When should a firm carry out due diligence?

The general requirement to conduct due diligence applies in the following cases:

1. When establishing a business relationship.
2. When carrying out occasional transactions amounting to EUR 15,000 or more, whether the transaction is carried out in a single operation or several operations which appear to be linked.
3. When there is suspicion of money laundering or terrorist financing regardless of any derogation, exemption or threshold.
4. When there are doubts about the adequacy of previously obtained customer identification.

We shall consider this in more detail later (Chapters 13 and 22). Notice that the primary responsibility is at the start of the relationship, but continues throughout the relationship. Of course, money launderers and terrorist financers will know this and accordingly will attempt to appear legitimate at the start of the relationship, undertaking inappropriate activity at a later stage. As we will see, there are also ongoing monitoring requirements.

What due diligence measures are required?

There is a list of required due diligence procedures in the Directive which do tend to form the basis for requirements in European States. These are as follows:

1. Identifying the customer and verifying the customer's identification on the basis of documents, data or information obtained from a reliable and independent source.

   Notice the requirement here is for independent sources, so you should not just accept documents provided to you by the customer – if they are undertaking criminal activity, they are likely to have perfect documents which are, in all probability, forged. Some form of independent confirmation should, where possible, be obtained. If it is not available then the firm will need to judge, using the risk-based approach, whether it has sufficient data to commence the relationship.

2. Identifying, where applicable, the beneficial owner of the account and using risk-based measures to verify identity so that the institution is satisfied that it knows who the beneficial owner is, including trusts and similar legal arrangements.

   This will include taking risk-based measures to understand the ownership and control structure of the customer. The importance of beneficial ownership is that the person appearing as the owner may, in reality, just be acting on behalf of the actual owner. As such, they may be partners in law firms or similar service providers appointed purely to act on the instructions of the actual controller. The information required is who is really behind the transactions, since they are more likely to be the criminal elements.

   This due diligence should take place before the establishment of a business relationship or the carrying out of any transaction. To fulfil this requirement a firm or person can decide whether they make use of public records of beneficial owners, or whether they ask their clients for relevant data or information, or how else they obtain sufficient information to provide themselves with adequate due diligence information. In other words, they can almost do whatever they like. However, in all cases the procedures adopted should be specified by the rules and regulations of the firm and should also be consistent with the requirements of local law, which could be to a higher standard than that applied by the Directive.

3. Obtaining information on the purpose and intended nature of the business relationship.

   This is required to enable the firm to subsequently identify transactions which are inconsistent with the purpose of the relationship to enable suspicious transactions to be identified. Without knowing what the account is to be used for, it will not be possible to identify transactions which are not consistent with the expectations for such a customer.

4. Conducting ongoing monitoring of the business relationship including scrutiny of transactions undertaken to ensure that they are consistent with the institution's or person's knowledge of the customer, the business and risk profile.

   This review should include obtaining information, where necessary, of the source of funds and ensuring that documents, data or information held are kept up to date. There is actually no requirement to obtain independent evidence of the source of funds, just to record the source of funds. For example, if the customer says they sold a car and received cash, there is no requirement to see that they actually ever had a car and whether it could have been worth the amount of funds received. All the firm would need to do is record that they received cash from the sale of a car.

   Of course, that is all that is required to comply with the Directive. A firm will always seek to protect its reputation and, accordingly, may choose to undertake additional verification work. If funds were left to a customer in the will of a relative, for example a grandparent, were there to be subsequent grandparents that also provided such legacies, then at some stage you would expect the firm to identify that this might be suspicious.

The issue of legal confidentiality

Where notaries, independent legal professionals, auditors, external accountants and tax advisors are in the course of ascertaining the legal position for their client or defending or representing their client in judicial proceedings or advice on instituting or avoiding proceedings, they do not need to comply with these requirements. This is to make sure that the legal process is not prejudiced and also to enable the “expert” to discuss matters with their client appropriately. If they had to make a report every time their client said something that might be considered illegal, then the whole process under which the legal profession operates could be undermined.

Under the Directive, basic due diligence requirements are mandatory for the categories of customers listed below. The requirements are distinguished between the different types of customer as the Directive recognises the different levels of risk which different types of customers represent. Accordingly, the requirements on the various customers must vary in order for firms to fully protect themselves against ML/TF.

1. Personal customers: Personal customers represent a lower level of risk to firms than that of other categories of customers. As a result, the due diligence requirements are not as onerous. In the first part of this section we set out the basic due diligence requirements as set out in Article 8.
2. Corporate customers: Corporate customers represent a slightly higher level of risk than personal customers, as transactions involve larger amounts of money and can become quite complex. Again, these have been set out in the first part of this section which includes the basic due diligence requirements as set out in Article 8.

3. Beneficial owners: The Directive places emphasis on the identification of beneficial owners, and verification of the beneficial owner's identity, as this category of customer is recognised as being a high-risk entity. The Directive advises Member States to introduce more specific and detailed provisions relating to the identification of the customer and of any beneficial owner and the verification of their identity. To that end, a precise definition of “beneficial owner” is essential. The Directive defines a “beneficial owner” as the natural person who ultimately owns or controls the customer and/or the natural person on whose behalf a transaction or activity is being conducted.

   Where applicable, the institution should identify the intended beneficial owner and take risk-based measures to verify their identity. Such work will include investigation into legal persons, trusts and similar legal arrangements, and the firm then taking risk-based measures to understand the ownership and control structure of the customer.

   Article 9 requires that the identification of the customer and the beneficial owner should take place before the establishment of a business relationship or the carrying out of a transaction. To fulfil this requirement, it is left to those institutions and persons whether they make use of public records of beneficial owners, or whether they ask their clients for relevant data or information, or how else they obtain sufficient information to provide themselves with adequate due diligence information.

Enhanced due diligence

Enhanced due diligence is required in all cases where the situation represents a higher money-laundering or terrorist-financing risk. Such procedures will apply particularly for non-face-to-face business, politically exposed persons and international correspondent banking relationships.

The Directive does provide some basic guidance, but we expand on this further in the relevant chapters of this book.

Problems associated with non-face-to-face customers

Where the customer has not been physically present for identification purposes, firms should apply one or more of the following measures:

1. Ensure that the customer's identity is established beyond reasonable doubt by obtaining additional documents, data or information.
2. Undertake supplementary measures to verify or certify the documents supplied.
3. Ensure that the first payment is carried out through an account opened in the customer's name with a credit institution.

Whilst the Directive states “one or more”, in most cases we are finding that the expectation is that all three measures will be adopted unless there is a good reason why one or other is unsuitable in the circumstances. Even this is not ideal. Identification documents that show a picture cannot be compared to the actual customer themselves, since they are never met.

Problems associated with international correspondent banking

In respect of cross-frontier correspondent banking relationships with respondent institutions from third countries, the requirements are for credit institutions to:

1. Gather sufficient information about a respondent institution to understand fully the nature of the respondent's business and to determine, from publicly available information, the reputation of the institution and the quality of supervision applied locally.

   This information is generally available in the market, and regulatory structures are even ranked by independent bodies to provide additional third party analysis.

2. Assess the respondent institution's anti-money-laundering and anti-terrorist-financing controls.

   This is rather harder to obtain other than directly from the firm itself. Even then it will not be clear which of the policies and procedures presented are actually being complied with. However, firms may be required to complete a report to their regulators in respect of what is known as the Pillar 2 capital assessment (or ICAAP). This document is required for most banks, with a similar document also being required for insurance companies in Europe (the ORCA from the Solvency 2 Directive). Such documents will provide information on how the financial institution operates its control environment and will therefore be of benefit.

3. Obtain approval from senior management before establishing new correspondent banking relationships.

   This will at least ensure that someone within the business has considered whether the relationship really is appropriate and consistent with the brand values of the firm.

4. Document the respective responsibilities of each institution with regard to money-laundering deterrence.

   As a general rule, firms are now rarely relying directly on work being conducted by a third party and are often repeating such work for themselves. However, it should be noted that the revised FATF Recommendations (Chapter 3) do allow reliance to be placed on another member of the same group's identification procedures so long as they are consistent with those that would have been undertaken within your own jurisdiction.

5. With respect to payable-through accounts, the firm needs to be satisfied that the respondent credit institution has verified the identity of, and performed ongoing due diligence on, customers having direct access to accounts of the correspondent and that it is able to provide relevant customer due diligence data to the correspondent institution upon request.

   This is to deal with cases where the customer is only passing through the correspondent relationship and not known in any other way, clearly an area of potentially heightened risk of money laundering. Whether it is actually even legal to provide the due diligence materials maintained will depend on the individual jurisdictional laws and rules which could inhibit the effectiveness of this rule.

Of course, trying to apply these rules within Europe where all countries in principle have implemented the same rules is rather different from applying them in non-European markets where different standards apply.

Problems associated with politically exposed persons

A “politically exposed person” (PEP) is defined as someone who is, or has been, entrusted with prominent public functions and their immediate family members, together with persons known to be their close associates.

In respect of transactions or business relationships with politically exposed persons residing in another Member State or in a third country, the requirement is for a firm to:

1. Have appropriate risk-based procedures to determine whether the customer is a politically exposed person.
2. Have senior management approval for establishing business relationships with such customers.
3. Take adequate measures to establish the source of wealth and source of funds that are involved in a business relationship or transaction.
4. Conduct enhanced ongoing monitoring of the business relationship.

As you will see, the definition applies to people that have been, or are in, office, therefore someone who has run for office, but not been elected, is not a PEP. Whilst this is what is stated in the Directive and is normally what has been transcribed into national law, it may well not be sufficient to provide the level of protection that a firm requires. Accordingly, many firms are adopting a wider definition that provides for additional investigation of a broader group of customers. The level of confirmation of wealth is clearly an issue, and in such cases just asking the customer cannot be sufficient. You know what the concerns are: the firm is concerned that the politically exposed person may have taken advantage of their position to increase their personal wealth. Additional enquiries independent of the customer will therefore be required to meet these demands.

Problems associated with anonymous accounts

There is particular concern over products or transactions that might favour anonymity. Effectively, the requirements have the aim of trying to prevent firms using numbered accounts or other secrecy approaches which may inhibit the identification of the actual or beneficial owner of an account. Basically, any firm should know the identity of the beneficial owners of all accounts that they are involved with.

Problems associated with casinos

Everything we have looked at so far in the Directive is related to banks and other types of financial institution. This section is rather different. There is a requirement that all casino customers should be identified and their identity verified if they purchase or exchange gambling chips with a value of EUR 2,000 or more. Casinos subject to State intervention shall be deemed, in any event, to have satisfied the customer due diligence requirements, if they register, identify and verify the identity of their customers immediately on or before entry, regardless of the amount of gambling chips purchased.

The requirement is easy to put into place, but the level of actual monitoring will be dependent upon the agencies that verify compliance by the casino. Of course, casinos are perfect for money laundering. You take cash in to the casino and there is no reason for you to have to say where the funds are from. You then provide some required identification documentation, but there is no need to provide any form of secondary identification. You purchase your chips and then go for a meal. Then you cash in your chips and receive laundered money. Perhaps this is a true case of having your chips and eating them. At least this regulation represents the starting point for effective regulation of the casino industry, although such regulation does vary considerably between jurisdictions.

What is simplified due diligence?

Simplified due diligence was introduced as an exemption to full due diligence where the customer is a credit or financial institution covered by the Directive or a credit or financial institution situated in a third country which imposes equivalent requirements and is appropriately supervised.

No requirement for due diligence at all

The Directive does not require customer due diligence to be conducted (at Member State discretion) in respect of:

1. Listed companies whose securities have been admitted to be traded on a regulated market which are subject to disclosure requirements consistent with Community legislation.

   This is because they will have been verified by the listing authority. Of course, the firm will still need to confirm that the company is that listed firm and not a firm trying to steal the identity of that listed firm.

   In practice, rather than pretending to be the listed firm, the unscrupulous will take the identity of a subsidiary of the listed firm. The subsidiary is, of course, not listed and in such cases it is incumbent upon the firm to conduct due diligence procedures to establish that the listed firm does indeed have such a subsidiary and that the officers approaching the financial institution are who they say they are. They also need to have the required levels of authority to bind the firm.

2. Beneficial owners of pooled accounts held by notaries and other independent legal professionals provided that they are subject to requirements to combat money laundering or terrorist financing consistent with international standards and are supervised for compliance.

   There is also a requirement that they will provide information on the identity of the beneficial owner, on request, to the institution that acts as the depository institution for the pooled accounts. Again, this exception is because the notary is under essentially the same identification obligation and has been reviewed in this regard by their regulator.

3. Domestic public authorities.

   The reason for this is because they clearly could never be guilty of money laundering. However, I would still expect any firm to wish to identify the public authority if only to ensure that there are no political issues which they need to be aware of. The politically exposed person rules will still probably require some form of due diligence to be conducted.

4. Customers representing a low risk of money laundering or terrorist financing.

   This is a consequence of the risk-based approach being applied and is purely because the regulators would wish the financial institution to concentrate on areas which are more likely to represent a significant risk. Such an example of a low-risk transaction or relationship might include payments taken directly from a salary by an employer. The financial institution would know exactly where the funds were from and who they were held by, which means the transaction clearly represents a very low risk of money laundering.

5. Life insurance policies where the annual premium is no more than EUR 1,000 or the single premium is no more than EUR 2,500.

   While cancelled life insurance policies could be used for money laundering, the view is generally taken that the level of funds laundered would render this cumbersome and expensive for the launderer to manage, and accordingly the risk posed to the system is low. Furthermore, cancelled life insurance policies are always reviewed by the insurance company so that they can understand what has caused the cancellation, since such cancellations are essentially expensive to the insurance company.

6. Insurance policies of pension schemes if there is no surrender clause and the policy cannot be used as collateral.

   This is because it is considered difficult to launder through such instruments. The absence of a surrender clause is an important consideration in coming to such a decision. In looking at such matters a distinction might be drawn between the pension scheme of a large or listed company and that of an SME or personally controlled company where the pension fund is only part of the real assets of the proprietor.

7. A pension, superannuation or similar scheme that provides retirement benefits to employees, where contributions are made by way of deduction from wages and the scheme rules do not permit the assignment of a member's interest under the scheme.

Really this is all about applying the risk-based approach to supervision and investigation. What the Directive is really saying is that these types of product or service are not really suitable for money laundering or terrorist financing and therefore it would be onerous to impose the same level of regulation on them. Notice, for example, the references to surrender clauses or value. Surrender clauses can be used by money launderers, but in the absence of such a clause it is difficult to see how the product could be a suitable money-laundering vehicle for the criminal fraternity.