GENERAL INSTRUCTIONS FOR OBLIGED ENTITIES REGARDING THE PREVENTION OF MONEY LAUNDERING AND TERRORIST FINANCING

Transcription

1 1 (8) Basic Public Services, Legal Rights and Permits Supervision of trades GENERAL INSTRUCTIONS FOR OBLIGED ENTITIES REGARDING THE PREVENTION OF MONEY LAUNDERING AND TERRORIST FINANCING Money laundering and terrorist financing The Finnish Act on Detecting and Preventing Money Laundering and Terrorist Financing (18 July 2008/503) (hereinafter the Act on Money Laundering) decrees measures to prevent money laundering and terrorist financing, to advance the discovery and investigation of such acts, and to enhance the tracking and recovery of the proceeds of crime. Money laundering refers to acts intended to erase or cover the source of property obtained through criminal activities. When investigating money laundering, the main interest of the authorities lies in the source of the property. Funds obtained by crime can originate from any type of crime. In Finland, most of the laundered money comes from white-collar crimes or narcotic-related crimes. Property obtained by crime, the benefit produced by a crime, or property replacing them can be the target of money laundering. Money laundering is typically carried out by changing the form of the illegal property, e.g. from cash to jewelry. After successful money laundering, the property appears as if it was obtained legally. One may be guilty of money laundering when accepting, using, modifying, handing over, transmitting, conveying, or retaining property obtained by crime with the intention of procuring benefit for oneself or someone else or of covering and erasing its criminal origins. Terrorist financing refers to, for instance, operations where funds are given or collected in order to carry out acts of terrorism. When investigating terrorist financing, the main interest of the authorities lies in the intended use of the property. However, funds used for terrorism may come from legal sources. A person, who directly or indirectly gives or collects funds with the intention or knowledge of an intention to use them to fund acts of terrorism as defined in the law, is guilty of terrorist financing. Money laundering and terrorist financing are being prevented by actively intervening with the proceeds of crime and the funding channels. Disclosure obligation and obligation to register The Act on Money Laundering decrees a disclosure obligation for the entrepreneurs who, within their normal operations, have the chance to detect money laundering and terrorist financing and who can be estimated to be exploited for these purposes. The entrepreneurs are referred to as obliged entities. All entities within the jurisdiction of section 2 of the Act on Money Laundering are considered obliged entities. These entities are in a key position in the prevention and investigation of money laundering and the funding of terrorism as they provide the authorities with the best chances of receiving information on suspicious business transactions. The Regional State Administrative Agency of Southern Finland maintains registers decreed in the Act on Money Laundering regarding operators who exercise currency exchange or provide trust and company services. Before

2 2 (8) Right to inspect of supervisory authorities Risk-based approach Knowing your customer beginning their operations, those exercising currency exchange or providing trust and company services must register to the Regional State Administrative Agency. Operating without registering is a punishable act. Changes to the information in the register must also be immediately reported to the Regional State Administrative Agency. The obligation to register does not apply to activities that are carried out on an occasional or very limited basis. The Act on Money Laundering gives the officials of the Regional State Administrative Agency the right to inspect in the office and storage facilities of obliged entities in order to supervise the compliance of the Act on Money Laundering and its regulations. The official carrying out an inspection is entitled to inspect the obliged entity s accounts, data processing recordings, and other documents relevant to the inspection. As a controlling authority, the Regional State Administrative Agency is also obligated to report any detected defects to the money laundering investigation centre. The risk-based approach required in the Act on Money Laundering means that a person under disclosure obligation will adopt risk management processes to prevent money laundering and terrorist financing. Risk-based evaluation refers to an evaluation carried by the obliged entity concerning the risks of money laundering and terrorist financing related to their own operations. Its purpose is to investigate company-specifically the types of cases where it is necessary to more thoroughly know both the customer and the actual beneficiary for whose benefit the transaction is carried out (e.g. the authoriser of the commission) or who has the authority in the company or the organisation of the communal customer. The obliged entity must have sufficient methods within the scope of their operations to know their customers and to monitor the customer relationships. The management of a money laundering risk may become a natural part of the general risk management and internal surveillance of the person under disclosure obligation. A risk-based approach also enables an efficient direction of the resources of an obliged entity that are related to the prevention of money laundering and the funding of terrorism in relation to the existing risk. An obliged entity must identify and evaluate the risks of money laundering and terrorist financing related to their line of industry, products, services, the development of technology as well as their customers and the business operations and actions of their customers. Knowing your customer, i.e. customer due diligence, is a key obligation in the Act on Money Laundering. Knowing your customer refers to the methods with which an obliged entity ensures the correct identity of a customer and that the obliged entity is as familiar with the customer's operations and background as required by the customer relationship. The obligation to know the customer is valid throughout the customer relationship. According the section 7 of the Act on Money Laundering, an obliged entity must know their customer and verify their identity:

3 3 (8) when establishing regular customer relationships when the sum of a transaction amounts to EUR 15,000 or more, whether the transaction is carried out in a single operation or in several operations which are linked to each other, and the customer relationship is of irregular nature that the assets involved in a transaction are used for terrorist financing or a punishable attempt to finance terrorism, or if they have doubts about the reliability or adequacy of previously obtained verification data on the identity of the customer Customer due diligence includes the identification of the customer and a potential representative as well as verifying their identity and identifying the actual beneficiary. The actual beneficiary refers to a natural person for whose benefit the business transaction is carried out or, if the customer is a legal person, the natural person under whose authority the customer is. Authority requires more than 25 per cent of the number of votes produced by shares or stocks. In addition, customer due diligence includes obtaining information on the purpose and quality of the business relationship as well as a constant monitoring of the business relationship. All the mentioned areas of customer due diligence must be implemented, but the extent of the measures depends on the type of risk of money laundering and terrorist financing related to the customer, product, service, and business transaction. Identification can be carried out with these documents when the customer is a natural person: One of the following, granted by Finnish authorities driving licence identity card issued by police authorities passport alien's passport or a refugee's travel document, or a KELA card with a picture If there is no document granted by Finnish authorities, one of the following will be valid for identification national foreign passport, or other identification accepted as a travel document In the question of a legal person, an extract from the trade register or other extract from a public register can be used as a verification document. In addition, a natural person acting on behalf of the legal person must be identified and their identification must be verified. It is also necessary to verify that they have the right to represent the legal person. If the obliged entity fails to implement the aforementioned measures required to identify a customer, the obliged entity will not be allowed to initiate a customer relationship or a business transaction. In addition, the obliged entity must report to the money laundering investigation centre under the Central Criminal Police if there is reason to suspect the possibility of money laundering. Records shall be kept of customer due diligence data in a secure manner for a period of five years (some exceptions may apply) following the end of regular customer relationships. The information regarding customer due diligence must only be obtained and stored in the extent necessary for evaluating the risk of money laundering and the funding of terrorism.

4 4 (8) Simplified customer due diligence The risk of money laundering and terrorist financing is not equally large in all cases. Simplified customer due diligence is allowed in, for instance, situations where the customer, product, service or business transaction is deemed to entail a low risk of terrorist financing and money laundering, or where the information concerning the identity of a customer or a beneficiary are publicly available, or where a sufficient inspection can be carried out within the scope of other systems. Even with simplified customer due diligence, the obliged entity must always know with whom they are in business, i.e. they must comply with the obligation to know their customer (sufficient levels of verifying the identity and investigating the operations and background of the customer). The customer relationship should also monitored so that any unusual business transactions can be detected in due time. The use of simplified customer due diligence requires that sufficient information be obtained of the customer, for instance concerning whether a communal customer has a licence and whether they are supervised by the authorities. Simplified customer due diligence does not require the obliged entity to comply with the measures decreed in the law on the identification of a customer and the verification of their identity (section 7), the identification of the actual beneficiary (section 8), the obligation to investigate (section 9, paragraph 1), and the storing of the identification information (section 10). In addition, specific situations where simplified customer due diligence can be applied are defined in the Act on Money Laundering. Sections 13 and 14 of the Act list the customer parties with whom the use of the simplified method is allowed. These include Finnish authorities and corresponding parties as well as companies whose stocks are in the public trade in an EEA country. Sections of the Act, in turn, decrees the simplified obligation to know a customer concerning certain products. Enhanced customer due diligence In certain cases, the Act on Money Laundering requires particularly precise methods in order to identify a customer and to verify their identity. Enhanced customer due diligence should be applied when: there is a larger than usual risk of money laundering or terrorist financing associated with the service, product, or business transaction, the customer or the business transaction has connections to a country whose prevention and investigation system regarding money laundering and terrorist financing does not meet the international requirements, a loro bank relationship is established, i.e. a credit institution, an investment service company, payment institution, trust company, manager of alternative funds, or an insurance company makes an agreement on the management of payments and other commissions with a credit institution located in a country outside the EEA, the customer is a Politically Exposed Person (PEP), or the customer uses non-face-to-face identification Enhanced customer due diligence obligation means that as the risk of money laundering or terrorist financing is greater than usual, the obliged entity should pay particular attention to the customer and their business transactions. The

5 5 (8) Non-face-to-face identification Obligation to obtain information obliged entity should ensure that the customer relationship is not connected with money laundering or terrorist financing. In the Act on Money Laundering, a politically exposed person refers to a person who is or has been (or whose family member or close business associate is or has been) in some point the head of some other country, the head of a government, a minister, a deputy or an assistant minister, a member of parliament; a member of the High Court, Federal Constitutional Court, or similar judicial body whose judgment cannot be appealed unless an exception is made; a member of a Court of Auditors and the highest deciding body corresponding to a supervisory authority of state economy inspecting the financial administration of a country, a member of Board in a central bank, an ambassador or a chargé d'affaires, an officer with the rank of at least a general, or a member of an administrative, management, or supervising body in a company entirely owned by the state. Non-face-to-face identification refers to all situations where the customer is not present in an identification and verification situation. If non-face-to-face identification is used, enhanced procedures should be used to identify the customer, e.g. paying particular attention to verifying the identity of the customer and extending the investigation of the background and purpose of the business transaction. The Act on Money Laundering requires that, when using non-face-to-face identification, the obliged entity must, in order to reduce the risk of money laundering and terrorist financing: verify the identity of the customer by obtaining additional documents or information from a reliable source; ensure that the payment related to the business transaction comes from a credit institution account or is paid to an account previously opened in the customer's name; or verify the identity of the customer with an identification method or a quality certificate referred to in the Act on Strong Electronic Identification and Electronic Signatures (617/2009) or with the help of other electronic identification technology which is secure and verifiable. Non-face-to-face identification can usually be carried out in a sufficiently reliable manner, but its use usually means that other requirements concerning knowing the customer are not sufficiently taken into account. This is why non-face-to-face identification is only recommended to be used in exceptional situations. On the basis of a general obligation to obtain information, the obliged entity should examine the use of the products or services in their own business operations and evaluate the risks of money laundering or terrorist financing associated with them. The obliged entity must have a clear idea of their customer's operations, the quality and extent of their business, and what the customer's grounds are for using the service of product provided by the obliged entity. Risk-based evaluation should be used when complying with the obligation to obtain information. In order to comply with the obligation to obtain information, the obliged entity must have sufficient methods for supervising the operations of the customer in order to detect any unusual operations. The surveillance should be proportioned

6 6 (8) Suspension a transaction Disclosure obligation to the quality and extent of the customer's operations and the related risks. For larger parties under disclosure obligation, constant monitoring requires information system-based monitoring. Special obligation to obtain information, i.e. due diligence, is related to the customer's business transactions that, for some reason, are unusual or exceptional. Special attention should be paid to the following business transactions: a) those with a structure or extent different from the usual b) those unusual due to the size of the party under disclosure obligation or the premises c) those with no apparent financial purpose, or d) those not compatible with the experience or information the obliged entity has of the customer In the aforementioned or similar, unusual situations, the obliged entity should request that the customer report the origin and intended use of the funds. In addition, the obliged entity can independently obtain related reports from, for instance, authoritative registers. On the basis of the reports, the obliged entity must evaluate whether the business transaction still appears suspicious. If a business transaction is suspicious or the obliged entity suspects that the funds related to the transaction are used to fund terrorism or to a punishable attempt to fund terrorism, the person under disclosure obligation has three alternatives: 1) to suspend the business transaction for additional investigations (special obligation to investigate) 2) to decline the business transaction 3) to carry out the business transaction if it cannot be discontinued or if discontinuing or declining would likely hinder the discovery of the actual beneficiary of the business transaction When selecting the proper alternative, it should be taken into account that the obliged entity should ensure that no funds included in the business transaction can be transferred out of the reach of authorities. A suspicious business transaction or a suspected terrorist financing must immediately be reported to the money laundering investigation centre. A report must always be filed if the business transaction remains suspicious despite additional investigations obtained on the basis of the obligation to investigate. The disclosure obligation is valid regardless of whether the business transaction has been discontinued, carried out, or declined. Enhanced disclosure obligation refers to situations where the customer has connections to a country whose prevention and investigation system regarding money laundering and terrorist financing does not meet the international requirements. In these situations, a report must always be filed if 1) the customer will not provide a report requested to fulfil the obligation to investigate; 2) the provided report is, according to the evaluation of the obliged entity, unreliable;

7 7 (8) Report on a suspicious business transaction 3) the grounds for the business transaction and the origin of the funds are not sufficiently explained on the basis of the reports obtained by the obliged entity; 4) a legal person cannot be identified; or 5) the actual beneficiaries or the person on whose behalf the customer is operating cannot be identified or reliably investigated. When filing a report, make sure to include the following information: 1) name of the person filing the report 2) natural persons taking part in the business transaction name Finnish social security number, if available nationality of a foreign person if they do not possess a Finnish social security number, and the number or other identification information from a passport or other travel document (also a copy of the passport or the travel document) 3) legal persons taking part in the business transaction full name of the legal person potential registration number, date of registration, and the registration authority members of the board of the legal person or a corresponding decision-making body those acting on behalf of the legal person or as authorised representatives 4) nature of the business transaction (e.g. real estate transaction, opening an account) 5) amount and currency of funds or other property included in the business transaction 6) origin or target of funds or other property 7) reason for which the business transaction is suspicious 8) whether the business transaction has been carried out, discontinued, or declined 9) whether the report has to do with a suspicion on the origin of the funds or terrorist financing 10) the personal views of the situation and the backgrounds given by the person filing the report Methods of reporting: 1) Electronic money laundering report through the reporting application intended for organisations on 2) ing the aforementioned information to rahanpesuilmoitukset@poliisi.fi 3) Mailing or faxing the aforementioned information to: Keskusrikospoliisi Rahanpesun selvittelykeskus Jokiniemenkuja 4, P.O. Box 285 FI Vantaa fax (0) On the basis of the obligation to investigate, the necessary information in order to fulfil the disclosure obligation must be stored for five years. This information

8 8 (8) Confidentiality obligation Training and protecting employees includes the information obtained by the obliged entity in order to investigate the background of the business transaction and on the basis of which they have filed a report to the money laundering investigation centre. The obliged entity must not reveal filing a report to the party suspected of money laundering or terrorist financing or any other person. The confidentiality obligation also includes those working for the obliged entity and those who have received confidential information on the basis of an emergency provision. The obliged entity must ensure that their employees receive proper training to ensure the compliance of the Act on Money Laundering and its regulations. In addition, the obliged entity must have instructions suited for their own operations on measures concerning knowing a customer as well as on the compliance of the investigation and reporting obligation related to the prevention of money laundering and terrorist financing. Each obliged entity must have a contact person in charge of preventing money laundering and terrorist financing. This person is responsible for filing money laundering reports on suspicious business transactions. The employer must implement appropriate and sufficient measures to protect the employers who file reports by, among other things, ensuring that their identity is not revealed to outsiders. More information on the prevention of money laundering and the funding of terrorism Branch-specific instructions for the prevention of money laundering and the funding of terrorism by the Regional State Administrative Agency of Southern Finland: If necessary, the money laundering investigation centre under the Central Criminal Police will provide advice for filing a report. Best policies for the prevention of money laundering (Rahanpesun torjunnan parhaat käytänteet) by the money laundering investigation centre: The Regional State Administrative Agency of Southern Finland publishes the bulletins of the international Financial Action Task Force (FATF) on their website: