CONTENTS First: Main Points of National Risk Assessment Second: FIs Risk assessment and CDD

First: Main Points of National Risk Assessment

1) RISK ASSESSMENT IN THE FATF RECOMMENDATIONS Technical Compliance of FATF recommendation I Countries should identify and assess the ML/TF risks for the country and this includes: Resources should be allocated adequately in the AML/CFT regime and RBA should be applied on the FATF recommendations Identifying, assessing and understanding risks designate an authority or mechanism to co-ordinate actions to assess risks take enhanced measures to manage and mitigate the risks where higher risks are identified. Adopting a Risk Based Approach to ensure the coherence between AML/CFT measures and the degree of identified risk

IMMEDIATE OUTCOME 1 EVALUATING THE EFFECTIVENESS OF COMPLIANCE OF RECOMMENDATION I IMMEDIATE OUTCOME 1 Money laundering and terrorist financing risks are understood and, where appropriate, actions coordinated domestically to combat money laundering and the financing of terrorism and proliferation. 5

6 Key concepts relevant to ML/TF risk assessment Degree of understanding AML/CFT risks How adequate AML/CFT policies tackle identified risks How results of the assessment were used to justify enhanced or simplified measures, or exemptions from AML/CFT requirements How objectives and activities of competent authorities are in line with the national risk assessment The extent of cooperation and coordination between competent authorities to develop and implement AML/CFT policies and activities The country’s efforts to ensure awareness of FIs & DNFBPs of the outcome of ML/TF risks on the national level

Understanding risks to adequately and effectively deal with them Providing policy makers with the assessment results Identifying knowledge gaps Optimal allocation of resources Helping relevant entities in their own risk assessment providing assessment results to other mutual evaluation groups Understanding the purpose of the AML/CFT National Risk Assessment

ML/TF Risk assessment Reporting suspicious transactions Applying CDD Record Keeping Criminalization of ML & TF Efficient law enforcement Currency declaration/ disclosure AML/CFT Training FIs/DNFBPs internal systems Competent Judiciary

Bottom-up approach rather than top-down STRs Criminal Investigations Supervisory examinations Policy makers Legislators Supervisors National Strategies Budgets Guidance Papers Guidance Papers Legislations FIs Risk Assessments

10 Example on how the data are aggregated

11

12

13

Second: FIs Risk Assessment and CDD

FIs Obligations according to FATF Financial institutions and DNFBPs should be required to take appropriate steps to identify, assess, and understand their ML/TF risks (for customers, countries or geographic areas; and products, services, transactions or delivery channels).

This includes being required to: Document their risk assessments. Consider all the relevant risk factors before determining the overall risk and appropriate mitigation to be applied. Keep these assessments up to date. Have appropriate mechanisms to provide risk assessment information to competent authorities. Have controls to mitigate risks. Monitor the implementation of these controls & enhance them when necessary.

Regulations Guidance CDD Rules Issued by the Egyptian FIU

Customer Acceptance Policy Identifying & Verifying customers Monitoring Customer Transactions Updating customers’ data Elements of the CDD rules Risk assessment and Management Wire transfers rules

Examples of Types of Risks in FIs & DNFBPs Geographical Risks Customers’ Risks Risks of products and services Delivery Channels Risks

Products and Services Risk Identifying products and services that are considered more attractive to money launderers and are considered high risk including new or innovative products/services provided by the bank or linked to it. Banking Services Private Banking Wire transfers Assets Mgt Services Prepaid Cards Mobile Payments Internet Banking

Customers’ Risk Identifying the risk through CDD data & customers’ transactions. Identifying beneficial owners of legal persons to be able to judge the level of risk. Identifying various risk levels inside each risk category.

Examples of high risk customers PEPs Nonresident customers Customers who belong to FATF public statement countries. NPOs DNFBPs

Geographical Risk Residence Business Headquarters Source/Destination Of transactions Countries Subject to intl. sanctions FATF Public statement Terrorism Supporting Countries Countries with high crime rates

Risk Likelihood Consequences Composed of Economic Social financial Threats Vulnerabilities The General Risk Equation

VulnerabilityScoreThreats Scor e Likeliho od ConsequencesScore The bank provides a small variety of not fully controlled e- banking products and services 0.45Criminals can take advantag e of these products/s ervice to launder money or finance terrorism Bank is mildly subject to ML/TF risks (reputation, legal, operational) 0.45

VulnerabilityScoreThreats Scor e Likeliho od ConsequencesScore Low level of human resources in the compliance dept 0.60Criminals can penetrate the bank without being detected due to low level of monitoring  The compliance Department is not able to perform all its obligations.  Less chances of detecting ML/TF  Bank more subject to ML/TF risks (reputation, legal, operational) 0.80

VulnerabilityScoreThreats Scor e Likeliho od ConsequencesScore Half of the bank branches are in high risk countries 0.85More chances of dealing with criminals or more chances of ML/TF attempts  Less chances to access foreign markets.  Bank ratings might fall down.  Bank is more subject to ML/TF risks (reputation, legal, operational) 0.80

VulnerabilityScoreThreats Scor e Likeliho od ConsequencesScore Low number of PEPs dealing with the bank and are subject to high controls 0.30PEPs chances to launder the proceeds of corruption Bank is subject to a minor level ML/TF risks (reputation, legal, operational) resulting from PEPs 0.30

Risk analysis & assessment RiskLikelihoodConsequences 1 Half of the bank branches are in high risk countries Low level of human resources in the compliance dept The bank provides a small variety of not fully controlled e-banking products and services Low number of PEPs dealing with the bank and are subject to high controls

Medium-High Risk Low level of human resources in the compliance dept Low Risk Low number of PEPs dealing with the bank Medium-Low Risk The bank provides a small variety of not fully controlled e-banking products and services High Risk Half of the bank branches are in high risk countries Consequences Likelihood zero Heat map 1

Zero Low High Medium- High Risk To be dealt with in the nearest possible time Medium- High Risk To be dealt with in the nearest possible time Low Risk To be monitored Low Risk To be monitored High Risk Requires immediate action High Risk Requires immediate action Medium-Low Risk To be dealt with in a suitable time Medium-Low Risk To be dealt with in a suitable time 100% Consequences Likelihood Next … is to set steps to mitigate identified risks

Customer Acceptance Policy Customer’s Nationality Customer’s business activity Customer’s Reputation Other accounts connected with the customer

Continuous monitoring mechanisms in place for detecting any possible unusual patterns through: Risk High Medium Low System alerts

34