anti money laundering | Outlier Solutions

OSFI

On March 2^nd, 2016, the Office of the Superintendent of Financial Institutions (OSFI) released the United Nations Security Council’s (UNSC) Al-Qaida and Taliban Regulations (UNAQTR) update to the consolidated list, underscoring recent information updates on 11 individuals and one entity.

The 11 individuals are subject to the assets freeze, travel ban and arms embargo set out in paragraph 2 of Security Council resolution 2253 (2015) adopted under Chapter VII of the Charter of the United Nations. The individuals all have different nationalities, locations and expertise, but they have been tied to Al-Qaida. The entity included is a Moroccan-led terrorist organization formed in August 2013, and were last known to be operating in the Syrian Arab Republic.

See the update on the United Nations (UN) website.

Go to the OSFI lists page.

OFAC

The U.S. Department of Treasury’s Branch, The Office of Foreign Asset Control (OFAC), released one update last week, related to North Korea and Non-Proliferation Designation Lists updates. A total of 11 individuals and five entities were added to both lists. OFAC also released two updates where information related to two entities was changed.

OFAC administers and enforces economic and trade sanctions based on U.S. foreign policy and national security goals. The sanctions target countries, regimes, terrorists, international narcotics traffickers, the proliferation of weapons of mass destruction, and other threats to the national security, foreign policy or economy of the U.S. The North Korean five entities added are all state-owned entities, who all have North Korean national defense objectives. The 11 individuals are all high ranking persons within the five organizations.

See the update on OFAC’s website.

See OFAC’s recent actions page.

Need A Hand?

We would love to hear from you. If there are subjects in this post that you would like to know more about, or if you need assistance with your compliance program, please contact us.

OSFI

On February 23^rd, 2016, the Office of the Superintendent of Financial Institutions (OSFI) released the United Nations Security Council (UNSC) ISIL (Da’esh) and Al-Qaida Sanctions Committee’s update, underscoring recent information updates on five individuals.

The five individuals are subject to the assets freeze, travel ban and arms embargo set out in paragraph 2 of Security Council resolution 2253 (2015) adopted under Chapter VII of the Charter of the United Nations. All of the updates relate to their most recent known location, 4 of which being, prison. The final was a ‘last known address’ update for a Tunisian individual, though he was reported as ‘in detention’ in Tunsia, as at December 2009.

See the update on the United Nations (UN) website.

Go to the OSFI lists page.

OFAC

The U.S. Department of Treasury’s Branch, The Office of Foreign Asset Control (OFAC), released two updates last week, but both related to settlement of alleged enforcement actions, or civil penalties related to alleged violations of the Cuban Assets Control Regulations (CACR). The enforcement actions were on two entities, CGG Services S.A., formerly known as CGGVeritas S.A. (CGG France) and Halliburton Atlantic Limited (HAL) on behalf of itself and its affiliate, Halliburton Overseas Limited (HOL).

See OFAC’s recent actions page.

CGG France has agreed to pay $614,250 USD for numerous alleged violations of Cuban Sanctions, when they exported spare parts and other equipment from the United States to M/V Amadeus while the vessel operated in Cuba’s territorial waters.

See the update on OFAC’s website.

The enforcement actions against HAL were for alleged violations of Cuban Sanctions, by dealing in property in which Cuba, or a Cuban national, had an interest when they exported goods and services in support of oil and gas exploration and drilling activities within the Cabinda Onshore South Block oil concession in Angola. HAL knew, or should have known, they were dealing in property in which Cuba had an interest. HAL issued 19 invoices to the Consortium operator Cupet, a company with headquarters in Angola, related to these goods and services, and HAL primarily performed the services which were invoiced. OFAC determined that the alleged violations were voluntarily self-disclosed and constituted a non-egregious case. The total transaction value of the alleged violations was $1,189,752 USD. The statutory maximum civil monetary penalty for the alleged violations was $1,235,000 USD and the base penalty amount for the alleged violations was $423,202 USD. HAL has agreed to pay $304,706 USD.

See the update on OFAC’s website.

Need A Hand?

We would love to hear from you. If there are subjects in this post that you would like to know more about, or if you need assistance with your compliance program, please contact us.

We get a lot of questions about examinations conducted by the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC). While we’re happy to be able to help our customers in their examinations (you can check out our free resources for FINTRAC exams here), the responsibility during the examination will rest with the money services business (MSB), mainly with the MSB’s Compliance Officer.

FINTRAC’s expectations have changed dramatically, since MSB’s were first required to comply with the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and its enacted regulations. In 2015, we noticed that there was a dramatic shift in focus of MSB examinations. FINTRAC’s examiners were much more interested in detailed procedures (documents that describe how MSBs are complying with the PCMLTFA and regulations), and the Risk Based Approach.

One of the most important things that MSBs can do to ensure that their AML compliance programs are up to date, and at the same time, prepare for FINTRAC examinations, is to read FINTRAC’s published guidance. Two important guidance topics published in 2015 are, the Risk-Based Approach Guide (this guide describes what is the risk-based approach) and the Risk-Based Approach Workbook for MSBs (this workbook is for MSBs looking to implement a risk-based approach). While guidance published by FINTRAC doesn’t carry the weight of law or regulation, it does provide valuable insight about FINTRAC’s expectations.

Another excellent source of information is FINTRAC’s published Policy Interpretations. These are FINTRAC’s official answers to questions asked by MSBs and other reporting entities.

In Person & Desk Examinations

Whether the FINTRAC exam is in person or desk (conducted by phone) examinations, they follow very similar formats. The key difference is the regulator’s ability to request additional operational data during onsite examinations.

It is ok for you to take notes throughout the examination process (and we recommend that you do). You are permitted to have a lawyer, consultant or other representative with you (if you do, FINTRAC will request that you complete the Authorized Representative Form in advance). While your representative cannot generally answer questions on your behalf, they can prompt you if you are nervous or stuck, and help you to understand what is being asked of you, if it is not clear.

If you do not speak English and/or French fluently, we highly recommend that you have a person present who can translate questions and responses for you.

If you are not certain what the examiner is asking for, you should always ask for clarification before answering.

For in person examinations, do not invite the examiner to have a pint, lunch or even a coffee. FINTRAC has very strict policies around bribery, to the extent that if I am out socially with an acquaintance who works for FINTRAC, I cannot pay for their tea. It may feel a little bit “over the top”, not to be able to extend these courtesies, but don’t be offended – it’s not you, it’s policy.

The Introduction

The examiner will provide a brief overview of the examination process as a formal opening to the examination. At the end of this introduction, the examiner will ask if you have any questions. At this point, it can be useful to provide a very brief (five minutes maximum) overview of your business.

Your introduction should reflect the materials that you have already submitted to FINTRAC (which ideally included an opening letter that described anything about the business that would not be readily apparent to the examiner, or anything that you believe could be misunderstood). Key facts about your business include:

Your corporate structure and ownership;
The types of products and services that are offered / types of transactions that are conducted;
Where your offices, agents and customers are located;
How you connect with and your customers; and
Anything significant that has changed since your last FINTRAC examination.

This synopsis must be very brief. If there is anything that is complex, it should be included as an explanation in your initial package (preferably in a simplified chart form – for example an ownership structure chart).

The examination will then begin. At the end of each section, the examiner will ask if you have any questions and let you know whether there are any deficiencies.

Part 1 – FINTRAC MSB Registration

In this part, FINTRAC will go through your MSB registration field by field and confirm that the information is accurate. The most common errors that we have seen are:

Not listing a trade name/operating name;
Not listing all relevant locations;
Listing bank accounts that are inactive or not listing bank accounts that are active;
Not including MSB or agent relationships (either buying from or selling to another MSB);
Incomplete ownership information; and
Senior Management and/or Compliance Officer information, that is out of date.

Although it is not technically part of the registration, some examiners will ask about the Compliance Officer’s responsibilities/duties at this stage.

Failure to update the MSB registration in the “prescribed form and manner” is the single most common deficiency for MSBs from 2008 to the present, accounting for deficiencies in 61% of examinations (according to FINTRAC data released in 2015).

Part 2 – Compliance Policies & Procedures

In this part, FINTRAC will ask questions about the policy and procedure documents that you have provided in advance of the examination. There are a few standard questions that are generally asked:

Who wrote the policies and procedures?
Were the versions submitted to FINTRAC the most recent versions?
When were they updated?
When and how do you identify your customers?
How do you ensure that identification is up to date?
How do you monitor transactions?
How do you recognize, document and monitor “business relationships” (note: this is any time that you have either an ongoing service agreement with a customer and/or your customer has performed two or more transactions that require identification).
What are indicators of a suspicious transaction?

The examiner will also ask a number of questions based on the documents that you have submitted, including questions about compliance-related processes.

Part 3 – Risk Assessment

In this part, FINTRAC will focus on your Risk Based Approach, asking specific questions about the Risk Assessment and related documents that you have provided in advance of your examination. Again, there are some common questions that are asked:

Do you have any high-risk customers or business relationships?
What factors do you consider in determining that a customer or business relationship is high risk?
How are customer due diligence and enhanced due diligence different (both generally, and in your processes and documentation)?

Most additional questions will be related to risk management processes. For example, it has been common in the last few months for examiners to ask if a customer or transaction could be rejected (“Yes, if it was outside of our risk tolerance.”)

This may also lead to questions about whether or not an Attempted Suspicious Transaction Report (ASTR) or Suspicious Transaction Report (STR) was filed. If there were reasonable grounds to suspect money laundering or terrorist financing, the answer should be yes, if not, you should explicitly say, “There were not reasonable grounds to believe that this event was related to money laundering or terrorist financing” then provide an explanation.

Part 4 – Operational Compliance & Reporting

In this part, the examiner will ask questions about specific transactions. Some of the cases that you must be ready to explain are:

A reportable transaction (generally an electronic funds transfer or EFT) was reported by another reporting entity;
A transaction matches an indicator of potentially suspicious activity (if there were reasonable grounds to suspect money laundering or terrorist financing, the answer should be yes, if not, you should explicitly say that “there were not reasonable grounds to believe that this event was related to money laundering or terrorist financing” then provide an explanation); and
Business relationships and ongoing monitoring (in particular, if this did not occur earlier in the examination).

During a desk examination, the examiners do not request additional materials.

During onsite examinations, it has become commonplace for examiners to request additional materials. These are generally related to:

Business relationships;
Ongoing monitoring (including the monitoring of business relationships),
High risk customers;
Enhanced due diligence; and
Other risk-based processes.

Be clear with the examiner about what can be extracted easily from your IT systems, and in the case that data cannot be extracted easily, be prepared to show the examiner an example (or several). If your system has an “auditor access” feature (generally read only access with search capability), it can be useful to set this up in advance of the onsite visit.

Exit Interview

Congratulations – you’ve made it to the finish line!

At this point, the examiner will sum up the findings (if there are any), and read a standard disclosure statement. For most of us, the disclosure statement is terrifying, as it talks about penalties. This is standard process – do not be alarmed. When the examiner has finished, you may ask if a penalty is being recommended (if you’re a worrier, please do this). Not all FINTRAC examiners will provide guidance at this stage, but it doesn’t hurt to ask.

The examiner will let you know when to expect a formal letter (generally within 30 days of the end of an examination).

After the Examination

You will receive a formal letter that details FINTRAC’s findings, as well as whether or not an Administrative Monetary penalty (AMP) is being recommended. In the case that there is a potential penalty, we recommend taking action as soon as possible). In most cases, FINTRAC does not require MSBs to submit an action plan (but your bank might still require that you do this, and it’s a good idea to keep a record of the actions that you’ve taken to correct any deficiencies).

Need a Hand?

If you are an MSB that needs compliance assistance preparing for an FINTRAC exam, remediating findings, or setting up an AML compliance program, please contact us.

If you’ve received an email, letter or call telling you that a larger than usual sum of money is headed your way, but before it can be delivered to your bank, you are required to get a clearance certificate, you are being set up for a scam.

The Setup

The scam goes by many names, but the setup is almost always the same…

Step 1: The Sexy Promise

The scammers need you to want to talk to them. To pique your interest, they’ll promise something that they think you will want. In most cases, it’s not a crazy sum of money that will be sent to you – most people would immediately recognize that as a scam. Instead, it will be a reasonable sum that is nonetheless attractive for your business.

In the most sickening cases that we’ve seen, the scammers have focused on charities by posing as potential donors. Outlier has even received a request for a clearance certificate from a “prospective client overseas.”

Step 2: The Legitimate Power

The scammers will claim that the certificate is being requested by a legitimate organization. Some of the scams that we’ve seen have said that certificates are required by:

Financial Transactions and Reports Analysis Centre of Canada (FINTRAC),
Financial Crimes Enforcement Network (FinCEN),
Office of the Currency Controller (OCC).
Securities Exchange Commission (SEC),
S. Department of Homeland Security,
International Monetary Fund (IMF), and
Financial Action Task Force (FATF).

None of these agencies issue, require, or have any other involvement with clearance certificates. In fact, if you call any of these agencies to ask about clearance certificates, they will tell you that you are likely the victim of a scam.

Step 3: The Real Threat

The type of “clearance certificate” that the scammers will ask for varies, but it’s usually something that most businesses have at least read about in the news, like “anti-money laundering” or “anti-terrorism.” It’s always something that sounds like it could be a real threat, although definitely not the type of threat that you would pose. Sometimes the requests will be phrased in a way that’s meant to make you feel a little bit indignant (“Why would this person think I’m a money launderer or a terrorist?!?)…

This is all part of the scam. If you’re emotional, you may not be thinking clearly, and it helps the scammer to build rapport with the victim. The scammer may offer consolations like, “Of course, I know that you’re not a criminal, but according to the * insert the authority from step 2 here * we must take these precautions…”

Step 4: Solving the Problem

The scammer is trying to collect as much information (especially financial information) as possible. The scammer will ask for your details directly (all for the purpose of obtaining the certificate, of course) or helpfully suggest a site for a “company” that can help you get your certificate.

Generally, this site requires a credit card payment (these may range from a few hundred to several thousand dollars). In more sophisticated scams, the site’s fine print states that the certificates are “not authorized by any government or international body” and that there are absolutely no refunds. This means that even if the victim reports the scam to their credit card company, they may not be able to issue a refund.

Step 5: Profit

At this stage, the scammers have the victim’s banking and/or credit card information. They may use this to conduct transactions (like draining the bank account or paying for things with the credit card), or simply sell the information on the dark web to other scammers.

Don’t Get Caught Up

It can be hard to believe that someone that you’ve been corresponding with, someone that seems like they could be good for business, is really just a scammer. It’s difficult, and embarrassing – but the sooner you exit the situation, the better off you are.

While you should report the incident (more about that below), it can be dangerous to attempt to bait the scammer to get more information about them (and the information that they provide is likely to be false in any case). Do collect as much information from your existing correspondence with the scammer (including screen captures and/or links to any websites that the scammer has provided you with), as these will be helpful in reporting the scam.

But if You Did, Protect Yourself

If you have already provided some, or all, of your financial details, it’s in your best interest to act quickly. Contact your financial institution(s) and let them know what’s happened. They will be able to close your existing accounts, issue new accounts and review your recent transaction history with you.

Report It

At any point, you can report the scam to the Canadian Anti-Fraud Centre either online or by phone (1-888-495-8501).

Need A Hand?

While Outlier is not a law enforcement or investigative agency, we do conduct staff training sessions, including training related to common scams and how to recognize them. You can get in touch with us at info@outliercanada.com or by using the online form.

Today’s guest blogger is Jonathan Krumins, Vice-President, AML Risk & Compliance, at vCAMLO Solutions Inc. vCAMLO provides anti-money laundering (AML) and anti-terrorist financing (ATF) support to Canadian credit unions. You can learn more about vCAMLO at www.vcamlo.ca.

Background

On July 4, 2015, draft amendments to the Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations (PCMLTFR) were published in the Canada Gazette. These changes are not yet in force, and are open to public comment until September 4, 2015. The proposed changes are based on requirements set out by the Financial Action Task Force (FATF), an inter-governmental body that sets out international standards for combating money laundering and terrorist financing. For this reason, we expect the final version of these amendments to be similar to the draft text.

2015 Proposed PCMLTFR Amendments and Credit Union Specific Analysis (Line By Line)

Why Do These Changes Matter to Credit Unions?

The proposed changes will have a direct impact on a Credit Union’s AML obligations, including record keeping, member identification and ongoing monitoring requirements. Some of the more significant changes include new member identification methods, expanded definitions (and requirements) for Politically Exposed Persons, and new record keeping requirements for “reasonable measures” taken.

New Member Identification Methods

The draft regulations will require identification documents to contain a member’s name and photograph. This will exclude SIN cards and birth certificates as acceptable identification documents, and may pose an issue when identifying seniors whose passport or driver’s license has long since expired.

The amendments also provide a number of new identification methods that can be used to identify members both face-to-face and non-face to face. These new methods are an improvement on existing rules, which are currently more restrictive.

For example, a Canadian credit file meeting certain criteria could now be used to identify a member. Many credit unions perform credit checks as part of their account opening process, so this could be used in place of government-issued identification in certain circumstances, or would allow simple non-face to face identification.

Also added is the ability to rely on information from “a reliable source” (yet to be determined, but likely online databases and other web-based resources), and information confirming that an individual has a deposit account, credit card or other loan account with another credit union, bank or caisse populaire. A credit union will also be able to accept identification performed by another credit union.

Politically Exposed Persons

The proposed regulations have added new categories of Politically Exposed Persons (PEPs), as follows:

Close associates of Politically Exposed Foreign Persons (PEFPs)
Politically Exposed Domestic Persons (PEDPs), their family members and close associates
Heads of International Organizations (HIOs), their family members and close associates

Given that the list (contained in bill C-31) of qualifying positions for PEDPs includes mayors, it is likely that many if not most credit unions will have members classified as PEDPs. The draft regulations mitigate this somewhat by adding a prescribed period of 20 years to the definition of a PEDP.

Additionally, required measures for PEPs such as determining the source of funds, obtaining senior management authorization to keep an account open, and performing enhanced monitoring will only apply to PEDPs and HIOs (and their family members and close associates) who have been determined to be high risk. Despite these exceptions, identifying and documenting these new categories of PEP will add to credit unions’ compliance obligations.

Reasonable Measures

Many AML record keeping, reporting and determination requirements rely on “reasonable measures” to be taken by financial institutions. For example, in a Large Cash Transaction Report, certain information about the conductor of the transaction, such as their country of residence, their home and business telephone numbers are not mandatory, but reasonable efforts must be made to obtain the information, and if you have it on file, it must be included in the report. The proposed changes will mean that whenever you take “reasonable measures”, and the measures taken are unsuccessful, you will then need to keep a record describing what the measures were and the reason they were unsuccessful. This will require additional work and record keeping for categories such as FINTRAC reporting, PEP determinations and correspondent banking relationships, among others.

Public Comments

Public comments about the proposed changes will be accepted by the Ministry of Finance until September 4, 2015. They must be submitted in writing, as follows:

Mail Attention: Lisa Pezzack

Director, Financial Systems Division

Department of Finance

90 Elgin Street

Ottawa, Ontario, K1A 0G5

Email: fcs-scf@fin.gc.ca

Need a Hand?

If you would like someone to look over your submission before you make comments to the Department of Finance, you can get in touch with us free of charge. We will look over your submission and make suggestions, without any cost to you. If you need a hand, please feel free to contact vCAMLO or Outlier.

It seems that every time I’m at a conference or event related to compliance, I hear people talking about going “above and beyond” the requirements. Something about this statement has always seemed wrong to me. It wasn’t until recently that I understood why: most of us aren’t getting the basics right.

Most Of Us Are Failing At The Basics

This is not an indictment of Compliance Officers and the tremendous effort that goes into compliance. It’s a simple statistical fact.

We crunched some numbers by industry for anti-money laundering (AML) compliance in Canada based on information obtained from the regulator through an access to information request in 2014. The rate of examinations for which there were no deficiencies (across all reporting entity types) was 17 percent. While we congratulate the savvy few that met this bar, that leaves 83 percent of reporting entities that failed to meet the basic requirements in some way.

While these results are specific to examinations conducted by the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC), it’s not unreasonable to assume that the results can be generalized to compliance more broadly.

Shift The Focus

Before anyone can go “above and beyond” the fundamentals should be solid. One of the most painful reviews (like an audit for compliance) that I’ve conducted was a classic case of going above and beyond while completely missing the mark on baseline compliance. The reporting entity had great technology and related risk ranking metrics. The methods that they used to understand customer behavior involved machine learning and geo-location data at each login, analyzed over time. It was a great risk management strategy, except that they hadn’t identified a single customer in accordance with the law. Not a single one…

Ironically, in working to design measures that went beyond the basic compliance requirements, they found themselves so far outside of what was allowable under the law that had an examination been conducted by a regulator at the time, they could have been facing a very hefty penalty (as was the case for Ripple Labs in the USA).

Consequently, they spent a good deal of time and money updating their systems and identifying customers. In some cases, customers were lost. The (re)identification process was frustrating for people that believed that they had already completed everything that was needful in order to transact freely. There were updates to process documents and IT systems that took place over the course of months, and a good deal of frustration at the rework involved.

A competent third party or in house expert can be useful in assisting with system and process design, provided that they are able to understand your business model, basic compliance requirements and how to achieve these in the most elegant way possible.

Keep It Simple (Seriously)

At a recent conference, I was listening to a speaker whom I consider a model for what not to do, both functionally and ethically. As he sweepingly gestured towards an overly complex chart, he stared into the blank faces of his audience and proclaimed “It’s ok if you don’t get it. That’s not the point. The point is that I should look impressive. Are you impressed?” I was not.

Which model fits your needs?

Remember that the people that are usually fulfilling your compliance requirements are your frontline staff. Would they be able to use the model to the left to risk rank your customers?

While it can be tempting to create complex rating systems, it’s important to understand that your compliance program should be functional. If the system that you’ve created is too complex for your staff to understand and adhere to, it will fail. Whether you’re hiring someone external or creating your program in-house, remember to keep it as simple and easy to follow as possible.

Ask, Check, Test

One of the many arguments that I’ve heard for going above and beyond is that this is helpful when dealing with regulators and banking service providers. While I agree that this can certainly be the case, it’s a moot point if the basic requirements are not met.

In my experience, both regulators and bankers are candid – when asked – about where their expectations are set. There is no real appetite on the part of either to create a set of secret standards related to going above and beyond. From a practical perspective, this means that reporting entities should be focused on understanding the basic requirements, and seeking clarification as needed.

Effectiveness reviews can also be a useful tool in this regard, provided that the reviewer or auditor is well versed in local compliance requirements. Similarly, internal testing should be geared towards baseline requirements to ensure that these are being met.

Opportunities & Innovation

Going above and beyond for its own sake (in terms of compliance) is neither required, nor particularly good business.

This is not to say that reporting entities should avoid innovation. Rather, these efforts should be focused and prioritized on finding the most cost-effective and efficient ways to meet baseline compliance requirements, and mitigating risk.

Changing compliance legislation can also provide opportunities for innovation, in particular where there are public consultations. This type of dialogue with lawmakers allows stakeholders to suggest alternatives that may mitigate risk in new and innovative ways. It provides an opportunity to showcase new technologies and processes that solve common compliance problems with greater efficiency (although they may not fit into the current regulatory paradigm).

Need A Hand?

We believe that good compliance is good business. If you have questions, please feel free to contact us.

On July 4^th, 2015, draft amendments to Canada’s Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations were published in the Canada Gazette. These updates are intended to, among other things, strengthen Canada’s anti-money laundering (AML) regime and address certain technical issues. The draft does expand the definition of a money services business (MSB) to include “dealers in digital currency,” but digital currency businesses may still consider submitting comments related to the draft, as the consultation period of 60 days is open to the public.

This round of amendments didn’t include ‘dealers in digital currency’ – so why should you comment?

While dealers in digital currency are not yet regulated as MSBs, it is reasonable to expect that this is the direction Canada is taking based on Bill C-31, which was passed last year. This means that the regulations could apply to digital currency businesses in the near future. The 60-day comment period is likely to be the only public comment period before a final version of the amended regulations is published.

One of the most significant changes in the current draft relates to customer identification. The current customer identification methods for non-face-to-face customers (which apply to all online MSB customers) are complicated and heavily reliant on an individual having at least six months of Canadian credit history (you can learn more here). The proposed amendments have the potential to broaden the range of available sources to include sources other than credit reporting bureaus.

Digital currency businesses should consider commenting on these amendments. While we at Outlier consider the changes to be positive overall, we’re aware that there are many identification solutions on the market (many of which don’t meet the current Canadian identification requirements). This has caused more than a few headaches for businesses that operate online. While the proposed changes may alleviate some of the current pain points, businesses should consider how these fit with your business model and service providers.

Customer Identification Measures

In the text below, the text that is struck through includes proposed deletions, while the green text includes proposed additions. You can also see a full marked-up version of the Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations here.

MEASURES FOR ASCERTAINING IDENTITY

(1) In the cases referred to in sections 53, 53.1, 54, paragraph 54.1(a) and sections 55, 56, 57, 59, 59.1, 59.2, 59.3, 59.4, 59.5, 60 and 61, a person’s the identity of a person shall is to be ascertained, at the time referred to in subsection (2) and in accordance with subsection (3), in the following manner:

(a) By referring to the person’s birth certificate, driver’s licence, provincial health insurance card (if such use of the card is not prohibited by the applicable provincial law), passport or other similar document; or

(a) By referring to identification document that contains their name and photograph and that is issued by the federal government or a provincial government or by a foreign government other than a municipal government, and by verifying that the name and photograph are those of the person;

(b) if the person is not physically present when the account is opened, the credit card application is submitted, the trust is established, the client information record is created or the transaction is conducted,

(i) by obtaining the person’s name, address and date of birth and

(A) confirming that one of the following entities has identified the person in accordance with paragraph (a), namely,

(I) an entity, referred to in any of paragraphs 5(a) to (g) of the Act, that is affiliated with the entity ascertaining the identity of the person,

(II) an entity that carries on activities outside Canada similar to the activities of a person or entity referred to in any of paragraphs 5(a) to (g) of the Act and that is affiliated with the entity ascertaining the identity of the person, or

(III) an entity that is subject to the Act and is a member of the same association as the entity ascertaining the identity of the person, and

(B) verifying that the name, address and date of birth in the record kept by that affiliated entity or that entity that is a member of the same association corresponds to the information provided in accordance with these Regulations by the person, or

(ii) subject to subsection (1.3), by using one of the following combinations of the identification methods set out in Part A of Schedule 7, namely,

(A) methods 1 and 3,

(B) methods 1 and 4,

(C) methods 1 and 5,

(D) methods 2 and 3,

(E) methods 2 and 4,

(F) methods 2 and 5,

(G) methods 3 and 4, or

(H) methods 3 and 5.

(b) by referring to information concerning them that is received by the person or entity that is ascertaining their identity on request from a federal or provincial government body — or a body that is acting as the agent or mandatary of such a body — that is authorized in Canada to ascertain the identity of persons, and by verifying that either the name and address or the name and date of birth contained in the information are those of the person;

(c) by referring to information that is contained in the person’s credit file — if that file is located in Canada and has been in existence for at least three years — and by verifying that the name, address and date of birth contained in the credit file are those of the person;

(d) by doing any two of the following:

(i) referring to information from a reliable source that contains their name and address, and verifying that the name and address are those of the person,

(ii) referring to information from a reliable source that contains their name and date of birth, and verifying that the name and date of birth are those of the person, or

(iii) referring to information that contains their name and confirms that they have a deposit account or a credit card or other loan account with a financial entity, and verifying that information; or

(e) by confirming that one of the following entities previously ascertained their identity in accordance with any of paragraphs (a) to (d), and by verifying that the name, address and date of birth contained in the entity’s record are those of the person:

(i) an entity that is referred to in any of paragraphs 5(a) to (g) of the Act and that is affiliated with the entity that is ascertaining the person’s identity,

(ii) an entity that carries on activities outside Canada similar to the activities of a person or entity referred to in any of paragraphs 5(a) to (g) of the Act and that is affiliated with the entity that is ascertaining the person’s identity, or

(iii) a financial entity that is subject to the Act and that is a member of the same financial services cooperative or credit union central as the entity that is ascertaining the person’s identity.

(1.1) In the case referred to in paragraph 54.1(a), the identity of a person shall be ascertained by a person or entity, at the time referred to in subsection (2) and in accordance with subsection (3),

(a) by referring to the person’s birth certificate, driver’s licence, provincial health insurance card (if such use of the card is not prohibited by the applicable provincial law), passport or other similar document; or

(b) where the person is not physically present when the credit card application is submitted,

(i) by obtaining the person’s name, address and date of birth and

(A) confirming that one of the following entities has identified the person in accordance with paragraph (a), namely,

(I) an entity, referred to in any of paragraphs 5(a) to (g) of the Act, that is affiliated with the entity ascertaining the identity of the person,

(II) an entity that carries on activities outside Canada similar to the activities of a person or entity referred to in any of paragraphs 5(a) to(g) of the Act and that is affiliated with the entity ascertaining the identity of the person, or

(III) an entity that is subject to the Act and is a member of the same association as the entity ascertaining the identity of the person, and

(ii) subject to subsection (1.3), by using a combination of any two identification methods referred to in either Part A or Part B of Schedule 7, or

(iii) subject to subsection (1.3), where the person has no credit history in Canada and the credit limit on the card is not more than $1,500, by using combination of any two identification methods referred to in any of Parts A, B and C of Schedule 7.

(1.1) For the purposes of subparagraphs (1)(d)(i) to (iii), the information that is referred to must be from different sources, and the person whose identity is being ascertained and the person or entity that is ascertaining their identity cannot be a source.

(1.2) for the purposes of paragraphs (1)(b)(i) and (1.1)(b)(i), an entity is affiliated with another entity if one of them is wholly owned by the other or both are wholly owned by the same entity.

(1.2) The person or entity that is ascertaining the identity of a person who is at least 12 years of age but not more than 15 years of age may refer under subparagraph (1)(d)(i) to information that contains the name and address of one of the person’s parents or their guardian or tutor in order to verify that the address is that of the person.

(1.21) For the purposes of subparagraphs (1)(b)(i) and (1.1)(b)(i),

(a) a financial services cooperative and each of its members that is a financial entity are considered to be members of the same association; and

(b) a credit union central and each of its members that is a financial entity are considered to be members of the same association.

(1.3) A combination of methods referred to in sub-paragraph (1)(b)(ii) or (1.1)(b)(ii) or (iii) shall not be relied on by a person or entity to ascertain the identity of a person unless

(a) the information obtained in respect of that person from each of the two applicable identification methods is determined by the person or entity to be consistent; and

(b) the information referred to in paragraph (a) is determined by the person or entity to be consistent with the information in respect of that person, if any, that is contained in a record kept by the person or entity under these Regulations.

(1.3) If a document is used to ascertain identity under subsection (1), it must be original, valid and current. Other information that is used for that purpose must be valid and current and must not include an electronic image of a document.

(2) The identity shall be ascertained

(a) in the cases referred to in paragraph 54(1)(a) and subsection 57(1), and paragraph 60(a), before any transaction other than an initial deposit is carried out on an account;

(b) in the cases referred to in section 53, paragraph 54(1)(b), subsection 59(1) and paragraphs 59.3(a), 59.4(1)(a), 59.5(a), 60(b) and 61(b), at the time of the transaction;

(b.1) in the case referred to in section 53.1, before the transaction is reported as required under section 7 of the Act;

(b.2) in the case referred to in paragraph 54.1 (a), before any credit card is activated;

(c) in the cases referred to in paragraphs 55(a), (d) and (e), within 15 days after the trust company becomes the trustee;

(d) in the cases referred to in subsection 56(1) and paragraph 61(a), within 30 days after the client information record is created;

(e) in the cases referred to in paragraphs 59.1(a) and 59.2(1)(a), at the time of the transaction; and

(e.1) in the case referred to in paragraph 60(a), before any funds are disbursed; and

(f) in the case referred to in subsection 62(3), at the time a contribution in respect of an individual member of the group plan is made to the plan, if

(i) the member’s contribution is not made as described in paragraph 62(3)(a), or

(ii) the existence of the plan sponsor has not been confirmed in accordance with section 65 or 66.

(3) Unless otherwise specified in these Regulations, only original documents that are valid and have not expired may be referred to for the purpose of ascertaining identity in accordance with paragraph (1)(a) or (1.1)(a).

64.1 (1) A person or entity that is required to take measures to ascertain a person’s identity under subsection 64(1) or (1.1) may rely on an agent or mandatary to take the identification those measures described in that subsection only if that person or entity has entered into an agreement or arrangement, in writing, with that agent or mandatary for the purposes of ascertaining identity.

(2) A person or entity that enters into an agreement or arrangement referred to in subsection (1) must obtain from the agent or mandatary the customer information obtained by the agent or mandatary under that agreement or arrangement.

(2) The person or entity may rely on measures that were previously taken by an agent or mandatary to ascertain the person’s identity if the agent or mandatary was, at the time they took the measures,

(a) acting in their own capacity, whether or not they were required to take the measures under these Regulations; or

(b) acting as an agent or mandatary under a written agreement or arrangement — entered into with another person or entity that is required to take measures to ascertain a person’s identity — for the purposes of ascertaining identity under subsection 64(1).

(3) In order to rely on measures taken by an agent or mandatary under subsection (1) or (2), the person or entity shall

(a) have entered into a written agreement or arrangement with the agent or mandatary for the purposes of ascertaining a person’s identity under subsection 64(1);

(b) obtain from the agent or mandatary all of the information that the agent or mandatary used to ascertain the person’s identity; and

(c) be satisfied that the information is valid and current and that the agent or mandatary ascertained the person’s identity in the manner described in any of paragraphs 64(1)(a) to (d).

64.2 Every person or entity that is required under these Regulations to ascertain a person’s identity in connection with a record that the person or entity has created and is required to keep under these Regulations — or in connection with a transaction that they have carried out and in respect of which they are required to keep a record under these Regulations or under section 12.1 of the Proceeds of Crime (Money Laundering) and Terrorist Financing Suspicious Transaction Reporting Regulations — shall set out on or in, or include with, that record the person’s name and the following information:

(a) if the person or entity referred to an identification document under paragraph 64(1)(a), the type of document referred to, its reference number and the issuing authority and, if available, the place it was issued and its expiry date;

(b) if the person or entity referred to information under paragraph 64(1)(b), the source of the information, the type of information referred to, a reference number associated with the information and the date on which the person or entity verified the information;

(c) if the person or entity referred to information under paragraph 64(1)(c), the source of the information, the reference number associated with the search of the credit file and the date on which the person or entity verified the information;

(d) if the person or entity referred to information under paragraph 64(1)(d), the source of the information, the type of information referred to and the account number contained in it — or if there is no account number contained in it, a reference number associated with the information — and the date on which the person or entity verified the information; or

(e) if the person or entity confirmed under paragraph 64(1)(e) that another entity had previously ascertained the person’s identity, the name of that entity, the manner in which it previously ascertained the person’s identity under any of paragraphs 64(1)(a) to (d), the applicable information set out in one of paragraphs (a) to (d) of this section that is associated with that manner of ascertaining identity and the date on which the person or entity verified the information.

Submit comments by September 12, 2015

Comments must be submitted in writing during the comment period, either by email or snail mail:

Snail Mail:

Lisa Pezzack, Director Financial Systems Division,

Financial Sector Policy Branch Department of Finance

90 Elgin Street Ottawa, Ontario K1A 0G5

Email:

fcs-scf@fin.gc.ca

Need a Hand?

At Outlier, we believe that it is important to participate in decisions that affect you and your business. If you would like someone to look over your submission before you make comments to the Department of Finance, you can get in touch with us free of charge. We will look over your submission and make suggestions, without any cost to you. If you need a hand, please feel free to contact us.

We’ve created a marked-up version of the Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations (PCMLTFR) that reflects the draft amendments posted in the Canada Gazette on July 4th, 2015.

Here’s a printable and downloadable PDF file: PCMLTFR Mark-Up (July 4, 2015 Draft Amendments)

If you would like a copy of the file in Microsoft Word, please contact us.

Need A Hand?

Where Can You See The Draft Regulations?

Amendments to Canada’s Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations (PCMLTFR) will be published this Saturday, July 4th, 2015 in the Canada Gazette. There will be a 60 day comment period, open to all stakeholders.

Who Should Comment & Why Does It Matter?

We expect that the draft amendments will include, among other things, the inclusion of ‘dealers in digital currency’ as money services businesses (MSBs), and updates to the methods that can be used to identify customers in a non-face-to-face environment.

If you are a regulated entity under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), including:

Financial entities;
Life insurance;
Securities dealers;
Money services businesses;
Accountants;
Real estate;
Casinos;
Dealers in precious metals and stones; and
British Columbia notaries,

or if you are a digital currency business, the proposed amendments are likely to have an impact on the way that you do business.

The 60 day comment period is intended for stakeholders to submit meaningful feedback that can shape the law, and provide insight for lawmakers on how the regulations will impact Canadian businesses.

How Do You Comment?

Comments must be submitted in writing (either on paper or electronically).

Snail Mail:

Attention: Lisa Pezzack

Director, Financial Systems Division

Department of Finance

90 Elgin Street

Ottawa, Ontario, K1A 0G5

Email:

fcs-scf@fin.gc.ca

Make Your Voice Heard

These are the only official means to submit comments. We highly encourage all stakeholders to participate in this process.

Need A Hand?

Background

Reporting entities (REs) often ask us about penalties, in particular when they are published publicly. Since 2009, The Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) has issued Administrative Monetary Penalties (AMPs) against persons and entities that were found to have violated the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, and its associated Regulations. In many cases up to 2013, FINTRAC has published details on its website about each penalty, including the name of the person or entity, the dollar amount of the AMP, as well as the cited deficiencies. The AMP area of their website has two sections – a list of all published penalties, as well as a running total of AMPs imposed since December 30, 2008, divided by sector.

As of June 26, 2013, FINTRAC changed its policy regarding public notice of AMPs, so that they would be published if one or more of the following criteria are met:

The person or entity has committed a very serious violation; or
The base penalty amount is equal to or greater than $250,000, before adjustments are made in consideration of the person or entity’s compliance history and ability to pay; or
Repeat significant non-compliance on the part of the person or entity.

AMPs can only be published once the appeals process is exhausted, which can take years to complete. This process can include an appeal to FINTRAC’s director, and a subsequent appeal to the Canadian Federal court.

Understanding this context is vital for RE Compliance Officers. While trend information related to published and unpublished penalties is not likely of interest to frontline staff, understanding these patterns is useful in fielding questions from Senior Management and the Board of Directors.

We have conducted an analysis of data published on the FINTRAC’s website which shows a trend of an increasing number of unpublished AMPs since 2013. These unpublished AMPs were primarily imposed on the Credit Union/Caisse Populaire and Money Service Business (MSB) sectors.

Methodology

We have made all calculations using information available as of April 20, 2015. We examined publicly available information on FINTRAC’s webpage, using the running total of AMPs by sector and the list of public AMPs. We also examined a summary of AMPs as of October 2014 obtained by Outlier through an Access to Information request. Our analysis focuses only on the sectors that have received AMPs, either published or unpublished: Credit Unions (including Caisses Populaires), MSBs, Real Estate Brokers, Securities Dealers and Casinos.

In addition, we accessed “cached” versions of FINTRAC’s website to review past versions in order to include six public AMPs that were issued between August 19, 2009 and April 26, 2010. In accordance with FINTRAC policy, these were removed from FINTRAC’s website after the five year public notice period had expired. We have included this historical data in order to provide a full view of the penalties issued. It is noteworthy that there are likely additional penalties in the process of being appealed (this information cannot be made available until the appeals process is complete).

Published AMPs vs. Unpublished AMPs

By analyzing the list of published penalties, compared to the running total of AMPs, it appears that there have been a significant number of unpublished penalties:

Credit Unions

Credit Unions have received the largest number of unpublished penalties, both in terms of number and dollar amount. Credit unions have received 3 published AMPs, totalling $246,690. They have also received an additional 11 unpublished AMPs, totalling $405,855.

Trend analysis: This appears to be a significant increase in overall enforcement action by FINTRAC in the Credit Union sector. The total number of penalties against Credit Unions have increased sharply to 14, which means that Credit Unions now have the second largest number of listed AMPs (published and unpublished), behind MSBs. All penalties against Credit Unions since 2013 were unpublished. This data can also be interpreted to mean that FINTRAC’s enforcement efforts against Credit Unions have increased since 2013, however it is important to remember that AMPs are listed on FINTRAC’s website after they are finalized, which can mean a significant gap between when an AMP was issued and when it is listed, especially if there is an appeal involved.

Money Service Businesses (MSBs)

MSBs have received 22 published penalties, totalling $527,510. They also have received eight unpublished penalties, totalling $68,520. Interestingly, a $12,880 penalty that was published against an MSB on July 11, 2013 no longer appears on FINTRAC’s website.

Trend analysis: MSBs continue to be the leading sector in terms of receiving AMPs, although similar to the other sectors examined, the majority of AMPs that were against MSBs from late 2013 through to 2015 were unpublished.

Real Estate Brokers

Real Estate Brokers have received three published penalties totalling $40,520 compared to three unpublished penalties totalling $25,960.

Trend Analysis: Real Estate Brokers have received relatively few published and unpublished penalties in comparison to the Credit Union and MSB sectors. The number of unpublished penalties (compared to the number of published penalties) is consistent with trends across all sectors.

Securities Dealers

Securities Dealers have received four published penalties totalling $565,180 compared to one unpublished penalty of $21,480.

Trend Analysis: Securities Dealers have received relatively few published and unpublished penalties in comparison to the Credit Union and MSB sectors.

Casinos

Casinos have never received a published AMP, however FINTRAC’s website shows an unpublished AMP of $56,700 issued against a casino. This may be surprising to anyone that has read about BC Lottery Corporation, however, AMPs are not part of these records until the appeals process has been exhausted (and there have been successful appeals).

Trend analysis: It is difficult to establish a trend based on a single data point, however this unpublished AMP shows that the Casino sector is no longer unaffected by FINTRAC penalties.

What Does This All Mean?

Note: The dates on the above graph represent when FINTRAC’s website was analyzed to calculate the total number of penalties, with the exception of October 2014, which is the “as of” date of an AMP listing received in a Freedom of Information request. Data for unpublished AMPs is only available since 2013.

As of June 2013, FINTRAC began to apply the updated standard for publicly listing AMPs. Since this change, unpublished penalties comprise approximately 42% of all issued AMPs by amount and 43% by number. While this is excellent news for REs that are concerned with the negative media and other reputational risk related to published penalties, it will make it more difficult to assess the reasons that REs are receiving penalties. The specific violations that led to a penalty are only made public by FINTRAC when the AMP is published. In order to ensure that our Credit Union clients are well-informed about industry trends related to penalties, vCAMLO will be requesting additional information and performing trend analysis. Stay tuned!

Your Best Defence

To avoid AMPs, it is essential to constantly test for weaknesses in your compliance regime. Conduct rigorous effectiveness testing (this is required at least every two years), and consider more frequent testing. Finally, ensure that immediate steps are taken to remediate deficiencies received in FINTRAC exams. Deficiencies that re-appear in follow-up exams are taken seriously by FINTRAC, and can lead to penalties, published or not.

Need a Hand?

vCAMLO: If you are a credit union or MSB, and have any questions related to financial compliance, or if you are interested in AML Support Services, please contact us for a complimentary 30 minute compliance discussion.

Outlier: If you need assistance reviewing your technology solution or FINTRAC reporting to be certain that you’re meeting the standard described in this blog, or just someone to chat with to make sure that you’re on the right track, please contact us.

Sanctions This Week: February 29-March 6, 2016

OSFI

OFAC

Need A Hand?

Sanctions This Week: February 22-28, 2016

OSFI

OFAC

Need A Hand?

Is Your MSB Ready for a FINTRAC Exam?

In Person & Desk Examinations

The Introduction

Part 1 – FINTRAC MSB Registration

Part 2 – Compliance Policies & Procedures

Part 3 – Risk Assessment

Part 4 – Operational Compliance & Reporting

Exit Interview

After the Examination

Need a Hand?

AML “Clearance Certificates” are a Scam

The Setup

Don’t Get Caught Up

But if You Did, Protect Yourself

Report It

Need A Hand?

Proposed AML Amendments & Credit Unions

Background

Why Do These Changes Matter to Credit Unions?

New Member Identification Methods

Politically Exposed Persons

Reasonable Measures

Public Comments

Need a Hand?

Above And Beyond What?

Most Of Us Are Failing At The Basics

Shift The Focus

Keep It Simple (Seriously)

Ask, Check, Test

Opportunities & Innovation

Need A Hand?

AML Regulation Updates & Digital Currency

This round of amendments didn’t include ‘dealers in digital currency’ – so why should you comment?

Customer Identification Measures

Submit comments by September 12, 2015

Need a Hand?

Proposed PCMLTFR Updates

Need A Hand?

Draft AML Regulations Will Be Released July 4th

Where Can You See The Draft Regulations?

Who Should Comment & Why Does It Matter?

How Do You Comment?

Need A Hand?

Unpublished FINTRAC Penalties

Background

Methodology

Published AMPs vs. Unpublished AMPs

What Does This All Mean?

Your Best Defence

Need a Hand?

Return to Blog Listing