Circular on. of Identity for Credit Institutions

Transcription

1 Circular on Identification and Verification of Identity for Credit Institutions

2 Table of contents 1. Introduction Purpose of identification obligations Explanation of terms Identification Information on identity Natural persons Legal persons Meaningful supporting documents Natural persons Legal persons Parties addressed by identification obligations Supervised companies Third parties Identification procedures Obtaining information on identity Verifying the information on identity obtained Verifying the authenticity of proof of identity Persons whose identity must be ascertained and verified Customers (Article 40 para. 1 BWG) Definition Scope of identification obligations Special case of minor customers Special case of trustees (Article 40 para. 2 BWG) Definition Scope of identification obligations Trustors (Article 40 para 2 BWG) Definition Scope of identification obligations Beneficial owners (Article 40 para. 2a no. 1 BWG) General comments on the term Beneficial owners of companies Beneficial owners of legal entities which administer or distribute funds Scope of obligation to identify the beneficial owner Authorised representatives Definition Scope of identification obligations Cases in which identification obligations apply when must identification take place? Establishment of a permanent business relationship (Article 40 para. 1 no. 1 BWG)

3 7.2. Execution of individual transactions exceeding the limit amount (Article 40 para. 1 no. 2 BWG) Suspicion of money laundering or terrorist financing activity (Article 40 para. 1 no. 3 BWG) Deposits into or withdrawals from savings accounts that exceed the limit amount (Article 40 para. 1 no. 4 BWG) Questions of doubt regarding the identity data obtained (Article 40 para. 1 no. 5 BWG) Consequences in cases where identification is impossible Identification obligations in individual banking transactions Savings account transactions Securities transactions Non-face to face transactions School savings schemes Severance and retirement fund transactions Updates of information Obligation to keep records

4 1. Introduction 1. The international community has set the goal of preventing the use of the financial system for the purpose of money laundering and terrorist financing. Cooperation on the part of credit and financial institutions is required in order to reach this goal. Their role is to counteract the flow of funds which stem from criminal activity or are destined for terrorist purposes by complying with certain customer due diligence requirements. 2. In connection with combating money laundering and terrorist financing, the major customer due diligence requirements applying to credit and financial institutions include: identification and verification of the identity of customers, authorised representatives and beneficiaries (trustors and beneficial owners); obtaining information on the purpose and intended nature of the business relationship; conducting ongoing monitoring of the business relationship; and reporting cases of suspicion. The aim in requiring credit institutions to introduce appropriate strategies and procedures for complying with customer due diligence requirements is to ensure that the individual measures taken by credit institutions will as a whole result in an effective system for combating money laundering and terrorist financing. 3. This FMA Circular is intended to assist credit and financial institutions in complying with requirements for ascertaining and verifying the identity of customers, authorised representatives and beneficiaries. 4. This Circular is directed at all Austrian credit institutions as well as credit institutions from EEA Member States, inasmuch as these are active in Austria either through branches under the freedom of establishment or directly provide services under the freedom to provide services. This Circular is furthermore directed at all Austrian investment firms and investment service providers as well as investment firms from EEA Member States, inasmuch as these are active in Austria either through branches under the freedom of establishment or directly provide services under the freedom to provide services. This Circular is also directed at all Austrian payment institutions as well as payment institutions from EEA Member States, inasmuch as these are active in Austria either through branches under the freedom of establishment or directly provide services under the freedom to provide services. It similarly applies to e-money institutions. 4

5 The parties addressed by this Circular are referred to uniformly in the following as supervised companies. 5. Financial institutions pursuant to Article 1 para. 2 of the Bankwesengesetz (BWG; Banking Act) are equally subject to the due diligence obligations specified in the BWG for the purpose of combating money laundering and terrorist financing. The contents of this Circular may thus also provide financial institutions with assistance in applying the specific statutory provisions. 6. The legal basis for ascertaining and verifying identity are found in particular in Article 40 paras. 1, 2 and 2a no. 1 and Articles 40a and 40b BWG. The aforementioned provisions transpose into national law Directive 2005/60/EC of the European Parliament and of the Council on the prevention of the use of the financial system for the purpose of money laundering and terrorist financing ( Third Money Laundering Directive ), which in turn is based on the 40 Recommendations and 9 Special Recommendations by the FATF (Financial Action Task Force on Money Laundering). 7. As well as setting out the relevant legal foundations, this Circular also includes key practical considerations and aspects of international standards. In developing these requirements, due consideration has been given to the heterogeneous structure of Austria s banking industry. 8. It is the responsibility of the individual supervised companies to more specifically define these requirements in accordance with the type, size, business structure and risk potential of the company in the particular case. As a consequence of the legal requirements for diligence on the part of management, it may well be appropriate to define more stringent recommendations than those presented below. 9. This Circular reflects the FMA s legal opinion on the statutory due diligence obligations for the purpose of combating money laundering and terrorist financing. The legal basis is not affected thereby. No rights or obligations going beyond those defined in statutory provisions may be deduced from this Circular. 5

6 2. Purpose of identification obligations 10. In order to be able to prevent and hinder money laundering and terrorist financing and aid in the prosecution of these offences, supervised companies must have as much knowledge as possible about their customers as well as their customers activities. The most important principle in combating money laundering and terrorist financing is therefore that of knowing your customer. By complying with identification obligations, supervised companies ensure that they have sufficient information about the identity of their customers. This in turn is a prerequisite for performing a comprehensive analysis of the risk of money laundering and terrorist financing as well as for complying with additional customer due diligence requirements aimed at combating money laundering and terrorist financing (e.g. the obligation to monitor the business relationship), which presuppose the knowledge gained about customers during identification. Effective systems, procedures and strategies for combating money laundering and terrorist financing must therefore ensure that supervised companies have sufficient information about their customers identity. 3. Explanation of terms 3.1. Identification 11. Identification is divided into two steps: ascertaining the identity and verifying the identity. 12. Ascertaining the identity means obtaining information on the identity of the natural or legal person to be identified. 13. Verifying the identity means validating the information on identity obtained against meaningful supporting documents and information. 14. Ascertaining and verifying the identity may be performed at the same time, and thus it is not always possible to clearly separate these two procedures. 6

7 15. Information on identity must be documented. The obligation to retain information stipulated in Article 40 para. 3 no. 1 BWG applies in this case Information on identity 16. With respect to information on identity, a distinction can be made between necessary information and additional information. Necessary information must be obtained in every case. 2 It may be required to obtain additional information, i.e. in addition to the necessary information, in order to take the appropriate measures required due to the specific risk of money laundering or terrorist financing Natural persons 17. Necessary information on the identity of a natural person 3 includes the first name and surname(s), gender and date of birth. 18. Additional information on the identity of a natural person may include signature, citizenship, place of birth, address(es), postal address, telephone number, address, profession, employer or type of self-employed activity as well as social insurance number or other national identity number Legal persons Necessary information on the identity of a legal person 5 includes the company name (including any existing abbreviation), legal form, country of registration, registering authority and, if available, registration number (for instance, in Austria, the company register number Refer to Chapter X, para. 174 ff. Less stringent measures for the purposes of meeting the obligation to compile the necessary information may only be provided for in the cases described in Article 40a BWG to the extent stipulated by law. In any event, the customer must be identified to the extent that it can be established and proven to the FMA that the conditions for application of simplified customer due diligence apply (Article 40a para. 5 BWG). On the information needing to be verified in the case of natural persons, refer to Chapter III.C.1, para. 24 ff. The terms legal person and legal entity are used synonymously in this Circular. On the information needing to be verified in the case of a legal person, refer below to Chapter III.C.2, para. 37 ff. 7

8 or central register of associations number), place of incorporation 6, purpose of business, first name(s) and surname(s) and date of birth of the managing bodies 7 and of the other persons authorised to represent the company before the supervised company. 20. Additional information on the identity of a legal person may include, for example, postal address, telephone number, fax number, address, website, VAT ID number and, in the case of an affiliated company, the group structure. Additional information on the identity of a managing body and of any other person authorised to represent the company before the supervised company may be the information specified in para. 18 as well as, for example, a certified copy of the company s specimen signatures, as held at the court with jurisdiction over the company register. 21. The type of additional information on the identity of a natural or legal person which needs to be obtained in the specific case will mainly depend on the information required in order to analyse the risk of money laundering or terrorist financing and to appropriately monitor the business relationship in a manner aligned with the particular business transaction If, for instance due to a lack of cooperation on the part of the person to be identified, the necessary and potentially needed additional information on the identity of a natural or legal person cannot be obtained, the supervised company will not be able to comply with the identification obligation. The consequences stipulated in Article 40 para. 2d BWG must then be taken If the IT system 10 that is used to record the identity information does not have enough fields or characters, the information must be recorded in another manner, e.g. in a field for additional remarks or in a hard copy. In this case steps must be taken to ensure that the complete information is provided within a reasonable period of time to the FMA or the OeNB or, in case of applying legal requirements, to the competent authorities and courts This is the place at which central administration of the legal person takes place. The extract from the register may be used as proof of the identity of a managing body representing a legal person. On the information needing to be verified in the case of a managing body, refer below to Chapter III.C.2, para. 38. For details, refer to the FMA Circular on the risk-sensitive approach, as last amended. Refer to Chapter VII.F, para Supervised companies which have a small customer base that is easy to track may opt not to record customer identity information electronically. 8

9 3.3. Meaningful supporting documents Natural persons 24. An official photo identification document is a meaningful supporting document for verifying the information on the identity of a natural person. 25. Pursuant to Article 40 para. 1 BWG, an official photo identification document: is a document that has been issued by a government authority; bears a non-replaceable (i.e. must be attached by the authority), recognisable photograph of the head of the person to be identified; and the name of the person to be identified; the date of birth of the person to be identified; the signature of the person to be identified; as well as the authority which issued the document. 26. When compared, there should be no apparent discrepancies between the head of the person depicted in the photograph and the person that is physically present or between the signature in the photo identification document and the signature of the person that is physically present. The same applies when the age of the person, as calculated based on the date of birth, and the height (if this is included in the photo identification document) are compared with an estimate of the actual circumstances. 27. Individual criteria with regard to the official photo identification document pursuant to Article 40 para. 1 BWG may be waived where technical advances give rise to other criteria which are equivalent to the waived criteria in terms of their identification effects. Thus, biometric data of the document holder which is stored in the photo identification document, for example, could replace the signature of the person to be identified. Prior to a permanent business relationship being established, a signature sample of the person to be identified must be obtained. In the case of other banking transactions, taking appropriate, risk-based due diligence measures to combat money laundering and terrorist financing may require the obtaining of a signature sample. 9

10 28. A photo identification document such as a physicians identification card is also considered issued by a government authority when issued within the context of the cardholder s official responsibilities. 29. Austrian photo identification documents which are suitable in any case for the identification of natural persons include passports, personal identification cards and driving licences. Other official photo identification documents (e.g. hunters identification cards or firearm licences) must be verified individually for compliance with the criteria. 30. In particular photo identification documents which have not been issued by a government authority or photo identification documents having a photo which the holder himself has attached or which may be replaced without leaving any identifiable marks are not suitable for identifying natural persons. The aforementioned is most often true for public transportation passes, student identification cards and skiing passes. 31. Passports and personal identification cards with an expired validity may be used for identification in exceptional cases if there are no other grounds for doubt. 32. Foreign official photo identification documents which comply with the mandatory criteria are to be considered equivalent to Austrian photo identification documents Foreign travel documents which, in accordance with the laws of the issuing country, do not contain the complete date of birth may nonetheless be used for verifying identity. If, however, the travel document contains no information whatsoever on the age of the holder, and if there are doubts as to the identity of the holder of the travel document, additional proof (e.g. birth certificate) is required. 34. The required information on the identity of a natural person which must be verified on the basis of the photo identification document results from the criteria applying to a photo identification document within the meaning of Article 40 para. 1 BWG. According to these criteria, in all cases the first names, surnames and date of birth given in the photo identification document must be verified to correspond with the information obtained. Furthermore, within the scope specified under para. 26 comparison must be made between 11 The Federal Ministry for European and International Affairs publishes a list of travel documents that are suitable for admittance to Austria Buergerservice_Zentrale/ReiseGrenzverkehr/Einreisevoraussetzungen_nach_OEsterreich.pdf. This list may serve as a guideline for determining the suitability of foreign travel documents for the purpose of identification. Conversely, a regulation by the Federal Minister of Internal Affairs (Federal Law Gazette II No. 263/2007) specifies certain types of travel documents, issued by third countries, which are not suitable for compliance with passport requirements and they may therefore not be used for identification. 10

11 the head of the person depicted in the photograph and the person that is physically present or - if obtaining a signature sample is required 12 - between the signature in the photo identification document and the signature of the person that is physically present. Unless a good, legible copy of the photo identification document is made and kept, the identification document information (i.e. the type of photo identification document, the issuing authority, the date of issue and the document number) should be recorded and kept along with the identity information. 35. All other necessary and any required additional information on identity which may be verified or compared on the basis of the photo identification document should additionally be verified or compared within the scope mentioned under para. 26. Other necessary as well as any additional information on the identity of a natural person to be obtained should be verified in a risk-based manner against other documents, data or information stemming from a credible source. In the latter case, customer documents and information from the Internet may additionally be used to verify the identity. 36. It has proven very useful in practice to make and keep copies of identification documents, since this allows errors in transferring information to be recognised afterwards, on the basis of the copy, as well as another verification of the photo identification document against the copy if any doubts arise later. Care should be taken in such cases that copies are of sufficient quality Legal persons 37. Extracts from a register kept by the registering authority (e.g. extracts from the company register or central register of associations) or extracts from databases which are generally recognised for legal use are meaningful supporting documents for verifying the identity of legal persons registered in Austria. 38. All necessary and any additional information needing to be obtained on the identity of a legal person, which may be verified against the extract from the register, must be verified against the extract from the register. Other necessary as well as any additional information on the identity of a legal person to be obtained should additionally be verified in a risk-based manner against other documents, data or information stemming from a credible source. 12 On the question of when it is required to obtain a signature sample, refer to Chapter III.C.1, para

12 39. Meaningful supporting documents for the purpose of verifying the identity of legal persons registered in a foreign country are primarily extracts from registers which are comparable to extracts from Austrian registers. If the extracts from the foreign register do not provide as much information as the Austrian register, or if the laws of the registering country do not provide for documents comparable to extracts from Austrian registers, the identity of the foreign legal person must be (additionally) verified against other documents, data or information stemming from a credible and independent source. 13 In this case nationally applicable standards may be considered to a reasonable extent. If none of the individual identity documents fulfils the legal requirements when taken by itself, the identity of the legal person must be verified by reviewing several identity documents. 40. Extracts from registers and comparable foreign identification documents for legal persons should be recent and, if possible, no more than 6 weeks old. This is to prevent the supervised company concerned from contracting with a legal person which possibly no longer exists. 41. In regular intervals to be determined by risk-based methods, supervised companies must additionally have current extracts from registers submitted by customers with whom they maintain a permanent business relationship (Article 40 para. 2a no. 3 BWG). 42. Foreign identification documents should be submitted along with a translation certified by a recognised certification authority. It is also permissible for company employees to prepare working translations. Information on identity which is necessary and which may be additionally needed should be retained in German or English. 43. A recognised certification authority refers to a certification authority in accordance with the respective national law. In order for certification to be legally valid, the certification authority must comply with the regulations governing certification which apply to that authority. An apostille must then be obtained for the certified document, or it must be finally certified and legalised for Austria Other documents, data or information stemming from a credible and independent source which can be used as proof for the identity of a legal person may be, for example, a licence from a government authority, confirmation of membership in a chamber of commerce, information from banks, confirmation of tax registration or minutes of the general meeting. An apostille is a simplified form of legalisation (i.e. diplomatic certification) of public documents for legal use at the international level. For countries which signed the Hague Convention Abolishing the Requirement of Legalisation for Foreign Public Documents ( the apostille replaces any other legalisation required and represents final certification of a document in the home country. 12

13 44. If, due to a lack of meaningful supporting documents, the necessary and any required additional information on the identity of a natural or legal person cannot be reliably verified, the supervised company will not be able to comply with the identification obligation pursuant to Article 40 para. 1 BWG. The consequences stipulated in Article 40 para. 2d BWG must then be taken Parties addressed by identification obligations 45. The obligation to ascertain and verify the identity of a customer is directed at supervised companies. These comply with the obligation through their employees, assistants and qualified third parties within the meaning of Article 40 para. 8 BWG. Recourse to qualified third parties is permitted provided that the supervised companies are not aware of any information that would cast doubt on equivalent fulfilment of the obligations in question Supervised companies 46. Supervised companies comply with their identification obligations primarily through their employees. 47. In connection with special business arrangements (e.g. banking transactions linked with leasing contracts), supervised companies may utilise the services of assistants (e.g. seller of the leasing property) to fulfil their identification obligations. 48. Assistants, while not employees of the supervised company, are nonetheless bound by a contractual relationship to the supervised company. The parties may not enter the 15 In the case of foreign documents from countries which are not members of the Hague Convention or which have no bilateral agreement with Austria, national procedures for certification in the country of origin must first be completed and the document then finally certified by the foreign ministry of that country (Letztbeglaubigung). The document must then be legalised by the competent Austrian representation in the country of the document s origin in order to be legally valid in Austria (Überbeglaubigung). Refer to for more details. Refer to Chapter VII.F, para

14 contractual relationship solely in order to pass on identification obligations to other parties. In fact the relationship must serve comprehensively a commercial purpose. 49. The contractual relationship must exist with the natural or legal person acting as assistant. This natural or legal person may in turn rely on their employees in order to fulfil identification obligations. 50. Assistants must be regarded as a part of the supervised company, which is subject to the obligation to fulfil customer due diligence obligations to the end of combating money laundering and terrorist financing. Appropriate measures must be taken to familiarise assistants, in the same way as employees, with customer due diligence obligations for combating money laundering and terrorist financing, and specifically with identification obligations. This purpose is served in particular by participation in training measures and by regularly receiving information on any changes of law or current developments in preventing money laundering and terrorist financing. 51. Supervised companies are responsible for their employees or assistants not fulfilling identification obligations. Regardless of whether employees and assistants are active in Austria or abroad, they must apply the identification regulations which are relevant to the supervised company. 52. Assisting parties must provide the supervised company immediately with the identity information (including identification document information 16 ) and documentation used in complying with the identification obligation Third parties 53. Supervised companies may also, for the purposes of fulfilling their identification obligations pursuant to Article 40 para. 8 BWG, make use of qualified third, parties provided that there are no indications that would raise doubts on these obligations being fulfilled in an equivalent manner. Article 40 para. 8 BWG refers in turn to provisions of European law for a definition of qualified third parties. Qualified third parties within the meaning of Article 40 para 8 BWG mainly include: 16 Refer to Chapter III, para

15 EEA credit and financial institutions, and the payment institutions referred to in Article 3 para. 4 of the Zahlungsdienstegesetz (ZaDiG; Payment Services Act) 17 This includes Austrian credit institutions, 18 Austrian insurance undertakings, Austrian investment firms, Austrian financial institutions and Austrian payment institutions, as well as EEA credit, financial and payment institutions and their branch offices in Austria. Credit and financial institutions in a third country, provided that equivalency exits External auditors, external accountants, tax advisers, notaries and other independent legal professionals 19 This should be understood to mean statutory auditors within the meaning of the Unternehmensgesetzbuch (UGB; Corporate Code), chartered accountants and tax advisers within the meaning of the Wirtschaftstreuhandberufsgesetz (WTBG; Act on Article 3(1) of Directive 2005/60/EC defines a credit institution as a credit institution, as defined in the first subparagraph of Article 1(1) of Directive 2000/12/EC of the European Parliament and of the Council of 20 March 2000 relating to the taking up and pursuit of the business of credit institutions, including branches within the meaning of Article 1(3) of that Directive located in the Community of credit institutions having their head offices inside or outside the Community. Article 3(2) of Directive 2005/60/EC, in the amended version of 2009/110/EC, defines a financial institution as: a) an undertaking other than a credit institution which carries out one or more of the operations included in points 2 to 12 and 14 and 15 of Annex I to Directive 2006/48/EC, including the activities of currency exchange offices (bureaux de change); b) an insurance company duly authorised in accordance with Directive 2002/83/EC of the European Parliament and of the Council of 5 November 2002 concerning life assurance, insofar as it carries out activities covered by that Directive; c) an investment firm as defined in point 1 of Article 4(1) of Directive 2004/39/EC of the European Parliament and of the Council of 21 April 2004 on markets in financial instruments; d) a collective investment undertaking marketing its units or shares; e) an insurance intermediary as defined in Article 2(5) of Directive 2002/92/EC of the European Parliament and of the Council of 9 December 2002 on insurance mediation, with the exception of intermediaries as mentioned in Article 2(7) of that Directive, when they act in respect of life insurance and other investment related services; f) branches, when located in the Community, of financial institutions as referred to in points (a) to (e), whose head offices are inside or outside the Community. Credit institutions which hold a licence only for conducting exchange bureau business (Article 1 para. 1 no. 22 BWG) may not act as third parties. Art. 2(1)(3)(b) of Directive 2005/60/EC mentions notaries and other independent legal professionals, when they participate, whether by acting on behalf of and for their client in any financial or real estate transaction, or by assisting in the planning or execution of transactions for their client concerning the: i) buying and selling of real property or business entities; ii) managing of client money, securities or other assets; iii) opening or management of bank, savings or securities accounts; iv) organisation of contributions necessary for the creation, operation or management of companies; v) creation, operation or management of trusts, companies or similar structures. 15

16 the Profession of Financial Trustees), notaries within the meaning of the Notariatsordnung (NO; Code of Professional Conduct for Notaries) and attorneys at law within the meaning of the Rechtsanwaltsordnung (RAO; Code of Professional Conduct for Attorneys at Law). 54. These third parties may be relied on to fulfil identification obligations when they: are subject to mandatory professional registration, recognised by law; and must apply: in the case of Austrian third parties, the customer due diligence requirements for combating money laundering and terrorist financing which apply to their profession; in the case of third parties from EEA Member States, the customer due diligence requirements for combating money laundering and terrorist financing which have been standardised by implementing Directive 2005/60/EC; in the case of third parties from third countries, due diligence requirements equivalent to Directive 2005/60/EC for combating money laundering and terrorist financing; and their compliance with those requirements is supervised in accordance with Section 2 of Chapter V of Directive 2005/60/EC, or they are situated in a third country which imposes equivalent requirements to those laid down in Directive 2005/60/EC. 55. The above third parties from Austria and the EEA (which as well as the EU Member States also includes Iceland, Liechtenstein and Norway) meet these three conditions. With regard to third parties from third countries, the supervised company may rely only on third parties from countries having standards which have been expressly designated as equivalent 20 in a statement published by the FMA. Should the supervised company have information which raises doubts as to the equivalency of the standards in third countries, the company should inform the FMA of this fact and take measures to effectively counteract the consequent risk of money laundering and terrorist financing. 20 See in this regard the list of equivalent third countries at 16

17 56. The supervised company which relies on third parties bears ultimate responsibility for fulfilling the identification obligations. 57. In accordance with Article 40 para. 8 BWG, the supervised company must ensure that the third party makes identity data available to them immediately after identification. Identity documents (i.e. originals or copies) and identification document information may remain with the third party for the time being, whereas the supervised company must ensure that the third party forwards this information to the supervised company immediately upon request. 58. Third parties from equivalent third countries may comply with the identification obligations stipulated by the respective national law. Similarly, supervised companies may even accept identity data and documents (which have been obtained and verified by fulfilling the identification obligations governing the third party concerned) other than those required in Austria as long as the equivalency of the identity data and documents is ensured. 5. Identification procedures 5.1. Obtaining information on identity 59. The person to be identified must be called upon in due time to provide the necessary 21 as well as any required additional 22 information on their identity, so that identification may be completed before the business relationship begins or before the transaction is executed. 23 This request can be made either during a personal meeting with the person to be identified or by requesting an appropriate form to be completed. 60. If the customer fails to comply with the request and if the credit and financial institutions are thus not able to adhere to paras. 1, 2 and 2a of Article 40 BWG on customer identification and acquisition of other requisite information on the business relationship, they may not engage in any transaction or establish any business relationship and must terminate Refer to Chapter III.B, paras. 17 and 19. Refer to Chapter III.B, paras. 18 and 20. On the exception stipulated in Article 40 para. 2c BWG, allowing an account to be opened before identification is completed, refer to Chapter VII.A, para

18 any existing business relationship. Moreover, consideration should be given to sending a report on the customer to the Financial Intelligence Unit Verifying the information on identity obtained 61. In order to verify the information on identity obtained, the person to be identified must be called upon to provide the required 24 proof of identity. Natural persons must provide proof of identity personally by means of original documents. 25 The presentation of copies or oral statements alone is equally as insufficient as presentation by a natural person other than the person to be identified. Particularly in the case of unusual documents, additional risk-based measures are required to verify the identity of the natural person (including for example research using databases or the internet). Information on the authenticity of the submitted document should also be obtained. 62. Unless a (legible) copy of the photo identification document is made anyway, the type of photo identification document as well as the issuing authority, date of issue and number of the photo identification document must be recorded during verification of the identity of natural persons. In this way it is ensured that the photo identification document may be viewed if necessary at the office of the issuing authority Verifying the authenticity of proof of identity 63. Supervised companies must not have any doubts as to the authenticity of the proof of identity presented. Consequently, within the framework of training measures as specified in Article 41 para. 4 no. 3 BWG, supervised companies must familiarise those employees who are involved in carrying out identification or any assistants who are involved in carrying out identification 26 with the appearance and the security features of common Austrian photo identification documents and, in accordance with their customer groups, from abroad in order to be able to verify the authenticity of proof of identity. Employees involved in identification as On the information needing to be verified in the specific case, refer to Chapter II.B, para. 16 ff. Exceptions exist pursuant to Article 40b para. 1 no. 1 BWG for non-face to face transactions, pursuant to Article 40 para. 2 BWG for the identification of the trustor and pursuant to Article 40a para. 2 no. 2 BWG for school savings schemes. Refer to Chapter IV.A, para. 47 ff. 18

19 well as any assistants charged with this task should additionally be acquainted with the phenomenon of invented identification documents. In the case of doubt as to the authenticity of official photo identification documents or other meaningful supporting documents, additional investigation must be carried out to a reasonable extent and specifically information must be obtained on the authenticity of the proof of identity presented. 64. The Federal Ministry of Internal Affairs may be contacted for information on authentic identity and travel documents from Austria and abroad ([email protected]). Useful information in this regard is also provided by the Public Register of Authentic Identity and Travel Documents Online (PRADO), hosted by the General Secretariat of the Council of the European Union, at 6. Persons whose identity must be ascertained and verified 6.1. Customers (Article 40 para. 1 BWG) Definition 65. A customer is anyone who concludes a contract with a supervised company for a banking transaction. The customer has rights and obligations towards the supervised company. Both natural and legal persons may be customers Scope of identification obligations 66. Supervised companies must obtain the necessary information on identity as well as any additional information on identity which is required in the specific case. 27 Verification of the 27 Refer to Chapter III.B, para. 16 ff and also the FMA regulation on Money Laundering and Terrorist Financing Risk (GTV, Federal Law Gazette II No. 377/2011). 19

20 necessary as well as potential additional identity information needing to be obtained must be carried out using meaningful supporting documents of identity Special case of minor customers 67. Strict adherence to formal requirements is not necessary in the case of customers who are legal minors. The fact that minors sometimes do not have an official photo identification document will need to be taken into account. 68. Customers who are legal minors and do not possess an official photo identification document, and who cannot be reasonably expected to obtain an official photo identification document for the purpose of conducting identification procedures, may by way of exception be identified by using a document appropriate for the age of the person. As long as not unusually large amounts of funds, from a risk-sensitive point of view, or unusual banking transactions are involved, even pseudo identification documents otherwise not suitable for identification, such as a birth certificate, an entry in the parents passport 30 or a student identification card, may be used to verify the information on minor customers. 69. Yet only documents will be acceptable as proof of identity. Oral statements alone are by no means sufficient. 70. The remaining customer due diligence obligations must always be fulfilled to the full extent in the case of customers of minor age. 71. Beyond this, identification obligations apply to the full extent to the legal representatives of minor customers. 72. The identity information of minors above the age of 14, who are legally able to act on their own behalf, must always be verified against an official photo identification document within the meaning of Article 40 para. 1 BWG. With regard to any business relationship with a minor above the age of 14 that requires the consent/involvement of the minor s legal Refer to Chapter III.C, para. 24 ff. Reference is made here of the identification obligations stipulated in Article 78 para. 9 no. 4 BWG for customers with a place of incorporation or place of residence in a non-cooperative country. Currently, there is no longer any scope of application for this provision since the federal government regulation on non-cooperative countries was revoked with Federal Law Gazette II No. 495/2004. Pursuant to Article 78 para. 8 BWG, supervised companies are obliged to keep up with current information regarding non-cooperative countries. It should be noted that entries in parents' passports will cease to be valid with effect from 15 June

21 representative, the identification obligations will also apply in respect of the minor s legal representative Special case of trustees (Article 40 para. 2 BWG) Definition 73. Anyone who executes banking transactions for someone else, and who does not serve as representative in this case, is a trustee within the meaning of Article 40 para. 2 BWG and must be identified accordingly. Pursuant to Article 40 para. 2 BWG, trustees conclude banking transactions for the account of or on behalf of a third party. The wording of Article 40 para 2 BWG is widely encompassing. 74. Trustees are customers. Therefore, they also have rights and obligations towards the supervised company. Conducting banking transactions on a trust basis can be an effective means of disguising money laundering or may facilitate terrorist financing. Thus, Article 40 para. 2 BWG ensures the required amount of transparency when conducting banking transactions on a trust basis. Likewise, customers who conduct banking transactions as a trustee must reveal their trustee relationship. To this end, supervised companies must call upon the customer to indicate whether they intend to conduct the business relationship or the transaction for their own account, or for the account of or on behalf of a third party. The customer is legally obliged to comply with this request and must provide notification of any changes during an existing business relationship without delay and without being prompted to do so. 31 Particular attention should be paid in this regard to the obligation of the supervised companies to update identity data and documentation Supervised companies must ascertain in the individual case whether or to what extent a banking transaction that is conducted on a trust basis is also subject to enhanced customer due diligence obligations. For some products, trust relationships are widely used as an internationally recognised feature of the comprehensively supervised wholesale financial markets. An obligation to take enhanced due diligence measures does not automatically 31 Cf. Article 40 para. 2 BWG. If the customer fails to comply with the disclosure obligations, the customer is guilty of an administrative office and will be prosecuted by the FMA. 32 Refer to Chapter IX, para. 168 ff. 21

22 arise from the fact alone that there is a trust relationship in this particular case. Enhanced customer due diligence measures are, however, necessary in the case of trust relationships which are especially prone to misuse for purposes of money laundering or terrorist financing Scope of identification obligations 76. On account of the special activities of trustees, in addition to the due diligence measures applying to customers, 33 Article 40 para. 2 BWG stipulates the following two additional requirements for the identification of trustees: The identity of the trustee must be ascertained exclusively in the physical presence of the trustee. Identification of the trustee is therefore not permissible in the context of a non-face to face transaction. Identification of trustees by third parties, as specified in Article 40 para. 8 BWG, and assistants is precluded Trustors (Article 40 para 2 BWG) Definition 77. Trustors are the natural or legal persons for whose account or on whose behalf a business relationship is established or a transaction executed. 78. With respect to the banking transactions which the trustee conducts for the trustor, the supervised company maintains no contractual relationship with the trustor. Unless special regulations exist for the trustor, when applying customer due diligence requirements for the purpose of combating money laundering and terrorist financing, the trustor must be treated like a customer. The trustor has no right to dispose of an account held by the trustee on his behalf unless power of disposal has been specifically granted. 79. Like the beneficial owner of a legal person, the trustor is the beneficiary of the banking transaction conducted on his behalf. By stipulating the obligation to identify the trustor, Article 40 para. 2 BWG ensures the necessary degree of transparency in trustee 33 Refer to Chapter V, para. 59 ff. 22

23 relationships in order to prevent the misuse of trust arrangements in banking transactions for the purposes of money laundering and terrorist financing Scope of identification obligations 80. The trustee must ascertain the identity of the trustor personally or through reliable sources and confirm this fact in a written declaration to the supervised company. Reliable sources refer to courts and other government authorities, notaries, attorneys at law and third parties as specified in Article 40 para. 8 BWG, under the condition that they have their official fields of activity, places of incorporation or places of residence in a country which on its territory or in its jurisdiction adopts measures against money laundering and terrorist financing 34 that are equivalent to Austrian standards. 81. In addition, the trustee must cooperate with the supervised company in the indirect identification of the trustor by providing, upon the request of the supervised company, the necessary information on the identity of the trustor as well as any additional information which may be required and by submitting proof 35 of the necessary information on the identity of the trustor as well as any additional information which may be required. 82. If the trustor is a natural person, the supervised company must verify the necessary information on the identity of the trustor against the original or a legible copy of the trustors s official photo identification document. The supervised company must verify in a risk-based manner any other required additional information on the identity of the trustor against additional meaningful supporting documents If the trustor is a legal person, the supervised company must verify the necessary as well as any required additional information 37 on the identity of the trustor against meaningful supporting documents. 38 The trustee must submit the original documents On the equivalency of third countries, refer to Chapter IV.B, para. 55. On the question of the necessary and additional information on the identity which is subject to proof, refer to Chapter III.B, paras. 17f and 19f. On the question of what is meant by meaningful supporting documents, refer to Chapter III.C, para. 24 ff. On the question of the necessary and additional information on the identity which is subject to proof, refer to Chapter III.B, paras. 17f and 19f. On the question of what is meant by meaningful supporting documents, refer to Chapter III.C, para. 24 ff. 23

24 84. The last sentence of Article 40 para. 2 BWG allows simplified procedures for providing proof for the identity of trustors acting on behalf of joint ownership associations for real estate properties: In the event that: the trustee is an authorised real estate administrator; the trustors are several natural persons who jointly own a real estate property (joint ownership association) managed by the real estate administrator; and the trustor exclusively executes banking transactions in connection with managing the property, the supervised company may also verify the identity of the trustors against an extract from the property register on the property concerned which is presented by the authorised real estate administrator. These simplified procedures for providing proof of identity do not apply to sole owners of property or to legal persons who are joint owners of property. 85. Subject to an assessment of low risk, Article 40a para. 4 BWG allows for additional simplified procedures for providing proof for the identity of trustors in the case of fiduciary accounts held for their clients by attorneys at law or notaries from EEA Member States and from third countries, the latter provided that these are subject to requirements equivalent to FATF standards with regard to the suppression of money laundering and terrorist financing and are supervised for compliance with such requirements. 39 Article 40a para. 4 BWG transfers responsibility for conducting identification of the trustors to the attorney at law or the notary Specifically, Article 40a para. 4 BWG stipulates that credit and financial institutions may apply measures that are less stringent than the obligations determined in Article 40 para. 1 nos. 1, 2 and 5 and paras. 2 and 2a BWG subject to the risk of money laundering and terrorist financing being assessed as low under the following cumulative conditions: Individual verification is infeasible due to the representation of large co-ownership communities of changing composition On the equivalency of third countries, refer to Chapter IV.B, para. 55. The special provisions of Article 9a RAO and Article 37a NO apply to Austrian attorneys at law and notaries. 24

25 The attorney at law or notary submits a written declaration to the supervised company stating that: he has identified his clients in accordance with Article 40 paras. 1, 2 and 2a nos. 1 and 2 BWG or in accordance with Article 8(1)(a) to (c) of the Third Money Laundering Directive; he has stored the corresponding documents; and will present them to the supervised company upon request. Within two months prior to the end of each calendar year, the attorney at law or notary will submit to the supervised company complete lists of the natural or legal persons who are beneficial trustors of the fiduciary account or who were beneficial trustors of the fiduciary account during the course of the year concerned. These lists must include the necessary as well as any required additional information on the identity of the trustor. The trustor does not have his place of incorporation or place of residence in a non-cooperative country. The supervised company does not suspect or have reasonable grounds to suspect that the customer or the trustor belongs to a terrorist organisation, or that the customer objectively participates in transactions which serve the purpose of money laundering or terrorist financing. If the individual transactions conducted for the trustor through the fiduciary account or the share of the claim on the attorney at law or notary arising from fiduciary accounts does not amount to a total of 15,000, information on the identity of the trustor need not be provided annually (Article 40a para. 4 no. 3 BWG), whereas the attorney at law or notary must at any time comply with the request of the supervised company to provide the information on the identity of the trustor. 25

26 6.5. Beneficial owners (Article 40 para. 2a no. 1 BWG) General comments on the term 87. Supervised companies that conduct banking transactions for a legal person must, in addition to the legal person and that legal person's representatives, also have to identify the beneficial owner of the legal person. Article 2 no. 75 BWG defines the beneficial owner in general terms as the natural persons who ultimately own or control the customer. With regard to companies and legal entities that administer and distribute funds, Article 2 no. 75 lit. a and b BWG stipulates which natural persons are covered by the definition of beneficial owner Beneficial owners of companies 88. Companies as defined in Article 2 no. 75 lit. a BWG are Austrian corporations (GmbH, AG), incorporated Austrian associations with legal capacity (OG, KG) and comparable foreign or European corporations (SE, EEIG). 89. Article 2 no. 75 lit. a BWG stipulates three difference categories of beneficial owner. Leaving aside the different legal forms, and thus considered from a general perspective, the beneficial owners of a company can only take the form of natural persons who: hold a sufficiently large direct or indirect participation in the company; hold sufficient voting rights either directly or indirectly in the company; or exercise control over the management of the company in a different way. 90. Whether the prerequisites for each of these three categories are met must be reviewed individually for each potential beneficial owner. This means that once one or more beneficial owners falling into the first or second category have been established, the obligation to check for any further beneficial owners under the remaining categories continues to apply. If the prerequisites for all three categories are fulfilled, all of the persons concerned will be deemed to be beneficial owners and are to be identified accordingly. 26

27 Cases 1 and 2: Holding of sufficient shares and voting rights 91. Pursuant to Article 2 no. 75 lit. a sublit. aa BWG, a sufficient participation in a joint stock company (AG) that is not listed on a regulated market exists when the natural person concerned holds, either directly or indirectly, more than 25% of the shares or voting rights. 92. Similarly, a direct or indirect participation through shares or voting rights in other companies is deemed to be significant when it exceeds 25%. 93. Anyone with a sufficient participation in a company must be identified as a beneficial owner. 94. Even when participation is below the 25 plus 1 limit, identification of the beneficial owner may be required by way of exception in the presence of an increased risk of money laundering and terrorist financing and if appropriate pursuant to Article 40b para. 1 BWG. 95. A typical example of an indirect participation in a customer is the holding of shares in an affiliated company of the customer. The following example shows how natural persons holding sufficient shares in affiliated companies are to be determined: Customer X a company has shareholders in the form of two companies (Y 2 and Y 4) and two natural persons (Y 1 and Y 3). The participation of Y 2 and Y 3 is significant. The shareholders in Y 2 are two companies (Z 1 and Z 2) and one natural person (Z 3). The shareholders in Y 4 are one company (Z 4) and one natural person (Z 5). Whether a sufficient participation exists must be reviewed at each level (in this specific case at both level Y and level Z) and must not be calculated on a proportional basis. The natural person Y 3 holds a significant participation in customer X. The same applies to natural person Z 3, which also holds a significant participation in customer X since it holds a significant participation in Y 2, which in turn holds a significant participation in customer X. Natural person Y 3 therefore directly holds a significant participation in customer X, and natural person Z 3 indirectly. 96. Indirect voting rights are voting rights that can be exercised on the basis of an agreement or on a de facto basis. The beneficial owner has indirect voting rights if the following applies: The party concerned holds voting rights in a company affiliated with the customer. The party concerned holds voting rights in the customer and has transferred voting rights in the customer to a third party as security but may exercise the voting rights 27

28 without express instruction from the recipient of the security or influence the exercising of the voting rights by the recipient of the security. In this way, the party concerned has sufficient control over the voting rights. The party concerned has been granted a usufructuary right with regard to the voting rights in the customer as security, and may exercise these voting rights without express instruction by the person providing the security or can influence how the voting rights are exercised by the person providing the security. The party concerned is an authorised agent and may exercise the voting rights in the customer at his discretion in the absence of any instructions from the represented party. In this way, the party concerned has sufficient control over the voting rights in the customer. The party concerned holds voting rights in the customer and has entered into an agreement with another party that holds such rights obliging both to pursue a common, long-term policy with regard to the management of the company by exercising their voting rights by common consent. In this way, the two parties jointly hold sufficient voting rights. 97. In determining whether someone indirectly holds voting rights in the customer, supervised companies are dependent on cooperation on the part of the customer as specified in Article 40 para. 2a no. 1 BWG Case 3: Control over the management 98. In accordance with Article 2 no. 75 lit. a sublit. bb BWG, the beneficial owners of a company are those natural persons who otherwise exert control over the company s management than by holding shares or voting rights. Control over a legal person can be exercised through any form of influence on the management of that legal person resulting in management decisions being made in the interests of the party exerting influence. 99. Article 2 no. 75 lit. a sublit. bb BWG also covers merely de facto opportunities to influence the management, the legal basis of which is not contained in any agreement. If such opportunities to influence are established, the supervised company is obviously reliant on the cooperation of the customer s authorised representatives. The authorised representatives of 28

29 the customer are legally obliged to disclose the identity of the beneficial owner. 41 The supervised company shall acquire this information by questioning the customer s authorised representatives. The supervised company cannot be accused of failing to know about opportunities to exert influence if the customer himself is unaware of these With regard to the extent of the control over the management of the legal person, the same benchmark must be applied to this category of beneficial owner as to the other two categories. The extent of sufficient control must therefore correspond to a sufficient participation or to the holding of a sufficient quantity of voting rights Beneficial owners of legal entities which administer or distribute funds 101. Article 2 no. 75 lit. b BWG cites foundations and trusts as examples of legal persons that administer or distribute funds. These examples indicate that groupings of assets are being referred to which are dedicated to a particular purpose and have a legal personality. Unlike companies, groupings of assets do not have members, but have beneficiaries Article 2 no. 75 lit. b BWG defines two categories of beneficial owners of a legal person that administers or distributes funds. Beneficial owners of legal entities which administer or distribute funds include: the natural persons who are the beneficiaries of 25% or more of the allocations of the impersonal entity; and/or the natural persons who exercise control over 25% or more of the assets of the impersonal entity Whether the prerequisites for either category are met as in the case of the categories under Article 2 no. 75 lit. a BWG should be reviewed. If the prerequisites for both categories are fulfilled, all of the persons concerned will be deemed to be beneficial owners and are to be identified accordingly. 41 Cf. Article 40 para. 2a no. 1 BWG. 29

30 Case 1: Beneficiaries 104. Pursuant to Article 2 no. 75 lit. b sublit. aa BWG, the beneficial owners of an impersonal entity are the natural persons who are the beneficiaries of 25% or more of the allocations of the impersonal entity Even when participation is below the 25 plus 1 limit, identification of the beneficial owner may be required by way of exception in the presence of an increased risk of money laundering and terrorist financing and if appropriate as specified in Article 40b para. 1 BWG In the event that the future beneficiaries of the allocations of the impersonal entity have yet to be identified, making it impossible to investigate individual natural persons as beneficial owners, Article 2 no. 75 lit. b sublit. bb BWG specifies that the group of persons in whose interests the impersonal entity is primarily active or was set up should be considered as the beneficial owners The group of persons should be described using those prerequisites to be fulfilled by future beneficiaries in order to be included in the group of beneficiaries. It is therefore not necessary for the identity of individual natural persons within the group to be determined Case 2: Control over the assets 108. Pursuant to Article 2 no. 75 lit. b sublit. cc BWG, the beneficial owners of an impersonal entity are the natural persons who exert control over 25% or more of the assets of an impersonal entity. Control as defined in Article 2 no. 75 lit. b sublit. cc BWG over the assets of an impersonal entity can be exercised through any form of influence over how the assets of that entity are used. Also covered in Article 2 no. 75 lit. b sublit. cc BWG are merely de facto opportunities to influence the assets of an impersonal entity, the legal basis of which is not contained in any agreement. The details in this regard relating to Article 2 no. 75 lit. a sublit. bb BWG 42 apply accordingly In the event that the beneficiaries have not yet been identified, it appears sensible to establish the identity of the person(s) controlling the assets of the impersonal entity in any event. 42 Refer to Chapter VI.E, para. 98 ff. 30

31 Scope of obligation to identify the beneficial owner 110. The authorised representatives of a legal person who wish to establish a business relationship with a supervised company on behalf of the legal person must cooperate with the supervised company in the indirect identification of the beneficial owner of the legal person by providing, upon the supervised company's request, the necessary information on the identity of the beneficial owner and any additional information which may be required and by submitting proof required by the supervised company of the necessary information on the identity of the beneficial owner and any additional information which may be required The supervised company must obtain the necessary information on the identity of the beneficial owner of a legal person with which it intends establishing a business relationship and any additional information which may be required, and take risk-based measures to review the identity of the beneficial owner. The latter may also be carried out in a risk-based manner from the supervised company s own research, such as using databases or the Internet After carrying out measures to identify the beneficial owner, the supervised company must be convinced that it knows who its customer s beneficial owner is. The knowledge of the supervised company must also extend to the ownership and control structure of the customer. This means that the supervised company, in cases in which the economic entitlement of the beneficial owner is not direct but merely indirect, should know from whom and in what manner the beneficial owner is granted entitlement. Basically, where there is a chain of entitled parties, it is not sufficient to only be aware of the last link in the chain and to identify that link as the beneficial owner. Rather, the length of the chain and the form 43 and name 44 of its links should also be known to the company. What additional information is obtained over and above the links in the chain should be determined in a risk-based manner To be convinced that its knowledge about the identity of the beneficial owner is accurate, the supervised company must have taken appropriate steps with regard to the specific risk of money laundering and terrorist financing in order to review the information on the identity of the beneficial owner 45. It is imperative that, when applying the required due As an absolute minimum, the company should have ascertained whether the "link in the chain" is a natural or legal person. As an absolute minimum, the name and nationality of the natural person or the name, legal form and country of registration of the legal person should be known. For details, refer to the FMA Circular on the risk-sensitive approach, as last amended. 31

32 diligence, there were no indications to the effect that the information provided by the legal person was incorrect. The supervised company must take appropriate steps to verify the information on the identity of the beneficial owner Authorised representatives Definition 114. Authorised representatives are those who are authorised to conduct banking transactions on behalf of the customer. The authority to conduct banking transactions on behalf of the customer may be contractually awarded, or may result from statutory regulations or the articles of association of a legal person Contractual representation The most common form of contractually agreed power of representation (power of attorney) with regard to banking transactions is authority to sign. This entitles the authorised signatory to dispose of the customer s bank account. The authorisation is granted to the authorised signatory by means of an express written declaration on the part of the customer for the attention of the supervised company. There is therefore no obligation to provide documentary evidence of the power of representation The customer may award authority to draw on his account, unlike in the case of authority to sign, also outside the sphere of the account agreement. Generally, such a power of attorney purely applies to the internal relationship, of which the supervised company is first made aware upon its disclosure Based on the general rules of the law on representation, representative authority can also be awarded for the implementation of any other banking transaction. 46 With regard to contractual representatives, with the exception of the contractual representatives of legal persons (e.g. a Prokurist or general agent) and of sole proprietorships, the identification regulations apply to the trustee. 32

33 Legal representatives 118. A customer who does not have (full) legal capacity must have a legal representative to conclude his banking transactions on his behalf. Legal representatives are the parents of minors born in wedlock (Article 144 of the Allgemeines Bürgerliches Gesetzbuch [ABGB; General Civil Code]), the mothers of minors born out of wedlock (Article 166 ABGB), other persons entrusted with the care of minors (Article 187 ABGB), youth welfare service providers in the cases detailed in Article 211 ABGB and the case officers of disabled adults within the framework of the officer s remit (Article 268 ABGB) Whilst the parents of minor children born in wedlock, the mothers of minors born out of wedlock and youth welfare service providers are directly appointed as representatives by law (legal representatives in the narrow sense of the term), the other legal representatives must be appointed by court order (representatives by court appointment) For the sake of completeness it may be noted that a legal power of representation can be subject to restrictions which have been laid down by law or by the courts Representation through corporate bodies 121. Legal persons may only conclude banking transactions through their corporate bodies. Representatives in the form of corporate bodies are appointed to represent the legal person based on the articles of association of the legal person in question. Persons other than the corporate bodies may only effectively represent the legal person if they have been duly authorised by contractual agreement by the corporate bodies authorised to do so in accordance with the articles of association Scope of identification obligations 122. Authorised representatives must be identified by the supervised company prior to their first act of representing the company in a legal transaction. The measures that have been described for customers 47 should be applied in this regard. 47 Refer to Chapter V, para. 59 ff. 33

34 123. Article 40 para. 1 BWG requires the identification of authorised representatives of legal persons and natural persons without legal capacity. Additionally, all authorised representatives of natural persons with legal capacity (such as authorised signatories or persons authorised to carry out banking transactions) must be identified In addition to their identity, authorised representatives must also provide evidence of their power of representation by means of appropriate certificates (such as power of attorney, court order, articles of association of the legal person, etc.). In the event that the power of representation is derived directly from legal provisions, documentary evidence is required for those circumstances giving rise to the applicability of the corresponding statutory provisions For example, the right of parents to represent minors will usually reveal itself credibly through the statement made by the parents and by reviewing the identity documents of the parents and the child. No additional document is required as proof of the representation relationship in such cases, particularly since such documents are not required in Austria as long as the child s parents are still married The type of the power of representation and the circumstances leading to the representation should also be documented accordingly. 7. Cases in which identification obligations apply when must identification take place? 127. Article 40 para. 1 BWG determines the cases in which the identity of a customer must be ascertained and verified Establishment of a permanent business relationship (Article 40 para. 1 no. 1 BWG) 128. Prior to a permanent business relationship being established, the identity of any person(s) who will become a contractual partner of the supervised company due to such establishment must be ascertained and verified (Article 40 para. 1 no. 1 BWG). This means 34

35 that the process of ascertaining and verifying the identity must have been completed by the time of the agreement being concluded, such as the acceptance of an application to open an account by the supervised company. A preliminary contract discussion for information purposes does not trigger any identification obligation at this stage. Any information received at this stage, however, can be kept on file with a view to a potential business relationship A permanent business relationship exists for example upon: the opening of a giro account; the opening of a savings account; the opening of a securities account; the opening of a loan account; the provision of safe deposit box services Pursuant to Article 40 para. 2c BWG, by way of derogation from Article 40 paras. 1, 2 and 2a BWG, the opening of a bank account is permissible provided that there are adequate safeguards in place to ensure that transactions are not carried out by the customer or on the customer s behalf until full compliance with Article 40 paras. 1, 2 and 2a BWG has been attained. This applies correspondingly to any establishment of a permanent business relationship Supervised companies may therefore avail themselves of the provisions of Article 40 para. 2c BWG and conclude banking transactions subject to this condition precedent, and set up the account or establish the permanent business relationship even if the identification obligations have yet to be met (in full). In such a case they must have ensured however that the account is blocked for all transactions until such time as the condition of all of the provisions set out in Article 40 paras. 1, 2 and 2a BWG being fulfilled has been met. It is therefore also not permitted for deposits for the account to be accepted prior to this condition being met In order to fulfil the statutory rules on identification in the best way possible, use should only be made of this provision in exceptional cases. 35

36 7.2. Execution of individual transactions exceeding the limit amount (Article 40 para. 1 no. 2 BWG) 133. The identity of the customer must be ascertained and verified before executing any transactions which are not conducted in connection with a permanent business relationship and which involve an amount of at least 15,000 or an equivalent value. Individual transactions of this type are one-off banking transactions with no follow-up transactions. Examples include the purchase and sale of foreign currency, the discounting of bills of exchange or cheques, financial transfers and the payment of cash into a third party account. Reference is made to the special identification obligations set out in Regulation (EC) 1781/ In the case of individual transactions, the obligation to identify the client generally only applies from an amount of 15,000 upwards. However, if several individual transactions are obviously linked to one another and the total amount of all of these transactions is in excess of the 15,000 threshold, the client must also be identified Individual transactions that are effected in close succession are deemed to be linked to one another if they could have been processed as one single transaction but - for whatsoever reason - were split into smaller separate transactions Should it subsequently emerge that the amounts of several individual transactions that are apparently linked to one another total or exceed the amount of 15,000, identification must be carried out as soon as it has been established that the amount of 15,000 has been reached or exceeded. This process may be in response to an order to execute a follow-up transaction or may have nothing to do with any subsequent transaction but result from an ex-post monitoring process with regard to completed transactions. In order to fulfil the legal obligations it will be necessary as far as possible in the event of the latter to find the client responsible for the transactions and ask him to provide identification. All steps taken for this purpose should be documented. 48 Regulation (EC) No. 1781/2006 of 15 November 2006 on information on the payer accompanying transfers of funds (Official Journal 2006 L 345/1). For details, also refer to the FMA Circular on the Transmission of Payer Information, as last amended. 36

37 7.3. Suspicion of money laundering or terrorist financing activity (Article 40 para. 1 no. 3 BWG) 137. If it is suspected or if there are reasonable grounds to suspect that a customer: 49 belongs to a terrorist organisation as defined in Article 278b of the Strafgesetzbuch (StGB; Penal Code); objectively participates in transactions that serve the purpose of money laundering (Article 165 StGB 50 ); or objectively participates in transactions which serve the purpose of terrorist financing as defined in Article 278d StGB, the identity of the customer must be ascertained and verified irrespective of the amount involved in the transaction or the type of agreement concluded, and further appropriate due diligence measures should be applied on a risk-sensitive basis Given that merely objective participation in the named transactions is all that is required, the customer does not have to know and may not even seriously believe it to be possible that the transaction in which he participates is serving the purposes of money laundering or terrorist financing. It is sufficient for the supervised company to suspect or to have reasonable grounds to suspect that the transaction is actually serving such purposes. Correspondingly, it is enough for the supervised company to suspect or have justified grounds to suspect that the customer s transaction meets the physical elements of the offence provided by Article 165 StGB or the physical elements of the offence as provided under Article 278d StGB. The mental elements of the offence (intent or knowledge) need not be fulfilled and therefore do not require to be verified by the supervised company. Customers who are exploited by third parties generally beneficial owners without any intent on their part should therefore be identified in accordance with Article 40 para. 1 no. 3 BWG Customers as defined in Article 40 para. 1 no. 3 BWG include both customers that place an order for an individual transaction and those customers who are in a permanent With regard to the conditions under which a supervised company should be suspicious or is entitled to see grounds for suspicion, please refer to the FMA Circular on Suspicious Transaction Reports, as last amended. It should be noted that Article 165 StGB now directly criminalises self-laundering. 37

38 business relationship with the supervised company or wish to enter into such a relationship. Furthermore, the term of customer as provided by Article 40 para. 1 no. 3 BWG also covers authorised representatives With regard to customers who are in a permanent business relationship with the supervised company, the latter must already hold information on their identity. If doubts as to the customer s identity arise due to suspicions, the information on the customer s identity the provisions of Article 40 para. 2e BWG notwithstanding must be obtained again and any missing information on the customer s identity added, and the obtained information (possibly in combination with existing information) must be subject to a renewed review In all cases in the event of doubts as to the information provided on the customer s identity the information received should be confirmed by requesting further documents, data and information from a credible and independent source and used to verify the customer s identity Article 40 para. 1 BWG only makes provision for an identification obligation in the event of suspicious cases. However, this provision has to be read in conjunction with Article 40b para. 1 BWG, according to which supervised companies, in situations which by their nature can present a higher risk of money laundering or terrorist financing, must apply additional due diligence measures in addition to the obligations pursuant to Article 40 paras. 1, 2, 2a and 2e on a risk-sensitive basis. The existence of suspicions of money laundering or terrorist financing is a case governed by Article 40b para. 1 BWG in which additional due diligence measures are required In the event of a suspicion or reasonable grounds for suspicion, the supervised company must inform the Financial Intelligence Unit 51 of its suspicion in accordance with Article 41 para. 1 BWG. 51 The Financial Intelligence Unit referred to here and below is the authority as defined in Article 41 para. 1 BWG. For further details on contacting the Financial Intelligence Unit and on the form and content of a suspicious transaction report, refer to the FMA Circular on Suspicious Transaction Reports, as last amended. 38

39 7.4. Deposits into or withdrawals from savings accounts that exceed the limit amount (Article 40 para. 1 no. 4 BWG) 144. Upon each deposit into and withdrawal from a savings account, the identity of the holder of the savings account and where applicable the identity of the authorised representative carrying out the transaction must be ascertained if the amount deposited or withdrawn is at least 15,000 or an equivalent value (for further details in this regard see Chapter 8, paras. 152 and 153) Questions of doubt regarding the identity data obtained (Article 40 para. 1 no. 5 BWG) 145. If an employee of the supervised company has doubts as to the authenticity and adequacy of previously obtained identity data, a new or additional identification of the persons in question must be carried out with regard to these areas of doubt (customer, authorised representative, trustor or beneficial owner) Where there are doubts as to the authenticity of the identity documents, further documents, data and information should be requested from a credible and independent source and used to verify the identity If the doubts are not eliminated as a result of the new or additional identification, further appropriate due diligence measures are to be taken pursuant to Article 40b para. 1 BWG and upon the suspicion or reasonable grounds for suspicion that a business relationship or transaction is being used for the purposes of money laundering or terrorist financing or that the customer belongs to a terrorist organisation the reporting requirement set out under Article 41 para. 1 BWG must be fulfilled. If the supervised company is not in a position to fulfil its identification obligations, the consequences as detailed in Article 40 para. 2d BWG must be taken. 39

40 7.6. Consequences in cases where identification is impossible 148. In the event that the supervised company is not in a position to meet the identification obligations defined in Article 40 paras. 1, 2 and 2a BWG, provision is made in Article 40 para. 2d BWG to the effect that no business relationship may be established respectively the requested transaction may not be carried out. Any existing business relationship is similarly to be terminated. Moreover, if the discussions held or the identification process leads to the suspicion or reasonable grounds for suspicion that a business relationship or transaction is designed to serve the purposes of money laundering or terrorist financing or that the customer belongs to a terrorist organisation, a suspicious transaction report must be made to the Financial Intelligence Unit. 8. Identification obligations in individual banking transactions 8.1. Savings account transactions 149. Savings deposits, pursuant to Article 31 para. 1 BWG, refer to funds which are deposited with supervised companies and are not intended for payment transactions, but for investment, and as such can only be accepted against the delivery of certain documents (savings documents) Savings account transactions are always to be classed as a permanent business relationship. Correspondingly, the opening of a savings account is subject to the identification obligation stipulated by Article 40 para. 1 no. 1 BWG Savings documents may be: issued in the name of the identified customer; or issued with a certain designation. The use of names other than the name of the identified customer is, however, not permitted. Savings deposits which amount to less than 15,000 or an equivalent value and which are 40

41 not registered in the name of the identified customer must be subject to the restriction that the customer may only access the savings deposit upon provision of a password defined by the identified customer Withdrawals from a savings account: may only be made if the customer (holder of the savings account or person authorised to dispose of the account) has previously been identified (Article 40 paras. 6 and 7 BWG). may, in accordance with Article 32 para. 2 BWG, i.e. following presentation of the savings document and, pursuant to Article 32 para. 4 BWG, only be made in accordance with the following conditions 52 to the following people: in the case of savings deposits which amount to less than 15,000 or an equivalent value and which are not registered in the name of the identified customer, to the submitter of the savings document who is identified pursuant to Article 40 para. 1 BWG and who can provide the password; in the case of savings deposits whose balance has reached or exceeded 15,000 or an equivalent value since the last presentation of the savings document exclusively as a result of interest credits and which are not registered in the name of the identified customer, exclusively at the first presentation of the savings document after the limit is reached or exceeded, to the submitter of the savings document who is identified pursuant to Article 40 para. 1 BWG and who can provide the password; in the case of savings deposits which amount to at least 15,000 or an equivalent value, only to the identified customer or to that customer s authorised representative who must provide proof of identity and have been identified; 52 It is possible to deviate from these conditions on an exceptional basis in the following cases: - The party entitled to the savings account is not in a position to quote the password but can prove authorisation to draw on the savings deposit. - The savings were acquired in the context of a testamentary disposition. - The savings certificate is submitted as part of a court or administrative enforcement procedure. 41

42 in the case of deposits which are registered in the name of the identified customer, only to the identified customer or to that customer s authorised representative who must provide proof of identity and have been identified. may only be made in the amount of at least 15,000 or an equivalent value pursuant to Article 40 para. 1 no. 4 BWG if the identity of the holder of the savings account or, where applicable, the identity of the authorised representative carrying out the transaction has been ascertained. This applies irrespective of whether the party concerned was identified prior to the permanent business relationship being established. may only be made provided if the savings document has not been reported lost, withdrawal has not been officially prohibited and the accounts have not been frozen (Article 31 para. 4 BWG). must be recorded on the savings document (Article 32 para. 1 BWG). all withdrawals in the amount of at least 15,000 or an equivalent value pursuant to Article 41 para. 1a BWG, to the extent that the holder of the savings account has not yet been identified, must be reported to the Financial Intelligence Unit without delay. If this unit does not order any longer period, the payment may then be made seven calendar days after the date of the request Deposits into a savings account: may only be accepted if the customer (holder of the savings account or person authorised to dispose of the account) has previously been identified (Article 40 paras. 6 and 7 BWG). It is permissible for the bank to credit the account internally with interest. may also be accepted in cases where the savings document is not presented simultaneously. In this case such deposits are to be recorded in the savings document upon the next presentation of the savings document (Article 32 para. 2 BWG). must be recorded on the savings document (Article 32 para. 1 BWG). 42

43 may only be made in the amount of at least 15,000 or an equivalent value, or in a higher amount, pursuant to Article 40 para. 1 no. 4 BWG if the identity of the holder of the savings account or, where applicable, the identity of the authorised representative carrying out the transaction has been ascertained. This applies irrespective of whether the party concerned was identified prior to the permanent business relationship being established Savings deposits must not be accessed by means of funds transfers 53 or by means of cheque. Funds transfers to a savings deposit are permissible provided that the customer (holder of the savings account or person authorised to dispose of the savings account) has previously been identified (Article 40 paras. 6 and 7 BWG) After 30 June 2002, term commitments may only be agreed upon in cases where the customer s identity has been ascertained in advance (Article 32 para. 8 BWG) Savings accounts for which the customer s identity has not been ascertained must be maintained as specially labelled accounts (Article 40 para. 7 BWG) Securities transactions 157. The opening of a securities account in accordance with Article 11 of the Depotgesetz (DepotG; Depository Act) and the establishment of a business relationship in accordance with Article 12 of the same Act represents the establishing of a permanent business relationship. Correspondingly, these cases are subject to the identification obligation stipulated by Article 40 para. 1 no. 1 BWG With regard to a securities account pursuant to Article 11 DepotG opened prior to 1 August 1996 or a business relationship pursuant to Article 12 DepotG established before 1 August 1996, and with regard to which the identification obligation imposed by Article 40 para. 1 no. 1 BWG has therefore not been fulfilled to date, the following types of transaction are prohibited until such time as the identification obligation pursuant to Article 40 para. 1 no. 1 BWG has been met: The acceptance of securities is not permitted. 53 For exceptions to this principle, see Article 32 para. 3 BWG. 43

44 The acquisition of securities is not permitted. The sale of securities is not permitted. The withdrawal of balances is not permitted. The withdrawal of income is not permitted. Transactions involving accounts for settling securities are not permitted Non-face to face transactions 159. Article 40b para. 1 no. 1 BWG permits the carrying out of non-face to face transactions by allowing the identity of the customer and any authorised natural representatives of the customer pursuant to Article 40 para. 1 BWG to be established without them being physically present and without the submission in person of an official photo identification document. Those with legal capacity may not be represented upon the conclusion of a non-face to face transaction To take account of the higher risk of money laundering and terrorist financing associated with this type of identification, Article 40b para. 1 no. 1 BWG provides for further measures in relation to non-face to face transactions alongside the additional measures 54 that must always be implemented in areas covered by enhanced customer due diligence obligations. Specially, there are three possible types of identification in this case: Option 1 ( electronic signature ): The customer must issue a contractual declaration using a secure electronic signature in accordance with Article 2 no. 3a of the Signaturgesetz (SigG; Signature Act). 54 For details, refer to the FMA Circular on the risk-sensitive approach, as last amended. 44

45 If the customer is a natural person, the supervised company must know the name, date of birth and address of that customer prior to concluding any non-face to face transactions. If the customer is a legal person, the supervised company must know the name and place of incorporation of that entity prior to concluding any non-face to face transactions. The place of incorporation must also be the seat of the undertaking s central administration. A written declaration must have been submitted by the customer prior to the conclusion of the non-face to face transaction confirming that the place of incorporation is also the seat of the central administration, and this declaration should be signed by the customer. If the customer s place of incorporation or place of residence is in a third country, the supervised company must be in receipt of written confirmation from a credit institution prior to the conclusion of the non-face to face transaction to the effect that: the customer maintains a permanent business relationship with the credit institution providing the confirmation; and the customer has been identified by this credit institution in accordance with Article 40 paras 1, 2, 2a nos. 1 and 2 BWG and/or as defined in Article 8(1)(a) to (c) of the Third Money Laundering Directive. Instead of identification and confirmation from a credit institution, identification and confirmation from the Austrian representation in the third country concerned or a recognised certification authority 55 is a further option. If the place of incorporation of the credit institution issuing the confirmation is in a third country, the third country must impose requirements which are equivalent to those indicated in Articles 16 to 18 of the Third Money Laundering Directive On recognised certification authorities, refer to Chapter III.C, para. 43. See also para

46 Option 2 ( registered post ): The supervised company must deliver its contractual declaration in writing by registered post (in practice, the Ident.Brief-Verfahren procedure introduced in Austria would as a general rule meet the requirements set out under Article 40b para. 1 no. 1 lit a BWG) to that customer address notified to it as the customer s place of residence or place of incorporation. If the customer is a natural person, the supervised company must know the name, date of birth and address of that customer prior to concluding any non-face to face transactions. 57 If the customer is a legal person, the supervised company must know the name and place of incorporation of that entity prior to concluding any non-face to face transactions. The place of incorporation must also be the seat of the undertaking s central administration. A written declaration must have been submitted by the customer prior to the conclusion of the non-face to face transaction confirming that the place of incorporation is also the seat of the central administration, and this declaration must be signed by the customer. If the customer is a natural person, prior to concluding the non-face to face transaction the supervised company must have been submitted a copy of the customer s official photo identification document; in the event that the customer does not have legal capacity, it is sufficient for a copy of the authorised representative s official photo identification document to be submitted. A copy of the customer s photo identification document is not necessarily required. If the customer is a legal person, the supervised company must have been submitted a copy of the official photo identification document of the authorised representatives. If the customer s place of incorporation or place of residence is in a third country, the supervised company must be in receipt of written confirmation from a credit institution prior to the conclusion of the non-face to face transaction to the effect that: 57 This means that the credit or financial institution must generally obtain such information prior to issuing its legal declaration. 46

47 the customer maintains a permanent business relationship with the credit institution providing the confirmation; and the customer has been identified by this credit institution in accordance with Article 40 paras 1, 2, 2a nos. 1 and 2 BWG and/or as defined in Article 8(1)(a) to (c) of the Third Money Laundering Directive. Instead of identification and confirmation from a credit institution, identification and confirmation from the Austrian representation in the third country concerned or a recognised certification authority 58 is a further option. If the place of incorporation of the credit institution issuing the confirmation is in a third country, the third country must impose requirements which are equivalent to those indicated in Articles 16 to 18 of the Third Money Laundering Directive. 59 Option 3 ( account ): The first payment to the supervised company in conjunction with the non-face to face transaction is carried out through an account, prior to the opening of which the customer has been identified in accordance with Article 40 paras. 1, 2, 2a nos. 1 and 2 BWG and/or as defined in Article 8(1)(a) to (c) of the Third Money Laundering Directive. If the customer is a natural person, the supervised company must know the name, date of birth and address of that customer prior to concluding any non-face to face transactions. If the customer is a legal person, the supervised company must know the name and place of incorporation of that entity prior to concluding any non-face to face transactions. The place of incorporation must also be the seat of the undertaking s central administration. If the customer is a natural person, the supervised company, prior to concluding the non-face to face transaction, must have been submitted copies of the customer s On recognised certification authorities, refer to Chapter III.C, para. 43. See also para

48 documents and - in the event that the customer does not have legal capacity copies of the documents of the authorised representative on the basis of which the identity of the customer and the authorised person can be verified in a credible manner. If the customer is a legal person, the supervised company must, prior to the non-face to face transaction being concluded, have been submitted copies of the customer s documents and copies of the documents of the authorised representatives on the basis of which the identity of the customer and the authorised person can be verified in a credible manner. Instead of these copies, the supervised company may also request a written declaration from the credit institution through which the first payment to the supervised company in conjunction with the non-face to face transaction is to be carried out, to the effect that the customer and where necessary the customer s authorised representatives have been identified in accordance with Article 40 paras. 1, 2, 2a and 2e BWG and/or as defined in Article 8(1)(a) to (c) of the Third Money Laundering Directive In each of these three cases it must be guaranteed that: non-face to face transactions cannot be processed on a trust basis; that persons with legal capacity act personally and do not allow themselves to be represented; 60 that there is no suspicion or reasonable grounds for suspicion that the customer belongs to a terrorist organisation, or that the customer objectively participates in transactions which serve the purpose of money laundering or terrorist financing; that the customer does not have his place of residence in a non-cooperative country, as in such cases the conclusion of a non-face to face transaction would not be permitted. 60 Contractual representatives of sole proprietorships are exempted if the non-face to face transaction is conducted within the framework of the company s operations. 48

49 8.4. School savings schemes 162. With regard to the identification of minor students in the context of school savings schemes, the requirements are relaxed as follows in accordance with Article 40a para. 2 no. 2 BWG: the involvement of the legal representative in the identification of the students is not required; only the names, dates of birth and addresses of the children need to be obtained; and the quality of the identity documents may be lower Specially, there are the following options depending on the form of school savings scheme for identifying students: In the case of savings passbook accounts opened for individual students, the students can be identified either: by the students themselves in the presence of a teacher; or by a teacher on a trust basis. In both cases, the identity data of the students (name, date of birth and address) can be ascertained on the basis of their student identification cards, copies of these identification cards or a list drawn up by a teacher containing the names, dates of birth and addresses of the students concerned. In the case of collective savings passbooks for school classes, the students can be identified by a teacher, acting as trustee, using a list drawn up by the teacher containing the names, dates of birth and addresses of the students concerned Severance and retirement fund transactions 164. Article 27 para. 4 and Article 27a para. 7 of the Betriebliches Mitarbeiter- und Selbständigenvorsorgegesetz (BMSVG; Company Employee and Self-Employment Provisions Act) set out by way of derogation from Article 40 para. 1 BWG simplified 49

50 identification regulations for the beneficiaries (entitled) of corporate provision funds and/or employers allocated to such a fund pursuant to Article 27a para. 5 BMSVG On this basis, beneficiaries (entitled) may also be identified on the basis of the master data provided by the Main Association of Austrian Social Security Institutions to the corporate provision fund (this data comprises social insurance number, name, address, date of birth and gender). The identity of the employer who is assigned to a corporate provision fund pursuant to Article 27a para. 5 BMSVG should be determined, by way of derogation from Article 40 para. 1 BWG, using the master data reported by the Main Association of Austrian Social Security Institutions to the corporate provision fund with regard to the employer (Article 27 para. 4 BMSVG) The obtaining of this master data replaces the identification and verification processes otherwise used to obtain necessary and additional information on identity with regard to the beneficiaries (entitled) of a corporate provision fund and/or employers in the allocation process, in accordance with Article 40 para. 1 BWG In those cases in which the beneficiary (entitled) enters into a direct business relationship with the corporate provision fund, the simplified identification regulations are not applied. 9. Updates of information 168. In accordance with Article 40 para. 2e BWG, supervised companies must apply the identification obligations as set out in Federal Law Gazette I No. 108/2007, which entered into force on 1 January 2008, not only to all new customers, but also to existing customers on a risk-sensitive basis at the appropriate times New customers are those customers with whom a permanent business relationship was established or a bank transaction concluded after 31 December Existing customers are those customers with whom a permanent business relationship had been established prior to 1 January The obligation to apply identification obligations as stipulated in Federal Law Gazette I No. 108/2007 not only applies to customers but also to authorised representatives, 50

51 trustors and beneficial owners. The word customer respectively customers is therefore to be understood in a broad sense Identity data and documents should be continuously updated in a risk-sensitive manner. The priority should lie on updating the identity data of those customers who, on the basis of the risk analysis conducted by the supervised company, are to be classed as customers associated with an increased risk of money laundering or terrorist financing. Explicit reference is made to the fact that this obligation has already been in place since 1 January Irrespective of the obligation to update as defined in Article 40 para. 2e BWG and based on the current legal basis of identification obligations at the time, identity data and documents are to be kept up to date in accordance with Article 40 para. 2a no. 3 BWG at all times Where possible, every opportunity should be used to initiate contact with the person to be identified in order to meet the obligation to update identity data and documents. 10. Obligation to keep records 174. Supervised companies must keep adequate documentation of meeting all customer due diligence obligations in the combating of money laundering and terrorist financing. For this purpose, they are obliged under Article 40 para. 3 BWG to retain the following documents in particular: documents used to fulfil identification obligations in accordance with Article 40 paras. 1, 2, 2a and 2e BWG, for at least five years after the termination of the business relationship with the customer; and documentation and records of all transactions for a period of at least five years after their execution. The above periods may, however, be extended to up to fifteen years by means of an FMA regulation in cases where such a measure appears necessary in order to combat money laundering or terrorist financing. 51

52 175. The storing of physical or digital copies of identification cards has proved its worth in practice The record-keeping method must be such that immediate access to identity data and documents is guaranteed. A supervised company must be able to respond fully and rapidly to statutory enquiries from the FMA, OeNB and responsible authorities and courts, detailing the following: whether they maintain or have maintained during the previous five years a business relationship with a specified natural person or legal person; what nature of business relationship it is or was; which transactions have been executed through this business relationship over the past five years; which individual transactions exceeding the limit amount have been carried out during the past five years In the event that several accounts have been set up for a customer within the framework of a business relationship, it should be possible to cross-reference: the customer s accounts; the accounts with the customer s identity data and documents; the accounts with the identity data and documents of any authorised representatives of the customer; and the accounts with the beneficial trustor or owner resulting from the business relationship/transaction A supervised company should therefore also be able to respond rapidly upon request with regard to: Refer to Chapter III.C, para. 36. Reference is made to the special record-keeping obligations pursuant to Regulation (EC) No. 1781/2006 and to the relevant FMA Circular in this regard, as last amended. 52

53 whether and for which accounts, if any, a natural person is an authorised representative; whether and which transactions, if any, a person has implemented on someone else s behalf; whether and from which transactions or business relationships, if any, a person has gained economic entitlement as trustor or beneficial owner Generally, identity data must be stored electronically, and the identity, account and transaction data must be electronically linked. The identity documents serving to prove the identity data may, however, also only be held as hard copies For supervised companies with a manageable number of customers storing hard copies or having manual cross-references in place is regarded as a sufficient means to meet the statutory requirements, provided that such a system guarantees that the company in question can respond rapidly to enquiries from the authorities When identity, account and transaction data is recorded using IT systems it has to be ensured that records are kept in a format that is easy to retrieve, read and restore. 53