Suspicious Transactions and Activity Reporting Guidelines for Supervised Financial Institutions

SUSPICIOUS TRANSACTIONS/ACTIVITY REPORTING GUIDELINES ANTI-MONEY LUANDERING/COUNTERING THE FINANCING OF TERRORISM SUSPICIOUS TRANSACTION/ACTIVITY REPORTING GUIDELINES FOR SUPERVISED FINANCIAL INSTITUTIONS (SFIs) SEPTEMBER 2022

SUSPICIOUS TRANSACTIONS/ACTIVITY REPORTING GUIDELINES Table of Content

1. Introduction ............................................................................................................................................ 3
2. What is Suspicious transaction and Suspicious activity ........................................................ 5
3. Specific technical requirements for STR/SARs)........................................................................ 7
4. Reporting Suspicious Transaction and Activities ..................................................................... 8
5. Protection of identity of persons and information in STR/SAR.......................................... 8
6. Prohibition of Tipping Off.................................................................................................................. 8
7. Internal procedures for reporting of Suspicious transaction/activity............................. 9
8. TRANSACTION MONITORING ™ FRAMEWORK ......................................................................11 9 Identifying a suspicious transaction:...........................................................................................11 10 Review of the STR/SARS Guidelines .......................................................................................12

SUSPICIOUS TRANSACTIONS/ACTIVITY REPORTING GUIDELINES

1. Introduction 1.1 The Suspicious Transactions and Activity Reporting (STRs/SARs) guidelines has been prepared in accordance with Section 6 (27) of the Anti-Money Laundering (Amendment) Act 2017 which stipulates that a competent authority (hereafter referred to as Bank of Uganda or BOU) shall establish guidelines to assist accountable persons (hereafter referred to as Supervised Financial Institutions or SFIs) to implement and comply with the anti-money laundering (AML) and combatting the financing of terrorism (CFT) requirements provided in the AML Act. 1.2 The requirements to make STR/SARs are prescribed Anti-Money Laundering (Amendment) Act 2017, Amendment 5 which replaces Section 9 of the principal Act (the AMLA, 2013) and regulations 39 of the AML Regulations of 2015. Additionally, the prudential requirements for STR/SARs are prescribed in Principle 29: - Abuse of financial services – (Essential Criteria 3, 4, 5 (c), 9 (b) & (d) and 11) of the Basel Core Principles for Effective Supervision (September 2012 and the Recommendation 20 of the Financial Action Task Force (FATF) which prescribes the standards for technical compliance with the AML/CFT obligations of SFIs regarding STR/SARs. 1.3 This STR/SARs Guideline is intended to set out appropriate supervisory and prudential practices relating to the applicable AML/CFT laws and regulations regarding STR/SARs. Therefore, SFIs should incorporate and implement the supervisory and prudential aspects of the guideline in their practices as appropriate or as a minimum standard to align their AML/CFT practices regarding compliance with the STR/SARs requirements. 1.4 The requirements of the STR/SARs Guideline should be implemented by all SFIs in in Uganda which includes Commercial Banks (CBs), Credit Institutions (CIs), Micro-finance Deposit Taking Institution (MDIs), Foreign Exchange Bureaus (FXB) and Money Remittances Companies (MRs). 1.5 The STR/SARs practices provided in this Guideline sets out the minimum benchmark to enable the SFIs promptly report suspicious transactions or activities to the Financial Intelligence Authority if the SFI suspects or has reasonable grounds to suspect that funds are the proceeds of a criminal activity or are related to terrorist financing. It is provided as general information only and is not intended to replace the Act and the Regulations. The guideline therefore provide more elaborations, examples and good practices on how to implement the minimum standards prescribed in the law/regulation and to sensitize the SFIs on STR/SARs requirements and share some examples of red flags.

SUSPICIOUS TRANSACTIONS/ACTIVITY REPORTING GUIDELINES 1.6 Suspicious Transactions and Activity Reports (STRs/SARs) play a pivotal role in the fight against money laundering and terrorist financing (ML/TF). Information provided on STRs/SARs assist the Financial Intelligence Authority and Law Enforcement Authorities, in the disrupting criminal and terrorist activities, and can ultimately result in prosecution and imprisonment of money launderers and financers of terrorism activities. Additionally, STRs/SARs also provide authorities with valuable market intelligence on trends and typologies. 1.7 Whereas there are no hard and fast rules as to what constitutes suspicious transactions or activities SFIs should watch for activity that may be inconsistent with the SFI’s knowledge of the customer, their business and risk profile. Proper due diligence may require compliance personnel to gather further information regarding a customer or his or her transaction before deeming it suspicious and filing an STR or SARs with the FIA. A typical suspicious or unusual transaction/activity reporting process within a SFI as part of its AML/CFT program should at a minimum include the following. (a) Procedures to identify suspicious or unusual transactions or activity through employee observations, identification, inquiries from law enforcement or alerts generated by transaction monitoring systems (b) A formal evaluation of each instance, and continuation, of unusual transactions or activity (c) documentation of the suspicious transaction reporting decision (i.e., whether or not a report was filed with authorities) (d) procedures to periodically notify senior management or the board of directors of suspicious transaction filings; and (e) Continuous employee training on detecting suspicious transactions or activity. (f) Automation of the transaction monitoring, detection, analysis and reporting. The large number of customers and the volume of regulations and data involved in complying with regulations make manual AML/CFT compliance difficult, if not impossible. SFIs should therefore designate appropriate technology systems to automate their compliance activities to effectively and efficiently contribute to the fight against financial crime. Appropriate automation eases. (i) Customer verification through using third-party databases to compare information provided by a customer with source data.

SUSPICIOUS TRANSACTIONS/ACTIVITY REPORTING GUIDELINES (ii) Watch-list filtering by screening new accounts, existing customers, beneficiaries, and transaction of counterparties against terrorist, criminal and other blocked-persons sanctions and/or watch lists. (iii) Transaction monitoring by scanning and analysing transactional data for potential money laundering activity. (iv) Regulatory reporting through automated filing of suspicious transaction/activity reports (STR/SARs), and other regulatory reports with the government agencies. (v) Case management by providing a dashboard feature to view customer KYC, transaction history and any investigations undertaken, or regulatory filings filed on a customer. (vi) Audit trail through automatic documentation of steps taken to demonstrate compliance efforts to auditors and supervisory authorities. 2. What is Suspicious transaction and Suspicious activity 2.1 The Act defines a “suspicious transaction” as a transaction which is inconsistent with a customer’s known legitimate business or personal activities or with the normal business for that type of account or business relationship, or a complex and unusual transaction or complex or unusual pattern of transaction. 2.2 SFIs should be cognisant of the requirement in the AML (Amendment) Act 2017, Amendment 5 on “reasonable grounds” for an SFI to report to the Financial Intelligence Authority its suspicion of a transaction. “Reasonable grounds” should be interpreted to mean anything that a reasonable person would consider suspicious under the circumstances presented. A reasonable person would match the transaction/activity with the customer’s profile to determine whether the transaction/activity is suspicious and worthy of reporting to the FIA. When it turns out there to be no match between the customer’s profile and the transaction/activity in question, such transaction/activity is suspicious. 2.3 Regulation 39 of the AML Regulation, 2015 specifies that upon investigating and being fully satisfied that the transaction or activity is suspicious, the SFI should report to the Financial Intelligence Authority. 2.4 A suspicious activity is different from suspicious transaction. Suspicious activity is not a transaction per se but activities that may be derived from current or future transactions. This involves studying the behaviour of a customer, or potential customer or someone acting on behalf of the customer especially in terms of

SUSPICIOUS TRANSACTIONS/ACTIVITY REPORTING GUIDELINES documentations or information submitted for account opening or facilitating a transaction, which is suspicious in terms of ML/TF/PF. 2.5 Suspicious activities are indicative of the potential abuse of the financial system by criminals, money launderers and financiers of terrorism and proliferation activities. The STRs and SARs filed should indicate the “nature of the suspicious transaction or activity” to facilitate investigation by law enforcement agencies and prosecution (court) process. 2.6 In order to submit an STR/SAR to Financial Intelligence Authority, SFIs should ensure that they have completed the measures that enable establishment of a reasonable grounds to suspect that the transaction is related to the commission of a predicate offence that results into ML and on the other hand, commission of a TF offence. These measures include: (a) screening for and identifying suspicious transactions. (b) assessing the facts and context surrounding the suspicious transaction. (c) linking ML/TF indicators and red flags (refer to ANNEX 1 of indicators of suspicious transactions/activities) to the SFIs assessment of the facts and context; and (d) explaining SFI’s grounds for suspicion in an STR/SAR, where the SFIs should articulate how the facts, context and ML/TF indicators allowed the SFIs to reach reasonable grounds for suspicion. 2.7 A fact, for the purpose of completing an STR, is defined as an event, action, occurrence or element that exists or is known to have happened or existed — it cannot be an opinion. For example, facts about a transaction could include the date, time, location, amount or type. Facts known to the Money Laundering Control Officer (MLCO) could also include account details, particular business lines, the client's financial history or information about the person or entity (for example, that the person has been convicted of a designated offence or is the subject of a production order, or that an entity is being investigated for fraud or any other indictable offence). 2.8 Context, for the purpose of completing an STR, is defined as information that clarifies the circumstances or explains a situation or transaction. This type of information is essential to differentiate between what may be suspicious and what may be reasonable in a given scenario. You may observe or understand the context of a transaction through:

SUSPICIOUS TRANSACTIONS/ACTIVITY REPORTING GUIDELINES (a) A general awareness of the events occurring in a person or entity's business environment or community. (b) SFI’s knowledge of the typical financial activities found within the business. (c) Regular KYC activities (for example, verifying the identity of persons and entities, their occupation or business, how they generate their wealth, their typical or expected transactional behaviours, etc.); and (d) The information obtained through the application of the SFI’s risk assessment. 3. Specific technical requirements for Suspicious Transaction/Activity Reporting (STRs/SARs) 3.1 SFIs are required to report to the FIA if it suspects or has reasonable grounds to suspect that a transaction/activity or attempted transaction/activity involves proceeds of crime or funds related or linked to or to be used for ML/TF, regardless of the value of the transaction. The SFIs should make the report without delay but not later than two (02) working days/ 48 hours upon forming suspicion on an activity or transaction. 3.2 “Without delay” means when the SFI acquires that knowledge, forms a suspicion, or acquires those reasonable grounds to suspect ML/TF, the SFI should then submit the report through goAML platform to the FIA. This may be before the execution of a transaction/activity, or at the same time as the execution of a transaction/activity, or after a transaction/activity has occurred, depending on the nature of the knowledge, suspicion or reasonable grounds. 3.3 The report should be in the form as prescribed in the AML Regulations, 2015 Schedule B and should be accompanied by any documents directly relevant to that suspicion and the grounds on which it is based. 3.4 Additionally, according to regulation 12 (7) and (8) of the Anti-Terrorism Regulations 2016, SFIs must submit an STR/SAR to the FIA immediately if a designated entity1 attempts to enter a transaction/activity or continue a business relationship. However, generally, SFIs must not enter or “continue a business transaction or business relationship” with a designated entity. In reference to “continuing with a business transaction or business relationship” this implies the SFI should always conduct assessment of their existing customers to assess the risks of exposure to designated entities and undertake the necessary actions. 1 A designated entity means any individual or entity and their associates designated as terrorist entities by the United Nations Security Council (UNSC). SFI can also access the Security Council of the United Nations List (“the UN list”) on the UN website.

SUSPICIOUS TRANSACTIONS/ACTIVITY REPORTING GUIDELINES 4. Reporting Suspicious Transaction and Activities 4.1 In all cases, the SFI should immediately but not later than two (02) working days/ 48 hours file an STR/SARs once a determination of knowledge, a suspicion or reasonable grounds to suspect, ML/TF, has been made. The SFI may need to conduct further analysis and assessment to make its determination and the analysis and assessment should be conducted in a timely manner, however as soon as the SFI has established knowledge, a suspicion or reasonable grounds to suspect, it should immediately or promptly file an STR/SAR. 4.2 SFIs should put in place internal policies and procedures that will guide the process of reporting STRs. At a minimum the procedures should include established internal timeframe throughout the process within which potential STRs/SAR or alerts should be analysed and completed as well as certain circumstances where the timeframe can be exceeded, if necessary, and any relevant safeguards needed. 4.3 In certain situations where the SFI is not sure of the procedures it should adopt in each scenario regarding STR or SARs, SFIs should contact the FIA and seek further guidance. However, at the minimum, SFIs should develop their own policies and procedures to guide the STR reporting as indicated in Part 8 of this guidance. 4.4 The SFI should contact the FIA and seek guidance in urgent situations or in situations where the suspicious activity has the effect of removing the funds to a foreign jurisdiction if executed, or where it may be difficult for a law enforcement agency to trace such funds after the transaction has been executed. 5. Protection of identity of persons and information in suspicious transaction/activities reports. 5.1 The Staff of SFIs who make STR or SARs in good faith are protected from criminal and civil liability, even if [the Staff or employee] did not know precisely what the underlying criminal activity was, and regardless of whether illegal activity occurred (Section 9A of AMLA (as amended) 2017). 5.2 SFIs cannot be compelled to testify in courts of law about the reports made, the Staff identity is protected from disclosure and can only testify in court proceedings if the Staff wished to do so but cannot be compelled if the Staff do not wish to do so. 6. Prohibition of Tipping Off 6.1 In accordance with Section 117 of the AMLA (2013) and Regulation 14 of the AML Regulations 2015, SFIs are not permitted to inform anyone, including the

SUSPICIOUS TRANSACTIONS/ACTIVITY REPORTING GUIDELINES customer, about the contents of a STR or SAR or even that the SFI have made such a report to the FIA. As it is important not to tip the customer that the SFI is making a STR or SAR about them. 6.2 Customer due diligence should not be perceived as tip off when information is requested from the client as to the source and destination of funds. However, if a demand for clarity on a single transaction or attempted transaction may lead to tipping off, STR/SAR should be filed immediately with the FIA to investigate the matter. 6.3 SFIs should consider whether they should continue to act for a client when they have to submit an STR/SAR on that client. A relevant factor to consider would be whether they reasonably believe that to delay or to stop or the failure to proceed might make a client suspicious that a report may be or may have been made or that an investigation may commence or already has commenced. 7. Internal procedures for reporting of Suspicious transaction/activity 7.1 SFIs should put in place adequate internal policies and procedures to guide the STR and SARs process. In relation to the identification and escalation of internal STRs and SARs, SFIs should ensure that the end-to-end procedures for making STR or SARs internally to the MLCO (‘internal reporting procedures’) are adequately documented and that the internal reporting procedure captures all STRs or SARs requirements as prescribed in the AMLA, 2013 (as amended) and the implementing regulations. For example, the internal reporting procedures should include at least: (a) All required steps for the reporting of suspicions from staff to the MLCO, or any other person(s) charged under the SFI’s internal reporting process with investigating suspicions, and from the MLCO to the FIA. (b) Ensure that escalation of suspicious transactions or activity to the FIA is done not exceeding 2 working days from when a suspicion is raised. In addition, clearly define the timeline for MLCO to review all internally generated STRs. (c) Formal acknowledgement by the SFI’s MLCO or any other person(s) charged under the SFI’s internal reporting process with investigating suspicions raised internally by staff; and (d) Information on compliance with Section 117 of the AMLA 2013 and regulations 41 of the AML Regulation 2015; regulation 41 regarding prohibition of ‘Tipping-off’. Staff should be aware of their obligations, the penalties for the offence of Tipping Off and that they exercise caution after the filing of an STR/SARs.

SUSPICIOUS TRANSACTIONS/ACTIVITY REPORTING GUIDELINES 7.2 AML/CFT training provided to staff should include details on the SFI’s internal STR or SARs reporting procedure as well as details on the reporting of suspicions to the FIA 7.3 SFIs should ensure that there are no discrepancies between internal reporting procedures as documented and operational practices. For example, where the SFI’s internal reporting procedure states that suspicions are to be escalated using a reporting form then the raising of suspicions should not be conducted verbally. 7.4 SFIs using transaction monitoring system (TMS) should ensure there is regular review of the scenarios, or correlation between alerts generated from the TMS and the reporting of suspicious transactions to the FIA. Details of transaction monitoring are prescribed in Part 9 of this guidance. 7.5 Where a suspicion has been formed, the SFI’s records should provide sufficient detail of the assessment and adjudication giving rise to the decision to make a STR/SAR to the FIA or why the MLCO determines there are no reasonable grounds for making the STR to the FIA. For example: (a) The circumstances that gave rise to the suspicion. (b) The assessment or additional analysis that took place; and (c) The rationale for considering that there are no reasonable grounds for making STR or the basis for making a report to the authorities. 7.6 SFIs should retain sufficient information and sufficient documentation regarding the suspicious transaction/activity to support the SFI’s determination of whether considering that there are no reasonable grounds for making STR/SAR, or to proceed and file the STR /SARs with the FIA in line with regulation 28 AML Regulation, 2015. 7.7 Furthermore, the MLCO should retain information from the customer or the business lines for a minimum of 10 years after close of the business relationship. (for example any KYC information kept in the customer file, or transaction records, etc.). 7.8 Consideration to balance between the risk posed by the transactions/activities being assessed, the need to obtain further information while complying with the requirement to timely report to FIA. 7.9 Put in place a mechanism to facilitate the reporting of suspicious transaction / activity at branches, investigation and tracking for closure or further reporting to the FIA.

SUSPICIOUS TRANSACTIONS/ACTIVITY REPORTING GUIDELINES 8. TRANSACTION MONITORING ™ FRAMEWORK 8.1 SFIs should put in place effective TM framework to mitigate the exposure to the risk of being abused by criminals to place illicit funds within the Uganda’s financial system without detection. 8.2 An effective TM system is an important component of an effective AML/CFT compliance program. It supports efforts the SFI’s process of reporting ML and TF by helping in identify unusual or suspicious transaction that must be reported to the FIA. 8.3 SFIs should ensure the framework for effective execution Transaction Monitoring involve the following process: (a) Adequate oversight by senior management and the Board; (b) KYC process which include conducting ML/TF Risk Assessment and customer Due Diligence. (c) Risk-based calibrations of the transaction monitoring system which includes setting the parameter, threshold and scenario, back testing and data integrity. (d) Robust implementation which involves, pre-transaction checks of the transaction monitoring process, alerts handling and documentation. (e) Resolving and enhancement of the transaction monitoring system weakness which should include STR/SAR Filing and post STR practices; (f) Quality assurance (independent audits) and system Refinement (to minimize false positives/alerts). 9 Identifying a suspicious transaction: 9.1 When assessing potential suspicious transactions/activities, SFIs should consider attempted transactions, as well as completed transactions. 9.2 In addition, SFIs should note that there is no minimum monetary threshold for reporting and no amount should be considered too low for suspicion. This is particularly important when considering potential terrorist financing transactions which often involve very small amounts of money. 9.3 SFIs should consider their specific products, services and customers when deciding of suspicion, as what might be considered suspicious for one product, service or customer may not be for another.

SUSPICIOUS TRANSACTIONS/ACTIVITY REPORTING GUIDELINES 9.4 The following is a non-exhaustive list2 of examples of what might raise suspicions: 9.4.1 Factors to consider in identifying a suspicious transaction or activities: (a) The manner in which the transaction or activity was conducted or is attempted is a significant factor in assessing the suspicion. (b) This will vary from business to business and from client to client. (c) A transaction or activity should be evaluated in terms of what seems appropriate and is within normal practice in a particular line of business and based on knowledge of who the customer is. (d) The fact that transactions or activities do not appear to be in keeping with normal industry practices may be a relevant factor for determining whether there are reasonable grounds to suspect that the transactions or activities are related to ML/TF/PF. (e) Factors, including the knowledge of the customer’s business, economic/financial status, employment history, general background and behaviour of the customer are to be assessed in line with the type and value of the transaction to determine whether the transaction is suspicious. (f) All circumstances surrounding the transaction such as the source and destination parties, the jurisdiction (involving high risk jurisdictions)3 as well as beneficial owners where applicable should be thoroughly analysed. (g) Loan repayments inconsistent with a customer’s stated income, or early repayment of a loan followed by an application for another loan. Additional factors can be referred to under Annex 1. 10 Review of the STR/SARS Guidelines 2 SFIs should always refer to other reports regarding ML/TF Typologies as issued by the FIA, the risks assessment reports and other regional reports issued by the FATF. 3 High-risk jurisdictions as defined by FATF - have significant strategic deficiencies in their regimes to counter money laundering, terrorist financing, and financing of proliferation. For all countries identified as high-risk, the FATF calls on all members and urges all jurisdictions to apply enhanced due diligence, and in the most serious cases, countries are called upon to apply countermeasures to protect the international financial system from the ongoing money laundering, terrorist financing, and proliferation financing (ML/TF/PF) risks emanating from the country. This list is often externally referred to as the “blacklist”.

SUSPICIOUS TRANSACTIONS/ACTIVITY REPORTING GUIDELINES SFIs should ensure full compliance with this STR/SAR guidance and the SFIs are advised to compile and record any comments, which arise in relation to implementation of these guidelines for appropriated action. The comments should be forwarded to: The Office of the Executive Director, Supervision Directorate, Bank of Uganda, 3rd Floor Plot 45, Kampala Road, Kampala, Uganda. ANNEX 1 Indicators of Suspicious Transactions:

1. ML/TF indicators are potential red flags (i.e. warning signs that there is a problem that should be noticed or dealt with). They can initiate suspicion because they indicate that something may be unusual without a reasonable explanation.
2. Red flags typically stem from one or more facts, behaviours, patterns or other factors that identify irregularities related to a Customer’s transactions. These transactions often present inconsistencies with what is expected or considered normal based on the facts and context the SFIs knows about the customer and their transactional activities.

SUSPICIOUS TRANSACTIONS/ACTIVITY REPORTING GUIDELINES 3. On its own, an indicator may not initially appear suspicious. However, it could lead you to question the legitimacy of a transaction, which may prompt the SFI to assess the transaction to determine whether there are further facts, contextual elements or additional ML/TF indicators that would increase suspicion to the point where submitting an STR to FIA would be required. The following are the specific indicators by product. (a) General indicators i. Client curious about anti-money laundering, and prevention and combating of financing of terrorism and proliferation control measures. ii. Client presents contradictory details about the transaction or knows few details about its purpose. iii. Client appears to informally record large volume transactions, using unconventional bookkeeping methods or “off-the-record” books. iv. Client is secretive and reluctant to provide details regarding the transaction. v. Client appears nervous, and in a hurry. vi. Client insists that a transaction be done quickly. vii. Client is known to use multiple names. viii. Client attempts to develop close rapport with staff. ix. Client buys back a property that he or she recently sold. x. Client purchases multiple properties in a short time period, and seem to have few concerns about the location, condition, and anticipated repair costs, etc. of each property. xi. Client attempts to convince an employee not to complete any documentation required for the transaction. xii. Client makes inquiries that would indicate a desire to avoid reporting. xiii. Client seems very conversant with money laundering or financing of terrorism and proliferation activities. xiv. Client is quick to volunteer that funds are “clean” or “not being laundered.” xv. Client appears to be structuring amounts to avoid reporting thresholds. xvi. Client appears to be collaborating with others to avoid reporting thresholds. xvii. Client produces seemingly false identification or identification that appears to be false, altered or inaccurate. b) Personal Information i. Client conducts transactions at different physical locations to avoid detection. ii. Client is always accompanied by unknown person(s) and is being watched when transacting. iii. Client particulars incorrect: - telephone number provided not operational, residential address non-existent etc. iv. Client appears to be acting on behalf of a third party but does not tell.

SUSPICIOUS TRANSACTIONS/ACTIVITY REPORTING GUIDELINES v. The transaction does not appear to make sense or is out of keeping with usual or expected activity for the client. vi. Client spells his or her name differently from one transaction to another. vii. Client provides false information or information that is believed to be unreliable. viii. Client offers money, gratuities or unusual favours for the provision of services that may appear unusual or suspicious. ix. Client with unexplained wealth. x. Client is a PEP and is servicing loans with cash from unknown sources. xi. Client is a PEP and his/her lifestyle is extravagant: vacations financed with cash from unknown sources. xii. Client is a PEP and his/her salary paid in the bank is not being utilized. xiii. Client is a PEP, and his salary is depleted by way of servicing loans and nothing appears to have been left for his/her livelihood, but still lives a lavishing life. xiv. A new or prospective client is known to you as having a questionable legal reputation or criminal background. xv. Client refuses to produce personal identification documents. xvi. Client only submits copies of personal identification documents. xvii. Client wants to establish identity using something other than his or her personal identification documents. xviii. Client’s supporting documentation lacks important details such as a phone number. xix. All identification documents presented appear new or have recent issue dates. xx. Client presents different identification documents at different times. xxi. Client alters the transaction after being asked for identity documents. xxii. Client presents different identification documents each time a transaction is conducted. xxiii. Client frequently exchanges small bills for large ones. xxiv. Client presents notes that are packed or wrapped in a way that is uncommon for the client. xxv. Client deposits dusty or extremely dirty bills. xxvi. Client makes Large Cash Transactions of consistently rounded-off large amounts. xxvii. Client presents uncounted funds for a transaction. Upon counting, the client reduces the transaction to an amount just below that which could trigger reporting requirements. xxviii. Client conducts a transaction for an amount that is unusual compared to amounts of past transactions. xxix. Stated occupation of the client is not in keeping with the level or type of activity (for example a student or an unemployed individual makes daily maximum cash withdrawals at multiple locations over a wide geographic area). xxx. Transaction seems to be inconsistent with the client’s apparent financial standing or usual pattern of activities. xxxi. Transaction appears to be out of the normal course for industry practice or does not appear to be economically viable for the client. xxxii. Transaction is unnecessarily complex for its stated purpose.

SUSPICIOUS TRANSACTIONS/ACTIVITY REPORTING GUIDELINES xxxiii. Opening accounts when the client’s address is outside the local service area. xxxiv. Opening accounts in other people’s names. xxxv. Funds are being deposited into several accounts, consolidated into one and transferred outside the country. xxxvi. Client frequently uses many deposit locations outside of the home branch location. xxxvii. Multiple transactions are carried out on the same day at the same branch but with an apparent attempt to use different tellers. xxxviii. Activity far exceeds activity projected at the time of opening of the account. xxxix. Account that was reactivated from inactive or dormant status suddenly sees significant activity. xl. Reactivated dormant account containing a minimal sum suddenly receives a deposit or series of deposits followed by frequent cash withdrawals until the transferred sum has been removed. xli. Multiple deposits are made to a client’s account by third parties. xlii. Client and other parties to the transaction have no apparent ties to Uganda. xliii. Client has no employment history but makes frequent large transactions or maintains a large account balance. xliv. The flow of income through the account does not match what was expected based on stated occupation of the account holder or intended use of the account. xlv. Client makes frequent or large payments to online payment services. xlvi. Client runs large positive credit card balances. xlvii. Client wishes to have credit and debit cards sent to international or domestic destinations other than his or her place of business. xlviii. There is a marked increase in transaction volume on an account with significant changes in an account balance that is inconsistent with or not in keeping with normal business practices of the client’s account. xlix. Asset acquisition is accompanied by security arrangements that are not consistent with normal practice. l. Absence of contributions from donors located in Uganda. li. Large number of non-profit organizations with unexplained links. lii. The non-profit organization appears to have little or no staff, no suitable offices or no telephone number, which is incompatible with their stated purpose and financial flows. liii. Stated occupation of the client or the client’s financial standing is not in keeping with the level or type of activity (for example a student or an unemployed individual who receives or sends large numbers of wire transfers). liv. Client suddenly repays a problem loan unexpectedly. lv. Client makes a large, unexpected loan payment with unknown source of funds, or a source of funds that does not match what you know about the client. lvi. Client repays a long-term loan, such within a relatively short time period. lvii. Source of down payment is inconsistent with borrower’s background and income. lviii. Down payment appears to be from an unrelated third party.

SUSPICIOUS TRANSACTIONS/ACTIVITY REPORTING GUIDELINES lix. Down payment uses a series of money orders or bank drafts from different financial institutions. lx. Client wants to use cash for a large transaction. lxi. Client proposes to purchase an insurance product using a cheque drawn on an account other than his or her personal account. lxii. Client requests an insurance product that has no discernible purpose and is reluctant to divulge the reason for the investment. lxiii. Client who has other small policies or transactions based on a regular payment structure makes a sudden request to purchase a substantial policy with a lump sum payment. lxiv. Client conducts a transaction that results in a conspicuous increase in investment contributions. lxv. Scale of investment in insurance products is inconsistent with the client’s economic profile. lxvi. Unforeseen deposit of funds or abrupt withdrawal of funds. lxvii. Involvement of one or more third parties in paying the premiums or in any other matters involving the policy. lxviii. Overpayment of a policy premium with a subsequent request to refund the surplus to a third party. lxix. Funds used to pay policy premiums or deposits originate from different sources. lxx. Client makes payments with small denomination notes, uncommonly wrapped, with postal money orders or with similar means of payment. lxxi. The first (or single) premium is paid from a bank account outside the country. lxxii. Transaction involves use and payment of a performance bond resulting in a cross-border payment. lxxiii. Accounts that have been inactive suddenly experience large investments that are inconsistent with the normal investment practice of the client or their financial ability. lxxiv. Any dealing with a third party when the identity of the beneficiary or counterparty is undisclosed. lxxv. Client attempts to purchase investments with cash. lxxvi. Unrelated clients redirect funds toward the same account. lxxvii. Transaction of very large dollar size. lxxviii. Client is willing to deposit or invest at rates that are not advantageous or competitive. lxxix. All principals of client are located outside Uganda. lxxx. Payments made by way of third-party cheques are payable to, or endorsed over to, the client. lxxxi. Transactions made by your employees, or that you know are made by a relative of your employee, to benefit unknown parties. lxxxii. Third-party purchases of shares in other names (i.e., nominee accounts). lxxxiii. Transactions in which clients make settlements with cheques drawn by, or remittances from, third parties.

SUSPICIOUS TRANSACTIONS/ACTIVITY REPORTING GUIDELINES lxxxiv. Unusually large amounts of securities or stock certificates in the names of individuals other than the client. lxxxv. Client maintains bank accounts and custodian or brokerage accounts at offshore banking centres with no explanation by client as to the purpose for such relationships. lxxxvi. Client requests a transaction at a foreign exchange rate that exceeds the posted rate. lxxxvii. Client wants to pay transaction fees that exceed the posted fees. lxxxviii. Client exchanges currency and requests the largest possible denomination bills in a foreign currency. lxxxix. Client knows little about address and contact details for payee, is reluctant to disclose this information, or requests a bearer instrument. xc. Client wants a cheque issued in the same currency to replace the one being cashed. xci. Client wants cash converted to a cheque and you are not normally involved in issuing cheques. xcii. Client wants to exchange cash for numerous postal money orders in small amounts for numerous other parties. xciii. Client enters transactions with counter parties in locations that are unusual for the client. xciv. Client instructs that funds are to be picked up by a third party on behalf of the payee. Client makes large purchases of traveller’s cheques not consistent with known travel plans. xcv. Client makes purchases of money orders in large volumes. xcvi. Client requests numerous cheques in small amounts and various names, which total the amount of the exchange. xcvii. Client requests that a cheque or money order be made out to the bearer. xcviii. Client requests that a large amount of foreign currency be exchanged to another foreign currency. xcix. Client appears to be living beyond his or her means. c. Client has cheques inconsistent with sales (i.e., unusual payments from unlikely sources). ci. Client has a history of changing bookkeepers or accountants. cii. Client is uncertain about location of company records. ciii. Company carries non-existent or satisfied debt that is continually shown as current on financial statements. civ. Company has no employees, which is unusual for the type of business. cv. Company is paying unusual consultant fees to offshore companies. cvi. Company records consistently reflect sales at less than cost, thus putting the company into a loss position, but the company continues without reasonable explanation of the continued loss. cvii. Company shareholder loans are not consistent with business activity. cviii. Examination of source documents shows misstatements of business activity that cannot be readily traced through the company books.

SUSPICIOUS TRANSACTIONS/ACTIVITY REPORTING GUIDELINES cix. Company makes large payments to subsidiaries or similarly controlled companies that are not within the normal course of business. cx. Company acquires large personal and consumer assets (i.e., boats, luxury automobiles, personal residences and cottages) when this type of transaction is inconsistent with the ordinary business practice of the client or the practice of that particular industry. cxi. Company is invoiced by organizations located in a country that does not have adequate money laundering laws and is known as a highly secretive banking and corporate tax haven. cxii. Client presents a significant amount of cash. cxiii. Client purchases property in the name of a nominee such as an associate or a relative (other than a spouse). cxiv. Client does not want to put his or her name on any document that would connect him or her with the property or uses different names on Offers to Purchase, closing documents and deposit receipts. cxv. Client inadequately explains the last-minute substitution of the purchasing party’s name. cxvi. Client negotiates a purchase for market value or above asking price, but records a lower value on documents, paying the difference “under the table”. cxvii. Client sells property below market value with an additional “under the table” payment. cxviii. Client pays initial deposit with a cheque from a third party, other than a spouse or a parent. cxix. Client pays substantial down payment in cash and balance is financed by an unusual source or offshore bank. cxx. Client purchases personal use property under corporate veil when this type of transaction is inconsistent with the ordinary business practice of the client. cxxi. Client purchases property without inspecting it. cxxii. Client is known to have paid large remodelling or home improvement invoices with cash, on a property for which property management services are provided. c) Corporate and Business Transactions i. Client uses aliases and a variety of similar but different addresses. ii. Client pays for services or products using financial instruments, such as money orders or traveller’s cheques, without relevant entries on the face of the instrument or with unusual symbols, stamps or notes. iii. Client insists on providing signature on documents by fax only. iv. Information obtained from reliable source (media or other open sources) indicate that a client is suspected of being involved in illegal activity. v. Client pays rent or the amount of a lease in advance using a large amount of cash. vi. Transaction involves a suspected shell entity (that is, a corporation that has no assets, operations or other reason to exist). vii. Client inordinately delays presenting corporate documents. viii. All identification presented is foreign or cannot be checked for some reason.

SUSPICIOUS TRANSACTIONS/ACTIVITY REPORTING GUIDELINES ix. Client starts conducting frequent Large Cash Transactions reports in large amounts when this has not been a normal activity for the client in the past. x. Client frequently purchases traveller’s cheques, foreign currency drafts or other negotiable instruments with cash when this appears to be outside of normal activity for the client. xi. Shared address for individuals involved in Large Cash Transactions reports, particularly when the address is also for a business location or does not seem to correspond to the stated occupation (for example, student, unemployed, self￾employed, etc.). xii. Cash is transported by a cash courier. xiii. Large transactions using a variety of denominations. xiv. Activity is inconsistent with what would be expected from declared business. xv. A business client refuses to provide information to qualify for a business discount. xvi. No business explanation for size of transactions or cash volumes. xvii. Transactions of financial connections between businesses that are not usually connected (for example, a food importer dealing with an automobile parts exporter). xviii. Transaction involves non-profit or charitable organization for which there appears to be no logical economic purpose or where there appears to be no link between the stated activity of the organization and the other parties in the transaction. xix. Client makes one or more cash deposits to general account of foreign correspondent bank (i.e., pass-through account). xx. Opening accounts with names very close to other established business entities. xxi. Attempting to open or operating accounts under a false name. xxii. Account with a large number of small cash deposits and a small number of large cash withdrawals. xxiii. Establishment of multiple accounts, some of which appear to remain dormant for extended periods. xxiv. Deposits or withdrawals of multiple monetary instruments, particularly if the instruments are sequentially numbered. xxv. Frequent deposits of bearer instruments (for example, cheques, money orders) in amounts just below a determined threshold. xxvi. Unusually large cash deposits by a client with personal or business links to an area associated with drug trafficking. xxvii. Regular return of cheques for insufficient funds. xxviii. Accumulation of large balances, inconsistent with the known turnover of the client’s business, and subsequent transfers to overseas account(s). xxix. Offers of multimillion-dollar deposits from a confidential source to be sent from an offshore bank or somehow guaranteed by an offshore bank. xxx. Transactions involving an offshore “shell” bank whose name may be very similar to the name of a major legitimate institution. xxxi. Client takes cash advance to deposit into savings or cheque account.

SUSPICIOUS TRANSACTIONS/ACTIVITY REPORTING GUIDELINES xxxii. Large cash payments for outstanding credit card balances. Client makes credit card overpayment and then requests a cash advance. Client visits the safety deposit box area immediately before making cash deposits. xxxiii. Client wishes to have credit and debit cards sent to international or domestic destinations other than his or her address. xxxiv. Client has numerous accounts and deposits cash into each of them with the total credits being a large amount. xxxv. Client deposits large, endorsed cheques in the name of a third-party. xxxvi. Client frequently makes deposits to the account of another individual who is not an employer or family member. xxxvii. Client frequently exchanges currencies. xxxviii. Client frequently makes automatic banking machine deposits just below the reporting threshold. xxxix. Client’s access to the safety deposit facilities increases substantially or is unusual considering their past usage. xl. Many unrelated individuals make payments to one account without rational explanation. xli. Third parties make cash payments or deposit cheques to a client’s credit card. xlii. Client gives power of attorney to a non-relative to conduct large transactions. xliii. Client has frequent deposits identified as proceeds of asset sales, but assets cannot be substantiated. xliv. Client acquires significant assets and liquidates them quickly with no explanation. xlv. Client acquires significant assets and encumbers them with security interests that do not make economic sense. xlvi. Accounts are used to receive or disburse large sums but show virtually no normal business-related activities, such as the payment of payrolls, invoices, etc. xlvii. Accounts have a large volume of deposits in bank drafts, cashier’s cheques, money orders or electronic funds transfers, which is inconsistent with the client’s business. xlviii. Accounts have deposits in combinations of monetary instruments that are atypical of legitimate business activity (for example, deposits that include a mix of business, payroll, and social security cheques). xlix. Accounts have deposits in combinations of cash and monetary instruments not normally associated with business activity. l. Business does not want to provide complete information regarding its activities. li. Financial statements of the business differ noticeably from those of similar businesses. lii. Representatives of the business avoid contact with the branch as much as possible, even when it would be more convenient for them. liii. Deposits to or withdrawals from a corporate account are primarily in cash rather than in the form of debit and credit normally associated with commercial operations. liv. Client maintains a number of trustee or client accounts that are not consistent with that type of business or not in keeping with normal industry practices.

SUSPICIOUS TRANSACTIONS/ACTIVITY REPORTING GUIDELINES lv. Client operates a retail business providing cheque-cashing services but does not make large withdrawals of cash against cheques deposited. lvi. Client pays in cash or deposits cash to cover bank drafts, money transfers or other negotiable and marketable money instruments. lvii. Client purchases cashier’s cheques and money orders with large amounts of cash. lviii. Client deposits large amounts of currency wrapped in currency straps. lix. Client makes a large volume of seemingly unrelated deposits to several accounts and frequently transfers a major portion of the balances to a single account at the same bank or elsewhere. lx. Client makes a large volume of cash deposits from a business that is not normally cash intensive. lxi. Client makes large cash withdrawals from a business account not normally associated with Large Cash Transactions reports. lxii. Client consistently makes immediate large withdrawals from an account that has just received a large and unexpected credit from abroad. lxiii. Client makes a single and substantial cash deposit composed of many large bills. lxiv. Small, one-location business makes deposits on the same day at different branches across a broad geographic area that does not appear practical for the business. lxv. There is a substantial increase in deposits of cash or negotiable instruments by a company offering professional advisory services, especially if the deposits are promptly transferred. lxvi. There is a sudden change in Large Cash Transactions reports or patterns. lxvii. Unexplained transactions are repeated between personal and commercial accounts. Activity is inconsistent with stated business. lxviii. Account has close connections with other business accounts without any apparent reason for the connection. lxix. Activity suggests that transactions may offend securities regulations, or the business prospectus is not within the requirements. lxx. The organization’s directors are outside Uganda, particularly if large outgoing transactions are made to the country of origin of the directors and especially if that country is a high-risk jurisdiction. lxxi. The non-profit organization has operations in, or transactions to or from, high risk jurisdictions. d) Electronic funds transfer (EFTs) i. Client is a PEP and receives funds from unusual sources. ii. Client asks you to hold or transmit large sums of money or other assets when this type of activity is unusual for the client. iii. Unexplained transfers between the client’s products and accounts. iv. Large transfers from one account to other accounts that appear to be pooling money from different sources.

SUSPICIOUS TRANSACTIONS/ACTIVITY REPORTING GUIDELINES v. Correspondent accounts being used as “pass-through” points from foreign jurisdictions with subsequent outgoing funds to another foreign jurisdiction. vi. Multiple personal and business accounts are used to collect and then funnel funds to a small number of foreign beneficiaries, particularly when they are in locations of concern, such as countries known or suspected to facilitate money laundering activities. vii. Transaction crosses many international lines. viii. Use of a credit card issued by a foreign bank that does not operate in Uganda by a client that does not live and work in the country of issue. ix. Cash volumes and international remittances in excess of average income for migrant worker clients. x. Excessive demand for migrant remittances from individuals or entities based on migrant worker population. xi. Transactions involving high-volume international transfers to third party accounts in countries that are not usual remittance corridors. xii. Transaction involves a country known for highly secretive banking and corporate law. Transactions involving any countries deemed by the Financial Action Task Force as requiring enhanced surveillance. xiii. Foreign currency exchanges that are associated with subsequent wire transfers to locations of concern, such as countries known or suspected to facilitate money laundering and financing of terrorism and proliferation activities. xiv. Deposits followed within a short time by wire transfer of funds to or through locations of concern, such as countries known or suspected to facilitate money laundering and financing of terrorism and proliferation activities. xv. Transaction involves a country where illicit drug production or exporting may be prevalent, or where there is no effective anti-money-laundering and prevention and combating of the financing of terrorism and proliferation activities regime. xvi. Transaction involves a country known or suspected to facilitate money laundering and financing of terrorism and proliferation activities. xvii. Frequent requests for traveller’s cheques, foreign currency drafts or other negotiable instruments. xviii. Unexplained electronic funds transfers by client on an in and out basis. xix. Use of letter-of-credit and other method of trade financing to move money between countries when such trade is inconsistent with the client’s business. xx. Use of a credit card issued by an offshore bank. xxi. Client uses cash advances from a credit card account to purchase money orders or drafts or to wire funds to foreign destinations. xxii. Funds frequently withdrawn from the client’s account at various ATMs (Automatic Teller Machines) in a foreign jurisdiction where money laundering and financing of terrorism are rife. xxiii. Client requests movement of funds that are uneconomical. xxiv. High volume of wire transfers is made or received through the account. xxv. Client applies for secondary debit cards, which will eventually be handed over to unknown individuals in jurisdictions were terrorism is rife.

SUSPICIOUS TRANSACTIONS/ACTIVITY REPORTING GUIDELINES xxvi. A large number of incoming and outgoing wire transfers take place for which there appears to be no logical business or other economic purpose, particularly when this is through or from locations of concern, such as countries known or suspected to facilitate money laundering activities. xxvii. Client is reluctant to give an explanation for the remittance. xxviii. Client orders wire transfers in small amounts in an apparent effort to avoid triggering identification or reporting requirements. xxix. Client transfers large sums of money to overseas locations with instructions to the foreign entity for payment in cash. xxx. Client receives large sums of money from an overseas location and the transfers include instructions for payment in cash. xxxi. Client makes frequent or large funds transfers for individuals or entities who have no account relationship with the institution. xxxii. xxxiii. Client receives frequent funds transfers from individuals or entities who have no account relationship with the institution. xxxiv. Client receives funds transfers and immediately purchases monetary instruments prepared for payment to a third party which is inconsistent with or outside the normal course of business for the client. xxxv. Client requests payment in cash immediately upon receipt of a large funds transfer. xxxvi. Client gives instructions to transfer funds abroad and to expect an equal incoming transfer. xxxvii. Immediately after transferred funds have cleared, the client moves the funds to another account or to another individual or entity. xxxviii. Client shows unusual interest in funds transfer systems and questions the limit of what amount can be transferred. xxxix. Client transfers funds to another country without changing the currency. xl. Large incoming wire transfers from foreign jurisdictions are removed immediately by company principals. xli. Client sends frequent wire transfers to foreign countries but does not seem to have connection to such countries. xlii. Wire transfers are received from entities having no apparent business connection with client. xliii. Size of funds transfers is inconsistent with normal business transactions for that client. • Rising volume of remittances exceeds what was expected from the client when the relationship was established. xliv. Several clients request transfers either on the same day or over a period of two to three days to the same recipient. xlv. Different clients request transfers that are all paid for by the same client. xlvi. Several clients requesting transfers share common identifiers, such as family name, address or telephone number. xlvii. Several different clients send transfers that are similar in amounts, sender names, test questions, free message text and destination country. xlviii. A client sends or receives multiple transfers to or from the same individual.

SUSPICIOUS TRANSACTIONS/ACTIVITY REPORTING GUIDELINES xlix. Proposed transactions are to be funded by international wire payments, particularly if from countries where there is no effective anti-money-laundering system. e) Loans i. Loans secured by obligations from offshore banks. ii. Loans to or from offshore companies. iii. Client shows income from “foreign sources” on loan application without providing further details. iv. Client’s employment documentation lacks important details that would make it difficult for you to contact or locate the employer. v. Client’s documentation to ascertain identification, support income or verify employment is provided by an intermediary who has no apparent reason to be involved. vi. Client has loans with offshore institutions or companies that are outside the ordinary course of business of the client. vii. Client offers you large deposits or some other form of incentive in return for favourable treatment of loan request. viii. Client asks to borrow against assets held by another financial institution or a third party, when the origin of the assets is not known. ix. he loans transaction does not make economic sense (for example, the client has significant assets, and there does not appear to be a sound business reason for the transaction). x. Customer seems unconcerned with terms of credit or costs associated with completion of a loan transaction. xi. Client applies for loans on the strength of a financial statement reflecting major investments in or income from businesses incorporated in countries known for highly secretive banking and corporate law and the application is outside the ordinary course of business for the client. xii. Down payment or other loan payments are made by a party who is not a relative of the client. xiii. Unanticipated and inconsistent modification of client’s contractual conditions, including significant or regular premium top-ups.