Agreement No. 001-2019: Catalog of Alert Signals for the Detection of Operations Related to the Financing of Terrorism

Republic of Panama
Superintendence of Banks
AGREEMENT No. 001-2019
(of March 19, 2019)
"Catalog of Alert Signals for the Detection of Operations Related to the Financing of Terrorism"

THE BOARD OF DIRECTORS

In exercise of its legal powers, and

CONSIDERING:

That following the issuance of Decree-Law No. 2 of February 22, 2008, the Executive Branch prepared a systematic arrangement in the form of a Single Text of Decree-Law No. 9 of February 26, 1998, and all its modifications, which was approved by Executive Decree No. 52 of April 30, 2008, hereinafter referred to as the Banking Law;

That in accordance with paragraphs 1 and 2 of Article 5 of the Banking Law, it is the objective of the Superintendence of Banks to ensure the solidity and efficiency of the banking system; as well as to strengthen and foster the conditions conducive to the development of the Republic of Panama as an International Financial Center;

That in accordance with paragraph 5 of Article 11 of the Banking Law, it corresponds to the Board of Directors to establish, within the administrative sphere, the interpretation and scope of legal or regulatory provisions in banking matters;

That Article 112 of the Banking Law establishes that banks and other supervised entities have the obligation to establish policies, procedures, and internal control structures to prevent their services from being used improperly for the crime of money laundering, terrorism financing, and other related or similar nature crimes;

That Law No. 23 of April 27, 2015 adopts measures to prevent money laundering, terrorism financing, and the financing of the proliferation of weapons of mass destruction;

That Article 19 of Law No. 23 of 2015 establishes the Superintendence of Banks, among others, as the supervisory body;

That Article 20, paragraph 7 of Law No. 23 of 2015, establishes among the powers of the supervisory bodies, to issue guidelines and feedback to financial obligated subjects, non-financial obligated subjects, and activities performed by professionals subject to supervision for their application, as well as procedures for the identification of beneficial owners of legal persons and other legal structures;

That in accordance with what is provided in Article 22 of Law 23 of 2015, modified by Article 123 of Law 21 of 2017, it corresponds to the Superintendence of Banks to supervise, in matters of prevention of money laundering, terrorism financing, and financing of the proliferation of weapons of mass destruction, financial obligated subjects;

That in function of what is provided in Article 54 of Law 23 of 2015, financial obligated subjects must communicate directly to the Financial Analysis Unit (UAF), any fact, transaction, or operation, that may be related to the Crimes of Money Laundering, Terrorism Financing, and Financing of the Proliferation of Weapons of Mass Destruction, regardless of the amount, that cannot be justified or substantiated;

That the Financial Analysis Unit, through Administrative Resolution No. 33-2018 dated September 25, 2018, disposes the adoption of Guides and Compendiums in matters of Terrorism Financing, as a useful tool for Supervisors and Obligated Subjects in order to combat Terrorism Financing;

That the 40 Recommendations of the FATF constitute a consistent international standard that countries must implement effectively through legal, regulatory, and operational measures in order to have a solid national system that allows combating money laundering, terrorism financing, and financing of the proliferation of weapons of mass destruction;

That within the Recommendations of the Financial Action Task Force (FATF) it is established that if a financial institution suspects or has reasonable grounds to suspect that funds are the product of criminal activity, or are related to terrorism financing, it must be required, by Law, to report its suspicions promptly to the Financial Intelligence Unit, which in our case corresponds to the Financial Analysis Unit (UAF);

That in working sessions of this Board of Directors, the need and convenience has been manifested to establish by Agreement, a Catalog of Alert Signals for the detection of operations related to the Financing of Terrorism, based on the Compendium of relevant risk indicators for the detection of Terrorism Financing, issued by the Financial Analysis Unit (UAF).

AGREES:

ARTICLE 1. SCOPE OF APPLICATION. The provisions contained in this Agreement shall apply to the following obligated subjects:
a. Banks and/or banking groups. b. Trust companies.
c. Financial companies.
d. Financial leasing companies. e. Factoring companies. f. Issuers or processors of debit, credit, and prepaid cards, whether natural or legal persons, including those that issue and operate their own cards. g. Entities issuing payment instruments and electronic money. h. Agricultural Development Bank.
i. National Mortgage Bank.
j. Savings and loan associations for housing. k. Other corporate services performed by trust companies.
In the case of the obligated subjects mentioned in letters c, d, e, f, g, j, and k, only the alert signals related to the activities carried out by said obligated subjects shall apply to them.

ARTICLE 2. CATALOG OF ALERT SIGNALS. The following catalog of alert signals is adopted, which contains those behaviors of the client or companies, as well as the characteristics of certain financial operations that could lead to detecting a suspicious operation related to the Financing of Terrorism, which is not necessarily listed in this Agreement.
Obligated subjects must examine with special attention the operations and/or behaviors indicated in this Agreement, in order to determine, taking into consideration other signals, factors, and criteria, if they constitute suspicious operations linked to terrorism financing risks.

ARTICLE 3. ALERTS RELATED TO CLIENT BEHAVIOR. Obligated subjects must pay special attention to the following behaviors or actions adopted by clients:

1. Client who possesses mobile phone numbers about which it is known or suspected their use by terrorists or suspects.
2. Clients who are suspected to be supporters, sympathizers, or clandestine facilitators of violent extremism or radicalization or who maintain links or relationship with terrorists, terrorist groups, or organizations of this kind.
3. Client who resists the cultural norms of the country where the operation is conducted and makes manifest efforts to avoid personal contact with some bank employees (e.g., refusal to interact with female employees).
4. Client with behavior that indicates adherence to radical or extremist notions or that exhibits violent tendencies (e.g., social media profiles that exhibit multiple posts of news related to or sympathetic with terrorist organizations).
5. New clients who ask excessive questions to bank employees regarding disclosures, reporting requirements, thresholds, or record-keeping requirements.
6. Accounts opened in the name of a legal person with the same address as another natural person who is not associated with the account.
7. Client who opens several accounts (e.g., bank accounts, prepaid cards, electronic wallets, etc.) for the purpose of receiving and/or sending low-denomination transfers.
8. Client who opens an account with the sole purpose of receiving one or more transfers and withdrawing or transferring money to other people.
9. Opening of accounts in regions outside where the client lives or works and without a reasonable purpose.

ARTICLE 4. ALERTS RELATED TO THE CLIENT'S ECONOMIC PROFILE. Obligated subjects will pay special attention to the following patterns or circumstances regarding the client's economic profile:

1. Individual accounts receive multiple high-value transfers from unrelated persons or unknown sources (e.g., the declared purpose is "food").
2. Clients who present different identification documents whenever the institution requires them.
3. Clients who, in the course of their business, use aliases, nicknames, or other alternative or simplified expressions instead of their own name (complete). This could include the transposition of the order of names.
4. Transfers requested by different persons or entities that share one or more personal details (e.g., surname, address, employer, phone number, etc.) on the same day or on close dates.
5. The frequency or volume of the operation is inconsistent with the occupation, income, or age of the client.
6. Sudden significant withdrawal (generally in cash) of benefit payments that accrue over a period of months.

ARTICLE 5. ALERTS RELATED TO GEOGRAPHIC FACTORS. Obligated subjects must pay special attention to transactions or operations of their clients associated with the following geographic factors:

1. The originator of an operation and the beneficiary of funds that may be related to a high-risk jurisdiction or region.
2. Client whose nationality, residence, or place of business is located in high-risk jurisdictions or regions.
3. Clients who make transfers to persons in conflict zones, that is, those high-risk jurisdictions/regions that are not stable, are at war, where armed hostility is present, or where terrorist organizations are active.
4. Clients who make transfers to persons in provinces/regions with known links to terrorist organizations or that share borders with territories controlled by terrorist organizations.
5. Clients who make transfers to jurisdictions/regions that are transit points or that have had money flows to/from known foreign terrorists.
6. Clients who make transfers to jurisdictions with strategic deficiencies in the anti-money laundering and counter-terrorism financing system, deficient institutional frameworks, or those that do not comply with the standards of the Financial Action Task Force.
7. Clients who make transfers to countries where funds and other assets for acts of terrorism or terrorist organizations are generated regardless of where those acts are carried out or where the organizations reside.
8. Several persons sending funds to the same beneficiary in a high-risk jurisdiction.
9. The same client sending funds to multiple beneficiaries in a high-risk jurisdiction.
10. Low-value cross-border transfers sent/received with high frequency to/from persons not connected or unrelated.
11. Sending/receiving funds to/from the same counterparties by persons who appear to act separately. (That is, also known as a "consumer network" representing a number of people connected by common counterparties).
12. A payment from abroad, with the description of the operation as donation, aid, loan, etc., and its immediate cash withdrawal, or immediate transfer to a different account.
13. Excessive funds paid to a student's account in a foreign country by a family member or an unrelated organization.
14. Clients residing in a high-risk jurisdiction, or with a connection to it.
15. Clients accessing banking facilities online from an IP address within a conflict zone or an address not associated with the client's due diligence records.
16. The client shows significant expenses abroad in a recently opened account.
17. Indications that the client has traveled (or travels regularly) to areas in or around the conflict zone with cash on hand.

ARTICLE 6. TRANSACTIONS RELATED TO EXTORTIONATE KIDNAPPING. Obligated subjects must pay special attention to transactions that may be related to extortionate kidnapping, a source of income for terrorist groups.
Some indicators identified and linked to extortionate kidnapping are the following:

1. Relatives (in the name of the victim) acquiring money through the sale of assets or loans.
2. Establishment of a trust (or other legal structure) to collect/store donations of ransom payments.
3. Establishment of a "crowdfunding" site to accept donations on behalf of the victim.
4. International fund transfers in the name of groups or religious entities. Persons (e.g., treasurers) who control bank accounts on behalf of religious organizations who, when questioned by the bank, indicate that the true purpose of the operations was, in fact, the payment of ransoms.
5. Withdrawal of cash from disguised accounts for use as aid payments.
6. Funds received from an insurer that markets kidnapping and ransom insurance products.

ARTICLE 7. ALERTS RELATED TO EXPENDITURE ACTIVITY. Obligated subjects must pay special attention to the following behaviors related to the expenditure activity of clients:

1. Expenditure activity related to travel:
   a. Payments to outdoor activity stores (where they can buy boots, sleeping bags, clothing, thermal underwear, tents, and equipment). b. Payments indicating appointments at medical clinics before traveling.
   c. Purchases of airline tickets, bus tickets, car rentals, reservation of transport services.
   d. Reservation of outbound international flights by credit card (generally for persons with no identifiable direct connection). e. Purchase of numerous airline or bus tickets, after receiving several electronic or cash transfers. f. Payment of visas, particularly online bank payments for electronic visas to conflict regions. g. Travelers asking questions regarding confirmation that beneficiaries nominated for life insurance policies will receive payment in circumstances suggesting participation in terrorism, and not being a victim of terrorism. (These cases involve potential foreign terrorist fighters who do not declare their travel to conflict zones before departure). h. Young persons purchasing funeral or life insurance policies, or cashing a policy to pay for airline tickets.
   i. Purchase of cars to export them to countries bordering conflict zones.
2. Expenditure activity not related to travel:
   a. Purchase of expensive and sophisticated communication and information technology devices (e.g., satellite phones). b. Purchase of shooting games or participation in combat-type training activities.
   c. Purchase of weapons or dual-use products that can be used for terrorist attacks or in a war context (e.g., ammunition, explosive materials, military supplies, optical or electronic equipment) through electronic payment accounts.
   d. Payments to media or bookstores associated with the propaganda of radicalism, extremism, or violence. e. Donation to non-profit organizations or religious websites associated with the propaganda of radicalism, extremism, or violence. f. Purchase of multiple prepaid cards (e.g., phone, general purposes).

ARTICLE 8. ALERTS RELATED TO PRODUCTS OR SERVICES. Obligated subjects must pay special attention to the following transactions related to products and services:

1. Risk indicators to identify suspicious providers
   a. Extensive use of payphone accounts (in which small sums are deposited or added and then transferred abroad at regular intervals). b. Electronic transfers frequently sent by merchants to foreign countries that do not seem to have a commercial connection with the destination countries.
   c. Commercial accounts used to receive or disburse large sums of money but that virtually show no normal business-related activities such as paying salaries, invoices, etc.
   d. Frequent deposits of third-party checks and postal orders into commercial or personal accounts.
2. General indicators involving cash and ATMs.
   a. Sudden cash withdrawal, approximately corresponding to the current account balance, justified as the need to travel abroad. b. The client requests the withdrawal of cash funds previously transferred to their personal account within a short period of time after the initial operation.
   c. The client requests cash payment of the unused balance of their account.
   d. Structuring of cash deposits of smaller operations to avoid reporting requirements above a specific threshold. e. The making of several withdrawals from a single ATM on consecutive days or the making of several withdrawals at different ATMs in nearby locations. f. Cash withdrawals using debit cards, on the same day or on consecutive days, in different countries along the identifiable route to a conflict zone. g. Low amounts of cash frequently deposited in self-service terminals into private accounts (the account is used to collect donations) and shortly after, the withdrawal of the collected funds in self-service terminals. h. Large cash deposits followed by low-value international transfers below the reporting threshold.
   i. Structured deposits into a third-party account, followed by immediate withdrawals at an ATM abroad in transit areas or high-risk jurisdictions.
   j. Individual accounts that suddenly change typical activities such as numerous deposits, transactions performed by ATM, and then repeated balance inquiries by phone, followed by a large amount withdrawal by ATM.
3. Specific indicators identified for credit cards.
   a. Repeated cash advances in many countries neighboring conflict areas or countries that are along the routes normally followed to/from conflict areas. b. Credit card payments in several countries during transit (e.g., gas stations, toll roads on routes or in locations near an airport).
   c. The client shows high-value cash advances on a recently issued credit card.
   d. Cash advances on credit cards generally without immediate payment. e. Given the client's credit capacity, unfounded or unjustified request for a maximum increase in the credit limit. f. Reaching credit limits before leaving for travel. g. Sudden use of credit cards in high-risk territories (e.g., increased cash advances) when the use was preceded/followed by a few months of inactivity. h. Use of credit cards registered in the name of third parties.
4. Indicators identified for bank/personal loans.
   a. Clients who take bank loans in cash and tend to default. b. The use of bank loan funds by clients inconsistent with the declared purposes.
   c. The client requests a large personal loan and shortly after withdraws a significant portion in cash.
   d. Taking small loans with several loan/credit companies where no payment is made. e. Loans granted (e.g., based on falsified income statements) when there are indications that persons may flee abroad. f. Frequent taking of loans using high-value items as collateral. g. Loan applications that seem unjustified for the economic and financial background of the applicant. h. Fraudulent loan applications for the purchase of goods that do not seem to have been used by the applicants (e.g., purchase of vehicles or appliances).
5. Risk indicators for new payment products and services.
   a. Internet payments. a.1 A person using many financial profiles (e.g., electronic wallets) to register in multiple payment systems. a.2 Enrollment in an electronic wallet from a high-risk jurisdiction/region. a.3 Replenishment of an account from a high-risk jurisdiction/region. a.4 Remote transfer of money from the electronic wallet to third-party accounts opened in a different jurisdiction (person to person). a.5 Payments indicating that the account may be used for fundraising for charity. a.6 Multiple bank accounts from banks located in various cities used to finance the same account. a.7 Online accounts linked to persons related to terrorism charges by name, credit cards, addresses, email activity, and computer cookies (e.g.: these accounts were used to buy electronic parts and prepaid cell phone cards online). b. Specific indicators relevant to prepaid cards. b.1 Foreign prepaid cards issued in high-risk jurisdictions. b.2 Use of prepaid cards registered under false identities or under another person's name to buy online. b.3 Cards loaded through anonymous payment means (e.g.: coupons paid in cash, cash amounts via ATM, electronic wallet). b.4 Multiple purchases of prepaid cards that do not require identification, despite the fact that the fees are higher than those of a prepaid card with a higher threshold but requiring identification. b.5 Purchase of multiple prepaid cards at exchange houses during currency exchange. b.6. Numerous cash deposits to a reloadable prepaid debit card by subjects identified with charges related to terrorism.

ARTICLE 9. ALERTS RELATED TO NON-PROFIT ORGANIZATIONS. Obligated subjects must pay special attention to the following transactions related to non-profit organizations:

1. Donations.
   a. Large accumulated amounts and amounts not adequately justified, especially if they were made primarily in cash. b. Multiple cash deposits to...