DISCUSSION PAPER - CONSIDERATION OF POSSIBLE ENHANCEMENTS TO THE REQUIREMENTS FOR CUSTOMER DUE DILIGENCE

Transcription

1 Australian Finance Conference Level 8, 39 Martin Place, Sydney, GPO Box 1595, Sydney 2001 ABN Telephone: (02) Facsimile: (02) September 2013 Discussion Paper - Customer Due Diligence Reform International Policy Legal and Policy Branch AUSTRAC PO Box 5516 West Chatswood NSW 1515 By to CDD_Consultation@austrac.gov.au. Dear Sir/Madam, DISCUSSION PAPER - CONSIDERATION OF POSSIBLE ENHANCEMENTS TO THE REQUIREMENTS FOR CUSTOMER DUE DILIGENCE We refer to the Discussion Paper entitled Consideration of Possible Enhancements to the Requirements for Customer Due Diligence released by AUSTRAC and the Attorney- General s Department in May Attached to this letter are responses to the questions posed in the Discussion Paper and responses to the potential reforms identified in Table 1 in the Discussion Paper entitled Summary of Australia s Deficiencies and Associated Potential Reforms. By way of background, the Australian Finance Conference is a finance industry body comprising 60 plus member companies. Our affiliated bodies the Australian Equipment Lessors Association comprises around 80 members; and the Australia Fleet Lessors Association has 15 members. Members include finance companies, banks, specialist equipment and motor vehicle financiers, general financiers providing consumer, commercial (including small business) and wholesale credit facilities and credit bureaux. The Debtor and Invoice Finance Association of Australia and New Zealand (DIFA) represents 19 major providers of factoring and discounting services, also known as receivables finance. Membership lists for each of these bodies are attached. Financier members of the AFC, AELA, AFLA and DIFA are subject to customer identification requirements under the Commonwealth Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act). Overall, our members believe that the current AML/CTF regime in Australia is appropriate and workable for them and their customers. Any changes to the customer due diligence requirements should only be made as absolutely necessary to ensure that Australia continues to meet its obligations as a member of the Financial Action Task Force and if there is strong empirical evidence that Australian companies, trusts and other types of legal arrangements are being systematically used to launder money and finance terrorism. Any changes should be made in tandem with any amendments to the AML/CTF Act and to the AML/CTF Rules that arise out of the upcoming statutory review of their operation. As will be seen from the samples of member responses to the questions posed in the Discussion Paper, there are differences regarding the extent to which our members customer due diligence measures delve into issues of beneficial ownership and control, persons acting on behalf of others, settlors of trusts, PEPs and ongoing monitoring. This is appropriate under Incorporated in NSW as Australian Finance Conference Limited ACN

2 the risk-based approach and reflects the diverse nature of the financial services offered by our members and the type of customers they deal with. Despite these differences, there is a common desire to maintain the current framework under which the money laundering/terrorism financing risk and the systems and controls used to mitigate these risks are not just determined by the customer type, but also in the context of the type of product being offered, how it is delivered and any foreign jurisdictions dealt with, as reflected in Rule The Discussion Paper concentrates on the risks posed by particular types of customers (ie non-individuals) but the other elements of type of designated service, delivery methods and foreign jurisdictions should not be forgotten. Any changes to the current AML/CTF regime should not operate to the disadvantage of reporting entities that offer products that inherently present a low ML/TF risk, are only available in Australia to Australian entities and are made available by simple delivery methods. The fact that a customer is not an individual should not, of necessity, require the application of complex, expensive and timeconsuming customer due diligence and transaction monitoring systems beyond those already in place. There is some uncertainty among our members about the extent to which they can use government databases such as the ASIC company register as a reliable source for the collection and verification of information. There is also concern about the lack of an independent and reliable register of trading trusts containing the type of information that might need to be verified under the AML/CTF Rules. These issues are largely manageable under the current risk-based approach. If there are to be changes to the customer due diligence requirements, then the Government should consider how to make available additional sources of reliable and independent information to ensure that reporting entities can fulfil their customer due diligence obligations in a cost effective and efficient way. The responses to the questions posed under the heading Options to Minimise Regulatory Burden Associated with the Potential Reforms cover up-front exemptions; the possibility of establishment of a government-maintained trading trust register, the safe-harbour provisions, self-attestation and disclosure certificates. We would be happy to discuss these, and any other aspects of our submission, in further detail with AUSTRAC or the Attorney-General s Department. If you have any questions or would like to discuss our comments, please contact me or Catherine Shand on (02) or by to catherine@afc.asn.au. Kind regards, Yours sincerely, Ron Hardaker Executive Director

3 Responses of Members of the AFC, AELA, AFLA and DIFA to questions posed in the AUSTRAC/Attorney-General s Department Discussion Paper Consideration of Possible Enhancements to the Requirements for Customer Due Diligence September 2013 INTRODUCTION Set out below is a summary of the responses of members of the Australian Finance Conference, the Australian Equipment Lessors Association, the Australia Fleet Lessors Association and the Debtor and Invoice Finance Association of Australia and New Zealand to the questions posed in the Discussion Paper entitled Consideration of Possible Enhancements to the Requirements for Customer Due Diligence. Samples of individual member responses are also included. The variety of responses reflects the diverse nature of the financial services offered by members of these organisations and the type of customers they deal with. The responses focus on private companies and trusts, but many of the issues raised may apply to other legal persons such as partnerships, associations, co-operatives and government bodies. It is clear from the responses that there is some uncertainty about the extent to which information on ASIC databases can be relied on as a reliable and independent source for collection and verification of information about companies. In relation to the requirements for collection and verification of trustee and beneficiary information, the lack of an independent register of private trusts makes this difficult. The risk-based approach is applied in meeting these requirements. As noted below in the Response to 5 under Options to Minimise Regulatory Burden Associated with the Potential Reforms, a variety of verification sources are used, although not all of these may be truly independent and reliable. Ownership and control Deficiency 1: There is no requirement to take reasonable measures to understand the control structure of a customer that is a legal person or arrangement. 1. To what extent are reporting entities already assessing the concept of control as part of the beneficial ownership procedures and what information is being sourced from customers? For legal reasons under the anti-money laundering and counter-terrorism financing (AML/CTF) regime and for commercial/risk management reasons, control is looked at for commercial customers via trust deeds or other constituent documents. If necessary, further information is obtained from ASIC and credit bureau searches where possible. Sample of Member Responses: Steps are taken to understand the ownership/control structure of borrowers, whether a company, trust, partnership, joint venture or other body. Our customers are predominantly natural persons so this is not relevant. When the family tree corporate structure is assessed to determine ultimate beneficial owners, this may result in key related parties being added as co-borrowers or guarantors. ASX listed companies often have fund managers as shareholders, and those fund managers hold the shares beneficially for other investors. It is both difficult and impractical to discover who are the beneficial owners in those cases, so we become reliant on the substantial shareholder notices issued to the ASX. 1

4 We delve deeper into control on the basis of beneficial ownership for private companies being more than 25%.The names and address of the beneficial owners (individuals who directly or indirectly own more than 25% share in the company) are collected but may be accepted on face value without verification being required. For trusts, we collect either the full name of each beneficiary in respect of the trust or details of the class if the terms of the trust identify the beneficiaries by reference to membership of a class. Credit checks are performed to determine beneficial ownership and if a person is not a beneficial owner then additional information is sought to understand ownership structures. For trusts associated with a credit submission a copy of the fully executed trust deed is obtained prior to settlement to verify trustees, beneficial ownership and ability to borrow. Regard is had to ownership interests and other forms of effective control. However, the effective control arm of the definition is treated in a practical and non-prescriptive manner. 2. To what extent are reporting entities obtaining and verifying information on the powers that bind a customer? Information on powers is obtained from ASIC searches of companies, trust deeds, powers of attorney and other constituent documents. It is not possible to formally verify much of this information as it is contained in documents maintained by the customer and not on any formal register. For personal customers, if acting as a third party, Powers of Attorney are obtained the individual is identified and verified. Sample of Member Responses: Our customers are predominantly natural persons so this is not relevant. For wholesale dealer financing, due diligence is undertaken on entity structures including related entities and shareholdings. Verification is undertaken through ASIC and credit bureau searches where relevant. In the case of an ASIC registered organisation, it is possible to verify most information via a company search. Reviewing a company s memorandum and articles of association may not add anything to the ability to understand the corporation s organisation and management structure. Where a search is not possible (for example trusts, unincorporated associations) collecting these types of documents makes more sense, but there is uncertainty about the extent to which this information can and should be verified. It depends on the entity type - it is not part of our process for ASIC registered corporations, incorporated associations or Australian government entities. It is required for some entity types (e.g. trust structures, unincorporated associations, foreign companies, partnerships). A large percentage of automotive financing (except dealer wholesale facilities) is to simple entity structures. Most financiers obtain an ASIC and credit bureau search of the company and any guarantor whereby ownership structure and shareholding is largely visible. For sole traders and partnerships automotive financiers identify the individual person/s within the entity. The majority of private company applications are for mums and dads companies (excluding dealer wholesale facilities); a large percentage having two directors or less. AML/CTF customer identification procedures for individuals are applied to the directors. Additional procedures may be followed to avoid foreign lending, for example ensuring directors reside in Australia and the entity is Australian company. Financiers may have rules to ensure that foreign bank accounts are not debited to repay loans. 2

5 If a private company is a shareholder of a customer, financiers usually trace back to ensure that they do not compromise any foreign lending laws or to ensure that from a credit perspective the guarantee is appropriate. Trust entities are the exception given the lack of public information available. Financiers need to understand the beneficiaries and the trustee via trust deeds or financials. We take a risk based approach, for example to assess borrowing powers of trusts. A legal review of relevant documentation (for example trust deeds) is in place at specified thresholds. We ask in some cases for approval from the account owner to allow a person to have third party access. Deficiency 2: There is no comprehensive requirement to identify and verify beneficial owners of a customer that is a legal person or arrangement. 1. To what extent are reporting entities already assessing the beneficial ownership of customers that are legal persons or arrangements? Financiers want to understand their customers and, as appropriate, take security from either the individual customer or its controlling entity/persons such as directors, shareholders and trustees. Therefore enquiries are made about beneficial ownership and this information is verified to the extent possible and appropriate in the circumstances and based on the overall money laundering and terrorism financing risk. Sample of Member Responses: Government should take a greater responsibility to drive a consistent registration process for all legal entity types. For example, there could be a registration regime for trusts and partnerships to an equivalent status of private companies. ASIC could recognise and require registration of those entity types recognised by the Tax Office. Financiers would then be able to rely on information available on ASIC s databases. Financiers assess beneficial ownership to understand the ownership structure of an entity (borrower or guarantor) via company searches or trust deeds. Verification of beneficial owners identity is carried out if they are a party to the contract (either a borrower or guarantor). This is a critical element of the credit assessment. For lower ML/TF risk rated entities, we ascertain ultimate beneficial ownership information to 25%. For higher ML/TF risk rated entities, we ascertain ultimate beneficial ownership information to 10%. For companies, we rely on information contained in ASIC searches. We hope this information is accurate and reliable, but are not aware of the processes that ASIC go through when collating this information and if they verify any of it. For trusts - we collect names and rely on the trust deed. The beneficial owners may be children or other commercial entities or trusts. If beneficiaries are in classes it is very difficult to identify and verify these persons or entities. For testamentary trusts, the beneficiaries have no control (unless they are also executors). They are merely beneficiaries. To identify and verify these persons may be problematic, depending on location and age and the rationale behind collecting the information. There is potential for privacy implications and delays in being able to provide the service until such times as the identification and verification can be undertaken. We attempt to fully understand the structure of our commercial customers, and due to diligent credit assessment practices identify all parties to the facility. It is part of our credit assessment requirements to fully verify ownership of our customers to the extent possible and as appropriate in the circumstances as part of our CDD procedures. 3

6 2. Is the element of control taken into account? Control is looked at using a risk-based approach. Sample of Member Responses: For non-individuals, we consider key customer-related parties, such as directors, partners, trustees and office bearers. For individuals, we consider Powers of Attorney and subject the attorney to full individual customer ID requirements and obtain evidence of their authority to operate the customer s account. Yes for signatories to an account. 3. In seeking to understand the beneficial ownership of a customer, do you go beyond the first layer of ownership? Information on the ultimate beneficial ownership is collected and verified to the extent possible and appropriate, based on the overall money laundering and terrorism financing risk. Sample of Member Responses: We require information on the ultimate beneficial ownership. Where customers provide information indicating a non-individual ultimate beneficial owner, we seek further information or review trust deeds to ascertain the ultimate beneficial ownership. We investigate back to the ultimate beneficial ownership, or until an ownership is confirmed as being listed on a public stock exchange. We seek to determine the ultimate beneficial owner where feasible. Response by foreign owned financier: Yes because this is required by our regional procedures and because some overseas legislation already requires it. It will depend on the ownership of the next level. 4. Do you consider the cascading measures outlined by the FATF standards provide a reasonable approach to identifying beneficial ownership that balances the risks and practicalities? If not, do you have an alternative approach to suggest? Overall the current approach is reasonable. Sample of Member Responses: The concept of the cascading measures appears reasonable however, it should not apply to publicly listed entities or their related entities/subsidiaries. Measures outlined by FATF are too prescriptive and should be more in line with a matrix approach depending on the level of risk for the lender and type of transaction being entered. For a financier which is not an ADI and lends on specific assets only, a more balanced approach would be achieved by a risk matrix approach in implementing certain measures and allowing exemptions. It should not be a one size fits all approach for all countries because there are different corporate and trust structures used in various jurisdictions. 4

7 There are deficiencies in being able to undertake the activities as proposed, unless there is a national Trust Register outlining beneficiaries and confirmation that data held by ASIC is validated to allow business to rely on as a validation mechanism. Verification of identity should only be required if a person is actually issuing instructions. Any changes to the risk based approach will require significant re-work, for example systems, process, procedures, forms and significant cost for no/little value to financiers, customers or AUSTRAC. Not necessarily, it depends on the AML/CTF risk associated with products. Automotive financing is relatively low risk due to a range of factors including customer base, loan security and type of product. Financiers will incur additional delays in being able to provide loan services and will be required to educate the end users to understand the requirements. Obtaining management and organisation structure including names and positions would provide little value without the ability to verify the information. If ASIC collected the information it could then be included in the company report for financiers to verify against. Customer acting on behalf of another person Deficiency 3: There is no requirement for reporting entities to determine whether the customer is acting on behalf of another person and, if so, to take reasonable steps to verify the identity of that other person. 1. Are reporting entities already considering whether a person in acting on behalf of the customer is attempting to conceal or disguise the true owner of the transaction? If so, to what is extent is this being considered and how is this achieved? Yes, but if there is true intent to conceal the true owner it can be hard to know this. Sample of Member Responses: The nature of automotive financing means that it is relatively low risk. The process of deciding on a motor vehicle, test driving, applying for finance and then being liable for the debt usually means that the customer in front of the dealership is the end customer. No third party transactions are intentionally undertaken. All persons who are a party to a credit transaction are appropriately identified. Our policy prohibits dealings with anonymous ownership entity accounts such as where certificates or shares are issued in bearer form. Persons conducting transactions and making deposits on behalf of someone else are identified and verified. Yes, in relation to threshold transactions and also in relation to the requirement to provide suspicious matter reports where there is an element of suspicion. We consider the potential for financial abuse where persons may be influenced to complete transactions to benefit others or via Powers of Attorney and third party signatories to accounts. Settlor of a trust Deficiency 4: There is no specific requirement for reporting entities to identify and verify the settlor of a trust. 5

8 1. To what extent are reporting entities already identifying and verifying the settlor of a trust? Many of our members provide finance to trading trusts which are a commonly used business vehicle in Australia. The contribution of initial settlement funds (usually a nominal amount of around $10.00) is an administrative step, perhaps taken many years earlier by a professional adviser or a clerk who normally has no ongoing role in the operation of the trust. Information about the settlor of a trading trust (for example name and work address) might be available from the trust deed, but because the settlor is not the customer, their identity would not be verified. Sample of Member Responses: The settlor would be identified if they are a signatory to an account operated by a trading trust, in which case they would be identified in that capacity, not as settlor. In the case of a private trust (for example set up by a parent for a child), the settlor would be fully identified if they were able to operate the account. Settlor information might be collected if a copy of the trust deed is obtained, but it is unlikely to form part of the formal set of data collected as part of a financier s customer identification procedures for all trusts. Enhanced customer due diligence and politically exposed persons Deficiency 5: There is no specific requirement to apply a range of measures in high-risk situations and some enhanced due diligence measures are not clearly distinguishable from normal CDD measures. Reporting entities are not required to take specific additional measures for customers (or their beneficial owners) who are politically exposed persons (PEPs). 1. To what extent do reporting entities already undertake a range of measures under enhanced CDD in high-risk situations? (that is, more than one measure)? Member responses indicate that the AML/CTF Rules are followed and a variety of measures are applied on a risk basis in medium and high-risk situations, depending on the nature of the customer and the type of facility. Automotive and equipment financing and debtor and invoice finance are relatively low risk so this requirement is unlikely to come into play. 2. What measures are reporting entities commonly applying in high-risk situations? See responses to s 1 and 3. 6

9 3. To what extent do reporting entities already apply enhanced measures for a) foreign PEPs, b) domestic PEPs, and c) international organisation PEPs? Most of our members in the business finance market (for example equipment and motor vehicle financiers and providers of debtor and invoice finance facilities) would not deal with foreign PEPs so no enhanced measures are needed. Enhanced measures would only be used for domestic PEPs if the overall money laundering/terrorism financing risk is high. Sample of Member Responses: Members reported using the Australian DFAT lists, the US Office of Foreign Assets Control (OFAC) lists and World Check to screen for PEPs. The current flexibility in this area should be maintained. Reporting entities are best placed to determine the appropriate questioning and information gathering for enhanced customer due diligence situations. There should not be an automatic categorisation of foreign PEPs as high risk. Prescriptive requirements to use expensive PEP search facilities could operate to the disadvantage of smaller lenders offering low risk products, such as motor or equipment finance and debtor and invoice finance facilities. We only look for foreign PEPS and may apply enhanced due diligence measures at that point. We may determine we do not want the business and terminate the relationship and possibly make a suspicious matter report to AUSTRAC. In respect to domestic PEPs, we do not undertake anything special. It is what they do, not who they are. We screen all individual customers and their customer related parties (for example ultimate beneficial owners, directors) against PEP lists which include both domestic and foreign PEPs. If a PEP is identified, the customer or customer related party must be escalated to senior management for approval, including the AML Compliance Officer, and in some cases a regional AML officer. As part of the approval process PEP screening is carried out to assist in determining the level of risk posed by accepting the PEP relationship, which will in some case be rejected. PEP customers are considered to be a higher money laundering/terrorism financing risk and approved PEP customer related parties (for example ultimate beneficial owners, directors) cause the customer to be considered higher money laundering/terrorism financing risk. For individual customers, the result is additional automated transaction monitoring (lowered thresholds). For non-individuals this results in mandatory annual file reviews and collecting ultimate beneficial ownership information at the 10% level. We have policies and procedures that require us to determine if a PEP is an owner or controller or director of a customer. 4. What measures are reporting entities commonly applying in relation to PEPs? Response: See response to 3. Purpose of business relationship Deficiency 6: There is no requirement to collect information on the purpose and intended nature of the business relationship. 7

10 1. To what extent do reporting entities already include processes and procedures to understand the purpose of the business relationship, for example, as part of commercial and other risk-management requirements? Most financiers already collect information about this, so provided any new requirement is riskbased and allows financiers to determine the appropriate level of enquiry, our members would not oppose a requirement to have a reasonable understanding of the nature of the customer s business or occupation. Sample of Member Responses: In most cases the nature of the product sought will indicate the purpose of the business relationship, for example a home loan, a motor vehicle loan, an equipment or invoice finance facility relevant to the type of business conducted by the customer. It is usual for financial institutions to enquire about the business of a commercial customer and to understand the customer s source of revenue so we can assess their credit risk. We capture the necessary information to undertake a robust credit assessment, to understand their business in order to make a responsible decision to advance funds. The degree of verification of identity, beneficial control and source of funds and wealth depends on the nature of business and how well we already know the borrower. Automotive financing is largely to simple one layer business structures. The purpose and application of the equipment being financed is critical to the credit assessment process and is obtained and verified in all submissions. Updating customer due diligence records Deficiency 7: The obligations on reporting entities concerning record-keeping requirements regarding documents collected as part of the processes of identification, verification and updating of customers are inadequate. 1. On what basis are reporting entities already updating the records arising from the obligations to obtain and collect documents as part of the processes to identify and verify customers? For small or simple transactions, for example a loan where the principal is being reduced by regular payments or a term deposit that is regularly rolled over, it is impractical and not necessary to update CDD information, unless there is something suspicious. For higher risk facilities, an annual review may be carried out, but this would not necessarily involve carrying out fresh customer identification procedures. Any increased requirements to update records should be balanced with a reduction in the seven years currently required for record keeping to five years in line with FATF Recommendation 11 and Australian taxation laws. Sample of Member Responses: The monitoring of the business structures for complex customers is highly dependent on systems. Many large lenders have customer relationship systems with the ability to set up entity structures and identify and label the relationship within the corporate structure. These systems also have the ability to save and store documentation relevant to the 8

11 structure. However many smaller and more specialised financiers have single application systems which review the customer s structure at the application stage and largely monitor customer exposure on an account level rather than as a group. Foreign owned equipment financier: We deal with this through cyclical repeats of the KYC process which is prescribed in some countries. The approach is to conduct a comprehensive KYC review every 5 years for low risk customers (which would comprise 95+% of our portfolio) and every 2 years for medium/high risk customers. For commercial business, credit reviews may involve updating and refreshing KYC related information, depending on the money laundering/terrorism financing risk profile and other commercial factors. For consumer business, if a customer requests a change of name, additional supporting documentation is obtained and kept in line with the record keeping requirements. However, changes to address information do not require supporting documentation. 9

12 Options to minimise regulatory burden associated with the potential reforms 1. What circumstances would be appropriate for up-front exemptions? There should be an exemption from anything more than basic CDD measures for straightforward secured loans advanced in a single draw down and repaid regularly via an ADI account which is subject to the AML/CTF CDD requirements. This is because there is almost no opportunity to launder money or finance terrorism via this method. Transaction monitoring and on-going due diligence will highlight any suspicious activity and will be reported to AUSTRAC accordingly. The following types of customer could be exempt from the CDD requirements: - Simple family trusts - ASX regulated entities - Financial institutions - Managed investment funds - AFSL regulated entities 2. What benefits and problems may arise from a self-attestation model for the purposes of identification of beneficial owners and control structures? The Disclosure Certificate procedure already available under the Rules in Chapter 30 allows a level of self-attestation for some entity types where the reporting entity determines under the Rules in Chapter 4 that it is appropriate to rely on a Disclosure Certificate having regard to the money laundering/terrorism financing risk. This could be expanded to include beneficial owners and control structures. Any inconsistency between self-attestation information and data obtained from sources such as ASIC or credit bureaux searches would invoke the need to respond to the discrepancy as required under Chapter 4 of the Rules (for example Rule in relation to trusts and Rule in relation to companies). Sample of Member Responses: The safe-harbour procedures available for individuals and the simplified verification procedures should be available for some domestic listed public companies and trusts that are ASIC-registered managed investment schemes be expanded to include all customertypes where the overall money laundering/terrorism financing risk is low. Instead of imposing penalties on reporting entities who have been mislead by customers in relation to information that cannot be properly verified, penalties could be imposed on customers who provide manifestly incorrect or misleading information in Disclosure Certificates or otherwise (similar to penalties framework under Australia s taxation legislation), although this would not necessarily prevent all cases of fraud or intentional use of a legal person or arrangement to launder money or finance terrorism. Having the customer supply as much information as possible regarding its beneficial ownership and control is far more efficient than trying to obtain the information independently from government records as they are today. Where entities are registered with the government (for example with ASIC), reporting entities should be able to rely on registration information for both verification purposes, removing the inefficiency of collecting often inaccurate information directly from the customer. 10

13 3. In what circumstances would the provision of a greater flexibility in the current AML/CTF Rules provisions for reliance assist reporting entities to undertake CDD measures in a cost effective way? See response to the previous question 4. To what extent do reporting entities currently use simplified due diligence measures? What options may be considered to extend the use of simplified due diligence measures? There needs to be a distinction between reporting entities and businesses that have a high risk of being used for illegal activities (for example casinos/gaming/wagering operations, pawn shops, cash lending/cash receiving businesses) and low risk operations such as equipment leasing companies, motor vehicle financiers and providers of debtor and invoice finance facilities Sample of Member Responses: Some financiers who offer both simple and complex products have simplified due diligence measures available as an option for use whether more sophisticated measures are difficult to follow for some customers. However, the complexity introduced by offering different possible methods to front line staff and introducers/brokers means that higher standards are usually applied to ensure compliance with the higher standard. In practice, this can result in unnecessary costs and delays for customers for whom simplified procedures would be adequate. The safe-harbour procedures for individuals and the simplified verification procedures available for some companies and trusts should be expanded to include all customer-types where the overall money laundering/terrorism financing risk is low, with substantial penalties for customers who provide incorrect or misleading information. 5. What independent and reliable sources of information are used by reporting entities to verify beneficial ownership and control? What are the issues and concerns of reporting entities in meeting this obligation and what alternatives may be considered? There is uncertainty about the extent to which information on ASIC databases can be relied on as a reliable and independent source for collection and verification of information about companies 1. In relation to the requirements for collection and verification of trustee and beneficiary information 2, the lack of an independent register of private trusts makes this difficult. There is uncertainty as to the proper interpretation of Rules and The risk-based approach is currently applied in meeting these requirements. If there are to be changes to the requirements for identification of settlors, trustees and beneficiaries of trusts, then the Government should implement FATF Recommendation 25 to facilitate access by reporting entities to accurate and timely information about trusts, for example by establishing a trading trust register. It is acknowledged that there would be a cost 1 For example to meet the requirements of Rules 4.3.3, 4.3.5, and For example in Rules 4.4.9, , and

14 for this, which should be borne by those choosing to do business in this way, in the same way that ASIC charges for the establishment and maintenance of the company register. The Commonwealth Document Verification Service under development through the Attorney- General s Department will greatly assist with the verification of names, dates-of-birth and document number details for passports, citizenship certificates, visas and Medicare cards. The remaining states which have not yet facilitated access to driver licence information should be encouraged to do so by AUSTRAC and the Attorney-General s Department. Sample of Member Responses: Other than by inspecting original documents issued by the government or by verifying customer identification information via reliable and independent electronic databases, it is difficult to know whether information is accurate, particularly if the customer or their advisors actively set out to mislead or defraud a financier. Financiers can only be expected to make reasonable enquiries and verify information to the appropriate degree in view of the money laundering/terrorism financing risk in each case. Verification sources include the following, although not all may be truly reliable and independent: - Credit bureaux searches via commercial information brokers - ASIC searches - Information available via - Financial statements and asset and liability statements prepared by accountants or other advisers - Trust deeds - Partnership agreements - Copies of bank statements - Tax returns - Driver licences - Credit cards - Passports 6. If the AML/CTF regime was extended to address the deficiencies outlined at Part 2 of this paper, what is a sufficient lead time for reporting entities between the changes to the regime and the commencement of the obligations? There are a number of major regulatory changes underway in the financial services industry, including changes to privacy and consumer credit regulation, APRA requirements, and new obligations under the US Foreign Account Tax Compliance Act (FATCA). The new Federal Government may impose further changes on the industry. We suggest that an assisted compliance period of at least twenty four months month would be appropriate, depending on the extent of any changes. Any changes to the CDD requirements should be made in tandem with any other changes to the AML/CTF regime that arise out of the upcoming statutory review of the operation of the Anti-Money Laundering and Counter-Terrorism Financing Act. 7. What other options may be considered to minimise or reduce potential regulatory burden on reporting entities in meeting their obligations for beneficial ownership and control, if the AML/CTF regime was extended to address the deficiencies outlined at Part 2 of this paper? 12

15 Reporting entities should be able to rely on ASIC databases as a verification source for information held by ASIC about non-individuals. A verification source for trading trusts should be provided via ASIC or another body if there is to be any change to the requirement to verify beneficial ownership and control information. *********************************** 13

16 Responses on behalf of Members of the AFC, AELA, AFLA and DIFA to the potential reforms to address the deficiencies identified in Table 1 in the AUSTRAC/Attorney-General s Department Discussion Paper Consideration of Possible Enhancements to the Requirements for Customer Due Diligence Table 1 Summary of Australia s deficiencies and associated potential reforms Ownership and control September 2013 The potential reform to address the deficiency 1 Requirements for beneficial ownership and control The obligation on reporting entities to determine the beneficial ownership and control structures of customers is inadequate and inconsistent with the FATF standards because: there is no provision for a reporting entity to understand the control structures of a customer there is no requirement for a reporting entity to collect information on the powers that bind the legal person (e.g. company) or legal arrangement (e.g. trust). The potential reform to address the deficiency It is possible to extend the definition in the AML/CTF Rules of beneficial ownership of all customers to explicitly introduce a concept of control. Industry Response: The CDD measures listed in paragraphs (a) - (d) of Recommendation 10 are to be applied using a risk-based approach according to the paragraph which follows the list. The Interpretive Notes to Recommendation 10 refer to the purpose of these measures being to allow the financier to: (i) properly assess the potential ML/TF risk of the business relationship; and (ii) take steps to mitigate the risks. The ML/TF risk is not just determined by the customer type, but must also be seen in the context of the type of product being offered, how it is delivered and any foreign jurisdictions dealt with, as referred to in Rule The steps needed to mitigate the risks will also be determined based on these factors. The Discussion Paper suggests under the heading Potential Reforms that an option is for the AML/CTF Rules to require a reporting entity regardless of the level of perceived risk, to collect information about the powers that regulate and bind the customer and about its management and organisation structure and for this requirement to extend to all categories of legal person and arrangement. Although the Rules may not include a specific requirement to 1

17 Ownership and control The potential reform to address the deficiency investigate the ultimate control of a customer, it is normal practice in the case of privately owned or controlled customers for financiers to enquire about this for commercial and prudential reasons. In the case of complex customer structures, the extent to which this information is collected and formally verified is determined on a risk-based approach. In the absence of independently maintained reliable databases, it is very difficult to verify this information for privately controlled entities. This would largely defeat the purpose of making it compulsory to collect it in all cases. Currently the control concept is used in Chapter 15 of the Rules in relation to an enhanced customer due diligence program for high risk situations where the reporting entity must undertake one or more of a number of suggested actions. These include obtaining KYC information about ultimate beneficial ownership (defined in the case of a company as an individual who ultimately controls directly or indirectly more than 25% of the issued capital). We would only support extending the definition of beneficial owner to include a concept of control if: this was subject to the risk-based approach based on the overall ML/TF profile of the customer and the product it is obtaining; there is clear explanation of what is meant by control ; consistent with the current definition, control is to be verified in respect of more than 25% of the customer; there is a practical and cost-effective means to verify information about control ; and the meaning of the terms ultimate beneficial ownership and beneficial ownership was clarified. 2

18 Ownership and control The potential reform to address the deficiency 2 Requirements for beneficial ownership and control There is no explicit requirement for a reporting entity to identify and take reasonable measures to verify the beneficial ownership and control of its customers. The potential reform to address the deficiency It is possible to amend the AML/CTF Rules to explicitly require reporting entities to: identify and take reasonable steps to verify the identity of beneficial owners for all categories of customer, and clarify that the term beneficial owner means the natural person(s) (individual(s)) who ultimately owns or controls a customer. Industry response: Our members would oppose this being applied to all categories of customers, no matter what product they are obtaining and in what circumstances. The extent to which information about powers is collected is currently determined using the risk-based approach, particularly looking at the service being provided. The extent to which the information can be verified depends on the availability of reliable verification sources. Currently, the only way to verify information about private companies and trusts may be to examine the constituent documents. A customer who wants to mislead a financier can easily manufacture these documents. Even information lodged with ASIC may not be directly verified by ASIC, so conducting an ASIC search is not necessarily a reliable way to verify beneficial ownership or control information. For private/discretionary trusts, there is no independent register on which beneficial ownership and control information is held. A tax return may provide some comfort, but can be subject to manipulation by fraudulent customers and their advisers. Therefore any requirement to verify beneficial owner and control information must be subject to: (a) the risk-based approach; and (b) the extent to which reliable and independent sources are available as a verification tool which can be accessed at minimal cost. 3 Situations where a customer is acting on behalf of a person The AML/CTF regime does not require a reporting entity to determine whether a The potential reform to address the deficiency It is possible to amend the AML/CTF Industry response: It is very difficult to know if a person is acting on behalf of another person if they do not answer truthfully a question 3

19 Ownership and control customer, who is a natural person, is acting on behalf of another person and, if so, to take reasonable steps and apply adequate measures to verify the identity of that other person. Rules to explicitly require a reporting entity to take appropriate steps to: determine whether the customer is conducting a transaction on behalf of another person or third party, and accordingly identify the beneficiaries and the destination of the transaction. The potential reform to address the deficiency about this. If there is a definite intention to conceal ownership or control, it will be virtually impossible to determine the true ownership, for example a customer who is taking verbal instructions from an ultimate beneficial owner in relation to the establishment of a facility. This section of the Discussion Paper may misdescribe the intention of Interpretive Note B 4 to Recommendation 10. Note B 4 refers to persons acting on behalf of a customer, not to a customer acting on behalf of a person which is the wording used in this section of the Paper. We understand that Interpretive Note B 4 is aimed at ensuring that a financier satisfies itself that a person who is not the customer has authority to act for the customer and identifies that person. Section 89 of the AML/ACT Act is consistent with the Interpretive Note in that it refers to a customer dealing with a reporting entity through an agent. In turn, Part 4.11 of the Rules requires reporting entities to identify the agents of customers, whether the customer is an individual or a nonnatural person. Therefore we submit that this aspect of Recommendation 10 and its Interpretive Note is already adequately addressed in the AML/CTF Act and the Rules. In addition to the requirement to identify customers agents, Chapter 19 of the Rules requires threshold transaction reports to include various information about a person conducting a threshold transaction who is not the customer, including whether the person is an employee of the customer and a description of the reliable and independent documentation or electronic data relied upon to verify the individual s identity. If there is to be a more stringent requirement to determine whether a person is acting on behalf of a customer, then it should be clear that only reasonable enquiries need be made about this, in the light of the overall ML/T risk presented by the customer and the product they are obtaining. In other 4

20 Ownership and control The potential reform to address the deficiency words, the risk-based approach should apply, as permitted by Recommendation Settlor of a trust Where a reporting entity is dealing with a customer that falls under the category of a legal arrangement (e.g. trust), there is no explicit requirement under the AML/CTF regime to identify and verify the settlor of a trust. The potential reform to address the deficiency It is possible to amend the AML/CTF Rules to explicitly require a reporting entity to identify and verify the settlor of a trust. Industry response: The Discussion Paper states that the FATF Standards require that the settlor of a trust be identified and reasonable measures be taken to verify the identity of such persons because this person may be able to, under certain circumstances, exercise informal control over the assets of the trust by appointing a close associate or family member as a trustee. We do not believe that it is explicitly stated in the FATF Standards that the settlor of a trust must be identified. There is no direct reference to a settlor in the Recommendations. The Interpretive Note to Recommendation 10 states that beneficial owners of the customer are to be identified through information which includes, for legal arrangements such as trusts, the identity of the settlor. This is in the context of an overall responsibility to understand the control structure of the customer. The Discussion Paper also states that the identification and verification of the settlor of a trust will increase the transparency of this legal arrangement and enable the identification of the source of funds or assets. The FATF Recommendations do NOT specifically require identification of the source of funds in all cases, although Recommendation 10 refers to this as part of ongoing due diligence and its Interpretive Note states that enhanced customer due diligence measures could include obtaining information on the source of funds or wealth of the customer. In many cases a customer may not disclose that it is operating via a trust. This might be due to inadvertence if the 5