Supervisory Benchmark No 2/2018 as amended on 22 July 2022 on the requirements for selected procedures for the implementation of international sanctions

1 DATE: 22 JULY 2022 Supervisory benchmark No 2/2018 as amended on 22 July 2022 On the requirements for selected procedures for the implementation of international sanctions I. Relevant legislation Key regulations  Act No 69/2006 Coll., on the implementation of international sanctions, as amended (hereinafter the “IS Act”)  Act No 253/2008 Coll., on selected measures against legitimisation of proceeds of crime and financing of terrorism, as amended (hereinafter the “AML Act”)  Government Regulation No 210/2008 Coll., on the Implementation of special measures to combat terrorism, as amended by Government Regulation No 88/2009 Coll..  the sanctions provided for by directly applicable European Union (hereinafter the "EU") legislation issued by the competent EU authorities and published in the Official Journal of the EU and the relevant interpretative opinions of the European Commission (hereinafter the "EC") on those regulations1  Decree No 67/2018 Coll., on selected requirements for the system of internal rules, procedures and control measures against legitimisation of proceeds of crime and financing of terrorism, as amended (hereinafter the “AML Decree”) Selected provisions of legislation  in particular Article 10 and Article 11 of the IS Act  in particular Article 6(2)(a) and (b), Article 8(8)(a) and (b), Article 9(2)(b) and (c), Article 18(5) and Article 21(5)(b) of the AML Act  in particular Article 9(3)(b) and Article 12 of the AML Decree

1 https://ec.europa.eu/info/business-economy-euro/banking-and-finance/international-relations/restrictive-measures-sanctions_en

2 Methodological Instruction of the Financial Analytical Office  Methodological Instruction of the Financial Analytical Office (hereinafter the "FAO") No 1 of 23 April 2021 for obliged entities and other entities concerned on the implementation of international sanctions, in particular in connection with terrorist financing (hereinafter "FAO Methodological Instruction No 1")2  FAO Methodological Instruction No 5 of 26 February 2021 for obliged entities on the application of certain restrictive measures against persons, entities and bodies subject to UN Security Council decisions (hereinafter "FAO Methodological Instruction No 5")3  FAO Methodological Instruction No 9 of 26 February 2021 for credit and financial institutions – CUSTOMER DUE DILIGENCE4 II. Purpose The Czech National Bank (hereinafter the "CNB") carries out, inter alia, control activities in the area of prevention of money laundering and terrorist financing by the obliged entities it supervises (hereinafter the "institutions"). This document responds to repeated audit findings concerning the system of preventive measures that an obliged entity of this type must implement in its internal procedures and apply consistently in order to effectively implement binding international sanctions. III. General International sanctions (or also "restrictive measures", "sanctions" or "punitive measures") are, according to Czech legislation, measures adopted by the international community (UN, EU) to maintain or restore international peace and security, to protect fundamental human rights, and to combat terrorism. Such sanctions are binding on the Czech Republic (hereinafter the “CR”) by virtue of its membership in both these supranational communities. EU sanctions regulations are issued in the form of directly effective Council or Commission decisions and regulations effective in the Member States, thus including the Czech Republic, according to the date published in the Official Journal of the EU. In the case of sanctions regulations issued by the UN, it is not the UN resolutions as such that are directly effective, rather the content of these resolutions is translated by the European External Action Service (EEAS) into directly effective EU regulations. Last but not least, in rare cases the content of international restrictive measures is translated into government regulations. For the purposes of this supervisory benchmark, a sanctions list is a set of all currently applicable sanctions resulting from the above-mentioned legislation. Legally effective sanctions in the Czech legal system are those set out in the government regulation issued on the basis of the IS Act and those set out in directly effective EU legislation issued

2 https://www.financnianalytickyurad.cz/files/metodicky-pokyn-c-1-k-uplatnovani-mezinarodnich-sankci-v-souvislosti-s-financovanim￾terorismu.pdf 3 https://www.financnianalytickyurad.cz/files/metodicky-pokyn-c-5-provadeni-nekterych-omezujicich-opatreni-vuci-osobam-subjektum￾a-organum.pdf 4 https://www.financnianalytickyurad.cz/files/metodicky-pokyn-c-9-kontrola-klienta-urceny-uverovym-a-financnim-institucim.pdf

3 by the competent EU authorities and published in the Official Journal of the EU.5 In addition to international sanctions, individual states may also adopt their own so-called national sanctions. Such sanctions issued by a foreign state, unlike the (international) UN or EU sanctions described above, are not understood in the CR as international sanctions sensu stricto and are therefore not automatically binding or enforceable. However, depending on their nature, or the reasons for which they were adopted, they may be a supporting source of information useful in risk assessment within the meaning of Article 21a of the AML Act and Articles 5 and 6 of the AML Decree. In this context, we refer to FAO Methodological Instruction No 1 for more information. Individual international sanctions differ in their purpose and content, under which the following measures, for example, may be imposed:

• the obligation to secure the funds and economic resources of a specific person (to freeze the assets of a specific person) and, at the same time, to prohibit direct and indirect access to any assets of such person,
• the obligation to prevent specific persons, entities and bodies from accessing financial services or capital markets,
• prohibitions or restrictions on transactions in specific goods and the provision of related technical assistance, financial assistance and financing,
• prohibitions or restrictions on the movement of specific individuals,
• suspension of membership in international organisations. In addition to the conduct of primary persons, i.e. entities whose potential conduct is directly sanctioned, sanctions may also impact the conduct of secondary persons, i.e. those who indirectly commit the potentially sanctioned conduct in various forms (e.g. through intra-group relations, etc.).6 One of the most frequently applied types of sanctions are so-called financial sanctions, which impose an obligation to secure the funds and economic resources of specific persons, entities and bodies to which the sanctions apply, and which further prohibit directly or indirectly making available any funds and economic resources to such persons, entities or bodies. With regard to Article 11(1) and (2) of the IS Act, financial sanctions must be applied in the CR by, inter alia, any institution which is thus obliged, for example, to withhold the assets of7 persons listed on the sanctions lists if it finds out that the assets of such person are in its possession or that such person is or intends to become a party to an obligation relationship. However, some international sanctions also impose other, specific obligations (e.g. they prohibit credit and financial institutions from providing any financial services in the sanctioned country,

5 Information on the currently effective international sanctions regulations can be found via the link: https://www.financnianalytickyurad.cz/mezinarodni-sankce. 6 A typical example w ould be the examination of entities in the ow nership and management structure of a client in a situation w here the relevant sanction measure states that the sanctions apply to the entity in question, and then to all entities directly or indirectly controlled or ow ned by that entity. 7 Article 11 of the IS Act requires that assets not be handled other than f or the purpose of protecting them from loss, deterioration, destruction or other damage. Article 10 of the IS Act further requires notification of such assets to the FAO w ithout delay.

4 prohibit financing and financial assistance in connection with the supply of specific goods, etc.), but for the purposes of this benchmark we no longer refer to these as financial sanctions. Furthermore, the IS Act8 imposes, inter alia, a duty on any person who becomes aware in a credible manner that they are in possession of assets subject to international sanctions or who, in the preparation or conclusion of a contract, suspects that one of the parties to the obligation relationship is subject to international sanctions or that the subject of the obligation relationship is or should be assets subject to international sanctions, to notify the FAO without undue delay. The institution will fulfil this obligation pursuant to the AML Act and is required to report findings of a match with the sanctions lists9 in the form of a suspicious transaction report. The filing of a suspicious transaction report (including its particulars) in the event of a so-called sanction element, is regulated in Article 18(5) of the AML Act. IV. Requirements The CNB expects the institution to adopt procedures and measures to ensure that it implements international sanctions in a manner that does not expose it to the risks arising from a violation of an order, restriction or prohibition imposed by the relevant sanctions legislation, including the risk of failure to detect and report suspicious transactions. If the institution fails to ensure the effective implementation of international sanctions, it may also, in the extreme case, be committing a criminal offence pursuant to Article 410 of Act No 40/2009 Coll., the Criminal Code (violation of international sanctions). Below, this benchmark focuses exclusively on the implementation of financial sanctions. In this context, the institution is obliged, above all:

• to establish procedures to identify persons subject to financial sanctions,
• to establish procedures to be applied in the event of a finding that a person is listed on the relevant sanction list,
• to regulate these procedures and describe them in detail, clearly and comprehensibly in their internal regulations. As part of its supervision in the area of prevention of money laundering and terrorist financing, the CNB has encountered cases where institutions have not established and implemented adequate internal control and communication procedures for the implementation of financial sanctions. As a result, they were exposed to operational risk due to:
• failure to apply binding restrictive measures contained in the sanctions regulations,
• failure to comply with the notification obligation imposed by Article 18 of the AML Act in the cases referred to in Article 6(2)(a) or (b) of the same law, or failure to comply with the notification obligation pursuant to Article 10 of the IS Act,
• failure to take into account the risk factor in the institution's risk assessment

8 Article 10 of the IS Act. 9 Article 6(2)(a) and (b) of the AML Act.

5 pursuant to Article 21a of the AML Act in conjunction with Article 5 of the AML Decree,

• failure to take into account the risk factor in relation to Article 6 and Article 9(3)(b) of the AML Decree in the client risk profile and in the follow-up procedures towards the client,
• failure to implement a risk management procedure in accordance with Article 12 of the AML Decree. i. Identification of persons against whom financial sanctions are applied The CNB expects institutions to adopt procedures and measures that ensure the implementation of relevant sanctions measures in the context of an individual transaction or business relationship:
• for all clients whose identification data have been gathered or acquired by a substitute10 in the context of fulfilling the client identification obligation (Article 7 et seq. of the AML Act).
• for the beneficial owner of the client, whose identity has been gathered or acquired by a substitute in the course of fulfilling the obligation to carry out client due diligence (Article 9(2)(b) of the AML Act),
• for persons whose identification data the institution has gathered or acquired by a substitute in the course of fulfilling the client identification obligation (Article 7 et seq. of the AML Act) and the client due diligence obligation (Article 9(2)(b) of the AML Act), i.e. in particular for persons acting on behalf of the client, members of the statutory body of a client that is a legal person11 and entities and persons within the management and ownership structure of the client (hereinafter "persons connected with the client"),
• the counterparty to the customer's transaction, in particular where the institution is arranging the execution of the payment transaction (both seamless and documentary payments), taking into account all the information accompanying these transactions (e.g. the details of payments12 in the SWIFT, SEPA and CERTIS systems, documentary letters of credit, etc.). The relevant procedures should be set up with regard to the timely fulfilment of the obligation set out in particular in Article 8(8) of the AML Act and Article 12 of the AML Decree, which require the obliged entity to ascertain and record whether the client is a person against whom the CR applies financial sanctions pursuant to the IS Act. Following on from Article 21(5)(b) of the AML Act, institutions must include these procedures in their internal policy system. The institution will determine whether the above types of persons are subject to financial sanctions for persons where relevant and in the light of the information available to it. Therefore, if, for example, a payment transaction does not contain certain information in accordance with Regulation (EU) No 2015/84713, the institution need not actively identify the counterparty for the purpose of checking

10 Within the meaning of identification by a substitute pursuant to Article 11 of the AML Act. 11 All those w ho are listed in the extract from the Commercial Register or similar records. It is not sufficient to carry out due diligence only on those w ho deal w ith the obliged entity in a given transaction. 12 E.g. due diligence not only in relation to the sender's/receiver's bank, but also all correspondent banks (both in the form of free text and in the form of the so-called BIC - Bank Identifier Code), the information provided in the payment note (the so-called notice field). 13 Regulation (EU) 2015/847 of the European Parliament and of the Council of 20 May 2015 on information accompanying transfers of funds and repealing Regulation (EC) No 1781/2006.

6 against sanctions lists. Conversely, all relevant information available to the institution (including beyond the mandatory information) must be used (e.g. information in the transaction note). ii. Specific cases of persons and situations against which financial sanctions are applied Own counterparties and transactions with so-called 3rd parties When implementing financial sanctions, it should be noted that the restrictive measures resulting from them are imposed, inter alia, by an institution which has established in a credible manner that it holds assets of a person on the relevant sanctions list or that such a person is, or intends to be, one of the parties to an obligation relationship. Thus, the institution is obliged to apply sanction measures whenever it comes across assets that are subject to international sanctions or any person listed on the sanctions lists, irrespective of the role played by that asset/person in its activities. It is therefore not only the relationship of the institution providing the product/service to the client (which includes, inter alia, due diligence regarding the beneficial owner, members of the statutory body, persons who deal with the institution on behalf of the client, etc.), but also the relationship with the institution's own counterparty and contractual partners (e.g. within the framework of supplier-customer relationships or outsourcing). Cash transactions The institution will also apply the relevant procedures when carrying out cash payments, including in the case of transactions carried out by third parties with which the institution has no business relationship (provided that the conditions for identification are met).14 Domestic payments in the CERTIS system Obligations and prohibitions arising from financial sanctions are relevant and may apply to any transactions of the institution that relate to persons on a sanctions list. It is therefore necessary to apply the measures described above not only to international payment transactions but also, to a reasonable extent, to domestic non-cash payment transactions. For payments settled via the CERTIS system, it is not mandatory to provide e.g. the name of the payee/counter-account. In this context, however, it should be noted that although the CERTIS system does not require the provision of certain other data accompanying the payment, the institution may include such data in individual transactions and in such cases they will be available to it. In addition to the optional payee name field, this is typically information provided in the note to the payment. The fact that additional information relevant to the implementation of financial penalties may be included in the payment details underlines the importance of such checks.

14 E.g. a person depositing cash onto a customer account where the depositor is subject to the identification obligation in the c ontext of a one-off transaction of EUR 1 000 (or its equivalent in another currency).

7 Institutions must therefore take such available and relevant information into account to a reasonable extent when performing sanctions checks.15 In general, reliance cannot be placed on the financial sanction match checks carried out by other obliged entities as the scope and detail of the measures taken by them may be different or deficient. For this reason, it is undesirable for institutions to resign themselves to carrying out checks for matches with financial sanctions on payments made through CERTIS in the sense of not adopting a systematic approach to managing the risk associated with the sanctions element for domestic transactions. However, the set-up of the systems used may be adjusted appropriately in justified cases, e.g. payments settled through the CERTIS interbank payment system may not need to be verified in real time, in an "on-line" manner, as is the case for cross-border payments. However, it is always necessary to verify these domestic payments in a way that is procedurally as close as possible to the above-mentioned "near real-time” online mode. Furthermore, in this case, it is possible to set the checks so that the chosen algorithm has less strict rules 16 for potential matches, thus reducing the number of false positives. V. Basic prerequisites for the effective implementation of financial sanctions In order to comply with its obligations relating to the implementation of financial sanctions, the institution will apply measures and procedures that enable it to identify and apply the relevant sanctions measures and to notify the FAO of this fact not only at the initial identification of clients and persons associated with them (identification), but also on an ongoing basis throughout the duration of the business relationship, for all products and services offered and provided. As the relevant sanctions list is updated irregularly, the institution needs to establish and implement procedures that allow it to ensure the implementation of current sanctions measures immediately after their publication in the Official Journal of the EU. A system that enables financial sanctions to be implemented at a frequency that does not immediately reflect updates to the sanctions list exposes the institution to the risk of not identifying, applying and communicating current sanctions measures. Institutions must also apply similar measures in the event of an update to the relevant government regulation issued pursuant to the IS Act. At the same time, we would add that in its Methodological Instruction No 5, the FAO points out that there may be time delays between the announcement of relevant UN Security Council sanctions and the adoption of directly applicable EU or Czech legislation. Given the severity of he sanctions measures, there is therefore of reasonable concern that the purpose of the restrictive measures against the sanctioned entity could be frustrated during this delay. For this reason, the FAO publishes the UN Security Council measures on its website immediately after it becomes aware of their adoption, and instructs institutions to consider any case

15 Similarly, the scope of relevant data also applies to other situations, such as payments w ithin the European Union. 16 For example, set a high percentage match.

8 in which an entity published in this way is a party to a transaction to be a suspicious transaction within the meaning of Article 6 of the AML Act, with all the ensuing consequences and follow-up procedures. It follows that, as part of prudent compliance with AML/CFT obligations, the institution should make every effort to check the relevant lists after they have been published by the FAO. It is the obligation of the institution, where the conditions for identification are met, to actively investigate whether a person (including persons associated with such person) with whom it intends to enter into a business relationship or to execute a transaction outside of a business relationship, is on a sanctions list. Similarly, during the course of the business relationship, the institution must also actively investigate whether such client and persons connected with such client are on a sanctions list. At the same time, in the event of an update to the sanctions list, the institution must check whether a person who is an existing client of the institution or a person connected with such client, or a person for whom the institution has (any) identification data in its possession, has been added to the updated list. The CNB expects the institution to ensure that financial sanctions are implemented in a proactive manner, i.e. by searching the relevant sanctions lists, and that this method is clearly, comprehensibly and in sufficient detail described in the institution's internal regulations. The CNB considers mere reliance on a declaration by a client or a person connected with such client that he is not, or they are not, subject to international sanctions, to be a completely insufficient and unacceptable way of implementing measures to identify persons, entities and bodies against whom the CR applies international sanctions pursuant to the IS Act. The practicalities of implementing checks against sanctions lists Article 12 of the AML Decree states that: “(1) An institution shall, within its system of internal rules, implement and apply rules and procedures to identify the increased risk factor pursuant to Article 9(3)(b). (2) An institution, within its system of internal rules, shall implement and apply rules and procedures for effective management of risk connected with the identification of the increased risk factor pursuant to paragraph 1. These rules and procedures shall include at least rules and procedures to meet obligations pursuant to the legislation implementing international sanctions”. The CNB expects institutions to ensure that the relevant sanctions measures are applied consistently.17 As part of these steps and measures, institutions must, inter alia, consider the effectiveness of their systems for 'sanctions screening' (checking against relevant lists of sanctioned entities). One key assumption is not to rely only on the literal wording of the issued sanctions lists. This is of particularly key importance with regard to:

• possible differences in transcription, abbreviation, the use of aliases, etc.,

17 As a rule, additional information is handled through data augmentation w ithin commercial solutions. How ever, it is entirely up to the institution w hether to provide the required procedures and information in-house or through a commercial solution (purchase of a database) or directly through outsourcing.

9 where it is necessary to ensure that the sanctions are actually complied with in full for all relevant entities,

• detecting entities subject to sanctions due to direct or indirect ownership by another sanctioned entity.18 Procedures in the event a match is found The specific type of relevant restrictive measure (sanction) to be applied by the institution in the context of its activities is always set out in the relevant sanctions regulation that imposes the sanction on the person, entity or body concerned. Therefore, the institution must have internal procedures in place that allow it not only to identify a match (or suspected match) with the relevant sanctions list, but also to subsequently apply the specific sanctions measures relating to the person concerned. The obligation to define in detail the procedures following the determination that a person is subject to financial sanctions also follows from the aforementioned Article 12(2) of the AML Decree, and these procedures should be part of the institution’s internal policy system. The institution is also obliged to notify the FAO that it has found a match with a sanctions list. Further information in this respect, including the procedure in the event of a suspected match, is provided by the FAO in its Methodological Instruction No 1, available on the FAO website. In particular, this Methodological Instruction draws attention to the obligation to submit a suspicious transaction report where a match with a sanctions list is found, as well as where a match is suspected, and to the obligation to apply sanctions to the extent provided for in the relevant sanctions measure. VI. Conclusion The CNB expects institutions to ensure that, as part of their management and control system or internal policy system, they also have an adequate system for implementing financial sanctions. At the same time, the CNB states that the measures introduced by an institution to implement financial sanctions should not lead to the unjustified blanket rejection of client groups or discrimination against them.19 Advice: The information contained in this material expresses the opinion of the CNB's supervision departments, which is applied in supervision practice. A court and possibly the CNB Bank Board may take a different view. However, the CNB will, in its exercise of financial market supervision and within the limits of the circumstances of the specific case pursuant to consideration, consider a procedure in accordance with the information contained in this material to be a procedure in accordance with the relevant legislation in the area in question.

18 The sanctions regulation may, for example, specify that bank X is subject to the measure, as well as all entities that are more than 50 % ow ned by that bank. How ever, these directly or indirectly ow ned entities are no longer listed by name on the sanctions list. 19 Also commonly referred to as de-risking.