Banks Criminal Background Check Directive for Beneficial Owners (D6-2022)

P O Box 427 Pretoria 0001 South Africa 370 Helen Joseph Street Pretoria 0002 +27 12 313 3911 / 0861 12 7272 www.resbank.co.za 1 Ref.: 15/8/1/3 D6/2022 To: All banks, controlling companies, branches of foreign institutions, eligible institutions and auditors of banks or controlling companies Directive issued in terms of section 6(6) of the Banks Act 94 of 1990 Matters related to fit and proper assessment requirements pertaining to beneficial owners Executive summary The purpose of this Directive is to direct banks, controlling companies, branches of foreign institutions, eligible institutions and auditors of banks or controlling companies to implement processes to identify the beneficial owners (BOs) of their institutions and to, among other things, subject such BOs to criminal background checks (CBCs). Both the Financial Action Task Force’s (FATF) 40 Recommendations and the Basel Committee on Banking Supervision’s (BCBS) Core Principles for Effective Banking Supervision (Core Principles) place an obligation upon supervisors to ensure that major shareholders, including the ultimate BOs1 of financial institutions2 (FIs), are suitable and have not been involved in any criminal activities.

1. Introduction 1.1 The responsibilities of banks 1.1.1 There are various reasons supporting the duty on various key role players to identify the BO(s) of a bank. Unlawful activity can thrive when an entity’s 1 As per the definition of a ‘beneficial owner’ recognised by the Financial Action Task Force (FATF), a ‘beneficial owner’ refers to those persons who exercise ultimate effective control over a legal person or arrangement. Thus, an essential element of the FATF definition of a ‘beneficial owner’ is that it extends beyond legal ownership and control to consider the notion of ultimate (actual) ownership and control. In other words, the FATF definition focuses on the natural (not legal) persons who own and take advantage of capital and/or assets of the legal person as well as on those who really exert effective control over it (whether or not they occupy formal positions within that legal person) rather than on just the (natural or legal) persons who are legally (on paper) entitled to do so. Please see https://www.fatf-gafi.org/media/fatf/documents/reports/Guidance-transparency-beneficial-ownership.pdf. 2 A financial institution as per the FATF definition means any natural or legal person who conducts as a business one or more of the following activities or operations for or on behalf of a customer: 1. Acceptance of deposits and other repayable funds from the public. 2. Lending. 3. Financial leasing. 4. Money or value transfer services. 5. Issuing and managing means of payment (e.g., credit and debit cards, cheques, traveller's cheques, money orders and bankers' drafts, electronic money). 6. Financial guarantees and commitments. 7. Trading in: (a) money market instruments (cheques, bills, certificates of deposit, derivatives etc.); (b) foreign exchange; (c) exchange, interest rate and index instruments; (d) transferable securities; (e) commodity futures trading. 8. Participation in securities issues and the provision of financial services related to such issues. 9. Individual and collective portfolio management. 10. Safekeeping and administration of cash or liquid securities on behalf of other persons. 11. Otherwise investing, administering or managing funds or money on behalf of other persons. 12. Underwriting and placement of life insurance and other investment related insurance. 13. Money and currency changing

2 ownership structure is opaque and to uphold the integrity of the financial system it is essential that criminals or their associates are prevented from holding (or being the BO of a significant or controlling interest, or holding a management function, in a bank. 1.1.2 Banks are ultimately responsible for ensuring that they understand and keep record of their ownership structures, including BOs. 1.2 International standards 1.2.1 The BCBS’s Core Principles and, more specifically, the Essential Criteria 5 of Principle 5 states that a licensing authority identifies and determines the suitability of a bank’s major shareholders, including its ultimate BOs and others that may exert significant influence. It also assesses the transparency of the ownership structure, the source(s) of the initial capital and the ability of the shareholders to provide additional financial support where needed. 1.2.2 South Africa, as a member of the FATF, has a duty to conform to the FATF’s 40 Recommendations against money laundering and terrorism financing. FATF Recommendation 26 states that countries should ensure that FIs3 are subject to adequate regulation and supervision, and that they are effectively implementing the FATF Recommendations. Furthermore, financial supervisors should take the necessary legal and/or regulatory measures to prevent criminals or their associates from holding a management function (or being the BO) in a FI. 1.3 Legislative requirements 1.3.1 Sections 394 , 515 , 526 , 597 and 678 of the Banks Act 94 of 1990 (Banks Act) contain requirements related to information on shareholders and ownership structures of banks and their controlling companies. 1.3.2 Regulation 36(17)(b)(ii)9 of the Regulations relating to Banks provides that every relevant foreign branch, subsidiary, or operation of the bank or controlling company implements and applies anti-money laundering and countering the financing of terrorism measures consistent with the relevant FATF Recommendations (which includes Recommendation 26). 1.4 The duties of the Prudential Authority 1.4.1 The Prudential Authority (PA), in the execution of its mandate requires that banks comply with legislative requirements by implementing adequate and robust policies and processes, to ensure that the persons occupying the position of a BO(s) of banks, or its controlling companies are not criminals. . 4 Furnishing of information by shareholders 5 Application of Companies Act to banks and controlling companies 6 Subsidiaries, branch offices, other interest and representative offices of banks and controlling companies 7 Returns regarding shareholders 8 Disclosure of certain shareholders 9 Matters related to corporate governance, risk management and internal controls

3 2 Directive 2.1 Based on the aforesaid, and in accordance with the provisions of section 6(6)10 of the Banks Act, to enable the PA to effectively execute its responsibilities under applicable financial sector legislation and in consideration of its ongoing commitment to adopt international standards prescribed by, among others, the BCBS and the FATF, and to prevent criminals from holding or exerting significant influence over a bank, controlling company or branch of a foreign institution (hereinafter collectively referred to as ‘banks’), banks are hereby directed as follows: 2.2 Criminal background check report requirements 2.2.1 Banks must, at the written request of the PA, submit criminal background check reports11 (CBCRs) to the PA for each of their BOs. 2.2.2 Banks must ensure that they examine all the levels in their ownership structure and provide the PA with an organogram depicting the said structure and the assignment of percentages, explaining how the BOs were identified. 2.2.3 The PA will interrogate the information received and may require further information concerning the ownership, influence and/or control structure of the bank, as it may deem fit. 2.2.4 Applications in terms of section 1212 of the Banks Act, which are for the authorisation to establish a bank, must include CBCRs for each of the BOs. 2.2.5 CBCRs in respect of domestic BOs i.e. identified as South African nationals, must not be older than 30 calendar days from the date of submitting the information to the PA. 2.2.6 CBCRs or an equivalent document in respect of BOs identified as foreign nationals must not be older than 60 calendar days from the date of submitting the information to the PA. 2.2.7 CBCRs for domestic BOs can be requested or sourced from CBC service providers nationwide. These CBCRs will contain a unique CBCR reference number13. Banks must ensure that this unique CBCR reference number is clearly visible when submitting the document to the PA. 2.2.8 Banks with foreign BOs are advised that some of the domestic CBC service providers have arrangements in place with foreign governments and foreign third￾party service providers to source CBCRs or an equivalent document from such parties in foreign jurisdictions. Thus, banks may use these domestic service providers to source CBCRs or an equivalent document for BOs who are foreign nationals. 10 Powers of inspection of, and guidelines by, Registrar 11 A police clearance certificate or a report issued by a service provider having an arrangement in place with a Police Department to issue a statement in respect of a natural person’s criminal status on its behalf will be acceptable. 12 Application for authorization to establish bank 13 Unique CBCR reference numbers are only applicable to criminal background check screenings performed against the South African Police Service fingerprint database.

4 2.2.9 Foreign CBC service providers may also be approached to provide CBCRs or an equivalent document in respect of foreign nationals that are BOs of banks. If not captured on a CBCR, banks must submit the following information in respect of the CBC service provider in support of the CBCR to the PA: • registered name; • registration number; • postal address if available, and domicile address; • contact person; • telephone number; • email address; and • website address. 2.3 Changes to and accuracy of beneficial ownership information 2.3.1 Banks are required to: • submit updated CBCRs to the PA within the timelines outlined in paragraphs 2.2.5 and 2.2.6 upon becoming aware of any changes to their BO(s) structure; and • maintain up-to-date and accurate information pertaining to the identity of their BO(s). 2.4 Periodic criminal background check re-screening of BOs 2.4.1 The PA will require banks to submit CBCRs periodically and in line with the PA’s application of a risk-based approach to supervision. Banks must re-screen their BOs on a periodic basis to ensure that the information they hold is up to date and accurate. The CBCRs should be provided to the PA within 30 calendar days of completing such screenings. 3. Acknowledgement of receipt 3.1 Kindly ensure that a copy of this Directive is made available to your institution’s independent auditors. In addition, the attached acknowledgement of receipt duly completed and signed by both the chief executive officer of the institution and the said auditors should be returned to the PA at the earliest convenience of the aforementioned signatories. Fundi Tshazibana Chief Executive Officer Date: 2022-08-12 The previous Directive issued was Directive 05/2022, dated 29 June 2022