PART III.

AGENDA- PART III (chapters 6,7 and 8) Record keeping – statutory requirements Transaction records Format and retrieval of records Due diligence procedures for countries outside EEA Recognition and reporting of suspicious transactions Appointment and role of MLCO Internal reporting procedures External reporting procedures Education and training - statutory requirements Timing and content of training programs Methods of providing training

RECORD KEEPING – Statutory requirements. Need to be able to demonstrate compliance with the requirements of sections 58 & 68 of the Law Minimum records include (6.05): Client identity and due diligence All necessary documentary evidence and details relating to all transactions carried out on behalf of the client All relevant correspondence with clients or other persons with whom business relationship established Minimum retention period (6.04): 5 years after the termination of the business relationship or last transaction carried out (if no formal ending of the relationship)

RECORD KEEPING – Transaction records. Records must be kept for 5 years and must be sufficient to permit reconstruction of individual transactions (in order to provide adequate evidence in case of prosecution for criminal activity) For each transaction, need to keep record of (6.10): Name and address of client, including copies of official identification documents (e.g. passport) Name and address of counterparties Form of instruction or authority Account details from which funds were paid Form and destination of payment made Any business correspondence

RECORD KEEPING – Format and retrieval of records. Retention does not necessarily be in hard copy format – electronic or other form is permitted (6.11) Whatever the format, need to be available at request by MOKAS (6.12) Section 47 of the Law: Where evidence is kept electronically, information must be presented in a visible and legible form which can be taken away by MOKAS

Due diligence and client identification procedures for countries outside EEA. Due diligence and client identification procedures for Branches /subsidiaries of firms established in third countries outside the European Economic Area (EEA) must apply due diligence, client identification and record keeping procedures set out in the Law and ICPAC Directive – Firms must notify the branches / subsidiaries accordingly (6.14) If the AML legislation of the third country differs from the Law and ICPAC Directive, then the stricter of the two must be followed (6.15) If laws of the third country does not allow for equivalent measures to be taken, the firm must inform ICPAC immediately and take additional procedures to mitigate the risk of ML and TF (6.16)

Recognition of suspicious transactions. Difficult to define but usually a transaction that is inconsistent with client’s known legitimate activities or type for the client’s business. Key to recognition is knowing enough about client’s business to recognise suspicious transactions / activities Need to ask right questions and identify any warning signs (7.02 and 7.03) Need to provide sufficient guidance to staff to enable them to recognise suspicious transactions (7.04) Appendix D contains examples of what might constitute suspicious transactions/activities

Examples of suspicious transactions or activities. Set out in Appendix D of ICPAC Directive and include: Transfer of funds between bank accounts held in various countries through Cyprus without justified reasons Transfer of funds between group or related companies without justified reasons Deposits performed without legitimate supporting documentation Transactions without apparent purpose or unnecessarily complex Transactions or their size or volume not in line with usual practice or business activity Transfer of funds to and from countries with inadequate or no AML legislation and enforcement

Examples of suspicious transactions or activities (continued). Set out in Appendix D of ICPAC Directive and include: Client reluctant to provide complete information on the nature and purpose of its business, its key personnel and location Information provided by client not adequate or misleading and expensive to verify Unusual identification documents that cannot be readily verified Client introduced by a foreign financial organisation or a third party from a country with ineffective or no AML legislation and enforcement Complex trust or nominee network or legal structure

Appointment of a Money Laundering Compliance Officer (MLCO). Appointment of a Money Laundering Compliance Officer Section 69 of the Law requires the appointment of a MLCO MLCO must be sufficiently senior to command the necessary authority (7.09) The name and position of the MLCO must be notified in writing to MOKAS (7.10) Role and responsibilities of MLCO must be clearly specified and documented in the relevant manual (7.11) MLCO must have direct and timely access to all documents, data and information held by the firm (7.11) Directive (7.12) defines the minimum duties of the MLCO

Reporting of suspicious transactions. Any knowledge of suspicion should be promptly reported to MOKAS (section 27 of the Law) by the firm’s MLCO Employees should report suspicions to MLCO (7.15 - 7.17) Once suspicions are reported to MLCO, employees have satisfied requirements of the Law and are not personally liable for any non-compliance (7.07) Engagement letters should include relevant paragraph informing clients of the firm’s potential reporting obligations (7.08)

Reporting of suspicious transactions – Internal procedures. Firms have an obligation to ensure that (7.15): An adequately resourced and independent audit function to test compliance is in place (internal audit) All employees are aware of the name and duties of the MLCO Clear reporting chain is provided to employees to report any suspicion to MLCO(such reporting lines should be as short as possible) All Internal enquiries and suspicions reported should be be documented (7.19) MLCO should acknowledge receipt of suspicious activity reports received from firm’s personnel (7.20). All internal records of suspicions not reported to MOKAS must be retained for 5 years from the date of the transaction (7.22).

Reporting of suspicious transactions - External. MLCOs’ reports should be sent to MOKAS (7.23): Mrs Eva Rossidou Papakyriakou Senior Council of the Republic, Head of MOKAS Unit for Combating Money Laundering (MOKAS) Law Office of the Republic P.O. Box 23768 CY-1066 Nicosia Cyprus Tel.: +357 22 446 018, Fax: +357 22 317 063 Email: mokas@mokas.law.gov.cy

Reporting of suspicious transactions - External(continued). Appendix B of Directive provides ICPAC’s recommended specimen form for reporting to MOKAS by MLCO Any relevant evidence must also be provided to MOKAS (7.26) After filing the report, MOKAS may provide instructions to as to whether or not to continue a transaction or terminate a business relationship (7.25) Firms must not “tip-off” their client – specific procedures must be followed (7.27) Firms have a constructive trust to the true owner where an asset does not rightfully belong to a client - Precise reasons for likelihood of any liability as a constructive trustee should be reported to MOKAS (7.28 & 7.29)

Education and training – Statutory requirements. Section 59 of the Law requires that all staff are made aware of the firm’s policies and procedures and provide on-going training for recognition and handling of suspicious transactions and activities (8.01) Staff must be made aware of own statutory obligations – failure to report information in accordance with firm’s procedures could make them personally liable (8.02) All relevant staff need to be educated on the importance of “Know Your Client” (KYC) requirements – thorough knowledge of source of funds and type of business activities to assist in identifying suspicious activity (8.03)

Education and training – Timing and content of training programs . Education and training – Timing and content of Tailored training depending on level and position of staff, and size and nature of the firm (8.06) Induction courses for new personnel emphasising the importance of reporting of suspicions and their statutory obligations in this respect (8.08) Adequate training especially for advisory staff, staff who can accept new clients and partners and managers (8.09 – 8.11) In-depth training required for MLCOs (8.12) Regular refresher courses (usually annually) should be provided to all staff (8.13)

Education and training – Methods of providing training. No standard way – Key is to tailor the training according to size and nature of the firm and its clients (8.14) No specific training programs required (8.15) Important to establish on-going employee training on current ML and TF techniques, methods and trends (8.16)

THANK YOU