16.1 WHO IS A CORPORATE CUSTOMER?

There are many different forms of corporate customer, ranging from listed companies through private limited liability companies to partnerships, trusts and charities. Corporate customers that are public companies listed on stock exchanges will already be subject to market regulation and higher levels of public disclosure, in terms of their management, ownership and business activities. Their accounts will be subject to external audit by an independent firm and their results will be analysed by the media. Such corporate customers may be considered as potentially lower risk from a customer identification viewpoint due to the level of scrutiny that clearly exists, although such firms could still, of course, be involved in inappropriate activity.

In the UK, there are unlisted securities exchanges which appear to be listed but still have reasonably high levels of scrutiny. Larger, unlisted companies will also still be subject to higher levels of public disclosure and an external audit. They may have issued fixed-income securities which are themselves listed, increasing the independent level of scrutiny on the firm. It is this level of public exposure which makes corporate customers particularly concerned about money-laundering risks. Such firms will no more wish to be involved with money laundering or terrorist financing than would be the case for the bank.

The key problem is that detailed information concerning such companies, such as company accounts, is easily accessible public information. Clearly, companies can be particularly vulnerable to the criminal intentions of money launderers, since they can access such information to use to their advantage. It is, therefore, advisable for firms in their verification processes to take into account that public information may be manipulated by money launderers to disguise their illegitimate objectives, stealing the identity of a legitimate business to cover their activity.

There are different problems in respect of family-owned and smaller companies. In such cases, there is a limited level of independent verification and differing expectations on the role of the auditor. In the case of smaller corporates there might not even be a requirement for the firm to have external auditors, or for an audit to be conducted. The bank will need to consider this when taking documentation and consider whether additional procedures should be undertaken.

16.2 RISKS ASSOCIATED WITH CORPORATE CUSTOMERS

It may not always be particularly obvious why a corporate customer may, in some cases, be at higher risk of money laundering than a private customer. Identification verification in the form of due diligence is important in the case of corporate customers for a number of reasons, not least of which are the local regulations promulgated within each jurisdiction.

There are things which, again, should suggest that a company is a higher risk than normal, and therefore enhanced due diligence procedures should be conducted. One of these is the issue of businesses with particularly complex structures or ownership. In the case of the major fraud at Enron, it was through taking advantage of accounting rules and operating complex structures that the losses of the firm were hidden for so long. In this case, the audit could not be relied upon to identify the fraud, indeed it is important to remember that external auditors are not seeking to identify fraud in the design of their work. Instead, their work is designed to see that the results of the firm provide a true and fair view as set out by the arcane accounting standards upon which the accounts are built.

The existence of a particularly complex business structure may mean that the financial institution must undertake additional measures to be reasonably satisfied of the identities of those that control their business customers. The very existence of a complex structure will, in itself, also need to be investigated, since this could be used to hide inappropriate activity, including, potentially, tax evasion. Again, it is not just the money-laundering concern that worries the firm; rather it is the losses that would occur were the company found actually to be conducting a fraud, resulting in, for example, loans not being repaid.

Firms must be satisfied that there is an obvious legitimate commercial purpose for a corporate customer's business structure. If firms are unable to demonstrate such a legitimate purpose, then the financial institution should be alerted to the increased risk of potential money laundering or terrorist financing and again conduct enhanced due diligence. In this case, this would involve investigating the structures of the group and identifying the controlling relationships that are of greatest importance.

Another factor of concern when dealing with corporate customers is the extent of control given to individuals through a direct shareholding. Shareholders can exercise significant control over a company through their decision-making powers. They may have the power to make decisions regarding the management of funds and transactions without requiring specific additional authority. Therefore, shareholders are, in some cases, able to override internal procedures and controls. A lack of internal control and regulations is typically the type of condition which a money launderer would exploit for his own illegitimate purposes.

However, a firm would not assume that in all cases where shareholders exercise a significant level of control that they may be using the firm's corporate structure to disguise money-laundering activity. A high level of shareholder control is merely a situation which firms must investigate further on a risk-sensitive basis. Levels of control within corporate entities may depend on the nature of the company, the distribution of shareholdings and the nature and extent of any business or family connections between the beneficial owners.

16.3 BENEFICIAL OWNERS

In order to conduct thorough due diligence on a corporate customer, firms will need to identify key individuals within the corporate structure. Typically, such a figure is one that:

• Ultimately owns or controls (whether through direct or indirect ownership or control, including through bearer shareholdings) more than 25% of the shares or voting rights in the body; or
• Otherwise exercises control over the management of the body.

You will note that directors do not necessarily fall within this definition, unless the director is a beneficial owner or has a controlling influence. Directors are excluded if they do not have an ownership interest in the body, nor do they control voting rights or exercise control over management in the sense that enables them to manipulate voting and composition of the board of directors.

However, in other cases there will not be a dominant shareholder nor an external controller and the directors will be the key people that the firm would seek to identify. The question then is the extent of verification that is required and whether the full, retail-style identification procedures should be conducted.

Of course, a firm may still wish to identify signatories to the accounts of the customer, if only to make sure that they are passing some of the risk back to the customer. Signature verification will again need to have some form of document, possibly produced by the legal function or company secretary. No additional work is normally required to be undertaken in such cases.

16.4 STANDARD EVIDENCE FOR CORPORATE ENTITIES

Firms must start by asking corporate customers to produce evidence of the existence of the corporate structure that they are claiming to be. This will usually include:

• Confirmation of the company's listing (if relevant);
• A search of the relevant companies registry;
• A copy of the company's Certificate of Incorporation;
• A copy of the documents forming the entity (for trusts, partnerships and similar structures);
• The memorandum and articles of association (even though these are both standard and easily available).

The standard identification evidence which all corporate customers must provide is generally as follows:

• Full name
• Registered number
• Registered office in country of incorporation
• Business address.

Private and unlisted companies will usually also be required to provide:

• Names of all directors (or equivalent);
• Names of individuals who own or control over 25% of their shares or voting rights;
• Names of any individual(s) who otherwise exercise control over the management of the company.

The final requirement here is a particularly interesting one. The suggestion that companies should disclose the names of seemingly unconnected individuals who control a company through a third party is a great idea in theory. In practice, however, it is completely impractical. In terms of company registration, there is no requirement to disclose who controls a company, assuming they are not a shareholder. Furthermore, even if this was a legal requirement, it would be impossible to enforce. The problems which would arise when trying to prove that a company is actually being influenced by somebody who is seemingly unconnected with it would be insurmountable, rendering this requirement idealistic and ineffective.

One of the important factors to notice is that we are stating that the information needs to be provided, not verified. While there is no specific requirement to obtain additional evidence to support the information provided by the corporate customer, we would always recommend that, where possible, a firm should obtain such information. Given the existence of the internet, trade journals and registration bodies, additional information to confirm data provided by the corporate customer is generally available. Again, the telephone book may be a source of evidence, together with accounts filed at a central registry.

Just as for a personal or retail customer, in the case of a corporate customer there is rarely a requirement to confirm the source of funds. The limit of such verification is normally checking a credit rating agency and the company registry in the country, together with obtaining the accounts. This work is not normally done with money-laundering deterrence in mind, but for other reasons. In some countries, there is a requirement to obtain the memorandum and articles of association of the company, but these are generally all standard documents and actually provide very little true evidence.

The firm needs to undertake sufficient work to ensure that the company is the firm that it believes it is and to identify those persons that will be acting on the account. As such, they will need to look at a variety of sources of information including information that is not obtained directly from the firm itself, but is obtained from third party agencies or public sources. If all of the information is received directly from the company, then it is not independent and this clearly limits its use in terms of verification procedures.

16.5 PRIVATE AND UNLISTED COMPANIES

Private and unlisted companies are subject to a lower level of public disclosure than publicly quoted companies. The structure, ownership, purpose and activities of private companies will also tend to be clearer and easier for a firm to understand. Furthermore, private companies may be long-established, reputable organisations with long histories of public information, although others will be young, developing businesses, many of which will fail in their first three years.

The regulations generally applied state that standard information may be sufficient evidence to meet the firm's obligations. It is also worth searching the company's registry to check that a firm is not in the process of being dissolved, struck off or wound up, but again this is not specifically conducted to identify money laundering. Firms should make search enquiries of the registry in the country of incorporation for the relevant firm. The documentation obtained from such searches can be checked as part of the due diligence process. The accessibility of such documentation will vary considerably between different countries, and firms should pay particular care when faced with obstacles when verifying company identification. This should raise additional concerns.

In countries where there is less transparency, less of an industry profile or fewer independent means of verifying the client identity, there is a higher risk of money laundering or terrorist financing. In such cases, in addition to the standard identification procedures set out above, firms should verify the identity of shareholders and controllers and conduct such additional procedures as they consider appropriate in the circumstances. A visit to the place of business may also help to confirm the existence and activities of the entity, as well as other business associations which may influence the firm's operations, although the office may just have been set up to convey the appearance of a business to satisfy the financial institution. One thing to look for is the appearance that everything is very new or that people are not really working. Perhaps undertake a surprise, unannounced visit and see if the company looks the same as when the formal arranged meeting took place.

While the rule is generally that directors of companies need not be investigated unless they are also beneficial owners of a company, this is unlikely to be sensible in the case of smaller or private family businesses, trusts or charities. In such cases, firms should consider whether the retail identification procedures should, in fact, be applied to significant individuals within the structure. Any failure to comply with such a request should alert the firm to the enhanced risk that clearly then exists.

The firm should undertake a risk assessment of a firm's money-laundering risk to identify which person's identity it is necessary to identify. Verification will normally be appropriate for those officers that have authority to operate an account or to give the firm instructions concerning the use or transfer of funds or assets, but might be waived for other directors.

As is the case with public companies, firms also wish, as part of a risk-based approach, to take adequate measures to verify the identity of beneficial owners (those controlling 25% or more of the company's shares of voting rights), as well as individual signatories. Signatories may also be identified as part of a risk-based approach, due to their power to give instructions concerning the movement of funds or assets, as well as their power to authorise directors to make decisions.

16.6 ENHANCED DUE DILIGENCE

Additional enhanced due diligence measures should be undertaken if the nature of the customer, its business, location and product or delivery channel is assessed under a risk-based approach as needing additional verification. Such measures may include requesting additional identity information.

If a firm is linked in some way to a politically exposed person (PEP), then they are higher risk and should be subject to enhanced due diligence. This is addressed in Chapter 17. On the other hand, if the firm is itself regulated by an active regulator, then this could mean that some form of simplified process is appropriate if this is permitted by local rules.

Extra care must also be taken when dealing with companies with capital in the form of bearer shares, because it will inevitably be difficult to identify the beneficial owners. Companies that issue bearer bonds will also typically be incorporated in higher risk jurisdictions, since, in most countries, the practice has died out. Therefore, firms should implement procedures to establish the identities of the holders and material beneficial owners of such shares, in particular to ensure they are notified of any change in ownership.

As a minimum precaution, firms should obtain an undertaking in writing from the beneficial owner which states that immediate notification will be given to the firm if shares are transferred to another party. Depending on the risk assessment of the customer, it may be appropriate to have this undertaking certified by an accountant or lawyer, or require shares to be held by a custodian, with an undertaking on the custodian to notify the firm of any changes.

16.7 CHARITIES AND TRUSTS

These both represent areas with an enhanced risk of money laundering and terrorist financing, and therefore, generally, additional work will need to be undertaken. Here the deeds that formed the organisation will need to be obtained and the objectives verified. As part of the ongoing monitoring of activity, the firm should seek to ensure that there is no evidence that the organisation's income and expenditure structure is inconsistent with the stated objectives of the organisation.

The firm should also seek to verify the controllers of these organisations, since in such cases there is rarely a beneficial owner and the original settlers are of relatively limited interest. They may have died centuries earlier.

The UK Charities Commission provides a “compliance toolkit”, which was last updated in December 2012. This advice and guidance is relevant to any firm in this space, and may be found at: http://www.charity-commission.gov.uk/About_us/pogs/g410a001.aspx

The Commission emphasises that it would not register an organisation that had support of terrorism as an object. It also states that the use of an existing charity's assets for support of terrorist activity is not a proper use of those assets, and any links or alleged links between a charity and terrorism are corrosive to public confidence in the integrity of charity. The Commission highlights that raising awareness in the sector to build on charities' existing safeguards is of primary importance. It also emphasises the importance of proactive oversight and supervision: proactive monitoring of the sector, analysing trends and profiling risks and vulnerabilities.

All charities must, at a minimum:

• Have some form of appropriate internal financial controls in place to ensure that all the charity's funds are fully accounted for and are spent in a manner that is consistent with the purpose of the charity. What those controls and measures are and what is appropriate will depend on the risks apparent to a particular charity based on its type, size and activities.
• Keep proper and adequate financial records for both the receipt and use of all funds, together with audit trails of decisions made and funds spent. Records of both domestic and international transactions must be sufficiently detailed to verify that funds have been spent properly as intended and in a manner consistent with the purpose and objectives of the organisation.
• Give careful consideration to what other practical measures they may need to put in place to ensure they take reasonable steps to protect the charity's funds and so meet their legal duties.
• Give careful consideration to what due diligence, monitoring and verification of use of funds they need to carry out to meet their legal duties.
• Deal responsibly with incidents when they occur, including prompt reporting to the Commission and any other relevant authorities, and ensuring the charity's funds are secure.

You can never tell how money laundering will be conducted in practice; all a firm can do is to have reasonable policies and procedures to act as a deterrent. It is also not possible to identify the firm that will always be a money launderer. There are always legitimate businesses operating in any market and likewise the unscrupulous. A recent reported case in Nicaragua highlighted the issue. A group of 18 Mexicans masquerading as a television crew were, in fact, trying to transport $9.2 million of illegal funds cross-border. The cash was concealed in six vans displaying the logos of a local television company. The detainees are facing a maximum 30-year sentence.

This case highlights that just because someone says they are from a firm does not mean they are actually from the firm. The financial institution needs to be careful. If the identity of the legitimate business is stolen by the money launderer, then the financial institution could be wasting a lot of time identifying the legitimate firm. The money launderer, of course, will have nothing to do with it. The financial institution needs to link the person they are dealing with directly to the firm they actually purport to be from by obtaining independent evidence to support the connection.