2023 NFIU Guidelines on STR Filing

NFIU/EXT/PUB/GDNTE/AC-COMP/FI-DNFI/2-MAY-2023/VOL.01/001 Guidance to Reporting Institutions on Preparing a Complete Suspicious Transaction / Activity Report and Filing Electronically to the Nigerian Financial Intelligence Unit (NFIU)

Pursuant to Section 7 of the Money Laundering (Prevention and Prohibition) Act 2022, Section 84 of the Terrorism (Prevention and Prohibition) Act 2022, and Section 3(q) of the Nigerian Financial Intelligence Unit Act 2018, the Nigerian Financial Intelligence Unit (NFIU), in fulfilment of its obligations, publishes this guidance to improve the quality of Suspicious Transactions Reports rendered by Reporting Entities NIGERIAN FINANCIAL INTELLIGENCE UNIT GUIDANCE NOTE

Contents Introduction .................................................................................................................................................. 3 Collection of Information for the STR/SAR Narrative ................................................................................... 4 WHO is conducting a suspicious transaction or activity? ......................................................................... 5 WHAT instruments or mechanisms are being used to facilitate the “suspicious” transaction(s)/Activity?............................................................................................................................. 5 WHEN did the suspicious activity take place? .......................................................................................... 6 WHERE did the suspicious transaction/activity take place? ..................................................................... 6 WHY does the Reporting Entity think the transaction/activity is suspicious? .......................................... 7 HOW did the suspicious transaction or activity occur? ............................................................................ 8 Conducting Internal Investigation and Organizing Information In The STR Narrative ................................. 9 Filing The Suspicious Transaction or Activity Report to The NFIU ................................................ 14 Tipping Off .................................................................................................................................................. 15 Protection of Staff ....................................................................................................................................... 16 Feedback ..................................................................................................................................................... 16 Penalty For Non-Compliance With This Guideline ..................................................................................... 16

3 | P a g e NFIU GUIDANCE NOTE Introduction

The purpose of the Suspicious Transaction Report/Suspicious Activity Report (STR/SAR) is to report any known or suspected violations of the law or suspicious activity observed by Financial Institutions and Designated Non-Financial Businesses and Professionals. This report should be subject to the provisions of the Money Laundering (Prevention and Prohibition) Act, 2022, the Terrorism (Prevention and Prohibition) Act, 2022, as well as the various AML/CFT Regulations and other relevant circulars and guidelines issued by regulators and international organization (FATF and UN resolutions) on AML/CFT/CPF. Financial institutions (FIs)1, and Designated Non-Financial Businesses and Professions (DNFBPs), also known as Reporting Entities (REs), are required to file STRs/SARs promptly (within 24 hours from when the STR/SAR occurred). STRs/SARs are primarily filed on the goAML platform. In many instances, analysis of STRs/SARs has been instrumental in investigations of money laundering, terrorist financing, and other predicate crimes. Information provided in STRs/SARs also assists the Nigerian Financial Intelligence Unit (NFIU) in identifying emerging trends and patterns associated with financial crimes thereby providing vital intelligence to law enforcement agencies and valuable feedback to Reporting Entities. The NFIU has observed inconsistencies in the narratives of STRs/SARs filed by reporting entities on the goAML platform, impacting the usefulness and timeliness of the analysis conducted and intelligence disseminated to competent authorities. These include STRs/SARs with incomplete, inaccurate, and disorganized narratives and in some instances no narrative provided. The failure of reporting institutions to adequately describe the factors making a transaction or activity suspicious undermines the very purpose of the STRs and lessens their usefulness to law enforcement. The STR/SAR narrative serves as the only free text section of the reporting platform for summarizing any suspicious activity, and therefore, it is essential that reporting institutions/compliance officers provide narratives that are clear, concise, and coherent. Late filing, absence of supplementary STR information, or inaccuracies in STRs also impact negatively on law enforcement’s ability to determine whether a crime has been committed, and the magnitude of criminal activity being committed. Therefore, it is imperative that reporting institutions file complete STRs/SARs promptly. 1 Section 30 of the Money Laundering (Prevention and Prohibition) Act 2022 extends the definition of financial institutions to include Virtual Assets Service Providers (VASPs). Therefore, all references to Financial Institutions in this guidance applies to VASPs.

4 | P a g e NFIU GUIDANCE NOTE Section 7 of the MLPPA 2022 and Section 84 of the TPPA mandate Reporting Entities to file STRs/SARs. Though Reporting Entities perform a variety of transactions, the basic structure for an STR/SAR narrative remains the same for all sectors. Therefore, the purpose of this Guidance is to sensitize RE on filing STRs/SARs and on how to organize and write constructive narratives that maximize the value of each STR/SAR through:

• the uses of a simple methodology for evaluating and reporting information for the STR narrative and why it is important, and
• organizing the STR narrative systematically so that critical information is concise and follows a logical order of presentation. Information presented in this guidance document should be used in conjunction with other user guides such as guides for Reporting Entities on Electronic Reporting as well as Lookup tables, regulations, circulars and guidance issued by respective regulators. This information on how to prepare a complete and sufficient Suspicious Transaction/Activity Report Narrative is provided solely to assist respective FIs, and DNFBPs in strengthening existing due diligence initiatives on AML/CFT/CPF. Collection of Information for the STR/SAR Narrative The information generated from STR filings plays a vital role in identifying potential illegal activities such as money laundering, terrorist financing, proliferation financing and other financial crimes, and assists law enforcement agencies in detecting and preventing the flow of illicit funds through the financial and non￾financial systems. It is critical that the information provided in STR/SAR filing be as accurate and complete as possible. The STR/SAR should include any information available to the filing institution obtained through the account opening process and during due diligence efforts such as transaction monitoring or customer record update. A good STR/SAR narrative should identify the five essential elements of information – Who? What? When? Where? and Why? of the suspicious transaction or activity that is being reported. The narrative should also include how the transaction or activities was carried out (the method of operation), as this provides vital additional information to the STR/SAR. This guidance will assist FIs and DNFPBs in providing information that addresses each of the elements to improve the quality of the STR/SAR filed.

5 | P a g e NFIU GUIDANCE NOTE WHO is conducting a suspicious transaction or activity?

The goAML STR template calls for specific “suspect” information details, however, the narrative field should be used to further describe the suspect(s), including occupation, title or rank within the business, and the nature of the suspect’s business(es). If more than one individual or business is involved in the suspicious transaction or activity, all suspects and any known relationships among them must be included in the Narrative Section. While detailed “suspect” information may not always be available (e.g., in situations involving non-account holders or a third party), reporting entities should include as much information to the maximum extent possible, such as Biometric Verification Number (BVN). Addresses of suspects are necessary, and reporting institutions should note not only the suspect’s primary street addresses but also other known address fields, including house, plot or flat or apartment numbers when applicable. Any form of identification numbers associated with the suspect(s) other than those provided earlier is also beneficial, such as staff identity, visa type and number, expatriate registration, driver’s license numbers, international passport number, voters card, National Identity Number, e-mail addresses, telephone numbers, etc. Examples Mr XYZ has a savings account opened at the ABC branch on April, 20xx, with Bank Verification Number, 222xxxxxxx, phone number +234xxxxxxxx, and address at Block 1, Flat C, Mr. P’s Compound, Road7 Extension, Fed Housing, DEF State. ABC Limited with account number xxx started a business relationship with yyy Bank Plc on June 19xx. The Company and proprietor’s details are hereby given: Account Name/Number: ABC limited /xxx Name of Signatory: Mrs QRS Address: 14 E Street Secretariat Road PP State Date of birth: 5th June, 19xx BVN: 22xxxxxxxxx ID type/Number: International Passport/Axxxxxxxx Issue/Expiry date: Mobile Number: +2348xxxxxxx

WHAT instruments or mechanisms are being used to facilitate the “suspicious” transaction(s)/Activity? An illustrative list of instruments or mechanisms that may be used in suspicious transactions or activity includes the following; cash transactions, wire transfers,

6 | P a g e NFIU GUIDANCE NOTE letters of credit, certificate of capital importation and other trade or financial instruments, correspondent accounts, shell companies, bonds/notes, stocks, mutual funds, insurance policies, claims or annuity, checks, bank drafts, money orders, credit/debit cards, stored value cards, property documents, precious metals and stones, digital currency/asset, and business services. Several methods may be employed for initiating the negotiation of funds or buying of shares or negotiation of insurance policies such as online, phone, e-mail, agents and couriers.

Examples During our review of the subject account opened on November 04 2021, we observed that on August 20xx, the account witnessed a huge cash withdrawal in the sum of $875,000.00 by Mr, Further review shows that the account has a repetitive pattern of receiving inflows followed by huge cash withdrawals.

WHEN did the suspicious activity take place? If the transaction or activity takes place over a period, reporting entities should indicate the date(s) the suspicious transaction(s)/activity(ies) were first noticed and describe the duration of the activity. Reporting entities often provide a tabular presentation of suspicious account activities (transactions in and out). While this information is useful and retained, do not insert objects, tables, or pre-formatted spreadsheets when filing an STR. These can be attached to the STR template under ‘Attachment’. These items may not convert accurately when keyed in or merged into the STR System. Furthermore, specific dates and amounts of transactions should be included in the narrative rather than just the aggregated amount(s). Example Structured inflows from ABC LTD on 20/08/20xx are the major reason for suspicion. The customer received inflows from XYZ LTD in tranches of NGNaamillion, NGNbbmillion and NGNccmillion the same day. The inflow of NGNdd million from DEF on March 14, 20xx, also deviated from his usual transaction threshold of NGN5 million. This is the highest inflow received in the last one year. WHERE did the suspicious transaction/activity take place? The “Narrative” section on the goAML platform should include information on the offices or branches of all FIs and DNFBPs involved in the suspicious transaction/activity and provide the addresses of those locations if known. The narrative should indicate if the suspected transaction (s) or activity involves foreign jurisdiction. Details of the foreign jurisdiction, including the FI(s) and/or

7 | P a g e NFIU GUIDANCE NOTE DNFBP(s) involved, address(es), the suspected person(s) or entity(ies) affiliated with the suspected transaction (s) or activity(ies) should be provided. Example During the investigation and based on the outcome of our Enhanced Due Diligence (EDD), the following observations were made: Mr A resides and operates from jurisdiction A. This is a high-risk jurisdiction as noted in the FATF’s list of high-risk jurisdictions. The email maintained on this account (abc@xyz.jurisdiction a) makes it more suspicious. WHY does the Reporting Entity think the transaction/activity is suspicious? It is recommended that the reporting entity’s sector/industry or nature of business is briefly introduced (e.g. Deposit money bank (DMB), Primary mortgage banker, securities dealer/broker, insurance underwriting, bureau de change, real estate, financial/legal advisory services). The reporting entity should, as detailed as possible, describe why the transaction or activity is unusual for the customer, the existing transaction pattern known to the reporting entity, unusual behaviour and requests, and resistance to providing additional information. It should also describe the existing patterns for comparison with the transactions/activities that have triggered the STR/SAR filing. The NFIU has provided a list of indicators under the STR template to assist in this regard. Example of a good narrative The customer received an inflow of NGN5 million on 13th October 20xx. This is the highest inflow received in the last one year. The customer has done a cumulative credit turnover of NGN300m in the last two and half months (from August to date) and this amounts to 41% of the cumulative credit turnover for the last one-year period reviewed. This shows that recent transactions on the account deviates from usual transaction dynamics. 4. The customer features occasionally on our one-to-many transfer to more than ten customer alerts. He made a transfer to 16 personal accounts on June 11, 20xx, amounting to a total of NGN1bn: and to 16 personal accounts on July 6, 20xx, amounting to a total of NGN8bn. Enhanced due diligence report showed that the customer deals in the supply of sea foods. The seafood industry in the landlocked country of jurisdiction A is a major source of sustenance.

Examples of some common patterns of suspicious transactions or activity are: a. A lack of evidence of legitimate business activity, or any business operations at all, undertaken by many of the parties to the transaction (s);

8 | P a g e NFIU GUIDANCE NOTE b. Unusual financial nexuses and transactions occurring among certain business types (e.g., a food importer dealing with an auto parts exporter); c. Transactions that are not commensurate with the stated business type or that are unusual and unexpected in comparison with the volumes of similar businesses operating in the same locale; d. Unusually large numbers or volumes of wire transfers or repetitive wire transfer patterns; e. Unusually complex series of transactions indicative of layering activity involving multiple accounts, banks, parties, jurisdictions; f. Suspected shell entities; g. Bulk cash and monetary instrument transactions; h. Unusual mixed deposits of money orders, third-party checks, and payroll checks, into a business account; i. Transactions were conducted in bursts of activities within a short period, especially in previously dormant accounts; j. Transactions or volumes of aggregate activity inconsistent with the expected purpose of the account and expected levels and types of account activity conveyed to the financial institution by the account holder at the time of the account opening; k. Beneficiaries maintaining accounts at foreign banks in flagged jurisdictions or that have been subjects of previous STR filings; l. Parties and businesses that do not meet the standards of routinely initiated due diligence and anti-money laundering oversight programs (e.g., unregistered/unlicensed businesses); m. Transactions seemingly designed to or attempting to avoid reporting and recordkeeping requirements, and correspondent accounts being utilized as “pass￾through” points by foreign jurisdictions with subsequent outgoing funds to another foreign jurisdiction. Further indicators of ML/TF are provided on the goAML template to assist reporting institutions. HOW did the suspicious transaction or activity occur? Use the Narrative field on the goAML to describe the “modus operandi” or the method of operation of the subject conducting the suspicious Transaction or activity. In a concise, accurate and logical manner, give a breakdown of the steps, actions and

9 | P a g e NFIU GUIDANCE NOTE methods instruments used to create the suspicious transaction or pattern of transactions committed. Provide as detailed as possible a full picture of the suspicious transaction or activity involved. For example, if what appears to be the structuring of deposits is matched with outgoing wire transfers from the accounts, the STR narrative should include information about both the inbound and outbound transfers (including amounts, dates, destinations, accounts, frequency, and beneficiaries of the funds transfers). Common methods used include cash, wire transfers, and structured deposits. When summarizing the movement of funds, always include the source of the funds (origination) that led to the application for a service or product, or recipient’s use of the funds (as beneficiary), or both. In documenting the movement of funds, identify all FI and DNFBP services or products used, such as account numbers at the financial institution affected by the suspicious transaction or activity and where possible, policy number, property details, unit of shares and the names/locations of the other FIs or DNFBPs, including foreign institutions involved in the reported transaction/ activity. It is essential that the location of depositor(s) and the beneficiary(ies) is provided.

Example The customer has been receiving inflows from Mr A, Mrs B and Dr. C through wire transfer, usually followed by immediate or next-day cash withdrawal. Prior to this time, there were repetitive wire transfers from the above-mentioned senders followed by immediate or next-day cash withdrawals and transfers. Conducting Internal Investigation and Organizing Information In The STR Narrative Reporting entities are expected to conduct internal investigations on the suspected transaction/activity and summarize the outcome of the internal in the STR narrative in a concise and chronological format. The internal investigation report must be conducted as soon as possible to enable reporting entities to capture and report all elements of the five W’s and an H (Who? What? When? Where? Why? And How?) Note that it is only by conducting a thorough internal investigation that reporting institutions can be able to address all the issues previously discussed in Section 1 of this document, as well as the provision of any other information that can assist the NFIU and law enforcement agencies in conducting thorough analysis and investigation respectively. Reporting entities are expected to present the narrative in three sections or paragraphs: an introduction, a body, and a conclusion.

10 | P a g e NFIU GUIDANCE NOTE Introduction: The introductory paragraph should provide: i. The purpose of the STR and a general description of the known or alleged violation [In some instances, this might warrant mentioning at the outset the type of suspicious transaction or activity being monitored, such as Informal Money Transfer System (IMTS) operations, smurfing, shell entities, complex layering activities, structuring, early policy termination, embezzlement]; ii. The date of any STR(s) filed previously on the suspect or related suspects and the reason why the previous STR(s) was filed; iii. Whether the STR is associated with any watchlist such as the Office of Foreign Assets Control’s (OFAC) sanctioned countries or Specially Designated Nationals and Blocked Persons or other government watchlists for individuals or organizations; iv. A summary of the “red flags” and suspicious patterns of activity that initiated the STR. (This information can be provided either in the introduction or conclusion of the narrative) Body: The next paragraph or paragraphs of the narrative can provide all pertinent information − supporting why the STR was filed and might include: Any or all relevant facts about the party(ies) (individuals and businesses) that facilitated the suspicious activity or transactions. Include any unusual observations such as suspected shell entities; financial activities which are not commensurate with the expected normal business flows and types of transactions; unusual multiple-party relationships; verbal customer statements; unusual or complex series of transactions indicative of layering; lack of business justification and documentation supporting the activity; Specific description of the involved accounts and transactions, identifying if known, both the origination and application of funds (usually identified in chronological order by date and amount); Disaggregating substantial volumes of financial activity into categories of credits and debits and by date and amount; The sender and beneficiary information; providing as much detail as possible. This should include the name and location of any involved domestic and/or international financial institution(s); names, addresses, account numbers, and any other available identifiers of originator and beneficiary and/or third parties or business entities on whose behalf the conductor was acting; the date(s) of the transaction(s); and amount(s);

11 | P a g e NFIU GUIDANCE NOTE An explanation of any observed relationships among the transaction parties or persons (e.g., joint accounts or group policy, addresses, employment/ employer, known or suspected business relationships and/or frequency of transactions occurring amongst them; signatory and account name or beneficial owner); Specific details on transactions that identify the branch(es) or location(s) where the transaction(s)/activity occurred, the type of transaction(s), and how the transaction(s)/activity occurred (e.g., deposit, online banking, ATM, etc.); Other observations or incriminating statements made by the suspect, especially when filing SARs. Conclusion: The final paragraph of the narrative should summarize the report findings and include: Information about any follow-up actions conducted by the reporting entity (e.g., intent to place the account under ‘POST NO DEBIT or blocking of accounts, termination of Insurance policy, ongoing monitoring of activity); Contact details of liaison staff at the reporting entity if different from the authorized personal filing the STR. A general description of any additional information related to the reported transaction or activity that may be made available to law enforcement by the institution; and Details of other law enforcement agency(ies) already investigating the case, where applicable. Examples of a good STR narrative Introduction (provides an overview of the customer and introduces the reason for suspicions. Also answers WHO – details of the primary subject of the STR) Customer A (account no 00000xxx) has a Savings Account opened at branch A on 21/12/20xx, with Bank Verification Number, 222xxxxxxx, phone number +xxxxxxxxxxx, and address at ABC Compound, Fed Housing, City X, AA State. Recent unusual transaction on the account though the customer resides abroad is the major reason for suspicion. During the investigation and based on the outcome of our Enhanced Due Diligence (EDD), the following observations were made: 1. The customer operates from jurisdiction A (as deduced from his phone number). This is a high-risk jurisdiction as jurisdiction A is on the FATF list of high-risk jurisdiction. The email maintained on this account (rustem.yakimov@inbox.ru)

12 | P a g e NFIU GUIDANCE NOTE makes it more suspicious.

Body (answers the 5Ws and H. provides a detailed analysis of the transaction that has triggered the STR) Structured inflows from ABC Limited on 20/10/xxxx are the major reason for suspicion. The customer received inflows from ABC Limited in tranches of NGN7 million, NGN4 million and NGN3 million the same day. The inflow of NGN28,028,000 from XYZ limited (another bank account- account no BBB) on 15/10/xxxx, also deviated from his usual transaction threshold of NGN5 million. This is the highest inflow received in the last one year. 3. The customer has done a cumulative credit turnover of NGN228,194,284.90 in the last two and half months (from August to date) and this amounts to 41% of the cumulative credit turnover (NGN 551,108,131) for the last one-year period reviewed. This shows that recent transactions on the account deviates from usual transaction dynamics. 4. The customer features occasionally on our one-to-many transfer to more than ten customer alerts. He made the transfer to 16 personal accounts on 11/10/xxxx, amounting to a total of NGN1,921,494.53: and to 16 personal accounts on 6/10/xxxx, amounting to a total of NGN8,445,448.

Conclusion (additional investigation conducted by the FI) Enhanced due diligence report showed that the customer deals in a supply of sea foods. The seafood industry in the landlocked country of jurisdiction A is a major source of sustenance.

Introduction (Provides details of the primary subject of the STR) ABC Nig Limited operates a domiciliary (USD) account with the Bank. The account was opened on 7/06/xxxx, and it is domiciled at AA Branch. The signatory to the account is Mr. B. As stated on the KYC form the customer is into trading. During the investigation and based on information at our disposal, the following were discovered. Body (answers the 5Ws and H. provides a detailed analysis of the transaction that has triggered the STR) A search on Accuity and the public domain returned negative as no adverse news was found against the customer. On 28/10/xxxx, the customer received the sum of $4,582.05 via a fintech application in three tranches of $1,527.35 from Mr M. On October 26, 2022, the customer received the sum of $2,993.06 via the same fintech application in two tranches of $1,496.53 respectively. The customer has been

13 | P a g e NFIU GUIDANCE NOTE receiving multiple inflows from 15 individuals totaling $xxx, all through another fintech application, and is usually followed by immediate or next-day cash withdrawal. Prior to this time, there were repetitive wire transfers from the above￾mentioned senders followed by immediate or next-day cash withdrawals and transfers. The cumulative credits and debits from inception to date are $72,503.49 and $ 67,919.88, respectively. The current balance in the account is $4,583.61.

Conclusion (additional information sought from the customer) Upon enquiry through the relationship manager, the customer claimed he is into trading. however, he was unable to provide any supporting documentation. Example of a bad narrative ABC Limited was opened at XYZ branch. on 17/09/20xx there was a huge cash deposit of 16 million naira. the cash lodgment is huge Comments: The narration does not clarify why the inflow is sufficient for filing an STR. It does not include an analysis of the customer’s profile, including the nature of the business. This narrative can be enhanced with details of the nature of the business of the client, the payer and relationship with the client, the reason given (if any) for payment and why the payment is made as a cash deposit. We reviewed the account of Mr. K who commenced a banking relationship with BANK BB on 18/12/2019. We observed that on 10/03/2023, the customer received an inflow of NGN113,000 from Ms N followed by immediate POS withdrawal in split transactions totaling NGN194,600 on April 10th, 2023. Further reviews show that these outflows were utilized via POS the customer has done a total number of 521 debit transaction count in the last 6 months. STR is recommended for multiple POS withdrawals. Comments: The information provided is insufficient to conduct a thorough analysis. Note that the period of increased POS transactions was within a timeframe of the CBN policy on cash transactions for which there was an increase in POS transactions. The bank has not provided details of the customer’s transaction pattern, for comparison with the suspected transactions. The bank has not conducted further analysis to explain the reason behind the influx of pos transactions. The account received multiple inflows of N22,000,000.00 between 10th November 2022 and 11th November 2022 of N2m and N20m, respectively. Comments: The bank has not adhered to the principle of answering the 5Ws and

14 | P a g e NFIU GUIDANCE NOTE 1H in filing STR.

1. The source and purpose of funds could not be verified. 3. The RM has not been able to respond to our enquiry. 4. The customer is into manufacturing, Sales, and Distribution of General Furniture, General Contracts and Merchandise as stated on the registration documents. 5. The account has not received any huge inflow in the past 15 months before these multiple inflows 6. The multiple inflows of N22m into the account are considered suspicious because of the volume which is unusual to the customer’s known pattern. 7. The sudden spike in transaction value is unjustifiable. Comments: information provided is not logically ordered. Internal analysis is not concluded given that the RM is yet to provide additional information. The transaction pattern for the inflow is not provided. Information on the customer is not provided. NOTE a. It is required that the internal investigation and reporting of a suspicious transaction should be done, as soon as suspicion is noticed immediately in line with the provision of the MLPPA, 2022 and/or TPPA 2022. Where it is not possible to conclude the internal investigation within the period required by law, the STR should be filed indicating that there is an ongoing internal investigation and the same forwarded to the NFIU when concluded under Action Taken on the STR reporting template. b. It is expected that reporting entities will periodically send, upon request, statistics/evidence of STR/SAR filed to NFIU to the various regulators/supervisor (CBN, SEC, NAICOM and SCUML). c. Sanctions for non -compliance with obligations to file STR/SAR will be enforced in line with the provisions of the MLPPA, TPPA and sector regulations. d. NFIU will render feedback on the quality of STR to the regulators (CBN, SEC, NAICOM and SCUML) periodically. Filing The Suspicious Transaction or Activity Report to The NFIU Reporting institutions can file these reports to the NFIU electronically using the following options on the goAML portal;

• WEB Report
• XML Upload The web report entails filling the STR Form manually while the XML Upload gives an interface where XML reports generated according to the XML schema are

15 | P a g e NFIU GUIDANCE NOTE uploaded. STRs may also be filed via the WEB Report portal to ease populating the required information on the form. This makes it easier for the reporting institution(s) that do not have a third-party application to generate reports in XML format. It also gives the flexibility of providing detailed REASON(s) FOR SUSPICION and ACTION TAKEN, which may be unique and cannot be generalized for all STRs. STRs and SARs can also be filed via the NFIU Compliance e-mail using the following emails fi@nfiu.gov.ng for deposit money banks, ofi@nfiu.gov.ng for other financial institutions, including VASPs, cmi@nfiu.gov.ng for capital market and insurance companies and dnfbp@nfiu.gov.ng for DNFBPs in instances where the FI or DNFBP is unable to file through the goAML platform. Note that a formal application must be made to the NFIU by the reporting institution before permission is granted to file such reports manually. “NIL” STRs/SARs are also expected to be filed via the Nil reporting portal (https://apps.nfiu.gov.ng/nilreport) and NOT via the Message Board on the goAML application. Please note that any STR/SAR filed via the compliance e-mail must be re-sent via the goAML portal when the system failure issue is resolved/restored. Attachments It is essential to attach all necessary or supporting documents to the STRs filed with the NFIU. These documents must include a summary of the internal investigation report, account/ Policy or transaction opening package, banks’ statement of account(s) and the instrumentalities used in the suspected transaction or activity. It is required that all bank statements of accounts should be converted to EXCEL FORMAT for ease of analysis. Tipping Off A ‘tipping off’ offence occurs when any person discloses, either to the person who is the subject of suspicion or any third party, that: a. Information or documentation on ML/TF has been transmitted to NFIU; b. A SAR/STR has been submitted internally or to NFIU; c. authorities are investigating allegations of ML/TF. Section 19 of MLPPA 2022 prohibits FIs, their directors, officers and employees from disclosing the fact that an STR or related information is being reported to NFIU. A risk exists that customers could be unintentionally tipped off when the reporting institution is seeking to perform its CDD obligation in those circumstances. The customer’s awareness of a possible STR or investigation could compromise future efforts to investigate the suspected money laundering or terrorist financing activity.

16 | P a g e NFIU GUIDANCE NOTE Protection of Staff Section 7 of MLPPA, 2022 protects employees, management and the board of an institution who file suspicious transaction reports. Legal proceedings cannot be instituted against employees, management and Board for reporting suspicion in good faith. Disclosure of information in good faith by a reporting organization or by an employee or director of such a reporting organization shall not constitute a breach of any restriction on disclosure of information imposed by contract or by any legislative, regulatory or administrative provision, and shall not involve the obliged entity or its directors or employees in liability of any kind even in circumstances where they were not precisely aware of the underlying criminal activity and regardless of whether the illegal activity occurred or not. Feedback The NFIU is required to send periodic feedback to reporting institutions on all STRs/SARs received, analyzed and disseminated to various Law Enforcement Agencies to serve as an encouragement to those reporting institutions in compliance with international best practices. The NFIU feedback on STR/SAR filed by reporting institutions on the status of the report received from LEAs should indicate the following;

i. Number submitted to NFIU ii. Number that failed validation by NFIU with specific reason(s) iii. Number under investigation iv. Number under prosecution v. Number of convictions vi. Number profiled by the NFIU (Put under monitoring and not disseminated to any LEA) Penalty For Non-Compliance With This Guideline Any reporting institution that fails to comply with this guideline shall be sanctioned appropriately under the Money Laundering (Prevention and Prohibition) Act, 2022, the Terrorism (Prevention and Prohibition) Act 2022, the NFIU Act 2018, and other relevant laws including respective regulations. Any STR filed to the NFIU that is not in conformity with this guideline shall be not valid and considered as not reported at all.