Circular NBB_2016_32: Application of Customer Due Diligence Measures to Asylum Seekers from Higher-Risk Third Countries

NBB_2016_32 – 12 July 2016 Circular – Page 1/7 boulevard de Berlaimont 14 – BE-1000 Brussels tel. +32 2 221 38 12 – fax + 32 2 221 31 04 company number: 0203.201.340 RPM Brussels www.bnb.be Circular Brussels, 12 July 2016 Reference: NBB_2016_32 your contact:
Arthur Van Damme tel. +32 2 221 35 04 – fax +32 2 221 31 04 arthur.vandamme@nbb.be Opinion of the European Banking Authority (EBA) on the application of customer due diligence measures to customers who are asylum seekers from higher-risk third countries (EBA-Op-2016-07) Scope All companies subject to the supervision of the National Bank of Belgium that, because they fall within the scope of the Law of 11 January 1993 on the prevention of the use of the financial system for the purpose of money laundering and terrorist financing, are subject to legal and regulatory obligations aimed at preventing money laundering and terrorist financing. These companies are hereinafter referred to as 'financial institutions'. Summary/Objective This circular transposes into the Belgian prudential framework the opinion of the EBA of 12 April 2016 'on the application of customer due diligence measures to customers who are asylum seekers from higher-risk third countries'. It further clarifies the implementation modalities in Belgium by financial institutions of this EBA opinion. Structure

1. Context
2. Transposition of the EBA opinion into the Belgian prudential framework
3. Implementation modalities in Belgium of the guidelines set out in the EBA opinion

Circular – Page 2/7 NBB_2016_32 – 12 July 2016 Madam, Sir, This circular transposes into the Belgian prudential framework the EBA opinion of 12 April 2016 on the application of customer due diligence measures to customers who are asylum seekers from higher-risk third countries (EBA-Op-2016-07). It provides further clarifications on the concrete application, in Belgium, of the guidelines set out in the EBA opinion.
This circular includes as an annex the full English text of the EBA opinion, available elsewhere on the website of the National Bank of Belgium (hereinafter 'the Bank').

1. Context
   Europe, and Belgium in particular, is currently facing a significant influx of refugees seeking asylum. It is important that these asylum seekers can access the financial system during their stay in Europe and in Belgium. This indeed avoids them turning to irregular financial service providers against whom no control can be exercised in terms of combating money laundering and terrorist financing (CFT/AML), which could stimulate the development of such illegal financial service offerings. Furthermore, asylum seekers' access to basic financial service offerings allows them to participate in societal life during their stay in Europe and in Belgium (receiving remuneration, executing payments, etc.) 1.

Granting access to basic financial services for asylum seekers poses major challenges for financial institutions, particularly regarding the correct application of existing CFT/AML regulations. Thus, verifying the identity of asylum seekers poses difficulties when this verification cannot be carried out using traditional identification documents such as an identity card or passport, or when doubts are possible regarding the authenticity of alternative identification documents presented. These difficulties are exacerbated when the applicants are from countries presenting an increased money laundering or terrorist financing risk (CFT/AML risk), notably because terrorist groups operate in some of these countries. Financial institutions are indeed required to ensure, if necessary, the application of existing financial sanctions and financial embargoes, including the freezing of funds of certain persons or entities in the context of counter-terrorism. For all these reasons, the EBA considers it appropriate to publish an opinion providing guidelines to financial institutions on how they can comply with their legal obligations regarding CFT/AML, without having to refuse asylum seekers access to the financial system.
2. Transposition of the EBA opinion of 12 April 2016 into the Belgian prudential framework
Although the EBA opinion of 12 April 2016 concerns in principle only certain categories of institutions subject to the Bank's supervision (credit institutions, stock exchange companies, payment institutions, etc.), the issue addressed in this opinion may also prove relevant for other categories of financial institutions falling within the scope of Belgian CFT/AML regulations (for example, life insurance companies). It goes without saying that it is mainly institutions offering basic financial services to asylum seekers that will have to face this issue (one thinks of credit institutions for basic banking services, and payment institutions for cross-border payments). The Bank estimates that asylum seekers will hardly seek access to other products or financial services (such as life insurance products, portfolio management, etc.). 1

However, it cannot be entirely excluded that such a case arises.
The Bank therefore considers it useful to attach the EBA opinion of 12 April 2016 to this circular, in order to disseminate these guidelines to financial institutions subject to its supervision. The insertion of the EBA opinion into this circular thus integrates said opinion in its entirety into the Belgian prudential framework applicable to the financial institutions concerned.
3. Implementation modalities in Belgium of the guidelines set out in the EBA opinion
3.1. Introduction: application of the guidelines to business relationships concluded with asylum seekers and to occasional operations carried out on behalf of an asylum seeker
In the following chapters, the difficulties that financial institutions will face regarding CFT/AML in their relations with asylum seekers are, for readability purposes, treated systematically in light of the conclusion of a business relationship between the financial institution and the applicant. The Bank nevertheless wishes to emphasize that most of the issues addressed in this circular apply in a similar manner to occasional operations carried out by financial institutions for asylum seekers with whom they do not maintain a business relationship. One can refer in this regard to the clarification given by the EBA when it emphasizes that financial institutions must be aware that their ability to identify, assess, and properly manage CFT/AML risks in the context of occasional operations will be limited. Consequently, financial institutions should, in such cases, take the necessary measures to capture these risks appropriately.
3.2. Customer identification and identity verification
a) Guidelines contained in the EBA opinion

The EBA opinion of 12 April 2016 first sets out guidelines regarding the verification of the identity of asylum seekers. European CFT/AML regulations indeed provide that financial institutions must always take the necessary due diligence measures regarding customers. This implies, in particular, that they must verify the identity of their clients based on information available from a reliable and independent source. Regarding asylum seekers, this obligation to verify customer identity is often complicated, as these asylum seekers are usually unable, upon arrival in Europe, to produce a traditional identification document such as an identity card or passport. And even if they are able to present such a document, financial institutions will often face difficulties in verifying whether the client is indeed the person they claim to be. On the other hand, asylum seekers will always be issued upon their arrival in Europe an identification document issued by a Member State attesting to their status and right of residence. The EBA considers that these identification documents may suffice, in accordance with European CFT/AML regulations, to verify the identity of the asylum seeker. Financial institutions must nevertheless verify in this regard that the validity date of the document presented by the applicant has not expired, that the document was issued by a national or local authority, and that it mentions the full name and date of birth of the client (as well as possibly an identity or registration number, a photo, and an address). Financial institutions can also always contact the authority that issued the document to determine if it is valid (i.e., not falsified).

Circular – Page 4/7 NBB_2016_32 – 12 July 2016 b) Application in Belgium Regarding more specifically the application of these guidelines in Belgium, the Bank first recalls Article 7 of the CBFA regulation of 23 February 2010 on the prevention of money laundering and terrorist financing 2. Its first paragraph provides that customer identity verification must in principle always be carried out using the identity card. For persons residing abroad, verification can also be carried out using their passport. The coordinated version of CBFA Circular 2010_09 'Due diligence regarding customers, prevention of the use of the financial system for the purpose of money laundering and terrorist financing, and prevention of the financing of the proliferation of weapons of mass destruction' 3 (hereinafter 'CBFA Circular 2010_09') specifies – in chapter 4.2.4.1.1 – that in exceptional cases, notably when the client's identity card is being issued by the competent Belgian authorities, other documents issued by Belgian or foreign authorities may be admitted as probative documents while waiting for verification to be carried out again later using the client's identity card. Paragraph 2 of Article 7 of the regulation of 23 February 2010 provides, for its part, that upon identification of persons of foreign nationality established in Belgium who, due to their legal status on Belgian territory, do not possess an identity card issued by Belgian authorities, verification of their identity may be carried out using their valid registration certificate in the register of foreigners, or, when they do not possess one due to their status, using a valid document issued by Belgian public authorities. CBFA Circular 2010_09 specifies in this regard – in chapter 4.2.4.1.2 – that this may be an identity card, a registration certificate in the register of foreigners, as well as one of the various annexes to the Royal Decree of 8 October 1981 4. Some of these documents can be very specific, and even order, for example, to leave the territory. These documents can also be used by asylum seekers as identification documents under CFT/AML legislation, even if, in this case, financial institutions must ensure that the operations the client wishes to carry out in Belgium are in accordance with the limited duration of their stay in Belgium. The identity of asylum seekers must therefore in principle always be verified, in application of Article 7, paragraph 2, of the regulation of 23 February 2010, using an identity card issued by Belgian authorities or another valid residence document issued by Belgian public authorities. Although this is not expressly provided for in chapter 4.2.4.1.2 of CBFA Circular 2010_09 (regarding persons of foreign nationality established in Belgium), it is admitted in this case also, by analogy with the provisions contained in said circular in its chapter 4.2.4.1.1 (see above), that the identity of asylum seekers who do not yet possess an identity card issued by
Belgian authorities or another valid residence document issued by Belgian public authorities, be verified, 'exceptionally and temporarily, using a passport issued by a foreign authority. This verification remains valid in this case while waiting for verification to be carried out again later using the client's identity card or the residence document issued by Belgian public authorities. 2 As approved by the Royal Decree of 16 March 2010, MB 24 March 2010. 3 CBFA Circular 2010_09 of 6 April 2010 modified by CBFA Circular 2011_09 of 1 March 2011. 4 Royal Decree of 8 October 1981 on access to the territory, stay, establishment, and removal of foreigners, MB 27 October 1981.

NBB_2016_32 – 12 July 2016 Circular – Page 5/7
3.3. Risk management measures
a) Introduction
The Bank emphasizes that obligations regarding customer identification and identity verification are not purely administrative obligations, but that they must enable financial institutions to comply with their obligations regarding customer acceptance policy, ongoing due diligence, and reporting to the Financial Information Processing Cell (CTIF).
It is therefore important that financial institutions can, within reasonable limits, form an idea, based on the documents and information they collect, of the client's profile and the services the client wishes to obtain. Financial institutions are then able to conduct an assessment of the CFT/AML risks associated with this business relationship, and to take appropriate risk management measures, such as an increased degree of ongoing due diligence or limiting financial services to a basic service.
It should also be noted in this context that documents or information that are patently falsified or do not correspond to the person producing them cannot be accepted or taken into consideration for the assessment of CFT/AML risks associated with the client's profile. In such cases, the financial institution must likely report these facts to the CTIF in application of Article 25 of the Law of 11 January 1993. b) Guidelines contained in the EBA opinion The EBA opinion of 12 April 2016 reminds financial institutions that when they establish a business relationship with asylum seekers, they are required to take the necessary measures to manage the CFT/AML risks associated with this relationship. The EBA emphasized in this regard that the information collected by financial institutions about the asylum seeker must enable them to conduct a good assessment of the CFT/AML risks associated with each business relationship, with emphasis on the fact that this risk assessment must be carried out on an individual basis. Financial institutions are also required to take appropriate measures to manage these risks, a distinction can be made between the following measures:

• Ensure adequate follow-up, adapted to each client's profile, of the business relationship (due diligence duty), partly by verifying if the operations carried out by the client are in accordance with the client's profile as established by the financial institution, and partly by keeping information related to the client up to date.
• Offer financial services to clients with the status of asylum seeker adapted to the CFT/AML risks associated with these clients' profiles, for example by refraining from offering them certain products or only offering them within certain limits.
• Ensure appropriate organization within the financial institution to be able to properly manage the specific CFT/AML risks associated with concluding business relationships with asylum seekers (risk analysis, internal procedures, documentation, staff training).

Circular – Page 6/7 NBB_2016_32 – 12 July 2016 c) Application in Belgium As noted above, customer identification and identity verification should not be considered a simple administrative obligation. Customer identification and identity verification must enable the financial institution to form an idea of the client's profile (customer knowledge principle), in order to be able to take appropriate risk management measures.

• Risk management by monitoring the business relationship with asylum seekers
  Identification and identity verification of asylum seekers will often have to be carried out using documents that are less reliable than traditional identification documents, and therefore provide less certainty to financial institutions regarding the identity of the asylum seeker who wishes to establish a business relationship with them.
  It is therefore important that financial institutions collect, as part of their customer acceptance policy, the necessary information to form a good idea of the asylum seeker's profile and their expectations regarding the business relationship (see for more explanations in this regard chapters 5.1 and following of CBFA Circular 2010_09). Chapter 5.2.3 of CBFA Circular 2010_09 then specifies that financial institutions are required to define specific risk criteria to be able, as part of customer acceptance, to appropriately distribute their clients on the risk scale. They must in this regard take into account both the characteristics of the products and services they offer and the characteristics of the client. The Bank estimates that it would however be advisable for financial institutions to establish complementary risk criteria for cases where identification and identity verification of the client must be carried out using less reliable identification documents, in order, thereby, to take into account the risk resulting from the more random nature of this identification for the appropriate classification of the client on the risk scale. Based on the information collected regarding the client's characteristics (for example, the nature, number, origin, and destination of the operations to be carried out), and taking into account the characteristics of the products and services they offer, financial institutions must then, based on a risk-based analysis, define an appropriate level of vigilance, which must be applied in the context of monitoring operations carried out or to be carried out (see in this regard chapters 6.1. and following of CBFA Circular 2010_09). The level of vigilance thus established must of course be consistent with the place assigned to the client on the risk scale in the context of customer acceptance.
• Risk management by limiting financial services
  Asylum seekers who, upon arrival in Europe, seek access to financial services will generally only need basic financial services. Offering asylum seekers a basic service comprising products or services that are more difficult to use for the purposes of money laundering and terrorist financing can therefore constitute an effective way to manage CFT/AML risks likely to be associated with these business relationships.
  In this context, the Bank emphasizes that Article VII.57, § 2, of the Code of Economic Law provides that every credit institution must offer a basic banking service and that every consumer has the right in principle to this basic banking service. Article VII.59, § 2, of the aforementioned text provides, however, that the credit institution may refuse a request or terminate the basic banking service in cases of, among others, money laundering or terrorist financing. With these provisions as support, the Bank estimates that it is unlikely that credit institutions can refuse basic banking services to asylum seekers solely on the grounds that they are from a country presenting an increased CFT/AML risk and/or because they have difficulties establishing their identity reliably. In the Bank's opinion, refusal of basic banking services is only possible if it can be established based on specific elements that the consumer is or could be involved in money laundering or

---

NBB_2016_32 – 12 July 2016 Circular – Page 7/7 capital or the financing of terrorism (or when any of the other refusal grounds provided for by the Code of Economic Law applies). The decision to refuse (or terminate) the basic banking service must furthermore always be justified and documented.

By analogy with what has been explained above for the basic banking service, financial institutions other than credit institutions may also limit the financial services they offer to asylum seekers if this is necessary to manage the ML/TF risks associated with this business relationship.

Nevertheless, limiting services to the basic banking service for asylum seekers cannot constitute a standard procedure in which the financial institution does not take into account the individual characteristics of the client, the ML/TF risks associated with the client's profile and/or the specific financial needs of this client. It cannot be excluded that asylum seekers, particularly if they are likely to stay in Belgium for an extended period, have specific financial needs for which a wider range of financial services would be necessary. If a financial institution were to decide in such a case that, despite the asylum seeker's request for wider services, only a basic banking service can be offered, such a decision should be justified on an individual basis in light of the ML/TF risks associated with the business relationship. The financial institution concerned must also ensure that the justification for this decision is duly documented in such cases.

The Bank also wishes to emphasize that limiting the financial services offered by financial institutions to asylum seekers does not exempt institutions from the obligation to continue, in these cases as well, to subject the business relationship and the operations carried out by the client to constant risk-based vigilance.

• Risk management through the implementation of accompanying measures

Finally, the Bank draws the attention of financial institutions to the need to also take appropriate accompanying measures to manage the ML/TF risks associated with establishing a business relationship with asylum seekers. These measures include, in particular, staff training, the establishment and communication of clear instructions to staff, the explicit establishment of specific procedures to be followed for clients with the status of asylum seeker, data retention, etc.

Please note that we are sending a copy of this to the commissioners and approved auditors of your institution.

I have the honor to be, Madam, Sir, the expression of my distinguished sentiments.

Jan Smets
Governor
Appendix: 1