason of the definition in the PCMLTFA, the
names of such family members are scrubbed against the FRFI’s client
databases to determine if accounts are held in such names by the
FRFI.
FRFIs that use agents or mandataries (deposit brokers, mortgage
brokers or others) to identify their clients and remit client identification
information to them retain responsibility for PEFP determination.
FRFIs may assign responsibility for collecting the information necessary
for the FRFI to determine if the client is a PEFP, but the FRFI,
not the agent, is responsible for making the determination and for
applying the prescribed measures accordingly. FRFIs should ensure
that where agents or mandataries are responsible for gathering the
information, the agents understand what is required to be done and
the FRFI satisfies itself that its agents are doing what is required.
If a client’s name is contained in a public database, but the
FRFI does not determine the client is a PEFP, the FRFI may wish
to make a note of the “hit” for future reference or to guide it
in any future risk assessment.
What Happens after a PEFP Determination is made
Once a PEFP determination is made, it may not be reversed or otherwise
changed, other than to correct error. The PEFP definition provides
that the criterion or criteria that trigger PEFP status remain(s)
in effect in perpetuity.
When a client is determined to be a PEFP a FRFI must:
- Take reasonable measures to establish the source (i.e., how
the client acquired the funds in the account) of the PEFP’s funds;
see “Applying PEFP Determination to Canadian sources of funds
or payments”, below;
- For DTIs, obtain the approval of a senior officer to keep the
account open; for life insurance companies, ensure that a senior
officer reviews the transaction; and
- Conduct enhanced ongoing monitoring of the PEFP’s account to
identify potentially suspicious transactions.
Reasonable measures to establish source(s) of funds include asking
the client to explain how the client came to hold the funds. Examples
of source of funds could include: savings accumulated through employment;
sale of investments; sale of a business; an inheritance; a salary
bonus; and consulting fees.
In respect of the approval by a senior officer, such individual
should be a person at a more senior level who has the authority
to make this decision.
Reasonable measures for enhanced and ongoing monitoring of PEFPs’
accounts may involve manual or automated processes, or a combination
of both depending on resources and needs and could include:
- Developing reports or performing more frequent review of PEFP
account activity, and flagging activities that deviate from expectations
and elevate concerns as necessary;
- Setting up a management committee to regularly review all identified
PEFPs and their transactions; and
- Reviewing transactions more frequently against indicators of
suspicious transactions.
PEFPs in Canada and Domestic PEPs
The PEFP definition in the PCMLTFA indicates that the country
of residence or citizenship of an individual is immaterial to PEFP
determination. FRFIs should therefore ensure that their methodology
of PEFP determination does not preclude individuals merely because
they may be Canadian citizens or residents.
FRFIs may need to ensure they distinguish between PEFPs and domestic
PEPs. The latter are not separately defined in the PCMLTFA definition
of PEFP, although a PEFP could also be a domestic PEP. However,
FRFIs are not under any legal obligation to identify domestic PEPs per se, whether by screening or flagging large transactions
or in any other way. Further, even if FRFIs know they are dealing
with a domestic PEP, they are not under any legal obligation to
apply the measures that are applicable to PEFP accounts, unless
that individual is a PEFP.
Where a FRFI is aware that a client is a domestic PEP, the FRFI
should assess what effect, if any, this may have on the overall
assessed risk of the client. If the assessed risk is elevated, the
FRFI should apply enhanced due diligence measures as it considers
appropriate.
Identification of PEFPs in Foreign Subsidiaries or Branches
The PCMLTFA and PCMLTFR do not oblige FRFIs to apply PEFP measures
to their subsidiaries or branches of FRFIs outside Canada.
Where a FRFI is aware that a client of a subsidiary or a branch
outside Canada is a PEFP, the FRFI should assess what effect, if
any, this may have on the overall assessed risk of the client. If
the assessed risk is elevated, the FRFI should apply enhanced due
diligence as it considers appropriate.
The operations of foreign branches and subsidiaries may be subject
to local AML/ATF legislation, which may include requirements to
identify and monitor PEPs, including PEFPs.
Identification of PEFPs who own or control 25% or more of Clients
that are Corporations or Entities, or who are directors or officers
of such corporations or entities
FRFIs are not obliged by the PCMLTFA or PCMLTFR to apply PEFP
determination procedures to persons who own or control 25% or more
of clients that are corporations or entities, or who are directors
or officers of such corporations or entities.
Where a FRFI is aware that a person who owns or controls 25% or
more of a client that is a corporation or entity, or who is a director
or officer of such a corporation or entity, is a PEFP, the FRFI
should assess what effect, if any, this may have on the overall
assessed risk of the client corporation or entity. If the assessed
risk is elevated, the FRFI should apply enhanced due diligence as
it considers appropriate. Appropriate due diligence could include:
- A determination as to whether the PEFP is a client of the FRFI,
and, if so, whether enhanced monitoring procedures should apply
to the client’s and the PEFP’s transactions.
- Enhanced monitoring of the client account.
Applying PEFP determinations to Canadian sources of funds or
payments
For life insurance companies, the PCMLTFR does not distinguish between domestic
and foreign payments. Accordingly, life insurance companies should
apply a PEFP determination to prescribed funds from any source,
domestic or foreign.
For DTIs, domestic transfers into or out of an account
do not, of themselves, trigger any requirement to make a PEFP determination .
However, if a DTI has already determined that a client is a PEFP,
OSFI believes that a risk assessment should be made to determine
whether monitoring domestic incoming transfers would be advisable.
Client Corporations that can issue bearer
shares
Identifying a client that is a corporation that can issue bearer
shares may require special customer identification measures. Bearer
shares can hide the identity of beneficial owners of the client
corporation. If the aggregate of such shares could amount to more
than 25% of such client corporation, a FRFI might be unable to identify
the beneficial owner(s).
Where a FRFI assesses (using the risk categories outline above)
that the risk of dealing with such a client corporation may be present,
the FRFI should apply reasonable measures to mitigate this risk.
Reasonable measures should always include obtaining the identity
of the person or persons who beneficially own 25% or more of the
shares of the corporation taking into account any issued and outstanding
bearer shares, and could also include one or more of the following:
- Requesting the client corporation to immobilize any issued
and outstanding bearer shares, for example, by arranging for the
certificates representing such shares to be placed with a custodian
such as a trustee. The arrangement should permit the FRFI to:
- Verify on request that the shares continue to be held by
the custodian; and
- Be advised on a timely basis of any change in ownership
of the shares that may change this information.
- Requesting the client corporation to amend its charter documents
to remove the power to issue bearer shares and limit the issue
of new shares;
- Requesting the client corporation to cancel any issued and
outstanding bearer shares and replace them with shares in registered
form.
FRFIs should ensure that the measures taken are documented.
Correspondent Banking
For the purpose of this Guideline, "correspondent banking relationship"
has the same meaning as in the PCMLTFA.
Correspondent banking relationships are established between banks
to facilitate, among other things, transactions between banks made
on their own behalf; transactions on behalf of their clients; and
making services available directly to clients of other banks. Examples
of these services include: inter-bank deposit activities; international
electronic funds transfers; cash management; cheque clearing and
payment services; collections; payment for foreign exchange services;
processing client payments (in either domestic or foreign currency);
and payable- through accounts.
Correspondent banking relationships with foreign financial institutions
(FFIs) are identified by the FATF as a specific higher risk area,
and consequently the PCMLTFA and PCMLTFR prescribe measures to be applied
by FRFIs that enter into correspondent banking relationships with
FFIs and their clients.
FRFIs that offer payable through accounts services to customers
of FFIs must take reasonable measures to ascertain whether the FFIs
have met requirements that oblige them to identify and ascertain
the identities of such clients that are consistent with the requirements
of the PCMLTFR, and ensure that the FFIs will provide relevant customer
identification data to the FRFI, upon request.
Reasonable measures to achieve these requirements could include:
- Obtaining copies of the FFI’s AML policies, and in particular
its customer acceptance policies, and reviewing these for consistency
with the requirements of the PCMLTFR;
- Ensuring that the documentation of the agreement with the FFI
includes an obligation on the part of the FFI to provide relevant
customer identification information to the FRFI when requested
to do so.
Reasonable measures to monitor correspondent banking relationships
generally could include, for example:
- Establish and periodically update an AML country risk rating
system and assign a rating to each country in which a correspondent
banking relationship has been established, for the purpose of
implementing an appropriate level of monitoring;
- Review the FATF (or FATF style regional body’s) mutual evaluation
report or other assessment of the FFI’s home country’s measures
to implement the FATF 40 Recommendations and 9 Special Recommendations;
- Review the FFI’s ownership and background;
- Be satisfied that its activities are authorized, regulated
and supervised by the relevant regulatory authority in its home
country;
- Meet or otherwise communicate with senior representatives of
the FFI to understand their commitment to effective control of
ML and TF and understand key provisions of the FFI’s AML/ATF policies
and procedures such as those dealing with client acceptance; and
- Use the services of credible third parties (such as those providing
a document repository or AML/ATF rankings) as a source of additional
information on the FFI and its regulatory environment.
Where a FRFI ascertains, pursuant to s. 55.1 of the PCMLTFR, that
there are civil or criminal sanctions imposed against a FFI in respect
of AML/ATF requirements; or where a FRFI ascertains that a FFI does
not have in place AML/ATF policies and procedures as specified in
ss.15.1(3) of the PCMLTFA; then for the purpose of detecting any
suspicious transactions required to be reported to FINTRAC under
s. 7 of the PCMLTFA the FRFI should conduct ongoing monitoring of
all transactions in the context of the correspondent banking relationship
to mitigate the higher risk . The extent
of such monitoring in the case of sanctions identified against a
FFI should correspond to the context, severity and type of sanctions
imposed on the FFI. Reasonable measures could include:
- Reviewing in more depth the FFI’s client acceptance process
and its process for risk assessing its clients, products and services;
- Training officers of the FRFI on the required enhanced transaction
monitoring requirements to be applied with respect to the relationship,
including those transactions of the FFI’s clients that are permitted
to access the FRFI’s banking services;
- Escalating the level of Senior Management responsible for the
relationship;
- Reviewing transactions over threshold amounts (using a risk-based
approach), identified by analyzing client risk, business relationship
risk, product/service risk, delivery channel risk, geographic
risk and other relevant risk factors;
- Reviewing the FFI’s methodology for monitoring and surveillance
of transactions, in particular those that ultimately result in
a transaction being processed by the DTI (e.g. an international
wire payment, payment under a letter of credit, etc.) and preparing
a summary of the key AML/ATF policies and procedures of the FFI
as well as providing details on the due diligence carried out;
and
- Conducting risk-based retrospective due diligence on existing
clients utilizing the correspondent banking relationship using
the FRFI’s standards and criteria established in accordance with
the PCMLTFA and PCMLTFR; and
- Giving consideration to restricting or discontinuing payable-through
account services if the FRFI’s analysis of the relationship concludes
that the FFI’s polices and procedures do not meet the standards
set out in s. 55.2 of the PCMLTFR.
A FRFI acting as an intermediary bank may not be in a position
to understand the purpose of EFTs originated by clients of FFIs
or other originator banks, or conduct CDD on these persons. Consequently,
such a FRFI that receives a cover payment for transactions may not
be in a position to determine whether EFTs represented by the cover
payment are suspicious, based on an understanding of the activities
of the originator (and the beneficiary, if the beneficiary is not
a client of the FRFI). It is, however, possible for intermediary
FRFIs to monitor transactions that they process to identify patterns
of activity that may be suspicious, to report suspicious transactions
or attempted transactions, and, where such transactions are associated
with a particular FFI, to review the relationship with that FFI.
Processing Electronic Funds Transfers
All information prescribed by the PCMLTFA and PCMLTFR, including
originator information,
must be included on all outgoing international EFTs and domestic
SWIFT payments originated by FRFIs.
In addition, FRFIs must take reasonable measures to ensure that
incoming EFTs include originator information. FRFIs that act as
intermediary banks should develop and implement reasonable policies
and procedures for monitoring payment message data subsequent to
processing. Such measures should facilitate the detection of instances
where required message fields are completed but the information
is unclear, or where there is meaningless data in message fields.
Reasonable measures could include:
- Contacting the originator’s bank or precedent intermediary
bank to clarify or complete the information received in the required
fields;
- considering (in the case of repeated incidents involving the
same correspondent or in cases where a correspondent declines
to provide additional information) whether the relationship with
the correspondent or the intermediary bank should be restricted
or terminated; and/or
- filing a suspicious transaction report.
The reasons for decisions taken should be documented.
Trade Finance
Traditional trade finance services include letters of credit or
other financial products, which give FRFIs the opportunity to view
and assess details of the transaction that triggers an international
payment.
FRFIs that outsource trade finance services to other financial
institutions should ensure that this outsourcing is included in
the FRFI’s inherent risk assessment. If the assessment indicates
that the risk of ML and TF is elevated, the FRFI should implement
reasonable measures to control the risk. Reasonable measures could
include:
- Conducting an analysis of the provider’s policies and practices;
and
- Communicating to the provider what AML/ATF control measures
the FRFI expects the provider to have in place. The FRFI should
have the right to audit such measures.
OSFI recognizes that FRFIs whose services are used to make trade
finance payments on an open account basis may not have an opportunity
to review the nature of a client's underlying trade transaction.
Reasonable measures to address this risk could include:
- Periodic verification, using credible open source material
or information, of the business of the client that triggers the
need for such payments;
- Periodic review of electronic funds transfer data to determine
whether the client's business includes significant trade activity;
- Periodic review of the client's transactions compared to the
FRFI's record of the intended purpose of the account;
- Meeting or other interaction with the client; or
- Periodic confirmation that the client is not in a type of business
to which the FRFI has decided, as a matter of policy, not to provide
financial services.
Under- and over-Invoicing of Goods and Services
The FATF has advised that the laundering of funds through under- and over-invoicing is
one of the oldest methods of fraudulently transferring value across
borders, and remains a common practice. The key element of the technique
is the misrepresentation of the price of the good or service in
order to transfer additional value between the importer and exporter.
Many such cases have been identified by the FATF.
Multiple Invoicing of Goods and Services
By invoicing the same good or service more than once, a money
launderer may be able to justify multiple payments for the same
shipment of goods or delivery of services, especially if more than
one financial institution is used. Multiple invoicing avoids the
need to misrepresent prices.
Over- and Under-Shipments of Goods and Services
A third method of illicitly moving funds is to move more, less,
or no goods.
Other and More Complex Trade-based Money Laundering Techniques
The foregoing techniques can be combined in more complex series
of arrangements. For example, the so-called Black Market Peso Exchange
is a known technique used to launder the proceeds of the sale of
drugs. For more detailed information on techniques and typologies
associated with this and other trade-based money laundering, FRFIs
are requested to consult FATF material available on the FATF web
site.
Assessing the Risks in Trade Finance Services, and Enhanced Measures
to Mitigate Assessed Risk
Where the assessed risk of ML or TF in trade finance services
is elevated, FRFIs should take reasonable measures designed to mitigate
the risk of misuse of trade financing mechanisms. Reasonable measures
could include:
- Conducting periodic on-site assessment of the risks posed by
clients and the procedures they follow;
- Reviewing the routing of shipments and note ports of call or
transhipment points that are inconsistent with a standard commercial
transaction, for example, a shipment of steel from Canada to Asia
routed via a European port or a country where there is no apparent
business rationale for the routing, or where the routing or the
carrier is located in a high risk country;
- Subjecting requests involving letters of credit to cover shipments
of goods that are not consistent with the applicant’s normal business
patterns to more detailed review and noting the results in the
client’s records;
- Identifying significant differences (either between different
clients, different shipments or market quotes) in prices of a
good or commodity being financed under a letter of credit, and
determining the business rationale for the differences; and
- Making additional enquiries about the business rationale of
transactions involving multiple banks and payments flowing through
intermediaries as opposed to directly from the importer’s bank
to the exporter’s bank.
New and Developing Technologies
Developments in technology frequently drive the creation of new
financial products and services. Such developments can lower costs,
improve client service and expand markets. FRFIs should have policies
and procedures in place to ensure that new and developing technologies
are included in the FRFI’s inherent risk assessment process. In
this way FRFIs can ensure that appropriate AML/ATF controls are
in place, and, where appropriate, develop or amend controls to take
new risks into account. Examples of new and developing technologies
include stored value cards that may permit clients to subsequently
download those funds directly into a deposit or a credit account
and mobile telephone technology and various e-money services that
have similar characteristics.
RECORD KEEPING AND RETENTION
Procedures for keeping paper and electronic records of pertinent
information about clients and transactions must ensure that the
FRFI complies with all of the record keeping requirements of the
PCMLTFA and PCMLTFR. These include:
- for clients that are entities: prescribed information, if obtained,
about beneficial owners of corporate clients and other prescribed
information on corporations and other entities;
- for large cash transactions: large cash transaction records ;
related client records;
- for account opening: prescribed information about client individuals
and entities for non- credit card account opening;
and prescribed information about credit card holders for credit
card account opening;
- for account operation: account operating agreements and
other prescribed information for non-credit card accounts; and credit card account records
for credit card accounts;;
- for credit transactions: new credit files;
- for currency exchange: foreign currency exchange transaction
tickets;
- for transactions of $3,000 and more with non-account holders:
prescribed information for traveller’s cheques, money orders or
similar negotiable instruments
- for prescribed incoming EFTs: prescribed information;
- for trusts with respect to which trust companies are trustees:
copy of trust deed and other prescribed information;
- for accounts of PEFPs: PEFP office or position and other prescribed
information;
- for transactions of PEFPs: PEFP office or position and other
prescribed information ;
- for credit card accounts, account opening and accounts of PEFPs:
PEFP office or position and other prescribed information ;
- for foreign correspondent banking relationships: name and address
and other prescribed information;
- for purchases from life insurance companies of immediate or
deferred annuities or life insurance policies for which the client
may pay $10,000 or more over the duration of the annuity or policy:
client information record;
and
- for suspicious transactions and suspicious attempted transactions:
investigations and conclusions.
FRFIs are expected to use record keeping methodologies and formats
that are appropriate in their particular circumstances, provided
that records required to be kept by the PCMLTFA and PCMLTFR must,
as a general rule, be kept for at least 5 years and they must be made available to competent authorities on a timely
basis, which is within 30 days after a request is made .
Client information should be kept current to reflect regulatory
requirements and the FRFI’s continuing knowledge of the client,
client activities and purpose of the client relationship, which
facilitates monitoring for suspicious transactions and attempted
transactions.
A process should be implemented for dealing with incomplete documentation
with a view to making it complete and current before doing more
transactions or unrestricted transactions.
TRANSACTION REPORTING
General
The PCMLTFA and PCMLTFR prescribe reporting to FINTRAC on LCTRs,
EFTs, STRs and TPRs.
FRFIs should ensure that internal reporting processes are designed
to ensure compliance with regulatory reporting requirements as they
relate to transaction reporting systems. Systemic compliance issues
should be documented, escalated to the CAMLO and brought to the
attention of FINTRAC. Control measures should include the identification
of remedial action designed to eliminate compliance issues. For
example, FRFIs should notify FINTRAC promptly of any internally
identified LCTR, EFT or STR reporting errors or omissions. FRFIs
should pay special attention to FINTRAC’s error codes when filing
reports, and take remedial action on a timely basis when FINTRAC
indicates filing errors or other compliance issues. FRFIs should
confirm to FINTRAC when remedial action is complete.
Suspicious Transactions and Suspicious Attempted
Transactions, and Reports on Terrorist Property
Suspicious transactions and attempted transactions are defined
in the PCMLTFA as those in respect of which there are reasonable
grounds to suspect that the transaction or attempted transaction
is related to the commission or attempted commission of a ML offence
or a TF offence. There is no monetary threshold applicable to suspicious transactions
or suspicious attempted transactions.
A transaction or attempted transaction that the FRFI reasonably
suspects is related to a money laundering offence must be reported
to FINTRAC. Property in the possession or control of a FRFI that
the FRFIs knows, or has reasonable grounds to believe, is owned
or controlled by or on behalf of a terrorist or a terrorist group,
must also be reported to FINTRAC. This includes information about
any transaction or proposed transaction relating to that property.
The obligation to report suspicious transactions, suspicious attempted
transactions and terrorist property is designed to assist Canadian law enforcement authorities in their
investigation and prosecution of ML and TF offences and predicate
offences. Robust ongoing monitoring, examination and reporting processes
in FRFIs are crucial in assisting these law enforcement efforts.
Suspicious transactions and suspicious attempted transactions
should be identified by FRFIs from unusual activity or transactions.
Procedures to identify unusual activities should capture the background
and purpose of the transaction(s), who was involved, when and where
it occurred, what products or services were involved and how the
transaction was structured, and should be recorded.
STRs must be filed promptly in accordance with the regulatory
requirements. Supporting documentation must be retained as prescribed and made available to assist law
enforcement authorities within prescribed deadlines.
FRFIs must ensure that information concerning STRs, including
the fact that there is a suspicion and/or an STR, is kept strictly
confidential. The client(s) involved must not be tipped off to a
disclosure, and information within the FRFI must be strictly limited
to the CAMLO and others on a “need to know” basis.
The PCMLTFR require that, except where identity has been previously ascertained
in accordance with the Regulations, FRFIs must take reasonable measures
to ascertain the identity of every person with whom a suspicious
transaction or suspicious attempted transaction is conducted. While
reasonable measures may include normal client identification practices,
care must be taken to ensure that such practices, if used, do not
have the effect of tipping off the client.
Aggregation of Cash Transactions
The PCMLTFR provides that where two or more cash transactions of less than $10,000 each
are made within 24 consecutive hours that in the aggregate amount
to $10,000 or more, the aggregated transactions are considered to
be a single transaction of $10,000 or more for reporting purposes
if a FRFI knows that the transactions are conducted by, or on behalf
of, the same person or entity, or an employee or a senior officer
of the FRFI knows that the transactions are conducted by, or on
behalf of, the same person or entity.
For the purposes of interpreting this requirement, FRFIs that
have systems in place that permit the FRFI to know, by making a
record of multiple cash transactions referred to in this requirement,
that the transactions are conducted by or on behalf of the same
client should ensure that such transactions are aggregated and reported
to FINTRAC as Large Cash Transactions.
TRAINING
Effective training programs for staff and others (as required)
is an important and statutorily required element of FRFIs’ AML/ATF
programs.
FRFIs should ensure that written AML/ATF training programs are
developed and maintained. Appropriate training should be considered
for Senior Management, employees, agents and any other
persons who may be responsible for control activity, outcomes or
oversight, or who are authorized to act on the Company’s behalf
pursuant to the PCMLTFR. The nature and content should be appropriate to the
AML/ATF responsibilities of and the FRFI's relationship with, each
intended recipient group. In particular, training should be tailored
to provide the types and granularity of information and skills that
are necessary for effective performance of the AML/ATF function
in each case.
Training programs for Senior Management should
provide sufficient briefing with respect to inherent risks and controls
to enable them to assess information reported by the CAMLO and Auditor,
and exercise effective oversight over the AML/ATF program.
SELF ASSESSMENT of CONTROLS
FRFIs should ensure that a self assessment of control measures
is conducted, preferably on an ongoing basis, but at least annually.
The assessment of AML/ATF controls is an important component of
AML/ATF program because of its quality assurance outcome.
While the assessments in business areas can and should be conducted
by individuals in those business areas, FRFIs should ensure that
the assessment process is designed to enable results in each area
to be consolidated for analysis and other purposes.
The self assessment in each relevant area of the FRFI should cover,
at a minimum, the adequacy of the inherent risk assessment, AML/ATF
policies and procedures, training and other controls implemented
to mitigate ML and TF risks.
FRFIs should ensure that the self assessment is neither too narrow
nor too broad. For example, a narrow legal/regulatory-based assessment
could fail to cover broader ML and TF controls. Similarly an operational-based
assessment might fail to cover prescribed controls.
All significant information used in the self assessment process
should be verified or readily verifiable. Methods used to ensure
that information is verified or verifiable will depend on the size,
complexity and governance structure of the FRFI. Reasonably effective
measures observed by OSFI tend to fall into one or more of the following
categories:
- Business areas are required by the CAMLO to provide information
on the methodology they used to assess or re-assess ML and TF
controls in their areas, in support of assessment results;
- Business areas are required by the CAMLO to provide evidence
of having documented support for the results of their assessments;
- The CAMLO reviews and confirms the assessment results; or
- A combination of the above.
The self assessment of controls should provide FRFIs with:
- Insight into the efficacy of controls in the AML/ATF program,
and the overall extent to which the program adequately mitigates
the identified inherent risks of ML and TF; and
- Information to aid in prioritizing remediation efforts if controls
are under-performing and opportunities to capture economies of
scale to better allocate resources to areas of higher risk.
EFFECTIVENESS TESTING
Like the assessments of inherent risk and risk management controls,
effectiveness testing of the AML/ATF program is an important component
of AML/ATF program quality assurance and is a statutorily required
part of the FRFI’s AML/ATF program.
The PCMLTFR require that the following AML/ATF program components be reviewed
for the purpose of testing their effectiveness every two years:
- Policies and Procedures;
- Risk assessments;
- Training programs.
The PCMLTFR also prescribe minimum content and timing for reports to a senior
officer on effectiveness testing.
In addition, it would be prudent for FRFIs to ensure that all
other elements of the AML/ATF program be tested for effectiveness
on a similar time scale.
FRFIs have access to internal or external auditors (or both) and
therefore FRFIs should ensure that the Auditor is responsible for
effectiveness testing. However, this does not preclude the Auditor
from outsourcing all or part of the effectiveness testing to qualified
third parties, although remaining responsible for the effectiveness
testing program. FRFIs should ensure that effectiveness testing
of the AML/ATF program is included in the Auditor’s mandate and
audit program.
Effectiveness testing may be carried out on a stand-alone basis,
or embedded in broader audits with other audit work. Whichever approach
is taken, testing must cover all key AML/ATF program components,
including policies and procedures, risk assessments and training
programs at least every two years.
FRFIs should ensure that effectiveness testing is:
- in addition to (not a substitute for) assessments of inherent
risks and risk management controls;
- appropriately risk based, with testing more frequently and/or
thoroughly in higher risk categories throughout the FRFI as identified
in the FRFI’s Inherent Risk Assessment;
- planned and performed by an auditor or auditors who have had
appropriate AML/ATF training and experience in respect of ML and
TF risk and an appropriate level of knowledge of the regulatory
requirements and guidelines; and
- reported to appropriate Senior Management,
including information on testing scope, findings and recommendations
or requirements for remedial action, and management’s responses
thereto.
Effectiveness Testing Compared To Assessment
of Risks and Controls
The following table compares the different purposes, content,
responsibility and outcomes of effectiveness testing and self assessments
of risks and controls:
|
Effectiveness Testing |
Assessments of risks and Controls |
| Purpose |
Test the adequacy and effectiveness of AML/ATF program
components in all relevant areas. |
Assessing the scope and content of AML/ATF program components
in all relevant areas. |
| By whom |
Internal or External Auditor |
Each relevant area And coordinated across the enterprise
by the CAMLO |
| Frequency |
Periodic; however at a minimum the FRFI must ensure the
prescribed elements of the AML/ATF program are tested at least
every two years. |
Ongoing. |
| Reporting: timing and recipients |
Within 30 days after work is complete, to Senior Management. |
Within a reasonable time after work is complete, to Senior
Management. At least once a year on a FRFI- wide basis by
the CAMLO to Senior Management. |
INTERPRETATION
The following meanings apply in this Guideline:
| AML |
Anti-money laundering |
| AML/ATF program |
A FRFI’s AML/ATF program designed to comply with this Guideline,
and includes the program referred to in s. 71 of the PCMLTFR |
| ATF |
Anti-terrorist financing |
| Auditor |
The internal or external auditor of the FRFI responsible
for effectiveness testing required by paragraph 71(1) (e)
of the PCMLTFR |
| Board |
Board of Directors. References to “Board” should be read
as references to the Principal Officer of foreign bank branches
and the Chief Agent of branches of foreign life insurance
companies, as appropriate |
| CAMLO |
The person designated responsible under PCMLTFR s. 71(1)
(a) for implementing the FRFI’s AML/ATF program, referred
to by OSFI as the Chief Anti-Money Laundering Officer |
| CRA |
Canada Revenue Agency |
| DTI |
Deposit taking institution |
| EFT |
Electronic funds transfer as defined in subsection 1(2)
of the PCMLTFR |
| FATF |
Financial Action Task Force on Money Laundering |
| FIU |
Financial intelligence unit, and includes FINTRAC, as appropriate |
| FINTRAC |
Financial Transactions and Reports Analysis Centre of Canada |
| FRFI |
Federally Regulated Financial Institution - includes banks,
authorized foreign banks in respect of their business in Canada
(foreign bank branches or FBBs), companies to which the Trust
and Loan Companies Act applies, and life insurance companies
or foreign life insurance company branches to which the Insurance
Companies Act applies; and includes a FRFI’s branches
and subsidiaries world wide, if applicable. |
| LCM |
Legislative compliance management |
| LCTR |
Large cash transaction report |
| ML |
Money laundering |
| OSFI Act |
Office of the Superintendent of Financial Institutions
Act |
| PCMLTFA |
Proceeds of Crime (Money Laundering) Terrorist Financing
Act |
| PCMLTFR |
Proceeds of Crime (Money Laundering) Terrorist Financing
Regulations |
| PEP |
Politically Exposed Person |
| PEFP |
Politically Exposed Foreign Person as defined in subsection
9.3(3) of the PCMLTFA. |
| STR |
Suspicious transaction report and includes a report of
a suspicious attempted transaction |
| Senior Management |
Includes, but is not limited to, any person who is a senior
officer as defined in the PCMLTFR |
| TF |
Terrorist financing |
| TPR |
Terrorist property report |