2 Excerpts from the Wolfsberg Principles reproduced with kind permission of the Wolfsberg Group. All rights reserved.
The Wolfsberg Group is an association of eleven global banks which aims to develop financial service industry standards and related products for Know Your Customer, Anti-Money-Laundering and Counter-Terrorist-Financing policies.
The Group came together in 2000, at Château Wolfsberg in north-eastern Switzerland, in the company of representatives from Transparency International, including Stanley Morris, and Professor Mark Pieth of the University of Basel, to work on drafting anti-money-laundering guidelines for private banking. The Wolfsberg Anti-Money-Laundering Principles for Private Banking were subsequently published in October 2000, revised in May 2002 and again most recently in June 2012.
The Group then published a Statement on the Financing of Terrorism in January 2002, and also released the Wolfsberg Anti-Money-Laundering Principles for Correspondent Banking in November 2002 with the Wolfsberg Statement on Monitoring Screening and Searching being issued in September 2003. In 2004, the Wolfsberg Group focused on the development of a due diligence model for financial institutions, in cooperation with Banker's Almanac, thereby fulfilling one of the recommendations made in the Correspondent Banking Principles.
During 2005 and early 2006, the Wolfsberg Group of banks actively worked on four separate papers, all of which aimed to provide guidance with regard to a number of areas of banking activity where standards had yet to be fully articulated by lawmakers or regulators. It was hoped that these papers would provide general assistance to industry participants and regulatory bodies when shaping their own policies and guidance, as well as making a valuable contribution to the fight against money laundering. The papers were all published in June 2006, and consisted of two sets of guidance: Guidance on a Risk Based Approach for Managing Money Laundering Risks and AML Guidance for Mutual Funds and Other Pooled Investment Vehicles. Also published were FAQs on AML issues in the Context of Investment and Commercial Banking and FAQs on Correspondent Banking, which complement the other sets of FAQs available on the site: on Beneficial Ownership, Politically Exposed Persons and Intermediaries.
In early 2007, the Wolfsberg Group issued its Statement against Corruption, in close association with Transparency International and the Basel Institute on Governance. It describes the role of the Wolfsberg Group and financial institutions more generally in support of international efforts to combat corruption. The Statement against Corruption identifies some of the measures financial institutions may consider in order to prevent corruption in their own operations and protect themselves against the misuse of their operations in relation to corruption. Shortly thereafter, the Wolfsberg Group and The Clearing House Association LLC issued a statement endorsing measures to enhance the transparency of international wire transfers to promote the effectiveness of global anti-money-laundering and anti-terrorist-financing programmes.
In 2008, the Group decided to refresh its 2003 FAQs on PEPs, followed by a reissued Statement on Monitoring, Screening and Searching in 2009. 2009 also saw the publication of the first Trade Finance Principles and Guidance on Credit/Charge Card Issuing and Merchant Acquiring Activities. The Trade Finance Principles were expanded upon in 2011 and the Wolfsberg Group also replaced its 2007 Wolfsberg Statement against Corruption with a revised, expanded and renamed version of the paper: Wolfsberg Anti-Corruption Guidance. This Guidance takes into account a number of recent developments and gives tailored advice to international financial institutions in support of their efforts to develop appropriate anti-corruption programmes, to combat and mitigate bribery risks associated with clients or transactions and also to prevent internal bribery.
More recently, focus has expanded to the emergence of new payment methods and the Group published Guidance on Prepaid and Stored Value Cards, which considers the money-laundering risks and mitigants of physical prepaid and stored value card issuing and merchant acquiring activities, and supplements the Wolfsberg Group Guidance on Credit/Charge Card Issuing and Merchant Acquiring Activities of 2009.
In 2014 the Group issued Guidance on Mobile and Internet Payment Services (MIPS) and reissued the Principles for Correspondent Banking first issued in November 2002.
The Wolfsberg Standards consist of the various sets of AML Principles, as well as related statements, issued by the Group since its inception:
In the following sections we consider key elements of certain of these statements. Further information on individual elements of the statements appears in the relevant chapters of this book. If you do need full details of all or any of the statements, then reference should be made to the original statements. The principles are reproduced with the kind permission of the Wolfsberg Group.
These principles update those originally issued in November 2002 and reiterate the requirements set out by FATF. The principles are also intended to be applied to SWIFT Relationship Management Application (RMA) relationships in part, or in totality, using a risk based approach.
Apart from the normal requirements regarding policies and procedures and governance there is also a requirement that at least one person, senior to or independent from, the officer sponsoring the relationship, should approve the correspondent banking relationship. There is also a requirement for independent review.
Again the risk based approach is adopted taking into account the nature of the supervisory environment in which the firm operates. The particular risks of the relationship do need to be considered with information being updated on a risk basis including the use of trigger events. These include relevant money-laundering-deterrence-related adverse media or adverse client behaviour that results in a material change in the client and this should prompt a review of the relevant documentation and information.
Elements that should be used to address specific risk indicators include the following, if appropriate:
Three issues are identified:
The remaining sections refer to monitoring and integration with the anti money laundering programme.
This recently updated guideline provides general principles for banks, particularly in relation to KYC and due diligence.
The guideline provides that banks will endeavour to accept only those clients whose source of wealth and funds can be reasonably established to be legitimate. The primary responsibility for this lies with the private banker who sponsors the client for acceptance. Mere fulfilment of internal review procedures does not relieve the private banker of this basic responsibility. Bank policy will specify what such responsibility and sponsorship entail. The use of the word “endeavour” is due to the rules of Wolfsberg not strictly being obligatory.
The bank will establish the identity of its clients and beneficial owners prior to establishing business relationships with such persons. Identity is generally established by obtaining the name, date of birth (in the case of individuals), address and such further information as may be required by the laws of the relevant jurisdictions.
The requirement is for the bank to take reasonable measures to verify identity when establishing a business relationship as noted below, subject to applicable local requirements.
Identification documents, if used for verification purposes, must be current at the time of opening and copies of such documents should be obtained.
Beneficial ownership, for AML purposes, must be established for all accounts. The guideline sets out various situations in which beneficial ownership should be ascertained:
In each of the above cases, the private banker will make a reasonable judgment as to the need for further due diligence.
The nature of the relationship of the bank with an intermediary depends on the type of intermediary involved.
An introducing intermediary introduces clients to the bank, whereupon the introducing intermediary's clients become clients of the bank. The bank will generally obtain the same type of information with respect to an introduced client that would otherwise be obtained by the bank, absent the involvement of an introducing intermediary. The bank's policies will address the circumstances in, and the extent to which, the bank may rely on the introducing intermediary in obtaining this information.
A managing intermediary acts as a professional asset manager for another person and either:
The private banker will perform due diligence on the introducing or managing intermediary and establish, as appropriate, that the intermediary has relevant due diligence procedures for its clients, or a regulatory obligation to conduct such due diligence, that is satisfactory to the bank.
The relationship between the holder of a power of attorney or another authorised signer, the account holder and, if different, the beneficial owner of the account, must be understood.
The identity of a holder of general powers over an account (such as the power to act as a signatory for the account) will be established and, as appropriate, verified.
The guideline obliges banks to determine whether walk-in clients or relationships initiated through electronic channels require a higher degree of due diligence prior to account opening. The bank is also obliged specifically to address measures to establish and verify satisfactorily the identity of non-face-to-face customers.
In addition to the information contemplated above, the guideline states that it is essential to collect and record the following information for clients and beneficial owners:
Applying a risk-based approach, the bank will corroborate the information above on the basis of documentary evidence or reliable sources. Unless other measures reasonably suffice to conduct the due diligence on a client (e.g. favourable and reliable references), a client will be met prior to account opening, at which time, if identity is verified on the basis of official identity documents, such documents will be reviewed.
The guideline only permits numbered or alternate name accounts if the bank has established the identity of the client and the beneficial owner. These accounts must be open to a level of scrutiny by the bank's appropriate control layers equal to the level of scrutiny applicable to other client accounts. Furthermore, wire transfers from these accounts must reflect the true name of the account holder.
Under the guideline, the bank is not allowed to permit the use of its internal non-client accounts (sometimes referred to as “concentration accounts”) to prevent association of the identity of a client with the movement of funds on the client's behalf, i.e. the bank will not permit the use of such internal accounts in a manner that would prevent the bank from appropriately monitoring the client's account activity.
New clients, subject to a risk-based approach, must be approved by at least one person other than the private banker.
The bank will specify categories of customers that it will not accept or maintain.
In its internal policies, the bank must define categories of persons whose circumstances warrant enhanced due diligence. This will typically be the case where the circumstances are likely to pose a higher than average risk to a bank.
The circumstances of the following categories of persons are indicators for defining them as requiring enhanced due diligence:
Clients who are not deemed to warrant enhanced due diligence may be subjected to greater scrutiny as a result of:
The bank's internal policies should indicate whether, for any one or more among these categories, senior management must approve entering into new relationships.
Relationships with PEPs may only be entered into with the approval of senior management.
The bank's policies and procedures will address client cash transactions, including specifically the receipt and withdrawal of large amounts of cash.
The private banker is responsible for updating the client file on a defined basis and/or when there are major changes. The private banker's supervisor or an independent control person will review relevant portions of client files on a regular basis to ensure consistency and completeness. The frequency of the reviews depends on the size, complexity and risk posed by the relationship.
With respect to clients classified under any category of persons mentioned above as requiring enhanced due diligence or being prohibited, the bank's internal policies will indicate whether senior management must be involved in these reviews and what management information must be provided to management and/or other control layers. The policies and/or procedures should also address the frequency of these information flows.
Reviews of PEPs must require senior management's involvement.
The bank will have a written policy on the identification of, and follow-up on, unusual or suspicious activities. This policy and/or related procedures will include a definition of what is considered to be suspicious or unusual and give examples thereof. The guideline provides examples of potentially suspicious activities and how to spot them, including:
Unusual or suspicious activities can be identified through:
The private banker, management and/or the control function will carry out an analysis of the background of any unusual or suspicious activity. If there is no plausible explanation, a decision involving the control function will be made to:
The report to the authorities is made by the control function and senior management may need to be notified (e.g. Senior Compliance Officer, CEO, Chief Auditor, General Counsel). As required by local laws and regulations, the assets may be blocked and transactions may be subject to approval by the control function.
The primary responsibility for reviewing account activities lies with the private banker. The private banker will be familiar with significant transactions and increased activity in the account and will be especially aware of unusual or suspicious activities. In addition, a sufficient monitoring programme must be in place. The bank will decide to what extent fulfilment of this responsibility will need to be supported through the use of automated systems or other means.
With respect to clients classified as high risk, the bank's internal policies will indicate how the account activities will be subject to monitoring.
A sufficient sanctions programme must be in place, and no bank or employee may provide any assistance to a client trying to deceive the authorities.
The guideline obliges banks to include standard controls to be undertaken by the various “control layers” (private banker, line management, independent operations unit, Compliance, Internal Audit) in its policies and procedures. These controls will cover issues of frequency, degree of control, areas to be controlled, responsibilities and follow-up, compliance testing, etc.
An independent audit function (which may be internal to the bank) will test the programmes contemplated by these controls.
There will be regular management reporting established on money-laundering issues (e.g. number of reports to authorities, monitoring tools, changes in applicable laws and regulations and the number and scope of training sessions provided to employees).
The bank will establish a training programme on the identification and prevention of money laundering for employees who have client contact and for Compliance personnel. Regular training (e.g. annually) will also include how to identify and follow up on unusual or suspicious activities. In addition, employees will be informed about any major changes in AML laws and regulations.
All new employees will be provided with guidelines on the AML procedures.
The bank will establish record retention requirements for all AML-related documents. The documents must be kept for a minimum of five years, or longer, as may be required by local law and regulation.
The bank will establish an exception and deviation procedure that requires risk assessment and approval by an independent unit.
The bank will establish an adequately staffed and independent department responsible for the prevention of money laundering (e.g. Compliance, independent control unit, Legal).
In August 2011, the Wolfsberg Group replaced its 2007 Wolfsberg Statement against Corruption with a revised, expanded and renamed version of the paper: Wolfsberg Anti-Corruption Guidance. This Guidance takes into account a number of recent developments and gives tailored advice to international financial institutions in support of their efforts to develop appropriate anti-corruption programmes, to combat and mitigate bribery risks associated with clients or transactions and also to prevent internal bribery.
Bribery is commonly described as involving the promise, offer/acceptance or transfer of an advantage, either directly or indirectly, in order to induce or reward the improper performance of a function or an activity. It may occur in a commercial arrangement (so-called commercial bribery) or involve the misuse of public office or public power for private gain in order to obtain, retain or direct business or to secure any other improper advantage in the conduct of business.
The statement provides guidance on anti-corruption programmes. It states that financial institutions should risk assess their own acuities, products and services, as appropriate, to develop and implement effective anti-corruption policies, procedures and measures, which are proportionate to the corruption risks identified. The following internal measures are important mitigants that a financial institution should consider implementing to prevent bribery and to protect employees, as well as the organisation itself, in the event that an allegation of direct or indirect bribery or corruption is raised:
Financial institutions may be misused to further acts of corruption or to launder the proceeds of bribery. For example:
In many instances, and without further information (for example, absent red flags), it may not be apparent from account activity that misuse is occurring and, therefore, it is hardly possible for financial institutions to make a distinction between accounts and transactions associated with corruption and those accounts and transactions that have a legal and sound commercial basis. This is particularly, but by no means exclusively, the case when dealing with substantial companies with complex business operations. The primary responsibility to ensure that funds are neither collected nor used for illicit operations, including bribery, must rest with a financial institution's customer or that customer's representatives. This is particularly true since a financial institution will seldom have a complete overview of its customers' financial activity.
Transactions involving the proceeds of corruption often follow patterns of behaviour common to money laundering associated with other criminal activities. Adherence to existing anti-money-laundering policies, procedures and controls is therefore important in the fight against corruption. By the same token, the standards and guidance set out in existing Wolfsberg papers are similarly relevant to determine and manage money-laundering risks related to corruption.
The anti-corruption programme addressing internal bribery risks should be based upon the financial institution's wider risk-management strategy which will encompass a risk-based approach. There is an appendix to the guideline providing further guidance based on the following criteria:
The payment and receipt of bribes may be effected through a variety of services provided by financial institutions. However, in considering and assessing exposure to this risk, there are certain services that may be considered more vulnerable to abuse than others. The risks and possible mitigating measures are highlighted below, together (where appropriate) with any particularly relevant red flags.
Factors that could be considered by a financial institution whose customers are directly involved in project finance or related activities might include country, industry and political risk (see the sections on Country risk and Customer risk below) as well as due diligence or enhanced due diligence on the customer. For example, it might be appropriate to consider a customer's record in relation to convictions or other sanctions for corruption, if known. It would not be reasonable to extend due diligence beyond the direct customer to sub-contractors, suppliers, agents, consultants or other intermediaries. However, if the financial institution discerns something sufficiently unusual about the transaction, it should seek clarification about the matter, so as to dispel concerns it may have with regard to the transaction.
Countries having been identified by credible sources as having significant levels of corruption; for further information see the Wolfsberg Guidance on a Risk Based Approach.
Certain customers identified during due diligence or enhanced due diligence (initial and ongoing) may potentially represent a greater degree of risk. Such due diligence or enhanced due diligence may include identification of negative publicly available information from credible sources that calls into question a customer's activities regarding corruption, or, indeed, that indicates that prosecutions or actions have been taken by governmental authorities and/or law enforcement. The risks and possible mitigating measures are highlighted below, together with any particularly relevant red flags.
PEPs potentially represent higher risk either because they are in a position to exert undue influence on decisions regarding the conduct of business by private sector parties, or they have access to state accounts and funds.
In certain industries, the services of intermediaries or agents are used by companies to help secure or retain business abroad. Commissions paid to agents have sometimes been used to pay bribes to government officials on behalf of a company. Intermediaries and/or agents are often difficult to identify.
Correspondent customers potentially represent higher risks because the bank typically has no direct relationship with the customers of the correspondent bank. The bank is, therefore, unable as a matter of course to verify the identity of these underlying customers or understand the nature of the business and transactions (e.g. wire transfers, clearing cheques) it processes on their behalf.
Certain business sectors and industries have historically been identified with high perceived levels of corruption. Financial institutions therefore need to assess, based on their own criteria, whether the activity of a customer in a particular industry poses a higher risk of corruption.
Where risk factors are identified, an assessment should be made as to whether the customer should be the subject of enhanced due diligence, transaction monitoring, senior management approval and/or other measures, including review and oversight of their financial operations, as may be appropriate. In some circumstances, the filing of a suspicious activity report (SAR) or other notification to the authorities may be required by local law or regulations.
The international community recognises the need for States to cooperate with one another in order to prevent and eradicate corruption. Organisations like the OECD and the UN also recognise that if efforts are to be effective, the involvement and support of individuals and groups outside the public sector are required, including civil society, non-governmental organisations and community-based organisations. Private sector companies and their related industry organisations, Chambers of Commerce and other industry organisations also have an important role to play in this regard in apprising financial institutions of developments to prevent corruption by industrial sectors or individual firms.
The Wolfsberg Group supports the publicly led multi-stakeholder approach to addressing the following important areas where further dialogue and cooperation may lead to improvements in preventing and deterring bribery and other corrupt activity as it affects the financial sector:
The Wolfsberg Group believes that constructive dialogue in this area will help to increase the knowledge and ability of such agencies and institutions to identify trends, patterns, money-laundering techniques and mechanisms used in the furtherance of acts of bribery and corruption and, with an effective public/private partnership, financial institutions will be better placed to assist in the fight to prevent and/or detect and disclose incidents of corruption.
This guidance supplements the guidance issued on credit/charge card issuing and merchant acquiring activities and on prepaid and stored value cards. It discusses the roles and operations of MIPS and also discusses Non-Bank Service Providers (NBSPs).
The concerns over MIPS are where the following services are included within their product offering:
The analysis of these features will enable a firm to assess the money laundering risks posed and the controls that can be applied to mitigate these risks.
The following factors should be considered when assessing the risk:
Again a risk based approach is adopted. For low risk propositions no identification and verification is required so long as patterns do not change over time. For higher risk propositions the identification of the MIPS user is required as well as verification of name and address.
In terms of screening for low risk propositions no sanctions screening is required, whereas for higher risk propositions it is required before the account or service is opened and during the lifetime of the relationship.
All partners in the service should be subject to appropriate risk based due diligence.
In terms of transaction monitoring the following are identified as being worthy of note:
In conclusion the Wolfsburg Group believes that: