Circular Letter No. CC/2024/00000025: Use of BPnet Services for AML/CFT Activities

Circular Letter No. CC/2024/00000025 Sent to: Credit Institutions, Financial Companies, Electronic Money Institutions and Payment Institutions. Mod. 40000375/T – 01/14 Subject: Use of BPnet services, in the context of activities related to the prevention of money laundering and terrorist financing

With a view to promoting the speed, effectiveness and security of communications between supervised entities and the Bank of Portugal, different services have been created in the "AML/CFT Prevention" area of the BPnet system, to pursue specific purposes related to the prevention of money laundering and terrorist financing ("AML/CFT").

In this context, the Bank of Portugal has sent supervised entities different communications regarding the mentioned services, containing their respective description, as well as the applicable subscription and use rules1.

Following the publication of Bank of Portugal Notice No. 1/2022, of June 6 ("Notice No. 1/2022"), and Bank of Portugal Notice No. 1/2023, of January 24 ("Notice No. 1/2023"), and the provisions set out, respectively, in Article 86(2) and Article 51(3), the Bank of Portugal now issues a new Circular Letter, which now concentrates the information regarding the use of the services made available in the "AML/CFT Prevention" area of the BPnet system, replacing the previous communications on the same subject1.

The services currently available in the "AML/CFT Prevention" Area of the BPnet System are as follows:

• "Inquiries and Responses to Specific Information Requests": to be used in responding to specific information requests made by the Bank of Portugal, for sending questions by supervised entities regarding the applicable legal and regulatory framework in matters of AML/CFT prevention, as well as to inform supervised entities of the availability in the "Bank of Portugal Communications Repository" service of communications issued by this Authority that integrate this service;

• "Inspections": to be used in responding to all requests made by the Bank of Portugal within the scope of an inspection, namely in the exchange of correspondence, sending of files or questions, as well as in responding to other information requests formulated by the Bank of Portugal;

• "Restrictive Measures": through which the Bank of Portugal disseminates, to supervised entities, information on restrictive measures sent to it by the competent authorities in this matter, namely the General Directorate of Foreign Policy of the Ministry of Foreign Affairs and the Office of Planning, Strategy, Evaluation and International Relations of the Ministry of Finance;

• "Bank of Portugal Communications Repository": through which supervised entities may access the set of communications addressed by the Bank of Portugal, intended to issue determinations, recommendations or general guidelines, alerts or to disseminate other information, of abstract or concrete nature, in order to promote or assist these entities in complying with the rules applicable in matters of AML/CFT prevention, provided for in Law No. 83/2017 and the sectoral instruments regulating it;

• "Risk Assessment and Supervisory Measures": to be used by supervised entities in responding to all requests made by the Bank of Portugal within the scope of carrying out risk analysis actions, off-site supervision and/or monitoring of supervisory measures issued;

• "RPB": to be used only by financial entities for the submission of the Report on the Prevention of Money Laundering and Terrorist Financing ("RPB") provided for in Article 83 of Notice No. 1/2022, whose model is defined by Instruction2, and for posing operational questions related to said reporting3.

In this context, the Bank of Portugal transmits the following:

1. Financial entities and entities carrying out activities with virtual assets must subscribe to the following services available in the "AML/CFT Prevention" Area of the BPnet system: "Inquiries and Responses to Specific Information Requests", "Inspections", "Restrictive Measures", "Bank of Portugal Communications Repository" and "Risk Assessment and Supervisory Measures".

2 Additionally, financial entities must also subscribe to the "RPB" service, made available in the same area of that system.

3. Supervised entities must ensure that the compliance officer appointed under Article 16 of Law No. 83/2017, of August 18 ("Law No. 83/2017") and Article 5 of Notice No. 1/2022 or Notice No. 1/2023, as applicable, and their substitute, are users of all services identified in number 1 and, in the case of financial entities, also in number 2.

4. Payment institutions and electronic money institutions with headquarters in the European Union and operating in Portugal through agents or distributors must ensure that they are users of the services identified above in numbers 1 and 2: a) The compliance officer referred to in point (b) of paragraph 2 of Article 73 of Notice No. 1/2022, and their substitute; and b) The central contact point, appointed under point (d) of paragraph 2 of Article 72 of Law No. 83/2017, and paragraph 5 of Article 73 of Notice No. 1/2022.

5. Regarding the "Bank of Portugal Communications Repository": 5.1. Supervised entities must ensure that only the compliance officer appointed under Article 16 of Law No. 83/2017 and Article 5 of Notice No. 1/2022 or Notice No. 1/2023, as applicable, and their substitute, are users of this service. 5.2. Payment institutions and electronic money institutions with headquarters in the European Union and operating in Portugal through agents or distributors must ensure that only the following are users of this service: a) The compliance officer referred to in point (b) of paragraph 2 of Article 73 of Notice No. 1/2022, and their substitute; and b) The central contact point, appointed under point (d) of paragraph 2 of Article 72 of Law No. 83/2017, and paragraph 5 of Article 73 of Notice No. 1/2022. 5.3. Under the provisions of point (d) of paragraph 2 of Article 5 of Notice No. 1/2022 and Notice No. 1/2023, as applicable, it is the responsibility of the compliance officer to ensure the provision to relevant collaborators (delimited on a case-by-case basis depending on the nature of the information) of the communications contained therein.

6. The compliance officer and the central contact point and, where applicable, their substitutes, are responsible for ensuring the adequate management of the aforementioned services, namely by ensuring: (i) the permanent currency of their users; (ii) the adequate use of the described services, restricting themselves to the purposes they pursue; (iii) the necessary prudence in the use of information exchanged in this context.

7. Whenever there is a change in any of the users of the services described in numbers 1 and 2, supervised entities must promote their immediate update.

8. All communications that the Bank of Portugal addresses to supervised entities, in the context of activities associated with the services "Inquiries and Responses to Specific Information Requests", "Inspections" and "Risk Assessment and Supervisory Measures" are exclusively sent through them, depending on the concrete nature of the requests.

9. All services referred to in the previous point contain a "Correspondence" tab, for exchanging correspondence in different contexts, and a "File Upload" tab, for sending larger volume files. 9.1. Communications that supervised entities address to the Bank of Portugal in the context of the activities referred to in point 8 must be carried out through the "Correspondence" tab within the service with which they relate. 9.2. Correspondence from entities that constitutes a response to a previous communication from the Bank of Portugal must use, without alterations, the "Subject" indicated in that communication. 9.3. The sending of files through the "File Upload" tab, within the services mentioned in point 8, must comply with the file naming rules described in each service.

10. In accordance with the provisions of Article 69 of Notice No. 1/2022, communications addressed to any entity belonging to the Integrated System of Mutual Agricultural Credit ("SICAM"), in the context of activities associated with the services described in numbers 1 and 2, will only be sent to the users of the Central Credit Union of Mutual Agricultural Credit, with these being responsible for sending the respective response through the same channel.

11. Regarding the "Restrictive Measures" service, insofar as it performs an automated dissemination of information sent to the Bank of Portugal by the competent authorities in matters of restrictive measures (General Directorate of Foreign Policy of the Ministry of Foreign Affairs and Office of Planning, Strategy, Evaluation and International Relations of the Ministry of Finance), any information requests regarding its content must be directed to these Authorities.

12. Regarding the "Bank of Portugal Communications Repository" service, it is emphasized that the history of communications, which by their nature fall within the scope of that service and whose currency remains, will be made available in a phased manner, and that communications of this nature that are subsequently issued by the Bank of Portugal will also be integrated into the repository after their respective publication.

Finally, the Bank of Portugal alerts supervised entities to the need to scrupulously observe the instructions contained in this Circular Letter and those that may appear in the "Technical Documentation" tab of the "AML/CFT Prevention" area, under penalty of violation of the provisions of Article 86(2) of Notice No. 1/2022 or Article 51(2) of Notice No. 1/2023, as applicable.

Thus, all communications that the Bank of Portugal addresses to supervised entities will be sent through the aforementioned services. Similarly, only communications addressed to the Bank of Portugal by supervised entities that comply with the provisions of this Circular Letter will be considered.

In order to guarantee full compliance with the provisions of this Circular Letter, the Bank of Portugal exceptionally defines September 30, 2024, as the deadline for subscribing to the services contained in this communication.

---

Footnotes: 1 "Use of BPnet in electronic communications and file submission, in the context of activities related to the prevention of money laundering and terrorist financing" - Circular Letter No. CC/2021/00000015; "Subscription and use of the new BPnet service dedicated to the dissemination of information on restrictive measures | DGI/2023/0000065966"; "Use of the BPnet System by entities carrying out activities with virtual assets, in the context of activities related to AML/CFT prevention - DGI/2023/0000069393"; and "Subscription and use of the new BPnet service 'Bank of Portugal Communications Repository' | DGI/2023/0000109882" 2 Through its respective collection application (reporting form). 3 Through the specific "Correspondence" tab of this service.