Circular CSSF 18/702 — Developments regarding the fight against money laundering and terrorist financing in the private banking sector

In case of discrepancies between the French and the English text, the French text shall prevail. Luxembourg, 20 December 2018 To all the professionals subject to the supervision of the CSSF for the purposes of the fight against money laundering and terrorist financing CIRCULAR CSSF 18/702 Re: Developments regarding the fight against money laundering and terrorist financing (AML/CFT) in the private banking sector Ladies and Gentlemen,

1. Introduction This circular addresses banks and other professionals of the financial sector that carry out private banking activities within the meaning of wealth management and associated activities. In the last years, the focus of many players of the Luxembourg financial centre shifted progressively towards private banking activities offering specialised services to international customers and to High Net Worth Individuals (HNWI). Considering the high risk inherent in private banking activities, the CSSF provided, over the last years, specific guidance to the banking sector aiming to prevent and mitigate existing or emerging risks of money laundering and terrorist financing (ML/FT) related to this activity. This includes:

• Circular letter of 3 December 2012 inviting the banks to adhere to the ICMA Private Wealth Management Charter of Quality;
• Circular CSSF 15/609 regarding the automatic exchange of tax information and anti￾money laundering in tax matters;
• Circular CSSF 17/650 on the application of the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended (hereinafter “2004 Law”)

Circular CSSF 18/702 page 2/5 and Grand-ducal Regulation of 1 February 2010 providing details on certain provisions of the 2004 Law to predicate tax offences; and

• Circular CSSF 17/661 on the adoption of the joint guidelines issued by the three European Supervisory Authorities (EBA/ESMA/EIOPA) on money laundering and terrorist financing risk factors1 . These communications are in line with the European regulations on anti-money laundering and combating the financing of terrorism and follow the FATF Recommendations of 2012 which specifically target the private banking activity as representing a potentially higher risk of money laundering or terrorist financing (ML/TF). In this context, the risk assessment undertaken by Luxembourg in 2018 allowed identifying a high risk for private banking activities. This circular is in line with previous communications of the CSSF. Its purpose is to guide the banks and to increase their awareness so that they continue strengthening their anti-money laundering and terrorist financing framework and ensure that the measures to mitigate the ML/FT risks they implemented remain effective.

2. ML/FT risks in the private banking sector in Luxembourg ML/FT threats may appear notably in relation with customers: • whose wealth stems from high-risk business sectors; • from countries that are associated with high ML/FT risks; • from countries subject to international or national sanctions or upon which certain countries have imposed or envisage imposing sanctions, on country-level or on some of these undertakings and/or citizens; • PEPs (politically exposed persons) and their relatives and associates; • requesting a discreet service; • involving transactions with high amounts; • having a number of important accounts; • using dedicated products and services that can be a source of higher ML/FT risk, including using less transparent and/or complex legal structures. The inherent risk is amplified where the professional in Luxembourg does not have a global overview of the customer, owing to the multitude of banking relationships of the latter. Among the underlying ML offences that are the most likely to constitute a threat, the offences of corruption, fraud and forgery need to be mentioned. In addition, there is also the ML risk linked to illicit traffic in narcotic drugs and psychotropic substances. Moreover, the sector remains exposed to ML risks linked to aggravated tax offences or tax evasion through professionals that provide services to customers of countries that do not take part in the 1 Joint Guidelines under Articles 17 and 18(4) of Directive (EU) 2015/849 on simplified and enhanced customer due diligence and the factors credit and financial institutions should consider when assessing the money laundering and terrorist financing risk associated with individual business relationships and occasional transactions. The Risk Factors Guidelines.

Circular CSSF 18/702 page 3/5 automatic exchange of information in tax matters according to the Common Reporting Standard (CRS) of the OECD. Account should also be taken of the risk of terrorist financing and proliferation financing. This risk can exist in particular where terrorist financing can take place by means of large amounts of money stemming from organised crime that are injected into the financial system in order to use them at a later stage for new offences (terrorism). When establishing effective mitigating measures, private banks shall take into account the ML/FT risks set out above. 3) Mitigating measures The preventive part of the fight against ML/FT in the private banking sector is based on effective procedures and processes in compliance with regulations and proportional to the institution’s risk assessment. It is also founded on an internal governance with a strong involvement of the management body, in its managing and supervisory roles, as well as on robust internal control arrangements. From an operational point of view, the definition and implementation of risk appetite, the customer/ultimate beneficial owner identification, the analysis and documentation of the origin of funds, and, where applicable, the source of wealth, as well as the scrutiny of the transactions concluded, remain key factors to ensure an effective fight against ML/FT. ML/FT risk prevention starts with the definition of acceptable risk, as described in the strategy and risk appetite approved by the bank’s supervisory body. ML risks that cannot be mitigated effectively, must be excluded from risk-taking. The following are risks to be excluded: • Unsustainable private banking models founded on a non-diversified high-risk customer base. Diversification is not given where the professional's profitability solely depends on a few major high-risk customers or where the bank’s business model largely relies on the assets of high ML/FT risk customers. Indeed, in the presence of such dependencies, potential suspicious transaction reports that should be made could be difficult considering their direct impact on the bank’s profitability. The professional's strategy and risk appetite must reflect this diversification requirement. • The acceptance of ML/FT risk customers for which the professional is not able to eliminate doubts and the ML/FT risks relating to the origin of funds and, where applicable, to the source of the customer’s wealth. This assessment shall duly take account of public information from trusted sources, such as publications by supervisory authorities or press articles. • The creation, maintenance and use, or involvement of the professional in legal structures that do not offer all the transparency and AML/CFT guarantees. Based on the results of its supervision, the CSSF understands that the above-mentioned practices are not representative of private banking in Luxembourg. Nevertheless, as financial stability depends critically on the reputation of the financial sector through all its individual players, it is important that all the professionals active in private banking adopt without exception an exemplary approach as regards AML/CFT.

Circular CSSF 18/702 page 4/5 The controls performed by the CSSF in this area revealed that on the fringes of a robust AML/CFT regime, there are certain weaknesses which must be remedied by implementing mitigating measures. These measures shall notably include: • Knowledge, critical appraisal and supporting documentation of the origin of funds and, where applicable, of the source of wealth; • Documentation of the ultimate beneficial owner, the structure of the shareholding or control of the customer (including the declaration pursuant to Article 17 of Regulation CSSF N° 12-02); • Documentation of the rights of representation and of the representatives; • Critical and regular (according to the risk-based approach) or, where applicable, ad hoc (public information from trusted sources, such as publications by supervisory authorities or press articles) reassessment of the business relationship; • Monitoring, analysis and documentation of risky transactions and their adequacy with the (licit) purpose of the business relationship; • Suspicious transaction reports to be made because of doubt and not only in the presence of a materialised suspicion2 ; • Involvement of the group head (including formal acceptance by the professional in Luxembourg of all its customers and control over branches abroad directly by the head office in Luxembourg; coordination of the risk-taking that is not covered by the Common Reporting Standard with the head office3 ); • Definition of a risk-appetite specific to the most risky components; • Risk culture. These mitigating measures are all the more important where they concern PEP customers, customers from riskier countries or where they are designed to prevent abusive use of opaque or unduly complex legal structures. 4) Prudential impacts and intervention of the CSSF Where Luxembourg professionals accept risky HNWI customers, or where risky HNWI investors seek to acquire holdings in these professionals, Luxembourg incurs a non-negligible risk of reputation likely to harm the image of the entire Luxembourg financial centre. Moreover, where professionals face significant sanctions at the national or international level, reputational risk may swiftly transform into prudential liquidity or solvency risks with, as a consequence, risks for the financial stability of the bank. In order to mitigate these risks, the CSSF will continue to intervene with the professionals whose business model has residual risks that are deemed too high. Similarly, the CSSF will also continue to apply strict guidelines as regards the acceptance of new banking shareholders from countries that are particularly exposed to ML/FT risk, predicate offences or international financial sanctions. 2 Article 5 of the 2004 Law. 3 Article 4-1 of the 2004 Law.

Circular CSSF 18/702 page 5/5 Moreover, the CSSF will continue to adapt its (on-site and off-site) control programme in order to ensure compliance with the AML/CFT regulations. The CSSF will resolutely and firmly sanction serious deficiencies it observes, which will be penalised, where applicable, through significantly higher penalties in accordance with the new Article 8-4 of the Law of 12 November 2004 transposing the fourth European directive (2015/849) relating to AML/CFT. These sanctions will be published in accordance with the regulatory provisions applicable in this field. Yours faithfully, COMMISSION de SURVEILLANCE du SECTEUR FINANCIER Marco ZWICK Jean-Pierre FABER Françoise KAUTHEN Director Claude SIMON Claude MARX Director Director General