BCTL Instruction No. 26/2023 First Amendment to Instruction No. 5/2017 on Customer Identification, Record-Keeping and Transaction Report

Instruction No. 26/2023 of 30 October
1
First Amendment to Instruction N. 5/2017 of August 25 on Customer Identification, Record-Keeping, and Transaction Report Considering the current state of developments in the financial sector of Timor-Leste, particularly the banking sector, which requires an update to the existing rules for banking institutions to deal with their customers. Considering the latest development in the international standards related to the combating of money laundering and the countering the financing of terrorism. Further considering the need to protect the integrity of the banking system in Timor￾Leste. The Governing Board of Banco Central de Timor-Leste, pursuant to the authority granted under Article 45 of Law nº 5/2011 of 15 June, hereby resolves to approve the following Instruction:
Article 1
Purpose
This Instruction introduces the first amendment to Instruction N. 5/2017 of 25 August 25 on Customer Identification, Record-Keeping, and Transaction Report.
Article 2
Amendment
The following legal provision, comprising Articles 1, 4, 8, 9, 10, 12, 16, 17, 18, and 19 of the Instruction N. 5/2017 dated August 25 th, pertaining to Customer Identification, Record-Keeping, and Transaction Reporting, is hereby amended and rephrased as follows:
“Article 1
[…]
[…]
[…].
[…].
[…].
1 Please refer to Portugues version for official use. This English version is prepared to facilitate the availability of information for the financial institutions.

[…].
[…].
[…].
[…].
[…].
[…].
[…].
[…].
[…]:
[…]:
[…]:
[…].
[…].
[…]:
[…];
[…];
[…];
[…];
[…];
[…];
[…];
[…].
[…]:
[…];
[…];
[…].
[…].
[…].
[…].
“Straight-through processing” means payment transactions that are conducted electronically without the need for manual intervention. Previously sub-paragraph r).
Article 4
[…]
Every Bank shall develop internal policies, controls and procedures to ensure compliance with this Instruction and the relevant provisions in the AML/CFT Law. The policies, controls and procedures referred to in the previous paragraph shall have regards to both money laundering and terrorist financing risks and the size of the business and shall be approved by Senior Management and shall include, inter alia, the following:

[…];
[…];
[…];
Reporting of suspicious and cash transactions; […]; Control measures to identify and assess the risk of customers, especially in identifying the type of customers associated with a high risk of money laundering or financing of terrorism. The Bank shall ensure that systems are in place to monitor the implementation of those controls referred to above and to enhance them if necessary and to take enhanced measures to manage and mitigate the risks where higher risks are identified. Banks shall take appropriate measures to identify, assess, and understand the money laundering or terrorist financing risks by considering the following factors:
background or profile of the customers; nature of the customers’ business; structure of ownership for a corporate customer; the country origin of the customer and location of the business; the products, services, transactions or delivery channels offered. For the purpose of the previous paragraph, Banks are required to:
document their risk assessments; consider all the relevant risk factors before determining what is the level of overall risk and the appropriate level and type of mitigation to be applied; keep these assessments up to date; and have appropriate mechanisms to provide risk assessment information to the Central Bank. Previously paragraph 5.

Article 8
[…]

1. […].

2. Banks shall apply customer due diligence requirements to the existing
   customers on the basis of materiality and risk, and to conduct customer due diligence on such existing relationships at appropriate times, taking into account whether and when due diligence measures have previously been undertaken and the adequacy of data obtained.

3. […].

4. The Central Bank may, from time to time, determine the circumstances under
   which the obligations regarding the identification and verification of the identity of customers or the beneficial owners may be reduced or simplified. Reduced or simplified measures shall only be permitted where lower risks have been identified by the Central Bank and there is no suspicion of money laundering or terrorist financing. 5.

5. […].

6. Banks shall adopt risk management procedures concerning the conditions
   under which a customer may utilize the business relationship prior to verification.

7. For the purpose of the previous paragraph, risk management procedures may
   include inter alia setting a limit on the number and amount of transactions and/or requiring senior management approval for transactions.

Article 9
[…]

1. Banks shall identify their customers and beneficial owners and verify their
   identities by using reliable, independent source documents, data or information when:
   a). […]; b). carrying out occasional transactions whether by natural or legal person or legal arrangement; c). […]; d). […].
2. The due diligence process required in the previous paragraph shall include the
   identification of the beneficial owner, using the relevant information or data obtained from a reliable source, such that the bank is satisfied that it knows who the beneficial owner is.
3. […]:
   a). […]; b). Identification of legal persons or legal arrangements and verify the identity through the following information:
   i). name, legal form and proof of existence; ii). the powers that regulate and bind the legal person or arrangement, as well as the names of the relevant persons having a senior management position in the legal person or arrangement; and iii). the address of the registered office and, if different, a principal place of business. c). Identification of legal persons and take reasonable measures to verify the identity of beneficial owners through the following information:
   i). the identity of the natural person(s), if any, who ultimately has a controlling ownership interest in a legal person; and ii). to the extent that there is doubt about the identity of that natural person(s) as to whether the person(s) with the controlling ownership interest is the beneficial owner(s) or where no natural person exerts control through ownership interests, the identity of the natural person(s), if any, exercising control of the legal person or arrangement through other means; and

iii). where no natural person is identified under i). or ii). above, the identity of the relevant natural person who holds the position of senior managing official.
4. Banks shall understand and, as appropriate, obtain information regarding the
purpose and intended nature of the business relationship.
5. […].
6. […];
a). […]; and b). […].
7. […].
8. […]:
a). […]; or b). […].

Article 10
[…]

1. […]:
   a). […]:
   i). […]; ii). […]; iii). […]; iv). […]; v). […]; vi). […]; vii). […]; viii). […]; ix). […]; x). […]; xi). E-mail address, if any, landline number and/or mobile phone number. b). […]:
   i). […]; ii). […]; iii). […]; iv). […]; v). […]; vi). […]; vii). […]; viii). […]; ix). […].

c). […]:
d).
2. […]:
a). […]:
i). […]; ii). As for non-residents, upon presentation of a passport and at least one of the following documents:
(1). document issued and/or certified by a Timorese public authority, which contains the identification of the non-resident; or (2). proof of application for a visa or other residence permit in Timor￾Leste, also issued by the Timorese public authority competent for that purpose. iii). As for non-residents subject to special legal visa exemption regimes, upon presentation of a passport and at least one of the following documents:
(1). identification document from the country of origin; (2). employment contract signed with Timorese private or public entities; (3). act of public appointment to exercise functions in Timor-Leste; (4). special passport granted by virtue of the public service mission. b). […] c). […]:
i). The identification data referred to in points i) to iii) of subparagraph b) of paragraph 1 shall be demonstrated by an extract from the commercial registry; and, in the case of non-residents, through a duly certified equivalent document; ii). The identification data referred to in points iv) and v) of subparagraph b) of paragraph 1 can be proved by the presentation of a certificate from the tax authorities, certificate of commercial registry or similar document, and, in the case of non-residents, through a duly certified equivalent document; iii). The identification data contained in points vi) and vii) of subparagraph b) of paragraph 1 can be demonstrated by simple written statement issued by the legal entity itself, containing the name or corporate name of the holders, signed, in the case of Public Limited Liability Companies, be signed by the Company’s Secretary. d). […]. e). […]. f). In the case of the Catholic Church and also canonically erected ecclesiastical entities and institutions, including, but not limited to, the Timorese Episcopal Conference, dioceses, parishes and other ecclesiastical jurisdictions, Catholic associations and foundations, congregations and seminaries, the elements of identification provided for in number 2, when

applicable, can be proven by presenting a certificate from the Catholic Church and other documents from the Timorese Episcopal Conference, diocesan curias, the Conference of Major Superiors of Institutes of Consecrated Life and Societies of Apostolic Life, parishes and other canonically erected ecclesiastical institutions and entities. g). With regard to legal persons or centers of collective interests without legal personality, upon presentation of the commercial registration certificate or, in the case of an entity based outside the national territory, an equivalent document issued by an independent and credible source, which contains; i). the name, ii). the object, iii). the full address of the headquarters and, when applicable, the branch or permanent establishment and iv). identification number of a legal person or, when none exists, an equivalent number issued by a foreign authority competent. h). As for embassies, consulates, diplomatic missions and other entities of a similar nature, the identification elements provided for in number 2, when applicable, can be proven by presenting a document proving their accreditation with the competent Timor-Leste authority.

Article 12
[…]

1. […]:
   a). […]; b). […]; c). […]; d). […]; e). […]; f). […]; g). […]; h). […].

2. Banks are required to put in place risk management systems to determine
   whether a customer or the beneficial owner is a politically exposed person.

3. Previously paragraph 2.
   a). […]; b). […]; c). […].

4. Previously paragraph 3.
   a). […]; b). […].

5. Previously paragraph 4.

6. Previously paragraph 5.

Article 16
[…]

1. […].
2. Bank shall observe all the requirements related to the customer due diligence
   procedures established in this Instruction when facilitating wire transfer operations.
3. Ordering Banks shall maintain all originator and beneficiary information
   collected, pursuant to Article 18 of Instruction N. 5/2017 of August 25.
4. Previously paragraph 3:
   a). […]; b). […].
5. Where technical limitations prevent the required originator or beneficiary
   information accompanying a cross-border wire transfer from remaining with a related domestic wire transfer, the intermediary Banks shall keep the record for the period required under Article 18, of all the information received from the ordering Bank or another intermediary Bank.
6. Intermediary Banks shall take reasonable measures, which are consistent with
   Straight-Through Processing, to identify cross-border wire transfers that lack required originator information or required beneficiary information.
7. Previously paragraph 4:
   a). […]; b). […]; c). […]; d). […].
8. Previously paragraph 5.
   Article 17
   […]
   […]
   […];
   […];
   […];
   […];
   […].
   For cross-border wire transfers with amount below USD 1,000, banks need not verify the accuracy of information referred to in the previous paragraph unless there is a suspicion of money laundering or terrorist financing. […].

[…].
[…].
Article 18
[…]
[…]:
[…];
[…];
[…];
[…].
Notwithstanding the requirements established in the previous paragraph, records that are the subject of criminal investigations, or administrative or regulatory proceedings or ongoing legal action shall be retained beyond the stipulated retention period until such records are no longer needed. […].
Article 19
[…]
[…].
[…].
In cases where Banks form a suspicion of money laundering or terrorist financing, and reasonably believe that performing the customer due diligence process may potentially alert the customer, the Banks are authorized to not pursue the due diligence process, provided however that a suspicious transaction report shall be submitted without delay pursuant to this Instruction. Previously paragraph 3. Previously paragraph 4. Previously paragraph 5. Previously paragraph 6. Previously paragraph 7. Previously paragraph 8.”

Article 3
Republication
The Instruction N. 5/2017 of August 25, on Customer Identification, Record-Keeping, and Transaction Report, with the changes introduced by this Instruction, shall be republished its current wording as provided in Annex, which is an integral part of the present Instruction.

Article 4
Entry into force
In accordance with article 66 paragraph 1 of the Organic Law of the Central Bank, this Instruction shall be published in the Journal da República. This Instruction shall enter into force on the day following its publication. Adopted in 30 th of October 2023 Governor, Helder Lopes

ANNEX

(as referred to in Article 4)
Republication of BCTL Instruction N. 05/2017 of 25 august on Customer Identification, Record-Keeping and Transaction Report 2

Banco Central de Timor-Leste has the duty to assure compliance, by the financial institutions, with the provisions of Law nº 17/2011 of 28 December, on the Legal Regime for the Prevention and Combatting Money Laundering and the Financing of Terrorism, as amended. Taking into consideration that a Bank or the banking system may be exposed to reputational, operational, legal and other risks related with money laundering activities and that the involvement of banking institutions in money laundering or the financing of terrorism is likely to seriously undermine their reputation and undermine the public’s confidence in them and in the banking system. Furthermore, considering that the effective knowledge and understanding by Banks of their customers and the business that they conduct with or through the banking institution is essential in preventing the banking system from being used for money laundering or the financing of terrorism, hence reducing the risk of the banking system becoming a vehicle for/or a victim of financial crime and suffering consequential damage, and protecting the reputation and integrity of the banking system. In view of the best international practices and in the interest of protecting the Timorese banking system, the depositors and the institutions, enhancing a sound and safe financial and banking sector. The Governing Board of Banco Central de Timor-Leste, in accordance with Article 27 paragraph 2 subparagraph c) of Law nº 17/2011 of 28 December and Article 31 paragraph 1 of Law nº 5/2011 of 15 June, hereby resolves to approve the following Instruction:
CHAPTER I
GENERAL REQUIREMENTS

SECTION I
GENERAL PROVISIONS
Article 1
Definitions
In this Instruction the terms below shall have the following meaning:
2 This English version of the Instruction is provided to facilitate banks and the public to understand the content. Interpretations should be referenced to the official version which the Portuguese version.

a). “Administrator” means any person who is an officer of a Bank, or other juridical person, including any member of the Governing Board or the Audit Committee and the Compliance Officer and further including any person who alone or together with one or more others has the authority to enter into commitments for the account of such juridical person; b). “AML/CFT” means anti-money laundering/combating the finance of terrorism; c). “AML/CFT Law” means Law n o. 17/2011 of 28 December on the Legal Regime for the Prevention and Combatting Money Laundering and the Financing of Terrorism, as amended; d). “Bank” means entities established under UNTAET Regulation n o. 2000/8 on Bank Licensing and Supervision including Other Deposit Taking Institution established pursuant to Public Instruction 06/2010 of 29 December, and their agents; e). “Beneficial owner” means the natural person[s] who ultimately owns or control a customer and/or the natural person on whose behalf a transaction is being conducted including those persons who exercise ultimate effective control over a legal person or arrangement; f). “Compliance Officer” means an officer who is responsible for ensuring that the Bank complies with its obligations in accordance with the present Instruction and the applicable laws and regulations; g). “Correspondent banking” means the provision of banking services by one bank to another bank (the respondent bank); h). “FATF” means the Financial Action Task Force, the inter-governmental body established in 1989, to which the Asia/Pacific Group on Money Laundering of which Timor-Leste is a member, is an associate member; i). “Financial Information Unit” or “FIU” means the institution established under Article 4 of Law n o. 17/2011 of 28 December as amended; j). “Legal arrangements” means express trusts or other similar legal arrangements such as fiduciary, nominee, etc; k). “Numbered accounts” means accounts in which the name of the beneficial owner is known to the Bank but is substituted by an account number or code name in some documentation; l). “Occasional transaction” means a single transaction, or a series of transactions that are, or appear to be linked to each other, where,
i. the Bank does not have a business relationship with the customer, and
ii. the total amount of money paid or received by the customer in a single
transaction or series of transactions is greater than US$ 10,000. m). “Payable through accounts” means correspondent accounts that are used directly by third parties to transact business on their own behalf; n). “Politically Exposed Person” or “PEP” means; the natural persons, resident both inside or outside of Timor-Leste, who are or have been entrusted within the previous year with prominent political or public functions, as well as their close family members and persons known to have close corporate or commercial relationships with them. For the purposes of this Instruction:
i. "Prominent political or public functions":
(1). Heads of State, heads of Government and Government members;

(2). Members of Parliament;
(3). Members of superior courts and other high-level judicial bodies, whose decisions are final and binding, unless in exceptional circumstances; (4). Members of board of directors and boards of auditors of central banks; (5). Heads of diplomatic missions and consulates; (6). High-ranking Military and Police officers; (7). Members of board of directors and boards of auditors of public companies and corporations wholly owned or controlled by the State, public institutes, public foundations, public establishments under whatever legal form; (8). Members of executive boards of international organizations.
ii. "close family members":
(1). The spouse or the unmarried partner; (2). The parents and offspring, their spouses or unmarried partners; (3). The siblings. o). “Qualifying Wire Transfers” are all wire transfers except for those that flow from a transaction carried out by a credit or debit or prepaid card for the purchase of goods or services (not including person to person transfers) so long as the card number accompanies all transfers flowing from the transaction; and bank-to-bank transfers and settlements where the both parties are acting on their own behalf; p). “Senior management” means the most senior persons in each Bank who are responsible for the management and administration of the Bank; q). “Shell bank” means a bank that has no physical presence in a country in which it is incorporated and licensed, and which is unaffiliated with a regulated financial group that is subject to effective consolidated supervision; r). “Straight-through processing” means payment transactions that are conducted electronically without the need for manual intervention. s). “Unusual transaction” means a transaction that appears to lack economic or commercial sense, or that involves large sums of money, particularly large cash deposits not consistent with the expected activity in an account.
Article 2
Scope

1. This Instruction shall apply to all Banks including branches of foreign entities
   licensed to operate in Timor-Leste.
2. This Instruction shall also be applicable to the foreign majority owned
   subsidiaries and branches of a Bank to the extent that local applicable laws and regulation so permit.
3. Notwithstanding the provision of the previous paragraph, in the event that the
   local laws and regulations prohibit compliance with these obligations, the Bank shall so advise the Central Bank.

SECTION II
PROHIBITION AND RESTRICTION
Article 3
Prohibition and restriction
Banks are prohibited from:
a). Keeping anonymous accounts or accounts in obviously fictitious names; b). Dealing with unknown customers and those who refuse to provide the details required to enable compliance with this Instruction; c). Allowing numbered accounts; d). Entering into or continuing correspondent banking relationships with shell banks.
SECTION III
INTERNAL PROGRAMMES

Article 4
Internal policies and procedures

1. Every Bank shall develop internal policies, controls and procedures to ensure
   compliance with this Instruction and the relevant provisions in the AML/CFT Law.

2. The policies, controls and procedures referred to in the previous paragraph shall
   have regards to both money laundering and terrorist financing risks and the size of the business and shall be approved by Senior Management and shall include, inter alia, the following:
   a). Customer identification and verification; b). Customer acceptance; c). On-going monitoring and control of high-risk accounts; d). Reporting of suspicious and cash transactions; e). Record-keeping; f). Control measures to identify and assess the risk of customers, especially in identifying the type of customers associated with a high risk of money laundering or financing of terrorism.

3. The Bank shall ensure that systems are in place to monitor the implementation
   of those controls referred to above and to enhance them if necessary and to take enhanced measures to manage and mitigate the risks where higher risks are identified.

4. Banks shall take appropriate measures to identify, assess, and understand the
   money laundering or terrorist financing risks by considering the following factors:
   background or profile of the customers; nature of the customers’ business structure of ownership for a corporate customer the country origin of the customer and location of the business the products, services, transactions or delivery channels offered.

5. For the purpose of the previous paragraph, Banks are required to:
   document their risk assessments; consider all the relevant risk factors before determining what is the level of overall risk and the appropriate level and type of mitigation to be applied; keep these assessments up to date; and have appropriate mechanisms to provide risk assessment information to the Central Bank.

6. Banks are required to establish adequate screening procedures into their
   recruitment policy to ensure high standards when hiring employees.
   Article 5
   Compliance measures

7. Every Bank shall appoint a Compliance Officer at Senior Management level,
   approved by the Central Bank, who is able to carry out his/her responsibilities effectively and become the point of contact for the Central Bank and the Financial Information Unit with regards to AML/CFT matters.

8. Compliance Officers shall have direct access to Senior Management and shall
   have full access to all customers’ information and data in order to ensure compliance with the provisions established in this Instruction and the applicable laws and regulations.

9. Banks shall obtain the Central Bank’s approval on the appointment or change
   in the appointment of the Compliance Officer.

10. Banks shall ensure that the roles and responsibilities of the Compliance Officer
    are clearly defined and documented to ensure the following:
    a). the Bank’s compliance with the requirements of this Instruction and other applicable laws and regulations; b). implementation of the anti-money laundering and combating financing of terrorism policies and programme; c). proper channels of communication are in place to effectively communicate to all levels of employees the AML/CFT policies and procedures; d). all employees are aware of the Bank’s AML/CFT measures, including policies, control mechanisms and the channels of reporting; e). the identification of money laundering and financing of terrorism risks associated with new products or services or arising from the Bank’s operational changes, including the introduction of new technology and processes; f). the AML/CFT mechanism is continuously assessed to ensure that it is effective and sufficient to address any change in money laundering and financing of terrorism trends.
    Article 6
    Annual compliance report

11. Every Bank shall prepare an annual report with regards to the implementation
    of this Instruction which shall include, but not be limited to, the following:
    a). A description of the bank’s systems, control objectives, controls and procedures to implement the AML/CFT regime in compliance with the

AML/CFT Law and Instructions, particularly addressing the objectives and requirements in Article 4; b). The name, role and responsibilities of the Compliance Officer; c). The role and responsibilities of Internal Audit in reviewing the systems and procedures, including HR, with a summary of the audit programs relating to AML/CFT planned and achieved during the year; d). A description of the AML/CFT training programs provided for staff during the year.
2. The report referred to in the previous paragraph shall include an assertion
signed by the Chairman of the Board of Directors, or by the chief executive officer in case of a branch of a foreign bank, that:
a). The description of the systems and procedures in the report presents the Bank’s systems and procedures as designed and implemented throughout the year; b). The controls related to the control objectives stated in the description of the Bank’s systems and procedures were suitably designed throughout the period; c). The controls related to the control objectives identified in the report operated effectively throughout the year; d). The other information in the report fairly describes the subject matter and operated effectively throughout the year.
3. Each Bank shall require its external or internal auditors to form an opinion
whether the description of the system and other information in the report fairly represents the system as designed and implemented; that the controls are suitably designed to meet the objectives of the AML/CFT regime; and that the controls operated effectively during the year.
4. The auditor shall issue an opinion that:
a). Conveys reasonable assurance about the matters in the management assertion; b). Includes a description of the tests of controls and the results thereof; c). Draws attention to material shortcomings or weaknesses; d). Draws attention to any limitations in the scope of the audit.
5. The report together with the assertion and auditor’s opinion shall be submitted
to the Central Bank within four months after the end of each financial year.
Article 7
Training programme

1. Banks shall provide regular training programmes on AML/CFT practices and
   measures for its staff, in particular, those staff that are directly dealing with customers and officers in-charge of processing and accepting new customers as well as staff responsible for monitoring transactions.
2. Banks shall make their staff aware that they may be held personally liable for
   any failure to observe the AML/CFT requirements.
3. Banks are required to make an allocation in their annual operating expenses
   budget to support an ongoing AML/CFT staff training programme.

CHAPTER II
CUSTOMER DUE DILIGENCE
Article 8
General requirements

1. Banks, in conducting a customer due diligence process, shall at all times obtain
   a copy of the documents and data to evidence the customer due diligence process has taken place.

2. Banks shall apply customer due diligence requirements to the existing
   customers on the basis of materiality and risk, and to conduct customer due diligence on such existing relationships at appropriate times, taking into account whether and when due diligence measures have previously been undertaken and the adequacy of data obtained.

3. Banks shall draw the attention of the customer to the need to update the
   information in his/her other accounts, if any.

4. The Central Bank may, from time to time, determine the circumstances under
   which the obligations regarding the identification and verification of the identity of customers or the beneficial owners may be reduced or simplified. Reduced or simplified measures shall only be permitted where lower risks have been identified by the Central Bank and there is no suspicion of money laundering or terrorist financing.

5. Banks are required to identify and assess risks but shall apply a risk-based
   approach in managing the risks that have been identified.

6. Banks shall adopt risk management procedures concerning the conditions
   under which a customer may utilise the business relationship prior to verification.

7. For the purpose of the previous paragraph, risk management procedures may
   include inter alia setting a limit on the number and amount of transactions and/or requiring senior management approval for transactions.
   Article 9
   Customer identification

8. Banks shall identify their customers and beneficial owners and verify their
   identities by using reliable, independent source documents, data or information when:
   a). establishing business relationship with any customer; b). carrying out occasional transactions whether by natural or legal person or legal arrangement; c). doubts exist about the veracity or adequacy of previously obtained customer identification data; d). there is a suspicion of money laundering or financing of terrorism.

9. The due diligence process required in the previous paragraph shall include the
   identification of the beneficial owner, using the relevant information or data obtained from a reliable source, such that the bank is satisfied that it knows who the beneficial owner is.

10. Banks shall identify and verify the identity of their clients, by the following
    means:
    a). Identification of individuals and verification of their identity shall include the full name and national identification number; b). Identification of legal persons or legal arrangements and verify the identity through the following information:
    i). name, legal form and proof of existence; ii). the powers that regulate and bind the legal person or arrangement, as well as the names of the relevant persons having a senior management position in the legal person or arrangement; and iii). the address of the registered office and, if different, a principal place of business. c). Identification of legal persons and take reasonable measures to verify the identity of beneficial owners through the following information:
    i). the identity of the natural person(s), if any, who ultimately has a controlling ownership interest in a legal person; and ii). to the extent that there is doubt about the identity of that natural person(s) as to whether the person(s) with the controlling ownership interest is the beneficial owner(s) or where no natural person exerts control through ownership interests, the identity of the natural person(s), if any, exercising control of the legal person or arrangement through other means; and iii). where no natural person is identified under i). or ii). above, the identity of the relevant natural person who holds the position of senior managing official.

11. Banks shall understand and, as appropriate, obtain information regarding the
    purpose and intended nature of the business relationship.

12. If there is doubt as to whether a customer specified in paragraph 1 above acts
    for his/her own account, Banks shall verify the identity of the person or persons on whose behalf the customer is acting and verify that he/she is authorized to do so.

13. Notwithstanding the requirements established in the previous paragraphs,
    Banks may verify the identity of a customer and any beneficial owner of the customer after establishing a business relationship with the customer if; a). this is necessary not to interrupt the normal conduct of business with regard to the customer; and b). any risk of money laundering or terrorist financing that may be caused by carrying out the verification after establishing the business relationship is effectively managed.

14. Banks that carry out verification after establishing a business relationship with
    a customer under the previous paragraph shall complete the verification as soon as reasonably practicable after establishing the business relationship but shall not exceed 3 business days.

15. If a bank is unable to comply with the requirements established in paragraphs
    1 to 6 above, it:

a). shall not open the account, commence a business relationship or carry out any occasional transaction with that customer; or b). if it has already established a business relationship with that customer, shall terminate the business relationship and consider making a suspicious transaction report.
Article 10
Minimum verification requirements

1. When Banks undertake the opening of deposit accounts, at least the following
   data should be collected in the respective forms for each of the account holders and their representatives, as well as any other person entitled to operate the account:
   a). In the case of a physical person:
   i). Full name and signature; ii). Date and place of birth; iii). Nationality; iv). Complete permanent address; v). Occupation and employer, if any; vi). Taxpayer number, if any; vii). Public office held, if any; viii). Type, number, date and issuer of the identification document; ix). Income; x). Expected use of the account: amount, number, type, purpose and frequency of the transactions expected; xi). E-mail address, if any, landline number and/or mobile phone number. b). In the case of a legal entity:
   i). Corporate name; ii). Corporate purpose; iii). Address of the registered head office; iv). Taxpayer number; v). Company’s registration number; vi). Identity of the partners or shareholders who own or have voting rights in the legal person corresponding to at least 5% of the share capital; vii). Identity of the legal person’s management bodies; viii). Identity of any persons exercising effective control of the legal person; ix). Identity of the beneficial owners. c). In case of accounts held by self-employed persons, the respective form for account opening must contain the tax identification number, name, registered head office or place of business and purpose, in addition to the information referred to in subparagraph a). d). The requirements established in subparagraph b) points v. and vii. do not apply in case of entities listed on a recognised stock exchange.

2. The data referred to in the preceding paragraph shall be proved through the
   following means of verification:
   a). For physical persons the data specified in points i) to iii) of subparagraph a) of the preceding paragraph shall be proved by:
   i). For resident persons, through the presentation of two of the following documents: national identity card, voter registration card, passport, resident permit in the territory, in case of a foreign citizen; ii). As for non-residents, upon presentation of a passport and at least one of the following documents:
   (1). document issued and/or certified by a Timorese public authority, which contains the identification of the non-resident; or (2). proof of application for a visa or other residence permit in Timor￾Leste, also issued by the Timorese public authority competent for that purpose. iii). As for non-residents subject to special legal visa exemption regimes, upon presentation of a passport and at least one of the following documents:
   (1). identification document from the country of origin; (2). employment contract signed with Timorese private or public entities; (3). act of public appointment to exercise functions in Timor-Leste; iv). special passport granted by virtue of the public service mission. b). The full address, occupation and employer may be evidenced by any document, mean or through any diligence considered suitable and sufficient to demonstrate the information provided; c). With regard to legal entities:
   i). The identification data referred to in points i) to iii) of subparagraph b) of paragraph 1 shall be demonstrated by an extract from the commercial registry; and, in the case of non-residents, through a duly certified equivalent document; ii). The identification data referred to in points iv) and v) of subparagraph b) of paragraph 1 can be proved by the presentation of a certificate from the tax authorities, certificate of commercial registry or similar document, and, in the case of non-residents, through a duly certified equivalent document; iii). The identification data contained in points vi) and vii) of subparagraph b) of paragraph 1 can be demonstrated by simple written statement issued by the legal entity itself, containing the name or corporate name of the holders, signed, in the case of Public Limited Liability Companies, be signed by the Company’s Secretary. d). When a physical or a legal person is not resident in the national territory and has not proved all of the identification data required in paragraph 2 above, the Bank may request written confirmation of the veracity and timeliness of the information provided, to be issued by a credit institution where the person already holds a bank deposit account.

e). When the confirmation referred to in the preceding subparagraph takes place, the Bank shall notify the Central Bank of the details of the credit institution that provided the information and the Central Bank may, if it deems necessary, impose further requirements. f). In the case of the Catholic Church and also canonically erected ecclesiastical entities and institutions, including, but not limited to, the Timorese Episcopal Conference, dioceses, parishes and other ecclesiastical jurisdictions, Catholic associations and foundations, congregations and seminaries, the elements of identification provided for in number 2, when applicable, can be proven by presenting a certificate from the Catholic Church and other documents from the Timorese Episcopal Conference, diocesan curias, the Conference of Major Superiors of Institutes of Consecrated Life and Societies of Apostolic Life, parishes and other canonically erected ecclesiastical institutions and entities. g). With regard to legal persons or centers of collective interests without legal personality, upon presentation of the commercial registration certificate or, in the case of an entity based outside the national territory, an equivalent document issued by an independent and credible source, which contains; i). the name, ii). the object, iii). the full address of the headquarters and, when applicable, the branch or permanent establishment and iv). identification number of a legal person or, when none exists, an equivalent number issued by a foreign authority competent. h). As for embassies, consulates, diplomatic missions and other entities of a similar nature, the identification elements provided for in number 2, when applicable, can be proven by presenting a document proving their accreditation with the competent Timor-Leste authority.

Article 11
New technologies and non-face-to-face business relationship

1. Banks are required to have policies in place and take appropriate measures to
   manage and mitigate risks to prevent the misuse of technological developments in money laundering or terrorist financing schemes when:
   a). developing new products and new business practices, including new delivery mechanisms; and b). developing the use of new or developing technologies for both new and pre￾existing products.
2. Banks that offer non-face-to-face business services shall pay special attention
   to the following when establishing and conducting business relationship:
   a). establishing appropriate measures for customer verification that shall be as effective as that for face-to-face customers; b). implementing a monitoring system and reporting mechanism to identify potential money laundering and financing of terrorism activities.
3. The measures that the Bank may use to verify non-face-to-face customers shall
   include, but not limited to:

a). requisition of additional documents to complement those which are required for face-to-face customers; b). developing independent contact with the customer; or c). verification of customer information publicly available.
4. The Bank shall ensure the certification of copies obtained when dealing with
non-face to face relationships.
Article 12
Enhanced due diligence

1. Banks shall conduct enhanced customer due diligence on customers who pose
   higher risk including, but not limited to, the following:
   a). High net worth individuals; b). Politically exposed persons; c). Complex legal arrangements; d). Non-resident customers; e). Intensive cash based businesses; f). Individuals and entities from locations known for their high rates of crime such as drug producing, trafficking, smuggling, etc; g). Businesses/activities identified by the FATF as of higher money laundering and financing of terrorism risk; and h). Countries or jurisdictions with inadequate AML/CFT laws and regulations as highlighted by the FATF.

2. Banks are required to put in place risk management systems to determine
   whether a customer or the beneficial owner is a politically exposed person.

3. Notwithstanding the requirements established in the previous paragraph, Banks
   may classify a customer or transaction as high risk, when:
   a). following the initial acceptance of the customer the Bank determines the pattern of account activity does not conform to the bank’s understanding of the customer; b). the customer refuses, without good reason, to provide the information requested and to cooperate with a Bank’s customer due diligence process; c). the Bank has cause to believe that the customer has been refused banking services by another Bank for reasons related to the implementation of money laundering and terrorist financing requirements.

4. Without prejudice to any requirement to adopt higher standards for certain
   transactions or for certain classes of persons, the due diligence process established in the previous paragraphs shall include, but not be limited to, the following:
   a). Obtaining more detailed information from the customer and the beneficial owner and through publicly available information take all reasonable and appropriate measures to establish the source of wealth or funds and the purpose of the transaction; and b). Obtaining approval from the Senior Management of the Bank before establishing or continuing the business relationship with the customer.

5. Banks shall conduct enhanced on-going due diligence on customers referred to
   in paragraph 1 above throughout their business relationships with such customers.

6. The Central Bank may from time to time review the type of customers referred
   to in the paragraph 1 above.
   Article 13
   Ongoing customer due diligence

7. Banks shall exercise ongoing due diligence with respect to the business
   relationship with customers and closely examine the transactions carried out in order to ensure that they are consistent with their knowledge of the customer, his/her commercial activities and risk profile and, where required, the source of his/her funds.

8. Banks shall operate a system to detect unusual transactions in all their
   customers’ accounts and procedures to assess whether these unusual transactions give rise to suspicions that should be reported to the FIU.

9. Banks shall conduct regular reviews on existing records of customers, especially
   when:
   a). a significant transaction is about to take place; b). there is a material change in the way the account is operated; c). the customer’s documentation standards change substantially; or d). it discovers that the information held on the customer is insufficient.

10. In circumstances other than those mentioned in the previous paragraph, a Bank,
    based on its risk assessment, may require additional information consistent with the Bank’s current customer due diligence standards from those existing customers that are considered to be of higher risk.
    CHAPTER III
    CORRESPONDENT RELATIONSHIPS
    Article 14
    General requirements

11. Banks are prohibited from establishing or maintaining business relationships
    with banks or financial entities that are domiciled or are subsidiaries of entities based in a country or territory that does not have effective consolidated supervision.

12. Banks are prohibited from establishing or maintaining commercial relationships
    with respondent financial institutions in a foreign country if they permit their accounts to be used by shell banks.

13. Banks are required to obtain approval of Senior Management before
    establishing a new correspondent banking relationship.
    Article 15
    Correspondent banking
    Banks shall take the following measures before establishing a cross-border correspondent banking relationship:

a). assess the suitability of the respondent bank by taking the following steps:
i). gather adequate information about the respondent bank to understand fully the nature of the respondent bank’s business, including the following, where applicable; (1). Know your customer policy; (2). Information about the respondent bank’s management and ownership; (3). Major business activities; (4). Its geographical presence or jurisdiction country of correspondence. ii). based on publicly available information, evaluate the respondent institution’s reputation and the nature of supervision to which it is subject; iii). assess the respondent bank’s AML/CFT systems and ascertain that they are adequate and effective, having regard to the AML/CFT measures of the country or jurisdiction in which the respondent bank operates; and iv). in the case of a payable-through account, the Bank shall ensure that the respondent institution:
(1). has verified the customer’s identity; (2). has implemented mechanisms for ongoing monitoring with respect to its clients; and (3). is capable of providing relevant identifying information on request. b). clearly understand and document the respective AML/CFT responsibilities of each bank.
CHAPTER IV
WIRE TRANSFERS

Article 16
Obligations of Banks

1. Banks shall not execute, intermediate, or receive a wire transfer unless the wire
   transfer complies with the provisions of this Instruction.
2. Bank shall observe all the requirements related to the customer due diligence
   procedures established in this Instruction when facilitating wire transfer operations.
3. Ordering Banks shall maintain all originator and beneficiary information
   collected, pursuant to Article 18 of Instruction N. 5/2017 of August 25.
4. Intermediary Banks in the payment chain for processing wire transfers shall
   ensure that:
   a). all originator and beneficiary information remains with the wire transfer or related message throughout its processing; b). effective risk-based policies and procedures are in place for determining (i) when to execute, reject, or suspend a wire transfer lacking required

originator information or required beneficiary information; and (ii) the appropriate follow-up action.
5. Where technical limitations prevent the required originator or beneficiary
information accompanying a cross-border wire transfer from remaining with a related domestic wire transfer, the intermediary Banks shall keep the record for the period required under Article 18, of all the information received from the ordering Bank or another intermediary Bank.
6. Intermediary Banks shall take reasonable measures, which are consistent with
straight-through processing, to identify cross-border wire transfers that lack required originator information or required beneficiary information.
7. Beneficiary Banks shall:
a). take reasonable measures to identify cross-border wire transfers that lack required originator or required beneficiary information; b). verify the identity of the beneficiary, if the identity has not been previously identified; c). maintain records concerning the identity of the beneficiary; d). have effective risk-based policies and procedures for determining (i) when to execute, reject, or suspend a wire transfer lacking required originator information or required beneficiary information; and (ii) the appropriate follow-up action.
8. In the processing of wire transfers, Banks are required to take freezing action
and shall prohibit conducting transactions with designated persons and entities, as per the obligations set out in Article 36 of the AML/CFT Law, relating to the prevention and suppression of terrorism and terrorist financing.

Article 17
Requirements for Wire Transfers

1. All Qualifying Wire Transfers shall always contain the following:
   a). the name of the originator; b). the originator account number, where such an account is used to process the transaction; c). the originator’s address, or national identity number, or customer identification number, or date and place of birth; d). the name of the beneficiary; and e). the beneficiary account number where such an account is used to process the transaction.
2. Banks for cross-border wire transfers with amount below USD 1,000 need not
   verify the accuracy of information referred to in the previous paragraph unless there is a suspicion of money laundering or terrorist financing.
3. No Wire Transfer may be originated for a customer unless proper due diligence
   process has been completed in accordance with this Instruction.
4. In the absence of an account, a unique transaction reference number shall be
   included which permits traceability of the transaction.
5. The requirement established in paragraph 1 above in respect of originator
   information may be waived where several individual cross-border wire transfers

from a single originator are bundled in a batch file for transmission to beneficiaries, provided that the originator’s account number or unique transaction reference number is included as described in paragraph 3 above, and the batch file contains required and accurate originator information, and full beneficiary information, that is fully traceable within the beneficiary country.

CHAPTER V
RECORD KEEPING

Article 18
Record-keeping

1. Banks shall maintain records, in an appropriate record keeping system, that are
   readily available to the Central Bank and other competent authorities determined by law, containing the following information:
   a). copies of documents evidencing the identities of customers, beneficial owners or agents, customer due diligence, account files, business correspondence and documents relating to transactions for at least ten 10 years after the transaction has been completed or the business relationship with the customer has ended; b). copies of all reports sent to the FIU for the period at least five years after transmission to the FIU; c). copies of all reports and data provided to foreign FIUs and/or entities; and d). copies of the feedback provided by the FIU regarding the reports on suspicious transactions submitted for five years after the receipt of such feedback.
2. Notwithstanding the requirements established in the previous paragraph,
   records that are the subject of criminal investigations, or administrative or regulatory proceedings or ongoing legal action shall be retained beyond the stipulated retention period until such records are no longer needed.
3. Banks shall ensure that the retained documents and records are able to create
   an audit trail of individual transactions that are traceable by Central Bank, the FIU and law enforcement agencies as determined by law.
   CHAPTER VI
   REPORTING OF TRANSACTIONS

Article 19
Suspicious transaction reporting

1. Banks shall immediately submit a suspicious transaction report to the Financial
   Information Unit, using the form in Annex 1 of this Instruction signed by the Compliance Officer, where there is reason to suspect that a transaction may involve proceeds from an unlawful activity or the customer is involved in money laundering or the financing of terrorism.

2. Banks shall also consider making a suspicious transaction report to the FIU
   when unable to complete a transaction or attempted transactions, or customer due diligence, regardless of whether the relationship has commenced or not.

3. In cases where Banks form a suspicion of money laundering or terrorist
   financing, and reasonably believe that performing the customer due diligence process may potentially alert the customer, the Banks are authorized to not pursue the due diligence process, provided however that a suspicious transaction report shall be submitted without delay pursuant to this Instruction.

4. Banks shall give full cooperation to the FIU in providing such additional
   information and documentation as it may request and to respond promptly to any further enquiries with regards to any suspicious transaction report.

5. Banks shall establish a reporting system for the submission of suspicious
   transaction reports to the Financial Information Unit including a mechanism for submitting reports from its branches.

6. Bank shall ensure that the suspicious transaction reporting mechanism is
   operated in a secured environment to maintain confidentiality and preservation of secrecy.

7. Banks shall undertake reasonable measures to ensure that all their employees
   involved in conducting or facilitating customer transactions are aware of the reporting procedures required in this Article.

8. In submitting a suspicious transaction report, utmost care must be undertaken
   to ensure that such reports are treated with the highest level of confidentiality and no person shall disclose the fact that a suspicious transaction report or related information has been or is being filed to the FIU and/or the Central Bank.

9. Banks shall immediately submit a suspicious transaction report to the FIU when
   it suspects or has reason to suspect that a transaction or series of transactions is being conducted in a manner to avoid the cash transaction reporting requirements of this Instruction, under Article 20.
   Article 20
   Cash transaction report

10. Banks shall report to the FIU, in a format to be determined by the Central Bank,
    any cash transaction in an amount equal to or above US$ 10,000, whether conducted as a single transaction or several transactions that appear to be linked.

11. Cash transactions shall include but not limited to checks, traveler’s cheques,
    money/postal orders, bank drafts or other monetary instruments in any currencies.

12. Banks shall ensure that they have systems in place in order to comply with the
    requirements established in this Article.

13. Notwithstanding the requirements established in the previous paragraphs,
    Banks are not required to report the following transactions:
    a). Transactions on behalf of Banks; b). Transactions with the Central Bank.
    Article 21
    Other reports

14. Banks shall report to the Central Bank the names of customers whose
    applications for opening an account with the Bank have been refused.

15. Banks shall immediately report to the Central Bank any law enforcement inquiry
    relevant to money laundering or terrorist financing being conducted in the Bank or a company under its control.

16. Banks shall immediately report to the Central Bank any transaction declined by
    the Bank pursuant to this Instruction.
    CHAPTER VII
    TRANSITIONAL AND FINAL PROVISIONS
    SECTION I
    TRANSITIONAL PROVISION
    Article 22
    Transitional provisions
    The implementation of the requirements established in Article 20 of this Instruction shall be effective from 1 January 2018.
    SECTION II
    FINAL PROVISIONS
    Article 23
    Final provisions
    Banks which at the time the present Instruction enters into force allow confidential numbered accounts or anonymous accounts to exist in their bank shall, within 30 calendar days, cease the operation of those accounts.
    Article 24
    Repeal
    The following are repealed and superseded by this Instruction:
    a). Public Instruction no. 02/2004 on the Prevention of Money Laundering, Customer Identification and Record-Keeping; b). Chapter VI of Public Instruction no. 06/2010 on the Licensing and Supervision of Other Deposit Taking Institutions (ODTIs); c). Section 1, Section 2 number 1 paragraph f) and Section 2 number 2 paragraph e) of Instruction no. 03/2003 on the Opening and Maintenance of Deposit Accounts.
    Article 25
    Compliance measures

17. Banks, any of their administrators, and their staff, shall be subject to the
    administrative sanctions established in Articles 31 and 32 of the AML/CFT Law if the Central Bank determines that the provisions of this Instruction have been violated.

18. The administrative sanctions set out in the previous paragraph shall not restrict
    the general powers of the Central Bank to issue written warnings, suspend or

dismiss administrators, revoke the license of a Bank, or exercise any other powers conferred by legislation.
Article 26
Entry into force and Publication

1. This Instruction shall enter into force from the date of its publication.
2. In accordance with Article 66 paragraph 1 of the Organic Law of the Central
   Bank, this Instruction shall be published in the Official Gazette. Adopted in 28 th of March 2017 Governor,

Abraão de Vasconselos

REPORTING ENTITY REFERENCE NUMBER

SUSPICIOUS TRANSACTION REPORT
The obligation to file a Suspicious Transaction Report is required under article 23 of Law 17/2011 dated 28 December, amended by Law no. 5/2013/III of 14 August, on the Legal Regime to Prevent and Combat Money Laundering and the Financing of Terrorism. Please send the completed form to the following address:
UNIDADE DE INFORMAÇÃO FINANCEIRA
Att. Executive Director
Banco Central de Timor-Leste
Avenida Xavier do Amaral No. 9
Dili, Timor-Leste
The completed Form can be sent also to UIF Fax: +670 3311172 Fields marked with an asterisk (*) are mandatory and must be completed by Reporting Officer prior to submission of the STR to UIF. The ones that are also marked “if applicable” must be completed if they are applicable to you or the transaction being reported. For all other fields, you have to make reasonable efforts to obtain relevant information.
PART A: INFORMATION ON CUSTOMER
a) Account holder

1. Name (*)
2. ID No/Passport No/Business Reg. No. (*) New
   Old
3. Gender (*)
4. Country *)
5. Nationality
6. Business/Employment (*) 7. Occupation *)
7. Other Occupation (*)
8. Name of Employer (*)
9. Address (*)
   c) Person conducting transaction
10. Name (*)
11. ID No/Passport No/Business Reg. No. (*) Old
    New
12. Gender (*)
13. Country (*)
14. Nationality (*)
15. Other Occupation (*)
16. Name of Employer (*)
17. Address (*)
    Male Female Male Female

PART B: TRANSACTION DETAILS
19. Customer Identification Number ()
20. Account Number () 21. Account Type ()
22. Date Account Opened () 23. Account Status ()
24. Balance ()
25. Branch () 26. Town
a) Introducer/Guarantor
27. Name ()
28. Type of Identification () Choose an item. Please specify if others
29. ID No/Passport No/Business Reg. No. () New
Old
30. Gender ()
31. Country )
32. Nationality ()
b) Transaction
33. Frequency () 34. Date of Transaction () Click to enter a date.
35. Total Amount in ()
USD
36. Amount of Foreign Currency Involved () 37. Type of Currency ()
38. Type of Transactions () Choose an item.
39. Purpose of Transaction
PART C: DESCRIPTION OF SUSPICIOUS TRANSACTION
40. Grounds for suspicion [Please mark (√) where relevant]
(Please specify)
41. Give details of the nature and the circumstances surrounding it ()
42. List of attachment (if any)
43. Date of Reporting (*) Click here to enter a date.
dd/mm/yyyy
PART D: FOR THE UNIDADE DE INFORMAÇÃO FINANCEIRA USE ONLY
44. Receiving Officer 45. Date Received Click to enter a date.
dd/mm/yyyy
Male Female Single Multiple Reactivated Dorman Account Regular / Unusual Offshore / Activity Large / Unusual Cash Deposit / Withdrawal Large / Unusual Inward / Outward Remittance Activity Inconsistent with Customer Profile Others. ___________________________

Attention: Article 25 of Law 17/2011, amended by Law no. 5/2013/III, strictly prohibits you to disclose or otherwise provide information you have submitted or is being submitted to the UIF and information regarding the investigation for the crime of money laundering and the financing of terrorism. It is a serious offence for the non-compliance with this obligation pursuant to the requirements established in Articles 31 and 32 of the said Law.