Regulation 44/2009 on Prevention of Money Laundering and Terrorism Financing

R E P U B L I C O F A L B A N I A B A N K O F A L B A N I A SUPERVISORY COUNCIL D E C I S I O N No. 44, dated 10.06.2009 ON THE APPROVAL OF THE REGULATION “ON PREVENTION OF MONEY LAUNDERING AND TERRORISM FINANCING “ The Supervisory Council of the Bank of Albania, having regard to the proposal from Supervision Department, in accordance with Article 9 of the Law No. 9662, dated 18.12.2006 “On Banks in the Republic of Albania”, Articles 7, 11, 24 and 26 paragraph 2 of the Law No. 9917, dated 19.05.2008 “On prevention of money laundering and terrorism financing”, Article 27 of Law No.9258, dated 15.07.2004 “On measures against terrorism financing” and Article 12, letters ”a” and Article 43, letter “c” of Law No. 8269, dated 23.12.1997 “On Bank of Albania” D e c i d e d:

1. To approve the Regulation “On Prevention of Money Laundering and Terrorism Financing”, as provided in the texture therein.
2. The Supervision Department of the Bank of Albania is charged with the implementation of this decision.
3. The Foreign Relations, European Integration and Communication Department is charged with the publication of this Decision in the Official Bulletin of the Bank of Albania and in the Official Journal of the Republic of Albania.
4. The Regulation “On Prevention of Money Laundering” adopted with the Decision No.10, dated 25.02.2004 of Supervisory Council, shall be abrogated. This Regulation shall enter into force on the 15th (fifteenth) day following its publication in the Official Journal of the Republic of Albania. SECRETARY CHAIRMAN Ylli Memisha Ardian Fullani

2 REGULATION “ON PREVENTION OF MONEY LAUNDERING AND TERRORISM FINANCING” (Adopted by Decision no.44, dated 10.06.2009 and amended by Decision no.55, dated 28.08.2013, by Decision no.22, dated 5.04.2017, by Decision no.78, dated 18.12.2019 and by Decision no.13, dated 1.4.2026 of Supervisory Council of the Bank of Albania) Chapter I General provisions Article 1 Subject-matter This Regulation lays down the procedures and documentation for the identification of customer, regulations for record-keeping, preservation of data and their reporting to the responsible authority from the subjects of this Regulation, 1 for the purpose of managing money laundering and terrorism financing risk. Article 2 Purpose The purpose of this Regulation is the prevention of the use of the financial system for the purpose of money laundering and/or terrorism financing. Article 3 Subjects This Regulation shall apply on the entities which are subject of the Law No. 9917, dated 19.05.2008 “On Prevention of Money Laundering and Terrorism Financing “and the bylaws issued for its purpose, which are licensed and supervised by the Bank of Albania. Article 4 Legal ground 2This Regulation is issued in accordance with Article 12, letter “a”, and Article 43, letter “c” of the Law No. 8269, dated 23.12.1997, “On the Bank of Albania”, as amended; Article 9 and Article 126, paragraph 2 of the Law No. 9662, dated 18.12.2006, “On banks in the Republic of Albania”, as amended; Article 60, paragraph 1, and Article 66 of the Law No. 52/2016 “On savings and loan associations and their Unions”, Law No. 9917, dated 19.5.2008, “On anti-money laundering and terrorism financing”, as amended; and the Law No. 157/2013, dated 10.10.2013, “On the measures against terrorism financing”, as amended.”. 1 Added upon the Supervisory Council decision no. 78, dated 18.12.2019. 2 Amended upon the Supervisory Council decision no. 78, dated 18.12.2019.

3 Article 5 Definitions

1. The terms used throughout in the Regulation shall have the meanings given by the Law No. 9917, dated 19.5.2008 “On prevention of money laundering and terrorism financing”, as amended3 , by the bylaws issued for the purpose of this Law implementation, 4by the Law No. 157/2013, dated 10.10.2013 “On the measures against terrorism financing”, as amended5 , and by the Law No.9662, dated 18.12.2006 “On banks in the Republic of Albania”, as amended6 .
2. The term “Law on prevention of money laundering” shall imply the Law No. 9917, dated 19.5.2008 “On prevention of money laundering and terrorism financing” as amended7 and the term “the Law on measures against terrorism financing” shall imply the Law No. 157/2013, dated 10.10.2013 “On the measures against terrorism financing” 8 , as amended9 . Chapter II Simplified due diligence, due diligence and enhanced due diligence10 Article 6 Preventive measures implemented by the subjects11
3. The subjects shall take all the measures of “simplified due diligence” 12 , “due diligence” and “enhanced due diligence” in cases stipulated in the Law "On the prevention of money laundering" and the by-laws issued for its implementation, and implement the measures to identify and verify the customers permanent or occasional (natural persons, legal persons and legal arrangements) 13 , in accordance with the requirements stipulated in the Law and in the provisions of this Regulation.14
4. The subjects shall have in place policies, guidelines or internal procedures on the acceptance, identification, recording, monitoring, risk management and reporting of customers' transactions, as defined in Article 2, paragraph 21, as well as in Articles 11 and 1215 of the Law "On the prevention of money laundering.16 3 Added upon the Supervisory Council decision no. 78, dated 18.12.2019. 4 Added upon the Supervisory Council decision no. 22, dated 5.04.2017. 5 Added upon the Supervisory Council decision no. 78, dated 18.12.2019. 6 Added upon the Supervisory Council decision no. 78, dated 18.12.2019. 7 Added upon the Supervisory Council decision no.55, dated 28.08.2013. 8 Added upon the Supervisory Council decision no. 22, dated 5.04.2017. 9 Added upon the Supervisory Council decision no. 78, dated 18.12.2019. 10 Amended upon the Supervisory Council decision no. 78, dated 18.12.2019. 11 Amended upon the Supervisory Council decision no.55, dated 28.08.2013. 12 Added upon the Supervisory Council decision no. 78, dated 18.12.2019. 13 Added upon the Supervisory Council decision no. 22, dated 5.04.2017. 14 Amended upon the Supervisory Council decision no.55, dated 28.08.2013. 15 Amended upon the Supervisory Council decision no. 78, dated 18.12.2019. 16 Amended upon the Supervisory Council decision no.55, dated 28.08.2013.

4 3. 17The subjects shall draft the necessary rules and procedures for the implementation of the measures against terrorism financing, which shall provide in particular the steps to be followed, the role of the structures of the subjects in this process, as well as the authority to whom they shall report, in order to ensure the prevention of the movement and use of funds of persons and entities involved in terrorism financing or in the production of weapons of mass destruction, in accordance with the published lists of persons and the relevant sanctions stipulated in the United Nations Security Council Resolutions18 . 4. The subjects shall identify completely and correctly their customers and beneficiaries, and require additional information in case they deem necessary. 5. The subjects shall verify the customer’s identity through the available legal documents. The customer shall submit the documents in original or 19in notarised copies or electronic document that satisfies the validity conditions under the applicable legislation on electronic document or electronic signature. 20The subjects, at the moment of establishing business relationships or carrying out the transaction/s, shall keep in the customer’s file copies of documents submitted by the latter in the form defined above, which should be sealed by the seal of subjects to this Regulation, within their availability term. 6. 21For the implementation of enhanced due diligence for customers, the subjects shall require the presence of their customers and their representatives before establishing a business relationship. 22Subjects shall adopt and implement specific procedures of risk management, in cases of transactions or business relationships, carried out without the physical presence of the customer. 7. 23In the event a customer is represented by a third person through a representation certificate (act), subjects shall verify if this person is authorised to represent the customer and to carry out the required operations, require data for the identification of the customer and his representative, and verify these data, as well as maintain in the customer’s file all the documentation submitted from the third person, including the original or a notarised copy of the representation certificate (act). 8. 24Before establishing business relationships and/or carry out transactions on behalf and for the account of the customers (new and existing), the subjects shall consult the updated published list of persons defined as funders of terrorism approved by a Decision of the Council of Ministers and shall notify the Bank of Albania, in accordance with the law on measures against terrorism financing and the bylaws issued for its implementation. 17 Added upon the Supervisory Council decision no. 22, dated 5.04.2017. 18 UNSCR - United Nations Security Council Resolution. 19 Amended upon the Supervisory Council decision no. 78, dated 18.12.2019. 20 Amended upon the Supervisory Council decision no. 78, dated 18.12.2019. 21 Amended upon the Supervisory Council decision no. 78, dated 18.12.2019. 22 Added upon the Supervisory Council decision no.55, dated 28.08.2013. 23 Amended upon the Supervisory Council decision no. 78, dated 18.12.2019. 24 Amended upon the Supervisory Council decision no. 22, dated 5.04.2017.

5 9. Subjects shall reject the opening of a customer’s account, the conduction of transaction and shall not enter into business relationships with the customer, if there are not met the requirements on the customer's identification and the requirements on due diligence stipulated in Chapter II25 of the Law "On the prevention of money laundering. 26 10. In case subjects suspect at any time regarding the customer’s identity, they suspend immediately every operation with this latter and inform the responsible authority, in compliance with the requirements on reporting as set out in Article 9 of this Regulation. 11. In case customers that have business relationship with banks and branches of foreign banks, transactions on their account are carried out in any case through the account of the customer/customers. 12. 27The subjects shall continuously monitor the business relationship with the customers, through data collection on the scope and nature of this relationship and creating its risk profile, as well as the analysis of the performed transactions in the course of duration of this relationship, to ensure that they are consistent with the knowledge that the subject has about the customer, the nature of its business performed, the risk profile and the source of the funds. 13. 28The subjects shall define, in their internal procedures, the frequency of the continuous monitoring in accordance with the risk profile of the customers. 14. 29The subjects shall assess the risk arising from the exposure to money laundering and terrorism financing, based on the national assessment of the country risk, the category of the customers and the transactions performed, on the strategies of the subjects themselves and the risks undertaken by them, as well as the development of new products and the use of new technologies. 15. 30Subjects, part of a banking and/or financial group, shall implement the programs of the group on anti-money laundering and financing of terrorism, to the extent they are in compliance with the obligations set forth in the Law on the prevention of money laundering and the by-laws issued for its implementation. 16. 31Subjects, in case they rely on third parties, shall implement the requirements set forth in the Law on the prevention of money laundering. 17. 32The internal policies, rules and procedures drafted by the entities for the management of money laundering and terrorism financing risk, in accordance 25 Amended upon the Supervisory Council decision no. 22, dated 5.04.2017. 26 Amended upon the Supervisory Council decision no.55, dated 28.08.2013. 27 Added upon the Supervisory Council decision no. 22, dated 5.04.2017. 28 Added upon the Supervisory Council decision no. 22, dated 5.04.2017. 29 Added upon the Supervisory Council decision no. 22, dated 5.04.2017. 30 Added upon the Supervisory Council decision no. 78, dated 18.12.2019. 31 Added upon the Supervisory Council decision no. 78, dated 18.12.2019. 32 Added upon the Supervisory Council decision no. 13, dated 1.4.2026.

6 with the provisions of this regulation, shall be approved by the respective governing bodies of the entities. Article 7 Registration and record-keeping of data Subjects shall register on their database any information related to the customer’s identification and on any financial transaction carried out on this latter behalf or account. The record-keeping of this information, along with the subordinating documentation, is carried out in line with the requirements and terms set out in Article 16, of the Law on Prevention of Money Laundering. Article 8 Responsible structures of subjects

1. Subjects shall establish the needed structure/structures and infrastructure for the prevention of money laundering and terrorism financing.
2. 33Subjects shall assign a responsible person, at head office management level and at each representative office, subsidiary, branch or agency for the accomplishment of obligations arising according to the Law on the prevention of money laundering and the bylaws issued for its implementation. The responsible persons may access continuously all the data and all kind of information available at the subject, which is necessary to realise the duties.
3. Respective structures shall make available to the responsible person, set out in line with paragraph 2 of this Article, the sufficient asset and sources to fulfil his duty (such as the adequate technique, sufficient personnel, a reasonable budget, etc).
4. Subjects shall submit to the Bank of Albania the name of the responsible person assigned in line with paragraph 2 of this Article, and in all the cases that there are changes of this person.
5. 34Subjects shall immediately provide to the Bank of Albania, upon their approval, copies of internal procedures on the prevention of money laundering and terrorism financing, as stipulated in the provisions of this Regulation.
6. 35Subjects shall draft and approve regulations/procedures on the assessment and categorisation of customers or transactions in accordance with the risk level they have, in compliance with 36the Law on the prevention of money laundering. In addition to the categories set forth in 37the Law on the prevention of money laundering, the subjects may set forth other categories, referring to the Guideline 33 Amended upon the Supervisory Council decision no.55, dated 28.08.2013. 34 Amended upon the Supervisory Council decision no.55, dated 28.08.2013. 35 Amended upon the Supervisory Council decision no.55, dated 28.08.2013. 36 Amended upon the Supervisory Council decision no. 78, dated 18.12.2019. 37 Amended upon the Supervisory Council decision no. 78, dated 18.12.2019.

7 "On the risk assessment for money laundering and terrorism financing" attached to this Regulation. 7. Branches and agencies of subjects operating in the Republic of Albania register all the financial and banking operations of each customer at amounts set out in this Regulation and in the Law on Prevention of Money Laundering, or their counter value in the foreign currencies. The general Directory of subject preserve and maintain all the reports supplied by the subject’s branches and agencies, and summarised data regarding its network throughout Albania; 8. 38Subjects shall ensure that their subsidiaries, branches and agencies established outside the Republic of Albania, and in particular in places and territories which do not implement or partially implement the international standards, act in compliance with the preventive measures stipulated in the Law on the prevention of money laundering. If the preventive measures at places where they have the subsidiaries, branches and their agencies change, then the subjects should prioritise their obligations. If the countries laws, where are located the subsidiaries, branches or agencies, have laid down restrictions related to the implementation of obligations 39and preventive measures, the subject shall report about these restrictions to the responsible authority and to the Bank of Albania, accordingly. 9. 40The subjects shall also provide in the internal employment procedures, the criteria on the lustration and integrity 41of the employees, particularly those involved in the process of the prevention of money laundering and financing of terrorism, in order to prevent the risk of their involvement in criminal activities, money laundering, fraud, etc. 9/1. 42Subjects shall draft and implement an annual training program of the responsible person and employees of the structure responsible for the prevention of money laundering and terrorism financing. 10. The responsible persons of subjects, assigned in accordance with paragraph 2 of this Article, shall compile and implement an annual training program of subjects’ employees, related to the internal regulations and procedures adopted for the purpose of preventing money laundering and terrorism financing. 11. The responsible persons of subjects, assigned as stipulated in paragraph 2 of this Article, shall inform periodically the employees of these subjects related to the changes of applicable legal provisions on the prevention and punishment of penal offence of money laundering and terrorism financing, and on their obligations related to the implementation of these changes. 12. Repealed43 38 Added upon the Supervisory Council decision no.55, dated 28.08.2013. 39 Added upon the Supervisory Council decision no. 78, dated 18.12.2019. 40 Added upon the Supervisory Council decision no. 22, dated 05.04.2017. 41 Amended upon the Supervisory Council decision no. 78, dated 18.12.2019. 42 Added upon the Supervisory Council decision no. 78, dated 18.12.2019. 43 Repealed upon the Supervisory Council decision no. 22, dated 5.04.2017.

8 13. Repealed44 . 14. Employees of subjects shall preserve the confidentiality for the reporting process related to prevention of money laundering and terrorism financing and are not allowed to inform the customer on the procedures to verify suspicions and for the reporting to the responsible authorities. Article 9 Reporting to the responsible authority

1. Subjects shall report to the responsible authority as provided in the reporting forms and the terms set out by the bylaw act from the responsible authority regarding to: a. 45all transactions in cash equal or higher than ALL 1 000 000 (one million) or the counter value in foreign currency, carried out as a sole transaction or as transactions related to each -other within 24-hours; b. 46repealed.
2. Subjects whenever believe or have reason to believe that transaction applied to be carried out by a client or by another person for the account of customer, 47may include laundering of penal act products, terrorism financing or funds deriving from criminal activities, shall report immediately the case to the responsible authority. In these cases, subjects shall wait until 48 (forty-eight) hours after reporting to the responsible authority for the instructions of this latter, if they should carry out the transaction or not.
3. 48Subjects, whose activities include money or value transfer, in case of outgoing or incoming transfers, shall require information related to both the sender and the beneficiary, which minimally shall include, name, surname, address, 49ID number/personal number, or IBAN (where applicable) or the account number, as well as the name of the financial institution involved in the transfer. 50In case there is not an account number, the transfer shall be accompanied by a unique reference number. In case of missing information, the subjects shall refuse to perform the transaction and shall notify the responsible authority. The complete identifying information shall accompany the transfer throughout the transfer steps from the first sender to the last beneficiary.
4. 51Subjects, whose activities include money or values transfer, shall maintain a list of the agents that operate on their behalf. These agents shall be considered as 44 Repealed upon the Supervisory Council decision no. 22, dated 5.04.2017. 45 Amended upon the Supervisory Council decision no.55, dated 28.08.2013. 46 Repealed upon the Supervisory Council decision no.55, dated 28.08.2013. 47 Amended upon the Supervisory Council decision no.55, dated 28.08.2013. 48 Amended upon the Supervisory Council decision no. 22, dated 5.04.2017. 49 Amended upon the Supervisory Council decision no. 78, dated 18.12.2019. 50 Added upon the Supervisory Council decision no. 78, dated 18.12.2019. 51 Added upon the Supervisory Council decision no.55, dated 28.08.2013.

9 part of the subject, which should train them on the prevention of money laundering and terrorism financing and assure they implement the same due diligence, record keeping and reporting measures related to the customer. 5. 52Subjects shall submit a report to the responsible authority, where are presented the cases they know or suspect that is being conducted, has been conducted or tried to carry out laundering of criminal act products, terrorism financing or the involved funds derive from criminal activities. The reporting shall take place immediately and within 72 hours. Chapter III Final Provisions Article 10 Supervisory requirements

1. Bank of Albania shall supervise the implementation of the provisions set out in the Law “On Prevention of Money Laundering”, the bylaws issued for its implementation and the requirements of this Regulation.
2. Bank of Albania shall report to the responsible authority any suspicion, information or data it assesses as potentially relating to money laundering or terrorism financing, concluded over the supervision process 53of the subjects to this Regulation.
3. Bank of Albania shall assess the adequacy of internal control systems and programs of the subject, for the purpose of preventing money laundering and terrorism financing.
4. Bank of Albania, regarding all the evidenced violations which may be classified as administrative infringement, according to Article 27 of the Law “On Prevention of Money Laundering”, shall inform the responsible authority by providing the complete documentation related to the conclusion of infringement.
5. 54Repealed.
6. 55Bank of Albania may request to the subjects to access and make available all the information and documents for the subjects to accomplish their obligations in compliance with the Law on money laundering. 52 Added upon the Supervisory Council decision no.55, dated 28.08.2013. 53 Added upon the Supervisory Council decision no. 78, dated 18.12.2019. 54 Repealed upon the Supervisory Council decision no. 78, dated 18.12.2019. 55 Added upon the Supervisory Council decision no.55, dated 28.08.2013.

10 56Article 11 Reporting requirements Subjects of this Regulation report annually to Bank of Albania the data required according to Annexes 3 and 4 of this regulation, no later than 30 days after the ending of the calendar year. 57Article 12 Transitory provisions 58Article 13 Supervisory and punitive measures

1. Bank of Albania shall take supervisory and punitive measures against the subjects to this Regulation, as stipulated in the Law No. 9662, dated 18.12.2006, “On banks in the Republic of Albania”, as amended; and the Law No. 52/2016 “On savings and loan associations and their unions“ and the by-laws issued for their implementation, which regulate the activity of these subjects, if concluding that these subjects fail to implement the legal and regulatory framework in force, on the prevention of money laundering and financing of terrorism.
2. The Bank of Albania, when it shall consider it reasonable, may suspend one or more activities, or revoke the license of the subject, if requested by the responsible authority, accordingly to the Law “On the prevention of money laundering.” CHAIRMAN OF SUPERVISORY COUNCIL ARDIAN FULLANI 56 Added upon the Supervisory Council decision no. 22, dated 5.04.2017. 57 Repealed upon the Supervisory Council decision no. 78, dated 18.12.2019. 58 Added upon the Supervisory Council decision no. 78, dated 18.12.2019.

11 59ANNEX 1 GUIDELINE TO MEASURE RISK ARISING FROM MONEY LAUNDERING AND TERRORISM FINANCING The purpose of this guideline is to assist the entities which are subject of this Regulation "On the prevention of money laundering and terrorism financing" (following referred as AML/CTF), in risk money management and terrorism financing. The guideline does not replace the legal obligations of entities, but aims at assisting them to understand and manage risks that may arise during the conduction of their activity. Bank of Albania, in the light of this guideline, provides a risk-based approach on the best international standards for an effective risks management deriving from money laundering and terrorism financing. In this view, Bank of Albania encourages the entities to have in place practices and procedures to assess and prevent the conduction of operations which are used for money laundering or terrorism financing. In this regard, the guideline and matrices in the attached annex, shall serve as a supporting facility to assess risks that derive from the activity in the field of money laundering and terrorism financing. I. General description of risk assessment First, the entities shall identify the potential risks of money laundering, with the purpose the implementation of and effective system to assess risk. These risks may be identified at various forms, but mainly they are identified based on risk factors. "Risk factors" means the unity/group of customers' categories, products and services/transactions, business relationships, and the geographical area set out by reliable information sources as group of categories broadly accepted to assess risk. “Reliable information source”, in this guideline means public information, made broadly available by known authorities enjoying a reputation, such are: United Nations Organisation, Financial Action Task Force (FTAF), World Bank, International Monetary Fund, European Council, OFAC, Egmont Group, etc. The high-level managers of the financial entity shall assure that the risk assessment and the processes to mitigate it, be carried out professionally, with the purposes the accomplishment of all legal obligations in the field of preventing money laundering and any illegal action, which aim at money laundering and terrorism financing. The identification of potential risks level helps the entities to take the needed measures to prevent money laundering and terrorism financing. The identification of risks starts at the outset that customer requires to enter into business relationships with the entity. In 59 Amended upon the Supervisory Council decision no.55, dated 28.08.2013

12 continuing, the identification and assessment of risks shall become more evident during the conduction of the business relationship. Once the subject has determined the risk factors, it shall set out the categories of risk factors. “Risk factors categories”, shall imply the types of customers, with whom the entity has entered into business relationships, types of products and services that the entity offers to the customers, types of transactions and business relationships, and the geographical area the customers come from (origin/location) or have business relationships. Following the identification of potential risks, upon the entity has established factors’ categories, there shall be carried out the monitoring of these categories, which is deemed as one of the most important processes of risk assessment. The analysis60 process is conducted after the monitoring process. However, it is deemed that there is not a rational and genuine division between the monitoring process and the analysis process. Both these process, for many entities, may imply the undertaking of same measures, but for the purposes of this guideline we shall accept that "analysis" is part of monitoring process and includes its more strengthened measures, by keeping data/conclusions in written form, which are submitted to the respective authorities. The analysis of transactions is the base for the establishment of AML/CTF system by entities, as it is the output of the entire process. The analysing of risk factors categories shall take place based on categories variables. "Category variable" shall mean the core element of factor category, which serves to assess the compliance of customer's profile with the transactions' profile, and the destination of inflow and outflow funds. Identification of risk-related factors and factors categories provides the implementation of a risk-based approach. This risk-based approach provides to the financial entity's structures the possibility to focus on issues which have larger exposure to risk. The financial entity shall assess its capacities to build such an approach, through the identification and assessment of "possibilities, "weaknesses, "risks", and its "strengthening" to take advantage of this methodology. The entities shall build processes for the identification, measuring, monitoring and mitigation of risks arising from money laundering and terrorism financing, with the purpose the implementation of a risk-based approach. These processes should be supported by policies, procedures, dedicated structures, training and control system, which carry out the identification and effective management of the exposure to risk. The internal audit of the entity shall assess continuously the entire functioning of these processes. The highest-level management structures of the entity shall approve the established system. In the event the entities identify high risk exposure, they shall apply strengthened measures for the management and mitigation of exposure to risks. 60 Analysis - Identification, assessment, measuring and the conclusions about the risk accompanying the situation.

13 II. Risk level The entities shall identify risk, by carrying out assessment or measurement in two main directions:

• upon the impact (damage) that may arise, in case of occurrence of an event, which is followed or has led to money laundering or terrorism financing; and
• in case of the event occurrence, which may be followed or leads to money laundering or terrorism financing. The entity shall assess the impact (damage) of money laundering and terrorism financing risk depending on individual circumstances, but some of the main points the entities shall be based to assess the impact (damage) are:
• the impact on the activity of the financial entity, in case an event, which may be considered as a criminal act, may lead to financial loss or in the event when the entity is fined by the relevant authorities;
• the impact when a particular transaction may result to have been used for corruption, bribe, contraband, illegal emigration, trafficking in narcotic drugs, arms trafficking, terrorism, rubbery, acquisition, fraud or other criminal actions;
• the impact when a particular transaction may lead to sufferance due to the financing of weapons of mass destruction, illegal drugs, etc.
• the impact on the reputation of the financial entity, which relates to the damage that may be caused to the entity due to the entering (even unintentionally) into a business relationship or transaction, as a result of illegal activities that may lead to the placement of sanctions by competent authorities or the transfer of customers from the entity. The entities, depending on the assessment of the possibility or consequences that may bring about the conduction of an event, which leads to money laundering or terrorism financing, may conduct the risk assessment at different points of view. Regardless, risk is categorised in two levels in compliance with the legal framework:
• Low and medium level or moderated risk level - where the occurrence possibility on money laundering and terrorism financing is low and/or have low or ignorable consequences on the entity. In these cases, there are always implemented the measures of the 61simplified due diligence and the due diligence stipulated in the law or by laws.
• High-risk level - when there is the possibility to occur money laundering or terrorism financing and/or to have consequences, which may be considered harmful or rather serious for the entity. In these cases, there are always implemented the measures of the enhanced due diligence stipulated in the law or by laws. However, the entities may use such an approach which categorises risk in three levels: low level, medium level and high level, but the low risk and medium risk shall be categorised at the category of the 62simplified due diligence and due diligence. 61 Amended upon the Supervisory Council decision no. 78, dated 18.12.2019.

14 III. Risk factors The entities shall consider the broadly accepted factors for risk identification and measuring, which are: geographical risk, customer's risk, and the risk of products, services/transactions and business relationships. The entities shall be based on these three factors, which minimally compose the factors that serve to measure risk. Different entities may implement different weights for these factors (individually or in combinations) to assess risk, depending on the activity and the relevant circumstances. Thus, the entities shall determine these weights and the respective reasoning on the size of the selected/implemented weights. These weights are subject of assessment during the on-site controls, in compliance with the profile, strategy and vision of the entity. The weights assigned to each risk factor, shall be determined as "weighting coefficient of risk factor". All the categories set out in the legal framework and relevant guidelines, which are channelled in the enhanced due diligence process, have the highest-risk value, thus the highest weighting coefficients. This implies that the result of the system as built by the entity should automatically channel the business relationship with the customer in the category of enhanced due diligence. For example, in case a PEP conducts a transaction, the relationship shall be automatically channelled through the enhanced due diligence process, and consequently, the entity shall take all measures in compliance with the applicable regulatory and legal framework. There is no a single methodology to implement the risk-related factors. The implementation of factors aims to provide a strategy for the management of potential risks and these factors are considered to be useful indicators, but not indispensably for all the circumstances and cases. The entities shall establish their systems, for the purposes to minimally identify the factors and categories set forth in this guideline, which have the highest risk-level. The entities may determine also other factors and categories in compliance with their profile of fragmentation in the financial markets.

1. “Geographical risk” - means the risk set forth by the geographical position of the country of origin of the customer (beneficial owner) and/or location of the person included in a transaction with the customer. Categories of geographical risk which may lead to the conclusion that a country has a higher risk include:

• countries subject to the sanctions, embargoes or similar measures, as, countries/entities/individuals that are included in the United Nations Security Council Resolutions;
• countries which by reliable sources are identified to not have the regulatory and legal framework of AML/CTF, countries which are identified as such by Financial Action Task Force, International Monetary Fund, Moneyval, World Bank, Egmont Group etc.; 62 Amended upon the Supervisory Council decision no. 78, dated 18.12.2019.

15

• countries identified by reliable sources of information as providers of funds or supporters of terrorist activities that have established terrorist organisations that act within these countries;
• countries identified by reliable sources, to have sufficient corruption levels or any other criminal activity, as identified by the World Bank, International Monetary Fund or Financial Action Task Force. Also the risk assessment and measuring depends on the location of the entity or the location of its organisational units, implying different level of entities' risk located in an area visited by a considerable number of tourists, compared to a rural area where all customers know each other personally. Risk may be higher at border crossing points, airports, in places with high concentration of tourists or in case of transactions including foreigners (for example trade fairs), in places where are located embassies or counsellor offices, in countries with high risk of corruption and crime, etc. Also, transactions executed at off- shore destinations represent high-risk level.

2. "Customer risk/entity" factor - classification of customers by risk is carried out based on the possibility that the entity be used for the purposes of money laundering or terrorism financing or the customer may use the relevant business in order to combine the illegal money with the legal incomes. The entities shall take additional measures for those customers classified with high risk. The nature and the set of implemented measures depends on concrete established circumstances (for example if a customer is assessed at high risk due to the structure of his ownership, then the entities shall include a provision in their procedures, to determine the need of receiving additional data and the further verification of the presented documents). For the purposes of implementing the broadly accepted principles, and based on their experience, the entities are independent in determining their approach to the customer's risk. The customers' categories, whose activities may be an indicator of the highest risk level, are listed following: a) customers that conduct their business relationship under unusual circumstances, such are:

• considerable and inexplicable geographical distance between the entity and the customer's location;
• frequent and unjustifiable transactions of accounts in various entities and of funds among institutions at different geographical countries;
• customers, that have a complex structure, nature or business relationship that makes difficult the identification of the real owner and controlling structures; b) Non-profit organisations; c) Politically Exposed Persons (PEP);

16 d) Transactions with non-resident customers; e) Business relationships and transactions with customers, who live or conduct the activity in countries which do not implement or partially implement the international standards of AML/CTF; f) Transactions on the behalf of another person; g) Customers that conducts considerable movements of cash amounts; h) Ownership structure of the company appears unusual or rather complex, considering the business nature of the company; i) Frequent and unexpected establishment of similar business relationships with some banks, without considering the economical assessments. An example of such activities may be the opening of accounts in some banks, the agreements of membership in voluntaries pension funds within a short period of time (with one or more management companies) or the signing of some financial leasing agreements with different providers of financial leasing, etc.; j) Frequent and unexpected transfers of funds from the accounts at a bank to those to another bank, with no standing economic reasoning, particularly when banks are located at different geographical locations; k) customers that carry out business activities which are characterised by large circulation of money and cash payments, at considerable rates, such are: restaurants, gas stations, exchange bureaus, casinos, car wash locations, flowers shops, trade of high value items (precious metals, precious stones, vehicles, art objects, etc.), transporters of items and passengers, sport bets companies; l) Traders and producers of weapons; m) Representatives of parties, whose business includes the representing (attorneys, accountants or other professional representatives), particularly when the entity is in contact only with the representatives; n) Construction companies; o) Companies with a small number of employees who are not in a right proportion with their business field, companies without infrastructure or without business premises, etc. p) persons to whom the business bid is rejected by another entity, notwithstanding how such an information is received, and/or persons with no good reputation; q) Customers whose funds derive from unknown or unidentified sources, and/or customers with funds deriving from unverifiable sources; r) The suspicious customers that do not act for their account and/or apply the instructions provided by a third person; s) Trusts and companies having equities of the holder/companies that are engaged in import/export; t) Employees at high management level.

17 The entities, once having carried out the identification and verification of the beneficial customer/owner (placement of business relationship), the responsible structures, classify the customer at the respective category based on his profile, and determine the risk level. The entity shall carry out this process also for the existing customers. This guideline lays down only the categories which are classified as high-risk categories. The entities, along with the categories laid down in this guideline, shall determine other business relationships, customers and transactions, assessed to have high risk and against which there should be implemented the enhanced due diligence. All categories, which are not included at high risk level, shall be categorised as at low, medium or moderated risk level. The entities (responsive structures), if during the continuation of the business relationship or during the monitoring process, detect that the customer carries out an activity not in compliance with the profile, are obliged to analyse the reasons driving to this change in the customer’s profile. If deemed reasonable, the responsive structures shall take the decision to reclassify the customer's category at a high risk level, and channel it through a deeper monitoring process. The entities are recommended to lay down internal procedures related to the profile updating of the customer even though the customers do not show a different activity profile from the initial one. If the customer is not classified at high risk level, but uses products with high risk or conducts business relationships with destinations included at geographical risk, the case again shall be channelled through a deeper monitoring and enhanced due diligence￾analysing process. That is, again weighting results of risk factors should result at high￾risk level. The entities shall analyse with priority the cases when the customer, simultaneously, is categorised as high-risk customer, uses high-risk products or meets the conditions on geographical risk, and channel through a deeper information updating process, by conducting a continuous monitoring. Also, the entity shall keep the data about the customer, which are presented to the respective authorities to immediately begin to analyse the procedures for the reporting to the responsible authorities, if from the genuine analysis comes out a potential risk. Risk assessment shall be considered as a function of three risk factors. Risk weighting coefficients are attached to the factors. Based on weighting coefficients, the entities may decide to weight higher a risk factor. As a result the function shall overestimate a factor and underestimate another. The overestimation or underestimation shall be in compliance with the strategy profile structured by the entity, related to the measures implemented against money laundering and terrorism financing. Another issue to be considered is that all these three "factors" may be positively related to each other, implying that in case of a "non-resident" customer from the off-shore destination, he is also a high risk category based on both risk related criteria and geographical risk (if the customer has carried out off-shore transactions). The qualitative analysis of this case shall be crucial, whereas the quantitative analysis shall serve as a potential indicator of the exposure to risk.

18 3. Risk of products and services /transactions categories and business relationships The entities shall carry out the classification by products/transactions and services, based on the possibility that they may be used by the customer for the purposes of money laundering and/or terrorism financing or with the purpose to combine the illegal money with the legal incomes. The categories, which represent a high risk level, are the following: a) Services identified by competent authorities or other reliable sources as potentially with high risk level;

• Cross-border correspondent banking services;
• Correspondent banking services, whose accounts are used by shell banks;
• Complex transactions, with high and unusual values, which do not have a clear economical or legal purpose;
• Transactions carried out through the new technological developments; b) New services in market, not previously being provided in the financial sector, which should be particularly monitored, in order to determine the real risk level that accompanies these services; c) International private banking, that is private banking insurance and the management of funds for foreign citizens (private banking, potentially includes considerable risks for a customer, who may have available large amounts of money, is served by one employee of the bank or a small group of a bank employees, who may be instructed by their managers to meet all the requirements of the customer and/or independently the abuses and frauds that managers may commit related to the relevant duty); d) E-banking in cases stipulated by the entity in its procedures; e) Electronic delivery of securities trading orders, in cases laid down by the entity in its procedures; f) The providing of service to open join accounts, which mobilise funds deriving from different customers and sources, deposited at an account recorded under a sole name; g) The repurchasing or cheques payments or of another bearing instrument, or of the security; h) Use of the modern technology that provides anonymity (for example: ATM, internet banking, mobile banking, prepaid card, 63virtual tools, etc.). IV. Variables of category

For the purposes to assess the categories of factor, the entities shall minimally consider the following variables, which may be assessed individually or combined between them: a) The purpose of opening an account or a business relationship - the information that the entities collect on the opening of the account shows the purpose and the nature of business relationship and develops the risk profile. The possible difference between the customer's profile (customer’s risk) and products' profile (products risk) that the customer uses, shows a possible anomaly of the purpose on opening an account. The opening of an account, to carry out routine transactions, at not high values by a known customer, may 63 Added upon the Supervisory Council decision no. 78, dated 18.12.2019.

19 represent a low risk compared to an open account to carry out high-value transactions by an unknown or casual customer. b) Assets level or amount of transactions - the existence of assets or the conduction of transactions at higher values compared to those that may be expected based on the customer's profile, serves as a signal that a customer may be potentially assessed as high risk level and be treated as such. c) Adjustment level or other control or governance legal regimes where the customer is subject - a financial institution that is regulated in a country pursuant to a legal regime, which does not implement or partly implements the respective international standards, to prevent and fight money laundering and terrorism financing, represents more risk than an entity subject of the minimum rules against money laundering. Companies and subsidiaries (totally in their ownership), which are in public ownership, and trade in stock exchange, overall represent minimum risks of money laundering. For example, a company which have the centre at off-shore destinations represents a higher risk than a company with the centre at a country with legal regime complement with the international standards. d) Duration of business relationships - long-term relationships during which frequent contacts of the customers are involved, may represent lower risk in the light of money laundering. e) Source of funds. f) Justifying documentation for the transactions. V. Risk measuring steps The entities shall pursue the following steps to measure exposure to risk of money laundering and terrorism financing: a) The continuous monitoring of business relationships with the customer, based on the transactions profile, customers profile and exposure customer against geographical risk, throughout the duration of this relationship to assure they are in compliance with the knowledge the entity has on the complete categories variables. In this step, the products and services that they use, and the destinations of products are classified at 64simplified due diligence, due diligence and enhanced due diligence category. Related to any possible change of categories variables, the entities shall assess the risk. The entity, upon having identified a change of potential variables, shall assess the result for all the three risk criteria, by developing the relevant quantitative analysis. The quantitative analysis implies the sum of risk factors, where each factor is weighted through the weighting coefficients of the risk factor. b) The entities, if the result (quantitative analysis) shows a potential risk, shall base the analysis on the entire exposure to risk criteria (qualitative analysis), and on the factor category variables. Some of the additional measures to manage this exposure are: 64 Amended upon the Supervisory Council decision no. 78, dated 18.12.2019.

20

• Additional information on customer's profile (internet, public data base);
• Increase of frequency of data updating for the customer;
• Additional information on the intended nature of the business relationships, by requesting justifying documentation;
• Receiving the additional information on the source of funds;
• Receiving additional information on the reasons and purpose of this transaction or group of transactions;
• Receiving the approval from high-level managers on the beginning and continuance of business relationships with the customer, in cases when the relationship between the business and the customer is established and the entity concludes that the customer or the beneficial owner has changed the category;
• Enhanced due monitoring. The entities may lay down other additional measures for the management to this exposure. In this step, the entity should have arrived at qualitative and quantitative conclusions, by keeping certifying data. It may come out that a special case to not be identified by the quantitative indicators, but this is insufficient the entity to not have identified based on qualitative variables. The methodology to measure the risk of money laundering and terrorism financing provided in this guideline, represents a combined qualitative and quantitative approach, where the quantitative analysis would be nonetheless without the qualitative analysis. c) The responsible structures of the entity, once having identified a case, which represents materiality, shall follow the steps for the materialisation of the reasonable suspicion, and take all the needed precautions if the issue needs to be addressed to the responsible authorities. In the Annex attached to this guideline, it is provided a simple model to make possible the materialisation of requests of the qualitative and quantitative requirements. VI. Suspicious indicators The entities shall consider as suspicious indicators the operations which according to the nature may be considered as unusual for the relationship of the business and serve as signs to initiate a risk assessing procedure, in any case these indicators are evidenced. The suspicious indicators aim to assist entities to assess/measures possible signs of money laundering or terrorism financing and reduce uncertainty limits relating to entities assessments or discrete behaviours and to contribute in ensuring the correct and homogeneous accomplishment of the reporting obligations on the suspicious transactions. List of anomaly indicators is unlimited, considering among others, the on-going evolution of procedures on the conduction of transactions. The entities shall assess attentively other models of behaviour, which notwithstanding are not described in the suspicious indicators, may compose anomaly.

21 Suspicious indicators which are listed following are included in the high risk level and the measures of enhanced due diligence shall be implemented against them, as laid down in the law or by laws:

1. Suspicious indicators related to the customer: a) the customer refuses or does not provide easily the requested information or provides false information or frequently changes the information and without a clear justification; b) the customer, provides an overall information different from the one provided by independent sources, for example information taken from the archives, lists and registers or data published at official internet sites of the national and international authorities; c) the customer, upon the request of the financial institution for further information, prefers to not carry out transactions or enter into business relationships or to request the termination of the existing business relationships; d) the customer manifests an unusual behaviour, compared to the normal behaviour standards of customers, without providing any substantial justification; e) the customer avoids direct contacts with the financial institution, by authorising and providing power of attorney frequently and inconsistently to the activity the customer carries out; f) the customer addresses to a financial institution or its branch that is far from his residency area or in which it carries out the activity and frequently changes the branch that he uses; g) the customer frequently asks related to the procedures on the implementation of rules against money laundering and terrorism financing and tries to make the staff to avoid these rules, by simultaneously trying to establish confidential relationships with the employees; h) the customer shows to not have adequate knowledge on the nature, object, amount or purpose of the transaction or relationship or provides non-realistic, confusing or inconsistent explanations, which drive to the suspicion that the customer is acting for a third person; i) the customer during the conduction of the procedures to carry out transactions always is presented accompanied by other persons, who appear entirely interested on the transaction; j) customers, who are foreign citizens, particularly persons politically exposed, use the relationship established in Albania, exclusively for incoming or outgoing transactions, without economic reasons, notwithstanding these transactions may be carried out at the customer's country at lower cost and at a shorter time; k) the customer conducts large transactions in cash or through unusual procedures when it is made known that is subject of a penal procedure, preventive measures or

22 commodities sequestration or is in close contact (for example family member) with people to whom these measures are taken, or when the other party of the transaction is subject of these measures; l) applications for loan by persons, who are suspected that, may become member of criminal organisations for the purposes of re-investing the proceeds deriving from criminal activities in properties; m) the customer resides or carries out transactions with parties, which are located at high-risk rate territories or places and conduct large transactions by unusual procedures, without substantial justifications; n) the customer does not present details related to third parties for whom it is acting; o) the customer conducts frequent and large transactions, which are inconsistent with his economic profile or the transaction; p) the customer benefits transfers in his account by different third parties, which are not justified by the nature of his business; q) the order party in a transaction makes resistance or tries to avoid the compliance requirements of the receiving bank with the purpose the identification of the transaction data and details; r) the customer, natural or legal person, notwithstanding is advised on the identification requirements, refuses or gives obstructions in providing them to determine his identity, or tries to encourage the bank's employee to not record these data or refuses to complete the required documentation for the transactions or request for exclusion from the requirements to keep his data. 2. Suspicious indicators related to the transactions: a) the application for transaction, which are carried out without taking in consideration the investment risk assessment, the determined commissions or other costs; b) Repeated orders for transactions by companies which regularly result at financial loss or financial difficulties, which continue to have the same management, notwithstanding the frequent changes of owners; c) Frequent withdrawals of funds by different entities, accompanied by transfers ordered by customers regarding accounts, which are under the ownership of trustees; d) Large transactions frequently with parties, which are recently established companies and whose activity object is not in compliance with the activity carried out by the customer or which have a general purpose; e) transactions which are unusual with the current practices of the market or which are impacted by procedures and instruments particularly different from those of other active operators in that field, particularly if they are considerable complex, or do not have to do with transfers of large amounts, which are not justified by specific needs;

23 f) Unexpected transactions, accomplished within established periods, conducted related to relationships, which function regularly, through large amounts cheques or cheques depositing, and whose amounts are transferred to third parties; g) off-shore funds, at large and frequent amounts to accounts or relationships established in Albania by companies owned by persons with head office at high-risk countries or which trade transactions unnatural to the activity or business and which are accompanied by large cash withdrawals from these countries; h) Transactions not in compliance with the instruments used in the economic activity and the economic or financial profile or in case of legal persons or group, these transactions are not justified properly by the customer; i) Use of companies or enterprises' accounts by the shareholders, managers or employees for transactions, which are not part of the companies/enterprises' business, particularly cash transactions or for large amounts; j) Use of accounts on behalf of individuals (shareholders, managers, employees or customers or their relatives) for transactions for the interest of the company or enterprise, particularly transactions in cash or large amounts; k) Large-amount transactions by persons, who do not conduct any economic activity or are in economic difficulties; l) Frequent and large-amount transactions by customers on behalf or favour of third persons, or by third persons on behalf or favour of a customer, when the personal, trading or financial relationships between parties are inexplicable, particularly if these transactions seems to be established to not simulate a relationship to other transactions; m) Transactions authorised by one or more persons upon a warrant of attorney, whose characteristics and purposes are not related with the economic activity of the customer; n) Repeated transactions, particularly at considerable amounts, authorised related to relationships where involved, aged or disabled persons are. o) 65Transactions involving the use of virtual tools. 3. Cash transactions: a) Cash deposits and withdrawals at large amounts which are not justified accordingly the economic profile of the customer's transactions; b) When an account is credited in a large amount of money (cash) from third parties without the account holder being aware; 65 Added upon the Supervisory Council decision no. 78, dated 18.12.2019.

24 c) The existence of a large number of transactions in an account, with numerous deposits and withdrawals through the issuance of checks, while the account balance is kept at low levels; d) Re-activation of non-active accounts, particularly by using cash deposits through branches different from the branch in which it is open the account; e) Large amounts of banknotes at low-value dominations that are exchanged with banknotes at larger value; f) Frequent crediting of the account through banknotes at large value denominations; g) Frequent crediting of the account through foreign exchange, in case this action is not typical for enterprises at the dedicated sector of the activity; h) Frequent crediting of the account at low value at a solely account, whose total points at a considerable amount; i) Inexplicable increase of cash transactions volume at certain branches of the bank; j) the customer, who has an history of presenting counterfeited banknotes, unpaid cheques or cheques presented to be paid at a later date than the issuance date; k) The customer, who provides banking cheques versus cash or purchases travel cheques at large value; l) The customer, who has some accounts with the same bank and carries out cash deposits in each of these accounts, whose total amount points at a considerable value; m) Some persons carry out payments at the same account held by a natural person, without a clear economic purpose; n) Large cash amounts withdrawals from a previously inactive account, which is recently credited at a considerable value from abroad; o) Payment of a considerable amount of money for the purposes to participate on the increase/growth of a company’s equity; p) The customer, that uses his credit card to conduct large value transactions and then pays the credit in cash, without a substantial explanation regarding the funds origin; q) The customer, who does not provide supporting documents for the large deposits and explain the origin and use of funds; r) The customer, who exercises the profession of attorney and uses his accounts, to carry out transactions on behalf and for the account of legal and natural persons that the customer represents.

25 4. Transactions in financial instruments: a) Transactions through the employment of financial instruments which do not comply with the financial and economic profile of the customer or which are carried out through unusual procedures, particularly for large amounts of money not justified by particular procedures; b) Purchasing of financial instruments (particularly of real estate investments units) at notably higher prices than those of the market; c) Frequent financial transactions, including separation of transactions, for large amounts that are paid in cash or that are not transferred in the accounts or through the relationship with the customer; d) Frequent and large value investments in financial instruments, which are paid by entities/intermediaries at high-risk countries; e) Frequent long-term investments in financial instruments which are followed by subsequent requests for liquidation of the position and the transfer of income; f) Purchasing at a considerable amount of a considerable liquid financial instrument followed by the application for credit guaranteed by these instruments; g) Frequent purchasing and buying of financial instruments, by two or more persons, operations that implies a collaboration in the transferring of funds, particularly if the transactions are carried out at different prices from those of the market and which begin and end at short time and include less-traded instruments; h) Transactions with financial instruments which are characterised by the registration in the name of the third persons, which are not justified in a way by the relationship between the parties; i) The customer aims to purchase securities, which are normally traded in the market and refuses to complete the identification criteria, and to present the required verification documents; j) The purchasing of considerable amounts of financial instruments with request for the registration in the name of third related or not persons; k) Considerable and frequent transactions related to the receiving and payment of financial instruments, which belong to different persons and which are paid in the same account that is in the name of a trust; l) Frequent and considerable purchase of financial instruments carried out on behalf and for the account of residents in high-risk countries; m) Frequent and large amount purchasing related to non-materialised financial instruments, particularly to securities instruments, due to the lack of an acceptable justification;

26 n) Purchasing of non-materialised financial instruments accompanied at the same time by the request for physical delivery or transfer to third parties abroad; o) The introduction of non-materialised financial instruments to be exchanged in cash or to purchase other instruments without carrying out the transaction through the customer's account or their presentation to be deposited upon the request to provide a bill; p) The customer presents difficulties to provide the needed documentation to set forth this economic profile or the transaction; q) A representative of the company, who tries to terminate the agreement on behalf of the company, refuses to provide information, or provides insufficient information regarding the nature and purpose of the company's activity, the headquarters, ownership or control, identity of natural persons that are the real beneficiaries, expected volume of the activity in the account or other requested information or notwithstanding being requested by the financial entity the customer refuses to provide to this institution the certifying document; r) Repeated deposits or amount withdrawals, which are continuously lower than the reported identification limit; s) Frequent transactions of off-shore companies' equities, which are not identifiable owners and drive to the inability to identify the beneficial owner; t) Unexpected activism of an inactive business, particularly in the event of off-shore companies or companies that issue shares, which have unidentified owners (bearer shares). 5. Transfer of funds: a) Frequent deposits of customer in different accounts, are consolidated in a solely one and transferred abroad, particularly “to” and“ from” a country assessed as a favouring country to the taxation system or insufficiently implementing FAFT recommendations or is considered as a high-risk country for money laundering and terrorism financing. b) Accounts are opened on behalf of other natural or legal persons and do not show normal and on-going activity with the economic profile and transactions profile of the account, but are exclusively used for the transfer of funds abroad; c) On-going funds transfers for large amounts from/to low tax countries and which do not implement or partially implement the respective international standards related to the secrecy or from/to high-risk territories, without a clear business purpose related to the economic activity and customer's transactions profile; d) Funds transfer orders or deposits for non-large amounts which are withdrawn as cheques and bank drafts or deliveries, almost immediately, all or considerable part of

27 these funds are transferred in other cities or countries, in ways which are not in compliance with the activity or history of the customer; e) Orders of funds transfer for large amounts of incomes are collected by third parties, which do not have any clear familiar, business or professional relationship with the recipient showed in the payment order; f) A customer's account systematically shows debiting and crediting movements, which are not clearly related to legal transactions for goods and services; g) Funds are delivered or expected (received) by the same person to and from different accounts with no clear economic purpose; h) Consecutive funds' transfers, with no clear purpose, which may imply an effort to stop the tracing of beneficial owners; i) Unusual funds’ transfers among the accounts owned on behalf of legal persons under the same ownership (for example off-shore corporates belonging to a beneficial owner); j) Repeated funds' transfers to a recipient, who is located abroad and does not own an account at a foreign accepting bank; k) Funds' transfers from abroad to a customer in Albania, who continuously transfers funds to a third party; l) On-going funds' transfers at small value to a customer, who following provides instructions for the conduction of the transfers; m) Funds are delivered from a bank to another and at the end are turned back to the delivering bank; n) Considerable activity of funds' transfers to and from foreign countries by an enterprise not engaged in foreign trading; o) Considerable transfers of values arrived from abroad by a natural or legal person without any obvious economic reason; p) A corresponding account is credited at large amounts, which are unusual for this account. 6. Suspicious indicators related to business relationships: a) Considerable purchasing or selling at disproportional prices, related to the current value of the market or the calculated value (for example: real estate and securities, art works, jewellery, gold, other luxury items, companies, contracts, licences, shares, licenses or authorisations for trading activities); b) Immediate interruption of contractual relationships (particularly if it happens immediately after the contract is established), accompanied by orders on the liquidation of large amounts in cash or transfers in favour of third parties abroad;

28 c) Holding of different accounts by the same customer at the same financial institution, particularly if held in branches, which are located in close areas, or considerable number of power of attorney to carry out operations in the same financial institutions by the same customer; d) Relationships established to carry out transactions within a short time, which afterwards are terminated; e) Relationships on behalf of individuals or companies, that carry out modest operations, to whom there are deposited repeated large amounts or loans by third parties and which are followed by payment orders approximately the same amounts if transferred abroad; f) Receiving of guaranties, particularly from abroad, for considerable amounts from third unknown parties, related to whom the customer does not provide sufficient information; g) Signature of contractual agreements with restrictions or the providing of real estate or non-real estate as a guarantee for third parties, which appear to not have relations with the customer; h) Repeated presentation of guarantees by parties, which are not the original contractual parties; i) Requirements related to accounts or relationships qualified as inactive in compliance with the current laws presented by third parties, which are not related to the original owner of the account; j) Frequent use of cash registers or conservatorship/maintenance services or frequent deposits and withdrawal of sealed packages, particularly if made on behalf of another person or by using procedures that suggest the operations that are carried out for a third party; k) Unexpected intervention by third party out of the business relationship, with the purpose the payment of the liability or to cover the exposure of customer to the credit; l) Provision of the procurement for access to safe boxes to third parties that are not related to the customer to justify such a thing. 7. Suspicious indicators related to the means and procedures of payments: a) Repeated and unjustified use of cash, particularly at large amounts and large denominations; b) Deposits in cash, which are not explained in the light of the customer's economic activity, particularly when there are consumed money or large denominations;

29 c) Large amount withdrawals in cash, excluding the cases when the customer specifies particular need for this purpose; d) Exchange of money, particularly of large amounts, by using currencies of different countries of large amounts, particularly if the customer request for large denominations or the account is insufficient for the transaction; The request for information on the procedures to exchange into EUR/USD or other currencies, particularly if the operation is repeated or consists of large amounts; f) Cash deposits accompanied by frequent requests or for large amounts, for holding instruments, as cheques of orders, etc. g) Considerable payments in cash for credit cards, particularly if the customer has carried out frequent or large-amount withdrawals; h) Frequent cash deposits accompanied by withdrawals at ATM or POS particularly if carried out in the same day; i) Use of separated transactions for the purposes of avoiding the identification and registration requirements, due to the lack of justifications provide by the customer, for the purposes of hiding through other transactions; j) Frequent transactions for amounts slightly below the allowed limits for reporting, particularly related to cash or which are carried out at different branches; k) Frequent depositing of cheques at slightly lower values than the allowed limits, particularly if endorsed by several third parties; l) Withdrawals at large amounts ordered by many cheques, each at an amount slightly lower than the allowed one; m) Frequent requests for cheques, which do not contain the clause "non-transferable", particularly if they are used for cash/exchanged abroad; n) Use of payments instruments (debit cards, credit cards, pre-paid cards, e-money, in physical and virtual forms), whose procedures, repetition or economic importance is not in compliance with the financial activity of customers or with the distributors or traders' business; o) Frequent use of payment instruments, which relate to anomalies in selling volumes by a definite trader, particularly if the procedure and the amount suggests anomaly in giving cash to the customer; p) The application for the receiving of payment instruments which have excessive amounts and frequencies or requirements for compensations of unpaid amounts by a solely one distributor; q) Applications for frequent reimbursements or at large amounts or payments for the account of payment instruments of the customer;

30 r) Applications for the transfer of payments, through payments instruments for third parties, which appear to not have any relation with the customer; s) Frequent loans for payment instruments, which are accompanied by subsequent withdrawals of the credited amounts, or the subsequent change of customer's procedure for the use of the instrument; t) Frequent use of large amount of money, of payment services for the purposes of collection or transfer of money, in cases it is noted that transactions do not comply with the economic situation of the customer and which are not completely justified; u) Transfers or repeated withdrawals of the considerable amounts of money by a customer at a short time; v) Transfers or repeated withdrawals of considerable amounts of money from and to different counterparties that are abroad, particularly if these countries are not the country of origin of the customer; w) Transfers or money withdrawals from or in favour to counterparties in areas not far from each-other; x) Repeated incoming and outgoing transfers to and from different areas; y) Repeated money transfers or withdrawals through one or more financial agents in a place different form their residence or place of birth; z) Transfers or repeated money withdrawals by financial agents on their name or related persons (for example relatives, partners); aa) Repeated transfers of money for amounts slightly lower than the reported limit in favour of one recipient ordered by different persons, particularly if carried out at a short time, through the procedures that show the division of these amounts or the assignment of representatives; bb) Repeated deposits, particularly cash deposits, which are justified as income deriving from gambling, donations or heritage; cc) pre-payments, including those from financial leasing, which are clearly larger than those usually requested; dd) Large amounts of incoming funds, particularly from abroad, through the accounts that are used less and which are followed by large withdrawals or transfers through producers or to destinations or recipients who are not related to the customer activity; ee) Repeated payments for accumulated large amounts, including cheque use, in favour to legal persons or individuals, who seem to not have any relationship with the holder of the relationship; ff) Purchasing or selling of large amounts of currencies, gold or other precious metals, operations which are repeated.

31 8. Activities not in compliance with the business activity of the customer and the general economic profile of the transactions: a) A considerable increase of an enterprise deposits, not justified by a respective increase in its activity; b) Large amounts of cash are deposited in an account, without justifying the economic profile of the transactions; c) Transactions of a trade company are usually carried out in cash, more frequently and by other payment instruments, which usually are used for trade transactions; d) A bank account held by a natural or legal person is debited or credited at large amounts, which do not justify the economic profile of the customer's transactions; e) A large number of cheques or payments orders are deposited into an account or withdrawn cash form it, notwithstanding such an activity is not justified by the nature of business activity of the account's holder; f) Cheques at considerable amounts are deposited into an account without a clear familiar or business relationship between the account's holder and the person that carries out the withdrawals; g) An enterprise deposits cash at amounts, which are higher compared to enterprises at a similar size in the same sector; h) Broad use of crediting facilities and other types of financial market, driving to large capital flows among countries, for which such trading transactions are not usual, considering the normal activity of the customer's business; i) Large amounts are accumulated in deposits accounts and then are transferred abroad, unjustified complex transactions from the customer's business activity; j) A customer applies for services of managing its assets in foreign currency and the funds source is unknown or not in compliance with the financial situation and the business' activity; k) Considerable cash deposits (at number and value) by natural or legal persons with no clear economical purpose, particularly if within a short-term period the deposited amounts are transferred from the customer's account to a destination that appears that is not related to his activity; l) Owners of ships or transport companies of goods are engaged in transactions or activities which do not relate to transport activities; m)Transactions related to large-value purchases for the account of kids, persons of limited capacities or persons with limited economic or legal capacity to carry out large purchases;

32 n) Non-profit entities conduct transactions, which are not typical for their purpose or normal activity; o) Transactions carried out between the parties that do not act on their behalf but try to hide the identity of the real beneficiary. 9. Other suspicious transactions or behaviour of the customer: a) Frequent and inexplicable changes in fix telephone numbers or mobile and inactive e-mail addresses of the company; b) Abnormal behaviour showed by the customer during the conduction of the transaction; c) Accounts closed within a short time from their opening, particularly after the bank requests for the submission of the necessary documents, and in the event when respective funds are transferred; d) A considerable increase in the delivery of money in cash to/from one or some determined branches of a definite region; e) Transactions that include legal persons created recently, when the amount is large compared to their activity; f) Transactions that include legal persons that have interrupted the activity or are encountering financial difficulties; g) A legal or natural person that decides to close the accounts due to negative publicity; h) There are voices in the local community that the customer may have been involved in illegal activities; i) A customer shows considerable high profits deriving from fortune games or bets; j) The customer has accounts with some banks that conduct their activity in the same region, without a clear economic purpose; k) The customer insists on carrying out transactions only by a specific bank's employee, even though for routine transactions or the customer suspends/interrupts their conduction in absence of this employee; l) Frequent transfer of funds at an account held by an individual with low Income; m) Cheques on behalf of the bearer are issued and deposited upon they are endorsed several times; n) A bank account is continuously credited through "travel" cheques in foreign currency

33 o) Securities are purchased or sold frequently without any clear economic purpose (for example, resulting in losses for the investor). 10. Transactions of non-profit or charity organisations: a) Funds' sources are not in compliance with the collected funds' size, for example, large amounts are collected by communities, whose members have a low cost of living; b) An unaccepted increase of the transactions' frequency and size or vice versa, for example funds stay at the organisation account for a long time; c) Donations derive exclusively from non-residents of the country where the organisation is registered; d) Funds transfer at different countries, particularly at high-risk countries, and this is not justified by the organisation purpose as specified in its status; e) Organisations without staff, offices, telephone numbers, etc. 11. Use of safe-deposit boxes: a) Frequent use of facilities for maintaining deposits by joint lessee or their representatives, particularly when they include massive packages, which may be used to transport considerable amount of money (cash) or other objects; b) Increasingly frequent visits of safe-deposit box at a certain bank branch, in particular by individuals, who do not work or live at the area close to that branch, notwithstanding that similar services are supplied by a branch that is close to home or their business; c) Frequent change of common renters of safe-deposit boxes. 12. Loans: a) Complete or partial payment of the loan taken by the borrower, in the event the origin of funds is unknown; b) The guarantee for a loan is ensured by a guarantee for the bank (financial institution) and which do not clearly relate to the borrower; c) A customer requests to receive a loan without any declared purpose and is ready to offer cash as a guarantee; d) Application for loan based on assets, which have unclear origin or do not comply with the financial position of the applicant;

34 e) A customer applies to receive a loan, in the event the origin of customer’s participation is unknown or inexplicable; f) A customer receives a loan and does not use it, but deposits the amount in an account for a certain time and then withdrawals this amount in cash; g) The customer provides easily liquid assets as collateral for loan to purchase or restructure a property; h) The customer transfers funds abroad, for the purposes to be used as collateral for a loan and then transfer the amount in the customer’s country (returns the funds back), by presenting it as a credit granted for this customer or the respective business; i) The demand for large-amount loans supported by the collateral or personal guarantee by persons with offices at high-risk territories or countries or collateral placed in these countries; j) Frequent applications for loans by a solely person or related persons, who place as collateral goods that have not a definite origin; k) Fiduciary registration of assets or financial instruments which are subsequently followed by their third transfer or turned back to the creator of trust; l) Repeated payments abroad by the companies on which it is pretended to conduct international business, but which do not carry out funds’ transfer related to monetary transactions; m) Credit for international trade, in whose letter of credits the amount or the type of services and goods do not comply with those, which these customers carry out/produce, particularly where there is no relation among these services and the place specified in this letter of credit; n) Granting of credits, particularly within one group, in absence of any trading or financial relationship, based on relationships which are not consistent with the business or the involved persons; (o) Submission of securities for considerable amounts, particularly not broadly used, accompanied by the request to be liquidated in cash or as a collateral deposits for a loan. 13. Suspicious behaviour of employees: a) An employee living a luxurious life, which is not justified by this employee’s income; b) An employee does not implement (intentionally) the policies and procedures laid down by the financial institution, particularly when the employee is involved in the management of assets for important customers; c) An employee does not prefer to have permission for vacancies; d) An employee discusses /creates approach with customers more than usually.

35 14. Trade in goods: a) Overbilling or under billing of services, by employing different techniques; b) Considerable billing of goods and services; c) Considerable differences between the description of the item in the transport bill and the bill; d) The size of the delivery does not appear in compliance with the degree of the normal activity of exporter or importer's business; e) Type of the commodity being transferred may be of higher value and small volume (for example, precious jewellery), which have high rate of circulation and present difficulty of assessment; f) Type of item transferred seems not in compliance with the normal activity of the business of the exporter or importer; g) The commodity is delivered to or from a country with jurisdiction determined as "with high risk" for the activities related to money laundering; h) The payment means appear not in compliance with the risk-transaction characteristics, for example the pre-payment to the new supplier who is at a "high￾risk" location. 15. Real estate sector: a) The sale of a property versus the payment by using cheques endorsed in favour to one party or third party which does not relate to the selling transaction; b) The sale of a property versus the payment in some cheques issued within one day and in favour of a sole seller (of property); c) The selling of a property versus the payment in cash with origin from the account of a third party, which has no relation with the person determined as purchaser in the selling agreement; d) The selling of a property without implementing the obligatory legal formalities; e) According to the sale agreement, the property seems to have been purchased by the seller recently; f) Real estate transactions at a considerable higher price or considerably lower than the real market value.

36 16. Money laundering through the new methods of payments/electronic products: a) A customer carries out transactions at high value by using a pre-paid card, taking advantage by the possibility of filling the card without the physical presence at the bank, through ATMs, internet banking etc.; b) A customer purchases a considerable number of pre-paid cards issued by the same financial institution; c) Large balances of debit and credit cards are settled in cash, without any information on the source of funds; d) A customer credits his account at large amounts almost exclusively, through an ATM, maybe by denoting the purpose to avoid personal appearance at the financial institution. 17. Suspicious indicators related to legal persons: a) The accounts are opened at a bank by some off-shore corporates, which have the same beneficial owner and complex or unusual funds inflows occur through such accounts; b) Efforts to hide the identity of beneficial owner through the complex structures of the legal persons; c) An account of a legal person receives a credit transfer from another legal person and which are in ownership of the same recipient, by using as supporting document a credit contract, by setting out unusual terms and conditions, for example credit with no interest or not collateralised/unsecured. 18. Suspicious indicators related specifically to leasing and factoring: a) Unexpected settlement and termination of the contractual agreement once the contract has entered into force related to the leasing of vehicles; b) An unexpected settlement of delayed payments for a long period; c) A guarantee is granted by a person that does not have a clear business or personal relation of the lessee/factor; d) The customer refuses to provide additional information on the activity data when requested or during the examination of the file; e) When an off-shore company applied to enter into a leasing relationship and the entity is suspected regarding the beneficial owner; f) The entity encounters an application for the establishment of business relationships at a price considerably higher than the average of market;

37 g) The customer's liabilities are paid by cheques at large amounts, by a third party approved in favour of the customer without and indicator for either a business or family relationship; h) The cases when the customer conducts overbilling or under billing.

38 66ANNEX 2 a) Table of quantitative analysis of risk factors Weighting coefficients of risk67 factor Risk factors Quantitative analysis 0.33 Geographical risk 0.34 Customer risk 0.33 Products risk 1 Result: Quantitative analysis b) Risk68 measuring steps Risk measuring steps Quantitative69 analysis Measures Qualitative analysis Risk level a 0.5 Due diligence Moderated level a + b 0.665 Enhanced due diligence Qualitative analysis High level a+b+c 0.835 Enhanced due diligence Qualitative analysis Review for potential reporting High level C1 1 Enhanced due diligence Qualitative analysis Decision￾taking for potential reporting Reporting at GDPML 66 Amended upon the Supervisory Council decision no.55, dated 28.08.2013 67 Note, these coefficients are considered only for the purposes of illustration. 68 Refer to point “5. Risk measuring steps”. 69 Note: these results are achieved based on the weighting coefficients of risk factors that are used in the table for measuring risk. In any event of using other coefficients, the entity shall build an analysis in compliance with the legal requirements for the categorisation of this issue as a simplified due diligence, due diligence or enhanced due diligence.

c) Matrix of criterion assessment 70 Note EDD=Enhanced due diligence; CDD= Due diligence and simplified due diligence, as; EDD shall be 1, whereas CDD equal to 0.5. Qualitative analysis

Quantitative analysis Variables Risk criterion EDD=1 CDD=0.570 Categories of factor Purpose of opening an account or business relationship Assets level or size of transactions Adjustment level or other control or governance/ management regimes where the customer is subject Duration of business relationships Use of intermediary facilities Source of funds Justifying documentatio n for the transactions Enhanced due diligence Category determined by the institution Due diligence Category determined by the institution Category determined by the institution Category determined by the institution

41 d) Illustrative examples for matrix71 Case I. A resident customer with profession "doctor" has opened an account at X bank. The account has 6 months that is credited each month by EUR 2000 from company “Z”, where the customer is employed. In continuing, upon the customer's request, the institution debits half of funds delivering them to the family.

1. Quantitative analysis Coefficients Assessment of exposure to risk Quantitative analysis 33% Geographical risk 0.5 34% Customer’s risk 0.5 33% Products risk 0.5 100% Result: 0.5 According to the table "Quantitative analysis of risk", we see that the result of qualitative analysis, based on table "Steps of measuring risk", shows that the financial institution should apply the measures stipulated in "a “of table. Case II. We are upon the same conditions as in the first case, but now the customer is of German citizenship, wage EUR 6000, and half of funds are delivered in Germany.
2. Quantitative analysis Weights Assessment of exposure to risk Quantitative risk 33% Geographical risk 0.5 34% Customer’s risk 1 33% Products risk 0.5 100% Result: 0.665 According to the table "Quantitative analysis of risk criteria", we see that the result of qualitative analysis, based on table "Steps of measuring risk", shows that the financial institution should apply the measures stipulated in (“a” + “b”), because the customer is non￾resident. Consequently, quantitative analysis has identified the potential risk originating from non-residents. Based on the table "steps of measuring risk, the institution should apply the qualitative analysis 71 The examples are totally hypothetical for the purposes to illustrate the function of quantitative analysis. In any event, the financial institutions shall conduct a rather more qualitative analysis compared to that mentioned in the guideline.

42 Based on the table “Matrix of criterion assessment”, we judge on the three risk criteria in compliance with their categories and variables. Qualitative analysis Quantitative analysis Variables EDD=1 CDD=0.5 Categories that may drive to the conclusion that a country represents a higher risk The purpose of opening an account or business relationship Assets level or size of transactions Adjustment level or other control or governance/man agement regimes where the client is subject. Duration of business relationships Use of intermediary facilities Source of funds Justifying documentati on for the transactions Geographical risk 0.5 There is no list issued by reliable information sources that Germany bears a high risk Products risk 0.5 Wage account. There are carried out transfers Customer/entity risk 1 Non resident Client is credited the account by the salary. Half of funds is transferred to the family in Germany The account is credited only by the company "Z" for 6000/month High 6 months No Employment in company "Z" Wage income

43 The qualitative analysis shows that the indicators of quantitative analysis have identified a (non-resident) category, that in compliance with legal framework, the institution has analysed at enhanced due diligence. The purpose for opening the account is carried out to credit the wage from company “Z”. The transfer of funds is carried out to the destination completely in line with the international standards. Activity level is in compliance with the client's profile and source of funds. The duration of business relationships is short, but the account activity shows a normal development of transfers in the account. Qualitative analysis shows low materiality. Third case: We are in the same circumstances as in the first case, but now the client is of German citizenship, wage EUR 10 000 and half of funds are delivered to destinations with geographical risk.

1. Quantitative analysis Weights Assessment of exposure to risk Quantitative analysis 0,33 Geographical risk 1 0,34 Customer’s risk 1 0,33 Products risk 0.5 100% Result: 0.835 According to the table "Quantitative analysis of risk criteria", we see that the result of quantitative analysis, based on table "Steps of measuring risk", shows that the financial institution should apply the measures stipulated in (“a” + “b” + “c”), because the customer is non-resident and delivers funds to off-shore destinations. Consequently, the quantitative analysis has identified the potential risk arriving from non-residents and the risk arriving from non-residents and the risk arriving from geographical destinations/jurisdictions which are not collaborative with FATF standards. Based on the table “Steps top measure risk", the institution should apply the qualitative analysis, and to judge on a possible reporting.

44 Qualitative analysis Quantitative analysis Variables EDD=1 CDD=0.5 Categories that may drive to the conclusion that a country represents a higher risk include: Purpose of opening an account or business relationship Assets level or size of transactions Adjustment level or other control regimes or of the governance/management where the client is subject Duration of business relationships Use of intermediary facilities Source of funds Justifying documentation for the transactions Geographical risk 1 The destination is included in FATF list as non￾collaborative jurisdiction The client delivers funds to Equator, a country judged as non￾collaborative Products risk 0.5 Wage account. There are carried out transfers. The transfer bears risk Client/entity risk 1 Non resident The purpose for opening the account is carried out to credit the wage from company “Z” The account is credited by company “Z” for 10000/month. However it is identified that there are many crediting in cash 6 months No The employment in Z for EUR 10000. While it is missed for the other part. Crediting of the account from company “Z” and depositing cash

45 The qualitative analysis shows that the indicators of quantitative analysis have identified a non-resident category and a destination that in compliance with the legal framework, the institution has channelled at enhanced due diligence. The purpose for opening the account is carried out to credit the wage by company “Z”. The transfer of funds is carried out to non-collaborative destination/jurisdiction in line with the international standards. Activity level is not in compliance with the client's profile and the source of funds. Duration of business relationships is short. The account activity shows an unusual occurrence of the transactions in the account compared to the crediting as justified by company “Z”. As a consequence, after the collection of the information and the qualitative analysis and the fact that the responsible person at branch concludes that the client promises that will bring the justifying documentation, but still has not submitted it, the managing structures deem to address the case to the responsive authority.

72ANNEX 3* Table 1. Categorization of Customers The total number of subject’s customers Balance of customer's accounts at the end of the reporting period (in ALL thousand)** Weight (in%) of the number of customers in each category to the total number of customers Weight (in%) of the balance of accounts for each category to the total balance of accounts Categories by risk HIGH RISK CATEGORY Politically Exposed Person (PEP) Non-profit organizations (NPOs) Non-resident companies Non-resident individuals Offshore customers Others, if any MEDIUM- RISK CATEGORY According to the subject’s own categorization LOW- RISK CATEGORY According to the subject’s own categorization Total

• These data should be sent to the Department of Supervision of the Bank of Albania once a year, in electronic form or printed. 72 Added upon the Supervisory Council decision no. 22, dated 5.04.2017.

47 Table 2. Categorization of transfers Total number of transfers Transfers' value (in ALL thousand)** Weight (in%) of the number of transfers in each category to the total number of transfers Weight (in%) of transfers' value in each category to the total number of transfers Transfers (I) OUTGOING TRANSFERS (I.I)+(I.II) (I.I) Domestic

• of which, transfers that belong to high risk category (I.II) Cross-border
• of which, transfers that belong to high risk category (II) INCOMING TRANSFERS (II.I)+(II.II) (II.I) Domestic
• of which, transfers that belong to high risk category (II.II) Cross-border
• of which, transfers that belong to high risk category TOTAL OF TRANSFERS (I)+(II) ** For transactions in foreign currency, the conversion into local currency is carried out at the exchange rate of the last day of the reporting period, on the basis of which the financial statements are prepared.

48 Table 3. Additional data Subject Previous year Reporting year Number of reported SAR The number of cases analysed by the subject, with suspicion of money laundering or terrorism financing (non SAR) The number of cases reported by branches / agents Administrative measures (in value)

73Annex 4* ANTI-MONEY LAUNDERING (AML) / ANTI-TERRORISM FINANCING QUESTIONNAIRE PART 1: INFORMATION ON SUBJECT Subject’s name Chief Executive Officer Responsible person for AML/CFT Responsible structure in branches/subsidiaries for AML/CFT Address Tel/Fax: Web: How many branches/agencies does the subject have?

---

• These data should be sent to the Department of Supervision of the Bank of Albania once a year, in electronic form or printed. 73 Added upon the Supervisory Council decision no. 22, dated 5.04.2017.

50 PART 2: KNOW YOUR CUSTOMER/ ANTI-MONEY LAUNDERING (AML) / ANTI￾TERRORISM FINANCING REQUIREMENTS 2.1 General AML, Practices and Procedures 2.2 Risk Assessment 10. Does the subject have a risk focused assessment of its customer base and transactions? YES NO 11. If you answered YES to question 11, define the risk identified by the assessment. __________________________

1. Are you or any of your employees currently (or during the reporting period) subject to any investigation, indictment, conviction or civil action related to money laundering and financing of terrorism? (The answer can be based on self-declaration forms signed by the employees themselves, as well as on verifications that the subjects may carry out on specific or all cases). YES NO
2. Does the subject meet the FATF recommendations? YES NO
3. Does the subject have branches in any of the countries considered to be "non cooperative" by FATF? YES NO
4. Does the steering council of the subject approve the policies for AML / CFT? YES NO
5. Does the subject have written procedures documenting the processes that they have in place to prevent, detect and report suspicious transactions? YES NO
6. How many controls are performed during the reported period for the assessment of policies / procedures for AML / CFT by:

• The supervisory authorities

---

• The responsible authorities

---

• Internal audit ____

7. Does the subject have policies/procedures that cover relationships with politically exposed persons in accordance with legal/regulatory requirements? YES NO
8. Does the subject have record retention procedures, in accordance with the legislation in force? Yes No
9. Does the subject require that its AML policies and procedures be applied both on branches and subsidiaries in the home country and abroad? YES NO

51 2.3. 74Know your customer, Simplified Due Diligence, Due Diligence and Enhanced Due Diligence 12. Does the subject have policies that prohibit the opening and maintenance of anonymous accounts, (i.e. numbered accounts for which the subject does not know the owner)? YES NO 13. Have the subject implemented systems for the identification of its customers, in the case of account opening/establishing a business relationship (including the name, nationality, address, telephone number, date of birth, number and type of valid official identification, as well as the name of the state that issued it?) YES NO

14. Does the subject have a requirement to collect information regarding its customer's business activities? YES NO
15. Does the subject collect information and assess the policies and procedures of its customers' AML/CFT, of subject and interbank relations? YES NO 2.4 Reportable transactions and detection and prevention of transactions with illegally obtained fund
16. Does the subject have policies for the identification and reporting of transactions that are required to be reported to the authorities? YES NO
17. Does the subject have policies/ procedures, proper infrastructure or controls to prevent or identify structured transactions? YES NO
18. Does the subject screen transactions for customers or transactions the subject deems to be of significantly high risk (which may include persons, entities, or countries that are contained on lists issued by government/international bodies), that special attention to such customers or transactions is necessary prior to completing any such transactions? YES NO
19. Does the subject control its customer database against these updated lists of individuals/ entities, to ensure it does not provide financial services to or conduct business transactions with these individuals/entities for the purpose of detecting unusual activity? YES NO
20. How does the subject control the customer database? - Manually

• Automatically 74 Amended upon the Supervisory Council decision no. 78, dated 18.12.2019.

52 21. Does the subject have policies to reasonably ensure that it will not conduct transactions with or on behalf of shell banks through any of its accounts or products? YES NO 22. Does the subject have policies that assess the correspondent banks regarding the AML/CFT standards? YES NO 23. Is the subject conducting business with political or senior official figures or members of any regime likely to be involved in corruption or other illegal activities? Yes No 2.5 Monitoring 24. Does the subject have a monitoring program for suspicious or unusual activities that cover funds transfers or monetary instruments (such as traveller’s cheques, money transfers, etc.)? YES NO 25. Is implementation of AML/CFT/KYC policies and procedures monitored on a permanent basis? YES NO 2.6 AML training 26. Does the subject provide AML/CFT training to relevant employees that include the identification and reporting of transactions that must be reported to government authorities, examples of different forms of money laundering involving the subject's products and services and internal policies to prevent money laundering? YES NO 27. Does the subject retain records of its training sessions including attendance records and relevant training materials used? YES NO 28. Does the subject have policies to communicate AML/CFT legal/regulatory changes to relevant employees? YES NO 29. Does the subject have agents to carry out some of its functions? If yes, does the subject provide AML training that include the identification and reporting of transactions that must be reported to government authorities, examples of different forms of money laundering involving the subject's products and services and YES NO YES NO

53 internal policies to prevent money laundering? 30. Has the subject carried out control on agents for the implementation of legal/regulatory obligations for AML/CFT? YES NO Documents to be attached with your answer:

1. Copy of the subject' policies/procedures regarding AML/CFT;
2. Copy of the risk assessment of money laundering and terrorism financing carried out by the subject;
3. Summary information on findings, recommendations and measures taken by the internal audit on issues of AML/ CFT, during the reporting period.
4. Summary information for conducted trainings for the responsible structure and the employees included in the process of AML/CFT. I confirm that the above information is current, accurate and reflective of the policies: Know your customer/ Anti-Money Laundering/ Combating financing of terrorism of the subject I represent. Name Telephone number: Position: E-mail: Date: Signature: