D4/2022 Directive on Risk Returns

P O Box 427 Pretoria 0001 South Africa 370 Helen Joseph Street Pretoria 0002 +27 12 313 3911 / 0861 12 7272 www.resbank.co.za 1 Ref.: 15/8/1/3 D4/2022 To: All accountable institutions falling under the supervision of the Prudential Authority in terms of Schedule 1 read with Schedule 2 of t h e Financial Intelligence Centre Act 38 of 2001 Directive issued by the Prudential Authority in terms of section 43A(3) of the Financial Intelligence Centre Act 38 of 2001 Requirement to submit anti-money laundering and counter-financing of terrorism risk returns to the Prudential Authority on a periodic basis Executive summary In terms of section 45 of Financial Intelligence Centre Act 38 of 2001 (the FIC Act), it is the responsibility of the Prudential Authority (PA) as a supervisory body to ensure that it supervises and enforces compliance with the provisions of the FIC Act by accountable institutions falling within its supervision. In terms of Schedule 2 read with Schedule 1 of the FIC Act, the PA is the supervisory body for the following accountable institutions: (i) a person who carries on the ‘business of a bank’ as defined in the Banks Act 94 of 1990, (ii) a mutual bank as defined in the Mutual Banks Act 24 of 1993 and (iii) a person who carries on a ‘long-term insurance business’ as defined in the Long-Term Insurance Act 52 of 1998 (hereinafter referred to as ‘supervised entities’). This Directive is issued by the PA in terms of Section 43A(3) of the FIC Act and serves to direct supervised entities to on a periodic basis, submit information linked to the assessment of compliance with its obligations in terms of the FIC Act to the PA.

1. Introduction 1.1 The PA is a supervisory body in terms of Schedule 2 read with Schedule 1 of the FIC Act for the following accountable institutions: (i) a person who carries on the ‘business of a bank’ as defined in the Banks Act 94 of 1990, (ii) a mutual bank as defined in the Mutual Banks Act 24 of 1993 and (iii) a person who carries on a ‘long￾term insurance business’ as defined in the Long-Term Insurance Act 52 of 1998.

2 1.2 As a supervisory body, the PA, in seeking to further its understanding and assessment of money laundering (ML), terrorist financing (TF) and proliferation financing (PF) risk, and the efficiency of associated controls in the banking and life insurance sector requires that information at an institutional level be provided to the PA on a regular basis. 1.3 The PA takes note of Financial Action Task Force recommendations and in line with its own risk-based approach to supervision, the PA utilises a combination of off-site and on-site supervisory tools to achieve effective risk-based supervision. The information received from the banks and life insurers will assist the PA in its supervisory duties. 1.4 Core Principle 12 of the Core Principles (CP) for Effective Banking Supervision issued by the Basel Committee on Banking Supervision (BCBS) states that an essential element of banking supervision is that supervisors supervise the banking group on a consolidated basis, and adequately monitor and, as appropriate, apply prudential norms to all aspects of the business conducted by the group worldwide. 1.5 The International Association of Insurance Supervisors (IAIS) through its Insurance Core Principles (ICP) and Common Framework for the Supervision of Internationally Active Insurance Groups under ICP 12 mentions that coordination between the insurance legal entity and group control functions is important to help ensure overall effective systems of risk management and internal controls. Regardless of how the group control functions are organised and operated, the result should provide an overall view of the group-wide risks and how they should be managed. 2 Directive and format of submission 2.1 The following supervised entities are directed to complete and submit the pertinent ML/TF/PF risk returns to the PA as provided for below: a. banks 1 ; b. branches of banks 2 ; c. cross-border banking operations of domestic banking groups 3 (and subsidiary 4 banks, where applicable; d. mutual banks 5 ; and e. life insurers 6 . 1 “bank” means a public company registered as a bank in terms of the Banks Act 94 of 1990 2 “branch” means an institution that is not a public company as contemplated in section 11(1), but by means of which a foreign institution conducts the business of a bank in the Republic under an authorization referred to in S18A 3 means a group consisting of two or more persons, whether natural or juristic persons, that are predominantly engaged in financial activities and one or more of which is a bank and- (a) each of which persons is an associate, as defined in section 37(7), of any one of the others; or (b) which persons are so interconnected that should one of them experience financial difficulties, another one or all of them would likely be adversely affected, irrespective of whether any of those persons is domiciled in the same country as any of the others; 4 “subsidiary” means a subsidiary provided for in section 3 of the Companies Act; 5 “mutual bank” means a mutual bank as defined in section 1(1) of the Mutual Banks Act, 1993 (Act No. 124 of 1993) 6 a person who carries on a ‘long-term insurance business’ as defined in the Long-Term Insurance Act 52 of 1998

3 2.2 The information required is both quantitative and qualitative in nature and requires supervised entities to maintain requisite data to be in a position to provide the details required. 2.3 Where banking or insurance groups are concerned, information requested in respect of cross-border subsidiaries and branches should be completed by the relevant in country subsidiary/branch and submitted to the PA via the controlling company or head office located in South Africa. 2.4 In aid of the aforementioned, supervised entities will be required to electronically complete and submit the ML/TF/PF risk return through the PA’s webpage by using the link: https://paportal.resbank.co.za/umojaportal 3 Frequency of the ML/TF/PF risk returns 3.1 Banks and subsidiaries thereof are to submit ML/TF/PF returns to the PA quarterly, and are to cover the following reporting periods: a. Quarter 1: January, February, March b. Quarter 2: April, May, June c. Quarter 3: July, August, September d. Quarter 4: October, November, December 3.2 Completed ML/TF/PF risk returns must be submitted to the PA by no later than the following dates: a. Quarter 1: 30 April b. Quarter 2: 31 July c. Quarter 3: 31 October d. Quarter 4: 31 January 3.3 Mutual banks are required to submit ML/TF/PF returns twice a year covering quarter two and quarter four.7 3.4 Life insurers are required to submit ML/TF/PF returns twice a year covering quarter two and quarter four.8 3.5 Completed ML/TF/PF returns for life insurers must be submitted by no later than the following dates: a. Quarter 2: 31 July b. Quarter 4: 31 January 4 Failure to complete and submit a submission 4.1 This Directive is issued in terms of section 43A(3) of the FIC Act. The submission of ML/TF/PF risk returns are thus mandatory. 4.2 Failure to complete and submit a risk return is considered non-compliance with this 7 The period for quarter 2 and 4 is as per the period stated in clause 3.1 8 The period for quarter 2 and 4 is as per the period stated in clause 3.1

4 Directive and may result in administrative sanctions in accordance with section 62E of the FIC Act. 5 Effective date 5.1 This Directive is effective from date of publication on the South African Reserve Bank website. 6 Enquiries 6.1 Any enquiries related to the local bank risk returns submission may be submitted to localbank.riskreturn@resbank.co.za. 6.2 Any queries relating to the banking sector subsidiary risk return submission may be submitted to AMLCFTreturn@resbank.co.za. 6.3 Any queries relating to life insurance sector risk return submission may be submitted to Insurancesurvey2@resbank.co.za. 7 Terminology Term Definition Financial Action Task Force Global inter-governmental AML/CFT standard setting body Supervisory body Supervisory body in terms of Schedule 2 of the FIC Act Banking group In the BCBS core principles for effective banking supervision, “banking group” includes the holding company, the bank and its offices, subsidiaries, affiliates and joint ventures, both domestic and foreign. Risks from other entities in the wider group, for example non-bank (including non-financial) entities, may also be relevant. This group-wide approach to supervision goes beyond accounting consolidation. 8 Acknowledgement of receipt 8.1 Kindly ensure that a copy of this Directive is made available to your institution’s external auditors. The attached acknowledgement of receipt duly completed and signed by both the chief executive officer of the institution and the said auditors should be returned to the PA at the earliest convenience of the aforementioned signatories. Fundi Tshazibana Chief Executive Officer Date: The previous Directive issued was Directive 03/2022, dated 1 April 2022.