AML/CTF compliance guide for independent remittance dealers

Transcription

1 AML/CTF compliance guide for independent remittance dealers

2 Disclaimer The purpose of this guide is to provide assistance to independent remittance dealers in meeting their obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act It is not intended to be comprehensive and does not constitute nor should it be treated as legal advice or opinion. The Commonwealth accepts no liability for any loss suffered as a result of reliance on this publication. AUSTRAC recommends that independent professional advice be sought. The information contained herein is current as at the date of this document. Commonwealth of Australia 2013 This work is copyright. You may download, display, print and reproduce this material in unaltered form only (retaining this notice) for your personal, noncommercial use or use within your organisation. Where material has been sourced from other thirdparty sources, copyright continues. Requests and inquiries concerning reproduction and rights for commercial use should be addressed to corporatecommunications@austrac.gov.au Date: February 2013

3 03 /overview Overview The purpose of this anti-money laundering and counter-terrorism financing (AML/CTF) compliance guide is to help independent remittance dealers meet the requirements of the Anti-Money Laundering and Counter- Terrorism Financing Act 2006 (AML/CTF Act, or the Act). Who should use this compliance guide? This compliance guide is suitable for remittance dealers who: are sole traders or have a small number of employees operate either fully or partially as an independent remittance dealer (that is, not as a remittance network provider or as an affiliate of a registered network provider). How do I know if I am an independent remittance dealer? Independent remittance dealers are businesses which provide remittance services directly to customers using their own systems and processes. Typically, transfers for customers are conducted through the business s bank accounts rather than through a system provided by a registered network provider. Why are remittance dealers covered by the AML/CTF Act? The AML/CTF Act applies to remittance dealers because remittance dealers provide one or more of the services listed in the Act. These services are included in the Act because they are vulnerable to abuse by criminals for money laundering or terrorism financing (ML/TF) purposes. Services covered by the Act attract reporting and other obligations. These are discussed further in this guide. The services covered by the Act are referred to in the Act as designated services and will be referred to as services in this guide. What is money laundering and terrorism financing? Money laundering is the process where criminals attempt to hide the true origin or ownership of the proceeds of their criminal activities to avoid prosecution, conviction and confiscation of their criminal funds. Money laundering also refers to situations where a criminal chooses to spend money which is the proceeds of a crime, such as tax evasion or drug dealing. Terrorism financing includes receiving funds from, giving funds to, or collecting funds on behalf of terrorists and terrorist organisations. This includes where a remitter is unaware that the organisation is a terrorist organisation but does not take reasonable steps to find out whether the funds will be used to engage in a terrorist act. In the past, remittance dealers have been used by criminals to launder the proceeds of crime and/or facilitate the financing of terrorism. The following case study on page 4 is a recent example of this.

4 04 AUSTRAC guide for independent remittance dealers /overview AUSTRAC case study: Australian terror suspects sent funds to Somalia to support terrorist group A joint-agency investigation led to the arrest of five suspects on charges of conspiring to commit a terrorist attack on an Australian army base. Investigations revealed the group had sent funds destined for use by the Somalia-based terrorist group, al-shabaab. The group had also facilitated travel for Australia-based supporters to attend overseas military training camps. Funds remitted offshore by the suspects did not go directly to al-shabaab but to entities linked to al-shabaab activities in Somalia. Investigating officers, assisted by AUSTRAC information, discovered that the suspects had sent thousands of dollars in low-value international funds transfer instructions (IFTIs) to Somalia. Authorities suspected these IFTIs were to support the aims of al-shabaab and associated military training activities overseas. The suspects sent the funds via remittance service businesses, often using false names of the overseas beneficiary customer to obscure the money trail. However, the telephone numbers recorded in the IFTIs for the overseas customers were correct. Investigating officers concluded that the suspects used the customers correct phone numbers to ensure the funds arrived safely and were handed to the correct customer in Somalia. In this case, the information reported in the IFTIs was valuable intelligence for the investigating officers to use to confirm other information or consider leads in the investigation. In general, the group members paid for the remittances to Somalia using their own funds. The group also remitted funds that had been raised by Australia-based social and community fundraising groups a common practice in terrorism financing methods internationally. There was no evidence to suggest that members of the social and community groups involved were aware that the funds being raised were to be remitted to East Africa in support of al-shabaab. Three suspects were found guilty of conspiring to plan an Australia-based terrorist attack and were sentenced to 18 years jail to serve 13 years and six months. Source: AUSTRAC typologies and case studies report 2012 case study 21

5 AUSTRAC guide for independent remittance dealers /overview 05 What do you have to do? You must be able to show AUSTRAC that you have: carefully thought about your ML/TF risks and how you will protect your business against them written down your policies and procedures for managing these risks followed your own policies and procedures reviewed and updated your policies and procedures regularly and as your circumstances change. Documenting the steps you are taking is a way you can show AUSTRAC your willingness to comply with your obligations under the AML/CTF Act. This guide is designed to help you do this work. What are the penalties for not complying with the AML/CTF Act or Rules? You have obligations under the AML/CTF Act which you are legally bound to meet. If you are found to be in serious breach of these obligations, civil and/or criminal penalties may be brought against you. Civil penalties for contravention of the AML/CTF Act range up to $3.4 million for an individual and up to $17 million for a corporation. The penalties for criminal offences include imprisonment for up to 10 years and/or fines up to $1.7 million. How to use this guide This compliance guide will help you perform the following activities: 1. Identify and consider the ML/TF risks your business may be exposed to and the actions you need to take to manage those risks. 2. Record in your own words the policies and procedures you will use to manage your AML/CTF obligations. 3. Organise, list and attach other documents you have that can be used to provide evidence that you have considered, planned and implemented your AML/CTF obligations. This guide is an example of the level of care, diligence and detail AUSTRAC expects you to use when you plan and implement your policies and procedures. While AUSTRAC recommends that you consider and use this guide, it is not compulsory to do so. Please be aware that providing a remittance service while unregistered is a criminal offence and penalties apply,

6 06 AUSTRAC guide for independent remittance dealers /overview Overview of guide layout This guide is organised into five modules (parts). Each module introduces obligations that you must consider and explains how to document the steps you are taking to meet these obligations. If you need more room to respond to the directions in this guide, you can attach separate documents. Module Description Page number Module 1: Enrol and register your business with AUSTRAC Module 2: Your business and money laundering and terrorism financing risks Module 3: AML/CTF program Module 4: Threshold transaction, suspicious matter and IFTI reports Module 5: Record keeping for AML/CTF Appendices Module 1 will explain how to enrol and register with AUSTRAC Module 2 will help you consider the ML/TF risks your business faces Module 3 will help you plan and document your AML/CTF program Module 4 will help ensure you are reporting to AUSTRAC when required Module 5 will help you meet your AML/CTF record-keeping requirements Resources offering you further assistance in meeting your obligations Page 7 Page 8 Page 26 Page 48 Page 54 Pages Abbreviations/glossary Pages 64 65

7 07 /module /overview1 Module 1: Enrol and register your business with AUSTRAC Requirement to enrol and register with AUSTRAC Independent remittance dealers are required to enrol and register with AUSTRAC. Enrolling and registering are separate legal requirements and you must do both. You can submit your enrolment application and your registration application at the same time if you wish. Enrolling: You need to enrol within 28 days of providing or commencing to provide a service covered by the AML/CTF Act. You also need to keep your enrolment details up to date and advise AUSTRAC of any change to your details within 14 days. The fastest and easiest way to enrol is electronically through AUSTRAC Online at: If you do not have computer or internet access, you can enrol using a paper form available from AUSTRAC by contacting the AUSTRAC Help Desk on Registering: You also need to apply to be registered with AUSTRAC. To apply for registration under the new scheme you need to: provide information to AUSTRAC about your remittance business and main staff keep certain records about your business obtain and keep national police certificates for main staff. The fastest and easiest way to apply to register with AUSTRAC is by using the registration form located on the AUSTRAC website: If you do not have computer or internet access, you can register using a paper form available from AUSTRAC by contacting the AUSTRAC Help Desk on On 1 November 2011 a new enrolment and registration scheme was introduced. If you were enrolled or registered under the old scheme, you will still need to enrol and register under the new scheme. Please be aware that providing a remittance service while unregistered is a criminal offence and penalties apply.

8 08 08 /module/overview 2 Module 2: Your business and money laundering and terrorism financing risks You must identify the ML/TF risks your business faces. To do this you need to consider the nature of your business and how it operates. This involves considering: your customers the products and services you provide your business practices the countries you do business with. Quick checklist Step 1: Describe your business Step 2: Describe your customers and your services Step 3: Identify ML/TF risks a risk-based approach This is called an ML/TF risk assessment. To assist you with your ML/TF risk assessment, complete the following three steps.

9 AUSTRAC guide for independent remittance dealers /module 1 09 Step 1: Describe your business Legal name of your business 1 : Trading name of your business (if different to legal name): Approximately how many remittance transactions does your business conduct per week? What is the average value of these transactions? What are usually the highest and lowest values for transactions you conduct? Is the remittance service the only service your business offers? If not, what other services do you provide (for example, grocery store, restaurant, cafe, video store)? Does your business offer any other services covered by the AML/CTF Act (for example, foreign currency exchange)? 1 The legal owner of the business should be included here. The legal owner is normally an individual, a company or a partnership.

10 10 AUSTRAC guide for independent remittance dealers /module 1 Step 2: Describe your customers and your services To be able to identify the ML/TF risks to your business you must consider four important factors. These are: 1. your customers 2. the products and services you provide 3. your business practices 4. the countries you do business with. A. List all customer types On page 11, list the different types of customers you deal with. Typical customer types are individuals, companies, partnerships, associations and trusts. You may wish to list individuals in sub-categories such as face-to-face customers, students, tourists or members of your local ethnic communities. You may also want to include information about each customer type, such as their average and maximum transaction size, what percentage of your customers they represent, and whether they deal through an agent (including how often this occurs). Remember to include any politically exposed persons (PEPs) 2. 2 PEPs are individuals who are, or have been, entrusted with prominent public functions either in Australia or in a foreign country. Examples include Heads of State or government, senior politicians, senior government, judicial or military officials, senior executives of state-owned corporations and important political party officials. PEPs are potential targets for bribery due to their prominent position in public life and have a higher risk of corruption due to their access to state accounts and funds. Business relationships with family members or close associates of PEPs may involve risks similar to those in dealing with PEPs themselves.

11 AUSTRAC guide for independent remittance dealers /module 1 11 Please describe your customers: Which of the following customer types do you have? (please tick box) Individuals: Locals Customers you do not deal with face-to-face (for example, over the phone or internet) Tourists Students Regular customers Non-individual customers (for example, businesses such as a company or partnership) Other (please describe): Describe your customer types and their transaction patterns:

12 12 AUSTRAC guide for independent remittance dealers /module 1 Describe your average or typical customer (include information such as age, gender, occupation): What payment methods are used by your customers (cash, card, cheque, other)? What is the most common payment method?

13 AUSTRAC guide for independent remittance dealers /module 1 13 B. List services and methods of delivery The following table shows the services covered by the AML/CTF Act that are commonly provided by a remittance business. Use the table to indicate which services you provide and the delivery method you use. Services covered by the AML/CTF Act Face-toface Telephone Internet/ website Other: (for example, fax) I do not provide this service International funds transfer instructions outgoing (Accepting an instruction for the transfer of money or property from a customer under a remittance arrangement) International funds transfer instructions incoming (Making money or property available to a customer or arranging for it to be made available under a remittance arrangement) Specify any other services (for example, foreign currency exchange):

14 14 AUSTRAC guide for independent remittance dealers /module 1 Explain how your business transfers and makes money or property available on behalf of your customers for example, remittance through the banking system, offsetting funds, or other: C. List foreign countries you deal with The following table helps you set out the foreign countries you might deal with as an independent remittance dealer. What are the main countries your customers remit money to? What are the main countries your customers receive money from?

15 AUSTRAC guide for independent remittance dealers /module 1 15 Step 3: Identify ML/TF risks a risk-based approach What is a risk-based approach? The risk-based approach is the most cost-effective and appropriate way to manage and reduce the ML/TF risks faced by your business. It is effective in reducing risk because it allows you to focus effort where it is most needed. This means that the costs to your business and customers are balanced with the real levels of risk your business faces as assessed by you. If your business provides low-risk products to low-risk customers, the approach you need to take will potentially be simpler and less costly than if you provide high-risk products to high-risk customers. The steps involved in the risk-based approach are to: identify the ML/TF risks that are relevant to your business assess the risks facing your business design and put in place controls to manage and reduce these risks monitor and continuously improve these processes record what has been done and why. Using the risk-based approach, you decide for yourself what risks your business faces. You also assess each risk and decide how great each is. Then you put in place processes to manage and reduce those risks. Businesses often use a checklist to record the risks they face and how they intend to control each one. The attached Remitter Risk Checklist is provided as an example of a system you might use to identify, assess and minimise the risks your business faces. The checklist is an example only and may not suit your specific business. The steps of the risk-based approach are explained below. Identify the risks Identifying business risks means asking questions like: How could my business be used by criminals to launder money? What situations or customer behaviour might be suspicious? A risk-based approach starts with identifying the risks your business faces. Typical ML/TF risks faced by remittance businesses include risks posed by your customers and the products/services you offer. ACTION: write down the specific risks your business faces. You might like to use the Remitter Risk Checklist at the end of this module for this task. Risk assessment After you identify the risks, you need to assess each risk and decide if it presents a threat that is high, medium or low. This will assist you to work out how to manage the risk. To decide whether a risk poses a high, medium or low threat, you need to consider how likely it is that the risk will occur and what the impact of the risk will be. Page 16 includes examples of risks facing remittance businesses.

16 16 AUSTRAC guide for independent remittance dealers /module 1 Customers All customers potentially pose a ML/TF risk. Some customers will pose a higher risk than others. Below are examples of customers that may be high risk : a customer who is unwilling to produce evidence of identification or who produces unsatisfactory evidence of identification a new customer, particularly one who does not deal face-to-face, or wants to carry out large one-off transactions a customer who wishes to deal only in large amounts of cash and not in traceable bank transfers a customer who is not local to the business or outside your normal target customer base a customer engaged in a business which involves significant amounts of cash complex business ownership structures with the potential to conceal the identity of the underlying beneficial owners or controlling person(s) of a business an individual (or an immediate relative) holding a public position which carries a risk of exposure to the possibility of corruption e.g. a politically exposed person (PEP) a customer based in, or conducting business in or through, high-risk countries, or countries with known higher levels of corruption, organised crime or drug production/ distribution. Can a customer s behaviour change their level of risk? Yes, it can. For example, if a customer displays some of the behaviours below, their ML/FT risk level increases: a customer or group of customers making frequent transactions to the same individual/ group of individuals where the customer is, or appears to be, acting on behalf of another person, and the customer is unwilling to give the name(s) of the person(s) they represent a customer is willing to pay very high charges to complete a transaction a customer whose normal remitting behaviour changes and they are unwilling to explain the reason for this or the source of the increased funds. Products/services provided by your business All remittance products potentially pose a risk of abuse by money launderers or terrorist financiers. Some products or services can increase the risk. For example: products which allow/facilitate payments to third parties remittance arrangements which allow for individual payments to be pooled together with other payments before the funds are transferred overseas, making an individual payment hard to identify dealing with an overseas counterpart who is not appropriately licensed or is operating in an illegal or suspicious manner remittances to/from specific countries that may be considered a risk due to the country being known as a source of drugs or other significant criminal activity for example, subject to trade sanctions; known to be a tax haven; or linked to proscribed terrorist organisations. Note: The above is just a short list of examples. Your risk assessment of your own business should include any other risks that apply specifically to your circumstances.

17 AUSTRAC guide for independent remittance dealers /module 1 17 ACTION: Using the list of risks you identified for your business, categorise each risk as high, medium or low. You might like to use the Remitter Risk Checklist at the end of this module for this task Controlling and minimising the risk After you identify and assess the risks specific to your business, you now need to consider how you will control, minimise or avoid each risk entirely. These processes are called risk controls. Because every business is different, there are many ways to treat risks. Many of your existing procedures may already help to reduce the risk of ML/TF. Some examples are: limiting the size of transactions in some circumstances not transferring money to high-risk countries maintaining relationships with long-standing customers applying more rigorous customer due diligence measures obtaining additional information on higher risk customers to more thoroughly verify their identity and/or any beneficial owners of funds transferred conducting more rigorous ongoing monitoring of the transactions and activity of customers ensuring your staff are aware of the ML/TF risks which your business faces and are trained in how to control those risks. Identifying a customer or transaction as being of a higher risk does not automatically mean that the customer/transaction is involved with money laundering or terrorism financing. Similarly, a customer/transaction seen as low risk does not mean that the customer/transaction is not involved with money laundering or terrorist financing. Employees of the business need to be alert and use their experience and common sense when applying the business s risk-based criteria and rules. ACTION: Using the list of risks you identified and assessed for your business, write down what steps you will take to control, minimise or avoid each risk. Again, the Remitter Risk Checklist may be useful for this task. Risk monitoring and improving the effectiveness of controls Once you have identified your risks and considered how you will control them, you must then ensure you have processes in place to enable you to identify new risks or quickly recognise changes in your existing risks. This requires you to consider the risk of any new: products you introduce countries you remit to or from partners or staff who join your business processes you introduce delivery methods you implement customers or customer types you attract.

18 18 AUSTRAC guide for independent remittance dealers /module 1 Your business should also have some means of assessing whether your existing risk controls are working effectively and, if not, where they need to be improved. You will also need to regularly review your AML/CTF policies and processes. You should monitor and review the following factors when assessing your businesses ML/TF risks: the procedures you use to identify changes in customer characteristics or behaviour Further resources available The AUSTRAC website includes resources with examples of how to address the risks which typically face a small- to medium-sized business. These include: changes to the ways your products and services may be used for ML/TF the adequacy of your staff training the compliance monitoring arrangements you use; for example, internal audit/quality assurance processes or external reviews. Recording what has been done and why You should keep documents relating to the risk assessment and management procedures and processes. Keeping these documents will enable you to show AUSTRAC that your customer due diligence and ongoing monitoring procedures are appropriate.

19 AUSTRAC guide for independent remittance dealers /module 1 19 Remitter Risk Checklist EXAMPLE Risk types and risk indicators Possible control options Risk rating after controls: high, medium or low In all cases you must employ the following risk controls: obtain minimum know your customer (KYC) information maintain ongoing monitoring of transactions ensure your employees have risk awareness training. Customer profile and delivery method Customer is an individual and considered low risk, but you are not satisfied with the information about the true identity of the customer or the true intent of the transaction. Consider whether or not to proceed with the business. Customer who does not deal face-to-face Seek additional identification (beyond minimum requirements) and/or make independent enquiries about the customer and their background. If appropriate, insist on meeting the customer face-to-face. Proceed if you are satisfied. If you are not satisfied with the information about the true identity of the customer or the true intent of the transaction, you should consider whether or not to proceed with the transaction or business arrangement.»» If you are still suspicious, you must lodge a suspicious matter report (SMR) with AUSTRAC.

20 20 AUSTRAC guide for independent remittance dealers /module 1 Risk types and risk indicators A customer who is not a local resident or is outside your normal target customer base Possible control options Seek additional identification (beyond minimum requirements) and/or make independent enquiries about the customer and their background. Proceed if you are satisfied. If you are still suspicious, you must lodge an SMR with AUSTRAC. Risk rating after controls: high, medium or low A customer is not willing to produce evidence of identification, or produces unsatisfactory or seemingly forged identification A customer (or an immediate relative) who holds a public position and/or is located in a country which carries a risk of exposure to the possibility of corruption Seek additional identification (beyond minimum requirements) and/or make independent enquiries about the customer and their background. Proceed if you are satisfied. Develop an identification discrepancies policy that is, what you will do if your customer will not provide identification or where you suspect the identification is false. If you are still suspicious, you must lodge an SMR with AUSTRAC. Seek additional identification (beyond minimum requirements) and/or make independent enquiries about the customer and their background.»» If you are still suspicious, you must lodge an SMR with AUSTRAC.

21 AUSTRAC guide for independent remittance dealers /module 1 21 Risk types and risk indicators A customer who wants to carry out a large one-off transaction A customer who is engaged in a business which involves significant amounts of cash A customer which is a company with complex ownership structures and/or with the potential to conceal underlying beneficiaries Possible control options Seek additional identification (beyond minimum requirements) and/or make independent enquiries about the customer and their background. Make further enquiries about the nature of the transaction and source of funds. Proceed if you are satisfied. If you are still suspicious, you must lodge an SMR with AUSTRAC. Seek additional identification (beyond minimum requirements) and/or make independent enquiries about the customer, their business and background. Proceed if you are satisfied. Consider making further enquiries about the nature of the transactions the customer wishes to undertake, including enquiring about the beneficiary customer and the country of destination. Proceed if you are satisfied. If you are still suspicious, you must lodge an SMR with AUSTRAC. Seek additional identification (beyond minimum requirements) and/or make independent enquiries about the customer, their company and background. Proceed if you are satisfied. Complete detailed beneficial ownership search.»» If you are still suspicious, you must lodge an SMR with AUSTRAC. Risk rating after controls: high, medium or low

22 22 AUSTRAC guide for independent remittance dealers /module 1 Risk types and risk indicators A customer based in, or conducting business in or through, a high-risk country, or a country with known higher levels of corruption, organised crime or drug production/distribution A customer who begins remitting more often and/or in larger amounts than usual Possible control options Seek additional identification (beyond minimum requirements) and/or make independent enquiries about the customer and their background. Check if the country is a proscribed foreign country as defined in the AML/CTF Act 3. Check the AUSTRAC website ( for the current list. Consider also checking the Department of Foreign Affairs and Trade website ( gov.au/un/unsc_sanctions/index.html) for sanctioned countries. Proceed if you are satisfied. If you are still suspicious, you must lodge an SMR with AUSTRAC. Make further enquiries about the nature of the transaction and source of funds. Proceed if you are satisfied. If you are still suspicious, you must lodge an SMR with AUSTRAC. Risk rating after controls: high, medium or low A customer or group of customers making frequent transactions to the same individual/group of individuals Seek additional identification (beyond minimum requirements) and/or make independent enquiries about the customer and their background. Proceed if you are satisfied. Consider making further enquiries about the nature of the transaction and source of funds. Proceed if you are satisfied. If you are still suspicious, you must lodge an SMR with AUSTRAC. 3 As at February 2013 Iran is the only proscribed country.

23 AUSTRAC guide for independent remittance dealers /module 1 23 Risk types and risk indicators A customer is willing to pay unusually high charges or fees Possible control options Seek additional identification (beyond minimum requirements) and/or make independent enquiries about the customer and their background. Proceed if you are satisfied. If you are still suspicious, you must lodge an SMR with AUSTRAC. Risk rating after controls: high, medium or low Where the customer is, or appears to be, acting on behalf of another person, and is not willing to give the name(s) of the person(s) they represent A customer who insists on transfers which are immediate or as soon as possible for no apparent good reason Seek additional identification (beyond minimum requirements) and/or make independent enquiries about the customer and their background. Proceed if you are satisfied. Consider making further enquiries about the nature of the transaction and source of funds. Proceed if you are satisfied. If you are still suspicious, you must lodge an SMR with AUSTRAC. Seek additional identification (beyond minimum requirements) and/or make independent enquiries about the customer and their background. Proceed if you are satisfied. Consider making further enquiries about the nature of the transaction and source of funds. Proceed if you are satisfied.»» If you are still suspicious, you must lodge an SMR with AUSTRAC.

24 24 AUSTRAC guide for independent remittance dealers /module 1 Risk types and risk indicators Products and services Possible control options Risk rating after controls: high, medium or low Remittance services Ensure you are enrolled and registered with AUSTRAC before offering a remittance service (refer to pages 7 for further details). Implement an AML/CTF program (refer to pages 26 for further details). Report relevant transactions to AUSTRAC (refer to pages 48 for further details). Does your business employ a remittance arrangement where individual payments are pooled together with other payments before transferring overseas, making an individual payment hard to identify? Is your overseas counterpart licensed? Are they operating in a suspicious manner? Seek additional identification (beyond minimum requirements) and/or make independent enquiries about the customer and their background. Proceed if you are satisfied. Make further enquiries about your overseas partner. Proceed if you are satisfied.»» If you are still suspicious, you must lodge an SMR with AUSTRAC.

25 AUSTRAC guide for independent remittance dealers /module 1 25 Risk types and risk indicators Country Does your business remit money to or from countries that are: experiencing significant civil unrest under Australian Government sanctions or are proscribed foreign countries as defined in the AML/CTF Act known for significant transnational criminal activity such as drugs trafficking, money laundering, or people smuggling known as a tax haven known to have links to terrorist organisations? Possible control options Seek additional identification (beyond minimum requirements) and/or make independent enquiries about the customer and their background. Check if the country is a proscribed foreign country as defined in the AML/CTF Act 4. Check the AUSTRAC website ( for the current list. Consider also checking the Department of Foreign Affairs and Trade website ( unsc_sanctions/index.html) for sanctioned countries. Proceed if you are satisfied. Risk rating after controls: high, medium or low 4 As at February 2013 Iran is the only proscribed country.

26 26 26 /module/overview 3 Module 3: AML/CTF program Remittance dealers are required to have a written AML/CTF program to identify, minimise and manage ML/TF risks. The obligations which form part of your AML/CTF program are to: appoint an AML/CTF compliance officer implement a process to screen employees before they are employed train employees on an ongoing basis so they understand their AML/CTF responsibilities have a process in place to respond to feedback from AUSTRAC have a process in place to monitor and review your AML/CTF program have procedures in place to collect and verify customer identification information have procedures in place to monitor customers transactions list the types of reports you are required to submit to AUSTRAC (for example, SMRs) describe the procedures you have in place for reporting to AUSTRAC ensure approval and ongoing oversight of the AML/CTF program by the business owner (or Chief Executive Officer/Board). Quick checklist Step 1: Appoint an AML/CTF compliance officer Step 2: Describe your employee due diligence program Step 3: Describe your AML/CTF risk awareness training program Step 4: How will you respond to AUSTRAC feedback? Step 5: Establish regular independent reviews of your AML/CTF program Step 6: Collect and verify KYC information Step 7: Ongoing customer due diligence Step 8: Management approval and ongoing oversight of the AML/CTF program These obligations are described in more detail in the following eight steps. Complete each step as required.

27 AUSTRAC guide for independent remittance dealers /module 3 27 Step 1: Appoint an AML/CTF compliance officer You must appoint someone from management or at a senior level (such as the business owner) to be the AML/CTF compliance officer. The compliance officer should be the main point of contact for AUSTRAC and for your employees in relation to AML/CTF. You may also wish to nominate a backup person for times when the compliance officer is not available. What duties does the AML/CTF compliance officer have? (Tick all relevant tasks) Enrolling and maintaining business details with AUSTRAC Ensuring the business is registered with AUSTRAC and meets the record-keeping requirements for registration Approving the AML/CTF program and procedures Updating and maintaining the AML/CTF program and procedures Updating and maintaining the ML/TF risk assessment Training employees about their AML/CTF responsibilities Screening prospective employees Ensuring criminal history checks of main staff are undertaken Responding to feedback from AUSTRAC Monitoring transaction and customer activity to identify suspicious transactions

28 28 AUSTRAC guide for independent remittance dealers /module 3 Conducting further enquiries on high-risk or suspicious customers Sighting and recording identification for customers Reporting IFTIs, threshold transactions and suspicious matters to AUSTRAC Keeping records of the AML/CTF program and customer identification Other: Step 2: Describe your employee due diligence program You are required to have an employee due diligence program. This is a program to decide if, and how, you should screen your employees (including prospective employees) who are in a position to facilitate an ML/TF offence. For example, you may check their identity and background to satisfy yourself that they are of good character and are not involved with criminals or criminal activity. An employee due diligence program must also contain procedures to manage employees who fail, without reasonable excuse, to comply with a system, control or procedure which relates to your AML/CTF program. If you do not have any employees, please indicate below. How many employees do you have? (Include people who may assist you from time to time with conducting transactions, including unpaid family and friends who work in your business.) Full-time: Part-time: Casual:

29 AUSTRAC guide for independent remittance dealers /module 3 29 Are there different roles within your business (for example, accountant, customer service officer)? If so, list them below: Which roles are directly involved in the remittance services your business provides or could have an opportunity to facilitate ML/TF? How do you verify the identity of a new employee before you employ them in your business? What checks do you perform on new employees before you employ them for example, speak with previous employers, personal reference checks, work history checks, criminal history, national police check? What checks do you perform on an employee who is transferred or promoted to a position in your business where they have increased opportunities to commit ML/TF offences?

30 30 AUSTRAC guide for independent remittance dealers /module 3 How do you supervise employees to ensure they are following AML/CTF procedures? What would you do if an employee breached AML/CTF requirements? Step 3: Describe your AML/CTF risk awareness training program You are required to educate your employees (including unpaid family members and friends working in your business) about the risk of your business being misused to commit ML/TF offences. You are also required to train them in your AML/CTF obligations and procedures. You must have a risk awareness training program which covers: your obligations under the AML/CTF Act and the consequences of non-compliance the types of ML/TF risk your business may face and the potential consequences of such risk the policies and procedures in your AML/CTF program that affect the work carried out by employees. You may wish to refer to AUSTRAC s e-learning courses, which can be found online at courses.html. These online courses provide a general understanding of AML/CTF. Who receives the training?

31 AUSTRAC guide for independent remittance dealers /module 3 31 How often do employees receive training? (Tick all that apply) When they start working for the business Every 6 months Every 12 months Every 24 months When they change roles Other: Who delivers the training? How is the training delivered (for example, on the job, short group sessions, online training)?

32 32 AUSTRAC guide for independent remittance dealers /module 3 What topics are covered in your training? Do you keep records of employee training? If yes, please describe: How are employees tested on their understanding of AML/CTF after training? How do you ensure employees are kept up to date on new AML/CTF issues? What do you do if an employee breaches your AML/CTF program or procedures?

33 AUSTRAC guide for independent remittance dealers /module 3 33 Step 4: How will you respond to AUSTRAC feedback? You must have procedures that you will follow if AUSTRAC instructs you to improve your AML/CTF compliance. Who is responsible for responding to AUSTRAC feedback? What process does this person take to ensure feedback is recorded, responded to and relevant employees are notified of the result? What steps will you follow if AUSTRAC instructs you to improve your AML/CTF processes? What time frame have you set for responding to AUSTRAC feedback? Within two days Within one week Within two weeks Other:

34 34 AUSTRAC guide for independent remittance dealers /module 3 Step 5: Establish regular independent reviews of your AML/CTF program Your AML/CTF program must be regularly reviewed by an independent person. Many businesses choose to review their program annually, when business practices change or if a serious ML/TF incident occurs. The independent review should assess the following: the effectiveness of the AML/CTF program whether the AML/CTF program complies with the AML/CTF Act whether the program has been effectively implemented whether you have complied with your AML/CTF program. The results of the independent review must be provided to the AML/CTF compliance officer or other authorised senior officer/proprietor responsible for ongoing oversight of the AML/CTF program. While the review can be conducted by an internal or external person, the reviewer must be independent. That means the reviewer must not have been involved in designing or implementing your AML/CTF program. For example, your AML/CTF compliance officer would not be independent and is not an appropriate person to conduct a review. If there is no one in your business who can conduct an internal independent review, you may consider asking an external adviser such as your accountant or solicitor to conduct the review. You may wish to base your review on the AUSTRAC Small business checklist which is available at: Who conducts the independent review? How often will the review be conducted? Every 12 months Every 24 months Other:

35 AUSTRAC guide for independent remittance dealers /module 3 35 How do you ensure that the reviewer is independent? Describe the review process and how you will address recommendations arising from the review: Step 6: Collect and verify KYC information You must not start providing a designated service to a new customer before carrying out the applicable customer identification procedure. Failure to do this may lead to a civil penalty as detailed on page 5. Remittance dealers must identify a customer: when they transfer money to a foreign country on behalf of a customer when they make money available from a foreign country to a customer when a customer is considered to be high risk (the risks listed in your risk register will assist you in identifying high-risk customers) when you have a suspicion about the customer or doubt the customer is who they claim to be if your enhanced customer due diligence program requires you to collect and verify further KYC information about a customer (covered in Step 7). Identification is divided into two parts: collection and verification. Collection involves asking a customer to state their details. Verification involves confirming those details against identification documents, such as a drivers licence or passport.

36 36 AUSTRAC guide for independent remittance dealers /module 3 A. Collection The minimum identification information that needs to be collected for an individual is: the full name of the customer their date of birth their residential address (not a post office box). What information do you collect from an individual customer? Full name Residential address Date of birth Phone number address Other: What information do you collect from non-individual customers (for example, businesses such as a company or partnership)? (if applicable)

37 AUSTRAC guide for independent remittance dealers /module 3 37 You may need to collect additional identification details about a customer in situations when: the customer is not able to provide sufficient or satisfactory identification documents a customer is assessed as having a high ML/TF risk rating. Examples of additional identification details include a Medicare card or a bank statement. Details of a customer s occupation or their source of funds can often provide further context to their remittance activity and may help to reduce the ML/TF risk for that customer. What additional information would you ask a high-risk or suspicious customer to provide (for example, ask about their occupation, their place of employment and their reason for sending or receiving money)? Corporations and other customer types have separate identification requirements. AUSTRAC s customer identification Ready reckoner provides information about customer identification and is available at: B. Verification Verification is checking that the details the customer gave you are true and correct. Use identification documents such as a drivers licence or passport to do this. The minimum identification information to be verified for an individual is: the customer s name, and their date of birth or residential address. If the customer is not able to provide sufficient or satisfactory identification documents, or when you assess a customer as having a high ML/TF risk rating, you may need to verify additional identification details about a customer. There are many ways to verify the minimum information for individuals. An example for low- to medium-risk customers is provided on page 38.

38 38 AUSTRAC guide for independent remittance dealers /module 3 Example for verifying minimum individual information After collecting the customer information: verify the customer information using an original or certified copy of a photographic document for example, current drivers licence or passport or verify the customer information using both: an original or certified copy of a non-photographic government-issued document for example, a birth certificate, citizenship certificate or pension card issued by Centrelink and an original or certified copy of a commercial document such as a telephone bill. A certified copy is a copy of a document certified as a true copy of the original document by an authorised person, such as a legal practitioner, justice of the peace, or police officer (see Appendix 2). You must also check that the documents have not expired (although a passport issued by the Commonwealth which expired within the preceding two years is acceptable). List the procedures you follow when collecting and verifying information about your customers. You should also list what details are recorded and what identification documents (or combination of documents) are sufficient to prove a customer s identity to you:

39 AUSTRAC guide for independent remittance dealers /module 3 39 What photographic documents (or certified copies) will you accept as proof of identity on their own? Drivers licence Passport Proof-of-age card Other government-issued photographic ID: What combination of non-photographic and other documents (or certified copies) will you accept as proof of identity? Non-photographic: Birth certificate Citizenship certificate Centrelink pension card Other primary non-photographic document : Other: Centrelink statement

40 40 AUSTRAC guide for independent remittance dealers /module 3 Tax assessment notice Rates notice Other secondary document (for example, telephone bill): Describe how you record details of the identification process and documents for example, writing down the drivers licence number or photocopying the identification documents: If you have non-individual customers (such as companies), describe your identification and verification procedures for these customers: Describe your procedure if you form a suspicion that the identification document may be false or that the customer is not who they claim to be:

41 AUSTRAC guide for independent remittance dealers /module 3 41 Describe how you identify customers who use methods other than face-to-face interactions, to initiate a funds transfer for example, by telephone or over the internet: Step 7: Ongoing customer due diligence You must have processes in place to update and collect further customer information and to monitor your customers and their transactions on an ongoing basis. This is called ongoing customer due diligence and involves: deciding when you should update or verify your existing information about a customer (see A below) and collecting any further information about your customer as required ongoing monitoring of customers and their transactions (see B below) enhanced scrutiny of high-risk and suspicious customers (see C below). A. Describe in what circumstances you update and re-verify customer information In what circumstances would you update and/or re-verify an existing customer s information? You find out your customer has changed their name Your customer mentions they have a new address Mail you sent to a customer is returned marked not at this address or return to sender