1. Risk-based approach Briefing to AML Seminar 10 May 2011 Paul de Weerd Financial Supervision Commission

2. Session Objectives Briefing on: Feedback from CSP/TSP visits Approaches to implementing the risk- based approach

3. Overview Four themes: Preparation Risks specific to the business Client risks Monitoring and review

4. AML/CFT risk v. other risks The AML risk rating under the Code is distinct from financial, legal, regulatory etc. risks under rule 8.6 The two can draw different conclusions, e.g. on unmanaged business

5. Part 1 - preparation: review typologies Available online through FATF www.fatf-gafi.org

6. Risk rating Ratings and how to apply them should be understood by staff Ideally, simple, consistent and easy to apply Targeted and relevant

7. Part 2: Identify the specific risks for your own business Typologies provide examples not answers Consider: Types of business undertaken Sources of business

8. Identify the risks in business acceptance Core part of addressing risk First line of defence Reliance on others? Structured approach

9. Identify control risks Lack of control over client entities and reliance on third parties Registered office or registered agent only and “Split” boards Powers of attorney

10. Record your actions What the risk is Mitigation or controls to be applied Action plan

11. Part 3: Risk assessment of clients Identify client-specific risks Apply additional safeguards to PEPS and other higher-risk clients

12. Develop a recording mechanism Develop and apply a suitable mechanism for recording your view of client risks Allow for different grades of risk Record additional steps taken Understood and used by staff

13. Part 4: Monitoring and review To make the process work in practice Monitoring of client relationships Review cycle

14. Monitoring Effective monitoring is essential Review cycle(s) Update ratings for new information Sign and date Track action points

15. Effective review procedures Part of corporate governance and effective oversight: Learn from experience Update both licenceholder risks and client risks