The Association of Registered Agents and the National Public Records Research Association

Transcription

1 The Association of Registered Agents and the National Public Records Research Association Best Practices Recommendations to Prevent the Exploitation of the Company Formation Agent Industry for Criminal Activities The Association of Registered Agents ( ARA ) and the National Public Records Research Association ( NPRRA ) have jointly developed these Best Practices Recommendations to minimize, to the best of our abilities, the use of our products and services to facilitate money laundering, tax evasion or the financing of terrorist or other illegal activities. BACKGROUND The United States commercial engine depends upon the use of business entities that afford entrepreneurs and ongoing owners the comfort of limited risk and liability. The advantages of limited liability organizations has been time-tested and sophisticated legitimate parties routinely use multiple business entities created under State laws. The various State laws provide for the timely and efficient formation of legal entities, such as corporations, limited liability companies, limited partnerships and other business entities. This facilitates transactions and the timely formation of new companies to take advantage of emerging business opportunities. Over one million new business entities are formed nationwide each year, and there are over twenty million active U.S. business entities. While almost all business entities are created to further a lawful purpose, some are not. The Congress of the United States; law enforcement; the intelligence community; and international organizations, such as the Financial Action Task Force, have each identified the potential for the abuse of legal entities to facilitate: (i) (ii) (iii) (iv) money laundering, terrorist financing, tax evasion; and, violation of U.S. economic sanctions laws. The members of ARA and NPRRA form a significant sector of the Company Formation Agent Industry in the United States. We facilitate commerce by assisting lawyers, individuals, and businesses in forming legal entities for legitimate purposes. The members of ARA and NPRRA believe that the development and implementation of risk-based due diligence programs pursuant to a set of industry adopted best practices ( Best Practices Recommendations ) will provide the guidance needed to:

2 (i) (ii) (iii) (iv) exercise sound business judgment with respect to engaging in business with various individuals and entities, provide a framework for monitoring ongoing relationships with our customers, insure compliance with applicable federal and state laws governing the conduct of business with sanctioned individuals, entities and jurisdictions, and serve as responsible citizens in the effort to prevent criminal and terrorist activity. To achieve this goal, each ARA and NPRRA member adopting these Best Practices Recommendations will first identify the level of money laundering and terrorist financing risk they face, based upon an analysis of their specific products and services, sources of clients, and the geographies in which they operate. Based upon their analysis during the risk assessment phase, each member will develop appropriate internal controls, such as policies, plans, and procedures to manage these risks. The result of this process will be a risk-based compliance program. These Best Practices Recommendations set forth a series of steps each ARA and NPRRA member should take. Therefore, each party should recognize that fulfilling these best practices is an ongoing process The ARA and NPRRA acknowledge that each company provides a different mix of products and services, targets different sources for their customers and operates in different geographic markets. Each ARA and NPRRA member is free to implement these Best Practices Recommendations based upon its specific circumstances. To the extent that there is any conflict between these Best Practice Recommendations and any laws or regulations applicable to a member, applicable law or regulation will govern. BEST PRACTICES RECOMMENDATIONS Recommendation One Each ARA and NPRRA member should conduct periodic assessments to determine the degree of risk of conducting business or facilitating transactions with individuals or entities who would use U.S. business entities to conduct criminal activities and individuals and entities that are the target of U.S. economic sanctions laws. Each risk assessment should analyze risk from the perspective of the products and services offered; the nature and characteristics of the company's customers, the channels through which customers are referred, and the geographic areas the company serves. Each ARA and NPRRA member should base the frequency of these assessments on the nature of the risk discovered in previous assessments

3 Each ARA and NPRRA member should address the following special topics during the risk assessment phase, even if only to verify and document that the topic does not apply to their business. Customer Identification Program ( CIP ) o Assess the Company s CIP Office of Foreign Asset Control Supervised Programs prevent transactions with individuals, entities and jurisdictions that are the target of U.S. economic sanctions programs. E-Commerce Services and other technologies favoring anonymity identify the client who uses a technological interface to transact business. Trust and Asset Management Services identify any client who deposits money or other property with the company. The assessment should take into consideration factors such as whether the provision of such services is subject to federal or state antimoney laundering program requirements and whether the company is subject to examination for compliance with such requirements. Records Retention Policies o Assess the adequacy of the company s records retention policies that safeguard information for a reasonable period of time Corporate Staffing Services manage the risks associated with providing Corporate Staffing Services. Recommendation Two Based upon the analysis conducted during the risk assessment phase, each ARA and NPRRA member should develop written policies, plans and procedures to mitigate identified risks. These policies, plans and procedures should address the specific actions each company will take to mitigate identified risks and to set in place the necessary customer due diligence, customer identification, employee training and records retention programs related to these best practices. Recommendation Three Each ARA and NPRRA member should implement a training program to educate employees as to their role in the fight against money laundering, tax evasion, the financing of terrorist activities, and in the enforcement of United States Economic Sanctions Programs. Employers should teach their employees their company s policies and procedures to report suspicious activities, and the identity of the person within their company designated to receive such reports. Employers should also encourage their Employees to report suspicious activity to the proper person. Recommendation Four

4 Each ARA and NPRRA member should implement a customer identification program and any required due diligence to support that program. The application of the customer identification program should be in proportion to the level of risk associated with a particular product, service, customer or transaction. Recommendation Five Each ARA and NPRRA member should implement procedures to screen the names of customers against the Specially Designated Nationals List ( SDN List ). Recommendation Six Each ARA and NPRRA member should retain written records documenting: The findings of each risk assessment completed during each periodic risk assessment phase Policies, plans and procedures adopted to mitigate risks identified during the risk assessment phase Training materials produced, and training conducted in furtherance of polices, plans and procedures to mitigate risks. Recommendation Seven Each ARA and NPRRA member should identify, in writing, a person or persons, responsible for managing the company s programs to implement these Best Practices Recommendations. This person should hold sufficient seniority within the company s management structure to be able to carry out the policies. Recommendation Eight Each ARA and NPRRA member (or other industry participant) should review and formally approve and accept these Best Practices Recommendations pursuant to its own executive management decision making process and should document their adoption and acceptance as part of the company s records.

5 EXHIBIT A: Factors for Possible Consideration when adopting ARA/NPRRA Best Practice Recommendations: The following examples are set forth for consideration and reference purposes only. They are not in any way intended to establish minimum requirements, or otherwise, for any member adopting these Best Practice Recommendations. They are not intended to establish any standard, methodology or approach in the establishment or implementation of these Best Practice recommendations. They are set forth here solely as illustrative of factors that any member may wish to consider and are neither mandatory, all-inclusive, nor limiting in their scope or application. As noted above, the circumstances of each member s business are unique to that member and its individual risk assessment program should be constructed based upon an assessment of those specific circumstances. Factors to consider when adopting the above Best Practice Recommendations may, but need not, include any of the following: Recommendation One Example: Establishing the frequency of risk assessment - consider the nature of the service, the relative risk for abuse, source of the clients, the relationship with the clients (one time or ongoing service), and empirical factors determined in any prior risk assessment. Example: Scope of Services Offered consider risk associated with individual services such as, company formation. Example: Nature, nationality and source of customers consider whether customers are local, domestic, or international etc. and consider source of contact with the customer, (e.g. internet, referral, law firm, nationally recognized business, etc.) and the associated potential for abuse. Recommendation Three Example: Training Program consider who in the organization to train, the scope of training, level of training materials, method of training (e.g. internet, self-training and testing, group training etc.) Recommendation Four Example: Customer identification program consider nature or source of the customer such as nationality of individuals or businesses, prior knowledge of customers, direct contact, referral, through an intermediary etc. Determine the amount of customer information necessary to adequately identify the customer.

6 Example: Customer due diligence consider, based upon risk, the appropriate level of due diligence required (e.g. screening against sanctions lists, documentary or nondocumentary research) Recommendation Five Example: SDN List Screening consider Office of Foreign Asset Control Regulations for the Corporate Registration Industry, dated October 15, 2004, discussing Code of Federal Regulations (CFR) Title 31, Money and Finance: Treasury, Subtitle B Regulations relating to Money and Finance, Chapter V Office of Foreign Assets Control, Department of the Treasury. Recommendation Seven Example: Establish person(s) responsible for program consider the scope and size of the organization and the level of expertise and authority needed to ensure that the individual named has sufficient authority to carry out the program.