Red Flag Indicators for Capital Market Intermediaries

RED FLAG INDICATORS FOR CAPITAL MARKET INTERMEDIARIES 3 SEPTEMBER 2024

SECURITIES COMMISSION MALAYSIA 1 RED FLAG INDICATORS FOR CAPITAL MARKET INTERMEDIARIES The following red flag indicators are meant to facilitate capital market intermediaries (CMI) to identify suspicious circumstances where money may be laundered or used for terrorism financing/ proliferation financing. While one circumstance may not necessarily point to money laundering/terrorism financing/proliferation financing, the aggregation of several such circumstances might indicate a suspicious transaction. Presence of red flag indicator(s) together with risks posed by customers, products and services should be considered in monitoring, scrutinizing transactions and reporting of suspicious transactions where appropriate. These examples of red flag indicators are non-exhaustive and only provide possible indication of suspicious activities/ transactions. A. GENERAL 1.0 Large cash/ banker’s cheque transactions 1.1 Opening of trading/investment accounts with large cash/ banker’s cheques. 1.2 Larger or unusual settlements of securities transactions in cash form/ with banker’s cheque. 1.3 Crediting of a customer’s account using cash and by means of numerous deposit slips and/or banker’s cheques by the customer/third party where the amount of each deposit and/or banker’s cheque may or may not be substantial, but the total deposits and/or banker’s cheques are substantial. 2.0 Unusual Patterns of Transactions 2.1 Buying and selling of a security with no discernible purpose or in circumstances that appear unusual. 2.2 The intensity of transactions for an inactive trading account suddenly increases without plausible reason.  2.3 The entry of matching buys and sells securities, creating an illusion of trading. Such trading does not result in a bona fide market position and might provide ‘cover’ for a money launderer.  2.4 Unusually short period of holding securities. 2.5 Frequent selling of securities at significant losses.  2.6 Structuring transactions to evade substantial shareholding.  2.8 Simultaneous transfer of funds to a group of customers’ accounts from a third party. 2.9 Customers who consistently make profitable trades just before major company announcements. 2.10 Rapidly switching funds through multiple transactions to obscure the source of funds.

SECURITIES COMMISSION MALAYSIA 2 RED FLAG INDICATORS FOR CAPITAL MARKET INTERMEDIARIES 2.12 Customers holding significant open positions in futures contracts that may be disproportionate to their overall portfolio or financial capacity. 2.11 Mirror transactions i.e. large deposit/investment transactions and subsequent redemptions within a short period of time. 2.13 Large purchases and redemptions within a short duration of which the purpose of investments may be questionable. Some transactions resulted in gains while some at losses. 3.0 Transactions Incompatible with Customer’s Financial Standing  3.1 Transactions by a customer who suddenly starts making investments in large amounts when it is known to the CMI that the customer does not have the capacity to do so.  3.2 Transactions that cannot be matched with the investment and income levels of the customer. 3.3 Sudden significant spike in transactions, irregular with the customer’s usual trading or investment pattern. 3.4 The aggregate (or in tranches) value of private placement shares which were subscribed by the placee (customer) does not commensurate with the declared income and/or financial background of the placee. 3.5 Requests by a customer for investment management services where the source of funds is unclear or not consistent with the customer’s apparent financial standing. 4.0 Irregular Account Movements  4.1 Multiple accounts are used to transfer funds between accounts by generating offsetting losses and profits in different accounts. 4.2 Abnormal settlement instructions including payments to apparently unconnected parties. 4.3 Accounts with very large movements and subsequent fund transfers to offshore financial centres.  4.4 A customer who authorises fund transfer from his account to another customer’s account.  4.5 A customer whose account indicates large or frequent wire transfers, and these sums are immediately withdrawn.  4.6 A customer whose account shows active movements of funds with low level of trading transactions. 4.7 Sudden large amount and frequent transactions in an account which was reactivated after a long period of inactivity. 4.8 A customer who deposits large amounts in the CMI’s multiple bank accounts on the same day. 4.9 A customer who made large withdrawals from a previously dormant/inactive account, or an account which has just received an unexpectedly large deposit.

SECURITIES COMMISSION MALAYSIA 3 RED FLAG INDICATORS FOR CAPITAL MARKET INTERMEDIARIES 4.10 A customer whose accounts had multiple deposits via different modes of transactions (e.g. cash, ATM deposits, cheques, wire transfers, etc.) and/or by multiple depositors within a short period of time. 4.11 Account with multiple deposits in small sums and subsequently withdrawn within a short period of time, with minimal or no trading activity. 4.12 A customer who receives frequent deposits from third-party entities such as religious or charitable organisation then withdraws the funds within a relatively short period of time. 5.0 Suspicious Behaviour / Demeanour of a Customer 5.1 A customer who is reluctant to provide details and whose verification of identity proves unusually difficult.  5.2 A group of unconnected customers who: (a) share the same locality/correspondence address and/or email address; or (b) authorise a common third party to operate their accounts; or (c) open their accounts on the same day or about the same period and share the same locality/correspondence address and/or email address. 5.3 A customer who shows unusual concern for secrecy e.g. in the identity of beneficial owner of the account, his employment / business activity or assets and/or fails to indicate a legitimate source of funds. 5.4 A customer who registers a joint bank account with a broker, where the joint holder is a dealer representative or his/her spouse, for the specific purpose of receiving sales proceeds or making withdrawals from a trust account. 5.5 A customer who has undertaken a private placement offering over multiple tranches or multiple offerings and it does not commensurate with his/her declared net worth. 5.6 A customer who claims to have undertaken external financing for a large private placement offering but the origin and legitimacy of the financing could not be verified. 5.7 A customer who receives frequent deposits from third party individuals/entities with discernible or non-discernible relationships. 5.8 A customer who made frequent changes to his/her address and/or the authorised signatories. 5.9 A customer is accompanied by a third-party during onboarding/discussions with the dealer representative / agent where the third-party is more dominant. 5.10 Third party authorisation in respect of trading accounts involving non-active customers. 5.11 A customer who has adverse media reports that he/she is linked, directly or indirectly, to a known terrorist organization or is engaged in terrorist activities.

SECURITIES COMMISSION MALAYSIA 4 RED FLAG INDICATORS FOR CAPITAL MARKET INTERMEDIARIES 6.0 Suspicious Behaviour / Demeanour by an Employee / a Dealer Representative / a consultant or Marketing Representative of the CMI 6.1 There may be circumstances where the money laundering may involve employees / dealer representatives / consultants or marketing representatives of the CMI. Hence, if there is a change in these personnel’s characteristics e.g. lavish lifestyles, unexpected increase in performance, etc. the CMI may want to monitor such situations. 6.2 Multiple cash deposits by dealer representatives for the purpose of increasing their trading limits. 6.3 Active trading involving accounts related to a dealer representative e.g. spouse’s trading. 6.4 Recommendations or transactions that appear unsuitable for the customer’s risk tolerance, financial situation and/or investment objectives. 6.5 Complaints received on/against the CMI’s dealer representatives/consultants or personnel e.g. on alleged unauthorised transactions/trades, alleged misappropriation of client monies. 6.6 Multiple transactions with following characteristics by an ex-consultant who has been terminated by the CMI (may include but not limited to): (a) Deposits with cash and/or using bank drafts / banker’s cheques, followed by redemptions within a short duration thereafter; (b) Purpose of these investments may be questionable; and some transactions may even be at losses; and/or (c) The account functions as pass-through / temporary “parking” for funds with low average of monthly investment balances. 7.0 Dealing with Higher Risk Jurisdictions or Customers 7.1 Customers from/based in countries where high risk crimes may be prevalent e.g. fraud, bribery & corruption, smuggling, production of drugs or drug trafficking and organised crimes. 7.2 Customer is connected with a country of proliferation concern, or which allows for dual citizenship. 7.3 Customer or counterparty is found on publicly available lists of “denied persons” or has a history of export control contraventions. 7.4 Funds credited into customer accounts from and in countries – (a) associated with the production, processing or marketing of narcotics or other illegal drugs; or  (b) associated with other criminal conduct; or  (c) known as banking secrecy-haven country; or (d) generally known for money laundering, terrorist activities or proliferation concern; or (e) generally known for weak export control laws or weak enforcement of export control laws.

SECURITIES COMMISSION MALAYSIA 5 RED FLAG INDICATORS FOR CAPITAL MARKET INTERMEDIARIES PART B: EQUITY CROWDFUNDING AND PEER TO PEER FINANCING TRANSACTIONS Examples of red flags indicators or transactions specific to equity crowdfunding (ECF) and peer-to￾peer financing (P2P financing) transactions that may trigger suspicion are listed below. Where applicable, the general red flag indicators for capital market intermediaries set out in PART A are also relevant to ECF and P2P transactions. 1.0 Prospective/on-boarded issuer: (a) Company with unusual complex ownership structure; (b) Company with no apparent business purpose; (c) A newly established company with history of unexplained/unjustified high value and/or high frequency transactions (e.g. large transaction without economic/commercial purpose); or (d) Company with unexplained/unjustified sources of revenue, costs and/or payments which does not correspond to its nature of business. 2.0 Prospective/on-boarded issuer (for peer-to-peer financing only): (a) Issuers who frequently repay long-tenure investment notes within a short period of time; or (b) In relation to trade receivable and trade payable financing – i. High value invoices and/or large number of invoices issued by or to issuer from companies that are not related to issuer’s nature of business; or ii. High value invoices and/or large number of invoices issued by or to issuer are from companies that its existence is not verifiable. 3.0 Prospective/on-boarded investor: (a) Structured/multiple withdrawals of funds after being deposited without any investment; or (b) Beneficial owners of issuer(s) investing significant amount of money and/or frequently in fundraising campaign/investment notes hosted by the issuer(s).

SECURITIES COMMISSION MALAYSIA 6 RED FLAG INDICATORS FOR CAPITAL MARKET INTERMEDIARIES PART C: DIGITAL ASSETS Examples of red flags indicators or transactions specific to digital assets (DA) that may trigger suspicion are listed below. Where applicable, the general red flag indicators for capital market intermediaries set out in PART A are also relevant to DA. 1.0 Transaction Size and Frequency 1.1 Structuring transactions (frequent, short succession and regular pattern) in small amounts whether in fiat money or DA. 1.2 Making multiple high value transactions (especially when it does not commensurate with customer profile). (a) Immediately transferring DA to other virtual asset service providers and/or private wallets upon procuring the DA. (b) Activity of customer does not seem to indicate intention for DA as investment (one off purchase/trade and transfer, usually short period of holding) – potential mule accounts. 2.0 Transaction Patterns 2.1 New user making a large initial deposit (FIAT or DA) which is inconsistent with customer profile. 2.2 New user withdraws the DA and attempts to send the entire balance off platform. 2.3 Transactions involving various types of DA without logical commercial or investment purposes. 2.4 Frequent transfers in a short period of time to the same DA/ virtual asset account and/or wallet by more than one person (counterparty sending/beneficiary wallet receiving from multiple accounts). 2.5 Leaving large amounts of FIAT within account without trading activity. 2.6 Frequent internal transfers or receiving of DA (off-chain) between customers onboarded within ecosystem. 2.7 Wire transfer information submitted differ at different times (same wallet address, different names) 2.8 Refusal to provide information for unhosted wallets (private wallets). 2.9 Frequent or abnormal transfers to seemingly unconnected parties or from the same IP address across multiple customers.

SECURITIES COMMISSION MALAYSIA 7 RED FLAG INDICATORS FOR CAPITAL MARKET INTERMEDIARIES 3.0 Transactions that Facilitate Anonymity 3.1 Beneficiary/Sender wallet exhibits frequent dealings with the following type of services/products: (a) Peer-to-Peer (b) Mixer or Tumbler (c) Anonymity-enhanced Cryptocurrency or Privacy Coins 4.0 Suspicious Behaviour/ Demeanour 4.1 A group of unconnected customers who share a common correspondence address/ beneficiary/sender wallet address. 4.2 Dealing with wallets that are in close proximity (low number of “hops”) with sanctioned or blacklisted wallets. 4.3 Beneficiary/Sender wallets have a history of dealings with dark web. 4.4 Transactions initiated from non-trusted IP address, IP address from sanctioned jurisdictions, or IP address previously flagged as suspicious.