Decision on the manner of implementing the measures for prevention of money laundering and financing of terrorism

NATIONAL BANK OF THE REPUBLIC OF NORTH MACEDONIA Pursuant to Article 47 paragraph 1 item 6 of the Law on the National Bank of the Republic of North Macedonia (Official Gazette of the Republic of Macedonia No. 158/10, 123/12, 43/14, 153/15, 6/16 and 83/18 and Official Gazette of the Republic of North Macedonia No. 110/21) and Articles 11 paragraph 7 and 155 paragraph 3 of the Law on Prevention of Money Laundering and Financing of Terrorism (Official Gazette of the Republic of North Macedonia No. 151/22), the National Bank of the Republic of North Macedonia Council has adopted the following DECISION on the manner of implementing the measures for prevention of money laundering and financing of terrorism (Official Gazette of the Republic of North Macedonia No. 212/23) GENERAL PROVISIONS

1. This Decision shall prescribe the manner of implementing the measures
   for prevention of money laundering and financing of terrorism and the manner of performing risk assessment for the entities that are subjected to supervision of the National Bank of the Republic of North Macedonia in conformity with the Law on the Prevention of Money Laundering and Financing of Terrorism (hereinafter referred to as: “the Law on PMLFT”).
2. The entity shall ensure compliance with the measures for prevention of
   money laundering and financing of terrorism in accordance with the Law on PMLFT on a consolidated basis, as well as by its branches and subsidiaries in another country.
3. The provisions of this Decision shall also apply to foreign bank
   branches.
   DEFINITIONS
4. The terms used in this decision shall denote the following:
   4.1. "Risk of money laundering and financing of terrorism" shall denote the
   danger that the entity or a certain business relationship, the execution of a transaction or the use of a certain product or service will be misused for money laundering and financing of terrorism (hereinafter referred to as: MLFT).
   4.2. "Inherent risk of MLFT" shall denote the initial level of risk arising from
   and associated with the type of client and its country of origin, the nature of the business relationship to be established or the occasional transaction to be carried out, the products or services and distribution channels, without taking into account any control mechanisms established in the entity that aim to reduce the probability of risk occurrence and its impact.

4.3. "Aggregate risk of MLFT" shall denote the risk of MLFT after the entity
has applied an adequate system of internal control aimed at reducing the probability and the impact of the level of inherent risk of MLFT.
4.4. “Prevention of MLFT Department" shall denote the organizational unit
that entity shall be required to establish, in accordance with the Law on PMLFT. It can be established by the entity as an independent organizational unit or its activities can be performed within the organizational unit responsible for controlling the compliance of the operations with the regulations.
4.5. “Geographic risk” shall denote the risk arising from the client’s domicile
country or territory or place of residence of the beneficial owner, the country in which the client performs its activity i.e. the country in which the person with whom the client or its beneficial owner performs the transaction is located.
4.6. "Extraterritorial financial center (offshore)" shall denote the country or
territory that provides financial services to non-residents in a scope that is disproportionate to the size and financial power of the national economy.
4.7. "Unusual transaction" shall denote a transaction or activity that does
not correspond to the transactions, operation or professional profile and/or economic profile of the client or the beneficial owner or that has no obvious economic, business or personal motive.
4.8. "Entity" shall denote a bank, savings house, exchange office and
provider of money transfer services (fast money transfer) and other financial institution that provides payment services in accordance with the law, the supervision of which is within the responsibility of the National Bank of the Republic of North Macedonia (hereinafter referred to as: the National Bank) in accordance with the Law on PMLFT.
4.9. "Source of funds" shall denote the origin of the funds included in the
business relationship or occasional transaction, as well as the activities generating income on the account during the business relationship, for example the client's wage, rents, dividend payments, etc.
4.10. "Source of wealth" shall denote the origin of the client's wealth (for
example, inheritance, savings), that is, the entire property available to the client.
4.11. "Reports on the assessment of the risk of money laundering and
financing of terrorism" shall denote the reports that are used to improve the national regulation, determine the shortcomings of the system for prevention of money laundering and financing of terrorism, detecting the sectors or activities with a lower or higher risk, definition of priorities and allocation of resources, as well as assistance to entities in the implementation of their internal risk assessment.
4.12. "Client who is not physically present" shall denote the client, as well as
the person acting on the behalf of and for the account of the client, who are not physically present for identification purposes and if their identity cannot be verified by electronic identification means issued under a registered electronic identification scheme with a high level of security.
4.13. "Risk factors" shall denote factors underlying the assessment of risk of
MLFT at the level of entity, such as type of clients, products/services/transactions, distribution channels and geographical locations.
4.14. “Threats” shall denote the sources of inherent risks of MLFT, by risk
factor at the level of entity.
4.15. "Vulnerability” shall denote quality of internal regulations (policies and
procedures), activities of authorized person/department and of the internal control department at an entity level in order to prevent or reduce the threats of MLFT.
4.16. "Proliferation" shall denote financing of the proliferation of mass
destruction weapons in accordance with the Law on PMLFT.

For everything that is not defined by this Decision, the definitions set forth in the Law on PMLFT shall be applied accordingly. MEASURES FOR PREVENTION OF MONEY LAUNDERING AND FINANCING OF TERRORISM
5. In order to properly implement the measures for prevention of MLFT,
the entity, in accordance with the Law on PMLFT, shall:

• assess the risk of MLFT and ensure its regular updating,
• establish and implement a Program on effective reduction and management
  of the identified risk of MLFT (hereinafter referred to as: the Program on PMLFT”),
• conduct due client diligence, including enhanced due diligence,
• report and deliver data, information and documentation,
• store, protect and record the data,
• appoint an authorized person and their deputy and/or to establish a PMLFT
  Department and
• conduct internal control.
  In addition to the measures under paragraph 1 of this item, banks and money transfer service providers (fast money transfer) and other financial institutions that provide payment services in accordance with the law shall establish and regularly upgrade an information processing data system for implementation of the measures provided for in accordance with the Law on PMLFT. ASSESSMENT OF RISK OF MLFT AT THE LEVEL OF AN ENTITY

6. The entity shall conduct a risk assessment, which is a process through
   which the entity determines the inherent level of risk, vulnerability and total level of risk.
7. In carrying out the risk assessment, the entity shall:

• document the risk assessment and properly keep the data on the basis of
  which it was performed;
• take into account all risk factors before determining the risk level and the
  types of measures that should be implemented in order to mitigate the identified risk;
• update the risk assessment at least once a year, or more frequently in case
  of significant change in the system of managing the MLTF system;
• harmonize it with the reports on the assessment of the risk of MLFT, as
  well as the other acts, documents and information published by the National Bank and the Financial Intelligence Office (hereinafter referred to as: the Office);
• give the National Bank a justification about the conducted risk assessment.

8. When determining the inherent level of risk, the subject the entity shall
   take into account the following risk factors:

• client;
• geographic risk;
• products, services or transactions;
• distribution channels.

9. The entity shall determine the data that it will use for each risk factor,
   taking into account the following sources of data:

• reports on national assessments of the risk of MLFT of the country and
  of other countries and the sectoral assessment of the risk of MLFT prepared by the National Bank;
• instructions, circulars and information issued by the competent
  authorities in the country, as well as imposed corrective measures and misdemeanors, if they are publicly available;
• reports on threats, warnings and typologies and other information
  issued by the Office and other government authorities authorized for criminal prosecution;
• information obtained from due diligence of the client/s;
• own knowledge and professional experience;
• information from the associations or the chambers the entity belongs
  to in relation to typologies and information about the emerging risks;
• information from the reports of the international authorities competent
  for establishing standards for prevention of MLFT or lists of sanctions and
• information from commercial databases.

10. When determining the importance of the risk factors, the entity shall
    provide data on individual elements within each risk factor that need to be analyzed according to the guidelines given in this Decision and Annexes No. 1 and 2 which are an integral part of this Decision, and characteristic for the specified entity. The entity shall determine the risk level by individual element, using the following variables: data on the number and the type of the clients, the number of payment accounts, the stock and the movement of the cash flows on the payment account, the number of transactions, the average transaction value, etc. The entity should stipulate in the internal acts the risk assessment variables by the elements it uses. Тhe level of risk by elements shall be determined on the basis of the variables. The level of risk of each factor shall be determined on the basis of all elements taken into account for certain factors (client, product/service/transaction, distribution channels and geographical locations).
11. The entity shall determine the vulnerability of each element and factor
    at least based on the guidelines encompassed in Annex 1 of this Decision.
12. Based on the identified inherent risk and the degree of vulnerability of
    the entity, the level of aggregate (residual) risk shall be determined.
13. In carrying out the risk assessment, the entity shall include also the
    risk of financing of terrorism and proliferation in accordance with the elements encompassed in Annex 2 of this Decision.
14. The entity shall submit the report on assessment of the risk of MLFT as
    of the end of the year to the National Bank, no later than 30 April of the following year.
15. The entity shall be bound to incorporate the conclusions of the risk
    assessment in the Program on PMLFT and the internal control system.

PROGRAM ON PMLFT
16. The entity shall establish a Program on PMLFT, which shall set forth
the rules, procedures and actions for applying measures aimed at prevention of MLFT, i.e. for reducing and managing the identified risk of MLFT, which shall encompass the following:
 objectives, scope and the manner of operating of the system for prevention of MLFT;  description of the organizational structure for managing the risk of MLFT including data on the authorized person and their deputy;  authorizations and responsibilities of the authorized person and their deputy,  authorizations and responsibilities of all employees of the entity who participate in the implementation of the provisions of the Law on PMLFT and the by￾laws thereof;  description of the measures for client due diligence and client acceptability;  conclusion of the conducted risk assessment and the manner of managing the risk of MLFT;  manner of identification of unusual transactions and doubtful transactions;  procedure of conducting enhanced due diligence measures;  manner of establishing an internal mechanism for timely and appropriate reporting;  client risk profile, transaction risk, product or service risk and business relationship risk;  manner of keeping data and documents and the manner of submitting reports to the Office;  permanent training plan of the employees in the entity and the agent from the AMLFT area;  manner of conducting an internal control of the implementation of the measures for the prevention of money laundering and financing of terrorism in accordance with the size and type of the entity;  monitoring procedures for employment and for employees in order to ensure high standards for preventing money laundering and financing of terrorism;  the procedures for monitoring the sanctions lists of the United Nations and the European Union which shall cover clients, their beneficial owners, transactions, products and services. Entities that have established a separate PMLFT Department should provide elements for an independent audit function.
17. The rules, procedures or actions for the elements under item 16 of this
Decision can be developed as separate documents (internal acts) that shall be an integral part of the Program on PMLFT. CLIENT DUE DILIGENCE
18. The entity shall apply client due diligence in the following cases:
a) upon establishing a business relationship with the client; b) where a transaction in the amount of Euro 15 000 or more in denar counter value according to the middle exchange rate of the National Bank is made, regardless whether the transaction is made in a single operation or in several operations which are obviously linked;

c) where an occasional transaction is made constituting transfer of funds or cashless transfer, including also the virtual assets in the amount higher than Euro 1 000 in denar counter value according to the middle exchange rate of the National Bank of the Republic of North Macedonia; d) when there is doubt about the veracity or adequacy of the previously obtained client identification data or beneficial owner and e) when there is suspicion of money laundering or financing of terrorism, regardless of any exception or amount of funds. When conducting the client due diligence, the entity should take into account the results, i.e. the conclusions of the reports on assessing the risk of MLFT.
19. The client due diligence shall include identification and verification of
the identity of the client, the trustee, i.e. the person acting on behalf of and for the account of the client and the client's beneficial owner, understanding and adequately providing information about the purpose and intent of the business relationship and constantly monitoring the business relationship with the client.
20. The entity shall determine the risk profile of the client when
establishing the business relationship with the client, when performing occasional transactions and when updating the documentation and data for the client.
21. The entity shall prescribe in the internal acts the manner of determining
the client's risk profile, taking into account the risk factors in accordance with Annex 2 of this Decision.
22. When the entity uses means of electronic identification in order to
identify or verify the client and the beneficial owner, the entity should provide documented proof of the performed identification and verification.

23. The entity shall update the documents and data necessary to monitor
    the business relationship with medium-high and high-risk clients at least once a year. The entity shall prescribe, with an internal act, the update frequency of the other clients.

24. In accordance with the identified risk profile, the entity shall implement
    measures to:
     simplified client due diligence;
     standard client due diligence and
     enhanced client due diligence.

25. The entity may apply measures of simplified client due diligence when,
    in accordance with the client risk profile, i.e. the business relationship, the transactions it executes or the products it uses and the reports on the assessment of the risk of money laundering and financing terrorism, a low risk of MLFT are determined.

26. The entity shall apply measures of standard client due diligence in
    instances when for the client, i.e. for the business relationship, the transactions executed or the products used by that client or for the client home country country, no enhanced or simplified due diligence shall be applied according to the Law on PMLFT.

27. The entity shall provide and forward the information about the payer
    and the recipient when performing the transfer of funds, regardless of whether payment transactions are performed in the country or abroad. When performing payment transactions abroad, the entity shall:
     provide the data on the payer and the recipient of the funds regardless of the amount of the transaction;  if the entity is an intermediary, it shall ensure adequate forwarding of the data on the payer and the recipient of the funds at any time, with this data being an integral part of the message for the execution of the transfer. The data under paragraph 1 indent 2 of this item, which the entity must provide and forward to the bank that will pay the funds, shall be as follows:
     name and surname, i.e. title of the payer and title of the beneficiary;  the account number, and if it is missing or cannot be determined, it shall be necessary to determine its unique identification number of the transaction which enables its monitoring. For the transfer of funds in the country or abroad for payment transactions in the amount of Euro 1,000 or more, the entity shall provide and forward data on the address or the number of the national valid identification document or identification number of the client or date and place of birth. The entity shall provide and forward complete and accurate information about the payer and the recipient to the correspondent financial institution. The entity can perform several payment transactions abroad from one payer that shall be grouped in a batch files, if it complies with the requirements for providing and forwarding the necessary data in accordance with paragraph 1 of this item.

28. When performing the transfer of funds, the entity should have
    established internal controls that will prohibit cashless payments if the data on the instructing party or the beneficiary (legal entity or natural person) match in accordance with the regulations on restrictive measures, including Resolutions no. 1267/1989/2253 and 1373/1988 of the United Nations Security Council and all resolutions that will supplement these resolutions in the future. The entity can restrict or terminate the business relationship with other financial institutions that do not provide, that is, do not forward the data provided by the Law on PMLFT and this Decision. The restrictions under this item shall refer to the financial institution that is the instructing party, intermediary or beneficiary of the funds, and the information referring to the payer, that is, the recipient of the funds, should be provided and forwarded.

29. The entity shall prescribe the documentation about the source of funds
    in cash transactions depending on the level of risk of the client. The entity shall consistently apply the restrictive measures when executing cash transactions in accordance with the Law on Restrictive Measures.

30. In addition to the measures for enhanced due diligence of the client
    provided for in Article 39 of the Law on PMLFT, the entity shall take additional

measures when:
 a cross-border correspondence is established with a bank, other financial institution or service provider related to virtual assets;  the client is not physically present for identification and identity confirmation purposes;  the client and/or its beneficial owner is a public office holder when establishing a business relationship and executing transactions;  the business relationship with the client or the transaction involves a high￾risk country and  the client is a non-profit organization that carries a higher risk than the MLFT according to the national risk assessment or according to the risk assessment performed by the entity. Correspondent relationship
31. When the entity establishes cross-border correspondent relations with
other banks, payment institutions, electronic money issuers and virtual assets service providers, when performing enhanced due diligence, besides the requirements under
Article 40 of the Law on PMLFT, it shall take into account at least and the following
elements:
 the country where the correspondent financial institution's head office is located in order to identify the risk of MLFT at the country level;  the group the correspondent financial institution is a member in terms of reputation, if applicable and  the information about the management and ownership structure of the correspondent financial institution, its reputation and the financial activities, products and services it offers. Client who is not physically present
32. When the entity establishes a business relationship with a client who is not
physically present, in addition to the measures provided for in Article 41 of the Law on PMLFT, it shall perform at least one of the following activities:

• verify the client's identity by holding a video conference in real time;
• verify the client's identity on the basis of a document signed by the client
  with a secure digital signature and
• verify the client's identity by using new technological solutions including but
  not limited to biometric technologies (for example, fingerprint or iris scanning, facial recognition, etc.). Public function holders

33. When the entity establishes a business relationship with a client who is a
    public office holder, it shall implement the measures provided for in
    Article 42 of the Law on PMLFT.
    The entity shall establish an identification system for clients who are public office holders and legal entity clients whose beneficial owner is a public office holder.

When identifying clients holding public offices, the entity should establish appropriate control mechanisms in order to include the family members of the client who is public office holder and the person/persons who are considered close associates with that client, in accordance with the Law on PMLFT. Business relationship with a client and transaction which includes high risk country
34. When the entity establishes a business relationship or executes
transaction which includes high-risk country, it shall implement the measures provided for in Article 43 of the Law on PMLFT. Non-profit organizations
35. Entities shall undertake enhanced due diligence measures in relation to
business relationships and transactions with non-profit organizations that have a higher risk according to the national risk assessment or according to the risk assessment by the entity. In addition to the measures provided by Article 44 of the Law on PMLFT, when conducting enhanced due diligence to clients who are non-profit organizations according to the Law on PMLFT, the entity shall take into account at least the following elements:
 the activity, actions and beneficiary owners of the client;  providing additional data on the method of financing (donations/sponsorships transferred from high-risk countries or countries caught up in conflicts or wars), spending of the funds, significant projects in which the client is involved and additional data on the beneficiaries who receive the non-profit organization's funds. If the non-profit organization is required to prepare annual accounts, the entity should provide the annual financial statements or if it was founded for the purpose of realization of a certain project, it should provide information about the specific project and the stage of its implementation. In the internal acts, the entity shall prescribe the criteria, that is, the rules based on which it shall determine presence of a higher risk in non-profit organizations. Entrusting obligation for client due diligence to third party
36. In instances where the entity entrusts the obligation of client due
diligence to a third party, it shall ensure that the third party applies the requirements of the Law on PMLFT regarding the contents and due diligence structure and the keeping of the client data. The entity must not entrust the client due diligence obligation to a third party originating or established in a high-risk country or to a shell bank. The entity may not accept the client due diligence conducted by a third party in the following cases:
 the client due diligence has been conducted by an entity that does not meet the conditions to be a third party in accordance with the provisions of the Law on PMLFT;

 the entity did not receive the necessary information and documents about the due diligence conducted by the third party;  the entity doubts the reliability of the due diligence conducted by the third party. Introduction of new products and/or new technologies developing technologies
37. The entity should determine and evaluate the risk of MLFT that may
arise from the introduction of new products, services, activities or distribution channels, as well as during the introduction of new technologies and developing technologies for the current and new products and services.
38. When determining the risk under item 37 of this Decision, the entities
should take into account at least the following elements:
 whether the service is performed or the product is available without the physical presence of the client;  volume of transactions and distribution channels;  the type of transactions (cash, payment transactions abroad, etc.).
39. The entity should assess the risk of MLFT before the introduction of the
new product or new technology or before making significant changes to the current products and services and take measures to reduce the identified risk. The measures for reducing the identified risk should envisage at least the determining and the setting of limits for the payments that the users made through modern channels (for example: the maximum amount of each payment through modern channels, the total amount of payments within a certain time frame, etc.). REPORTING SYSTEM
40. The reports on the risk of MLFT that the authorized person/department
for PMLFT submits to the entity's authorities should contain at least:
a) information on the risk assessment, specifically:

• the summary conclusions of the last risk assessment;
• data on amendments in internal acts in the area of client due diligence and
  monitoring of transactions;
• statistical data on the client's risk level (number of clients per individual risk
  level, clients under enhanced due diligence, number of identified complex unusual transactions and number of conducted due diligence on these transactions, number of submitted suspicious transaction notifications, number of terminated business relations with clients due to the application of measures for PMLFT, number of requests for information received from the Office and other institutions). b) information about resources, specifically:
   description of the organizational setup and changes in the reporting period;  brief description of the human and technical resources and  information on the conducted supervision over the application of the measures in terms of entrusting these obligations to an external person. c) information about policies and procedures, specifically:

 summary information on the importance of internal acts in the reporting period;  identified deficiencies, findings of the internal audit or external institutions in relation to the internal acts;  description of the control performed by the authorized person/department for the prevention of MLFT in other organizational units of the entity or agents and the control over the adequacy of the PMLFT information system. The entity shall prescribe in the internal acts the type of information under paragraph 1 of this item and the frequency of their submission to the entity's bodies. KEEPING OF DATA
41. The entity shall keep documents or electronic records provided on the
basis of the client due diligence measures, the client file and business correspondence, the results of any due diligence carried out on the client or the beneficial owner in electronic or written form, for 10 (ten) years from the termination of the business relationship with the client or from the date of execution of the occasional transaction. The entity shall keep documents or electronic records for all transactions for 10 (ten) years after their execution, including keeping supporting evidence and records of transactions consisting of original documents or copies that can serve as evidence in court proceedings, which are necessary to determine and enable the reconstruction of individual transactions. APPOINTING AN AUTHORIZED PERSON AND ESTABLISHING A PREVENTION OF MLFI DEPARTMENT
42. The entity shall appoint an authorized person and their deputy, that is,
depending on the number of employees, in accordance with Article 68 of the Law on PMLFT, to establish a prevention of MLFT department.
43. The authorized person/department for the prevention of MLFT shall take
care of the implementation and/or coordination of the activities and processes related to:
 the analysis of the risk of MLFT the entity is exposed to (risk assessment at the level of the subject at least once a year);  implementation of internal acts pertaining to managing the risk of MLTF;  measures to improve internal control systems;  the opinion given during the establishment and continuation of the business relationship with clients for which enhanced due diligence is applied;  follow-up of the amendments in the regulations and international MLFT standards, as well as evaluating the degree of compliance of the internal acts with the regulations that refer to the prevention of MLFT;  regular reporting to the bodies of the entity;  submitting reports on suspicious transactions to the Office;  control over the operation of the individual organizational units in the entity the operations of which may result in a risk of MLFT and  communication with other bodies and institutions included in the activities for prevention from MLFT (the Office, the National Bank, other entities, etc.).

44. The authorized person and other employees in the PMLFT Department
    should have high professional standards and adequate knowledge in the business activity and work processes in the entity that may expose the entity to the risk of MLFT. INTERNAL CONTROL
45. The internal control shall be an integral part of the overall internal control
    system, established at the level of an entity. Entities shall establish a system of internal control proportional to the size and nature of the entity's activity. For the needs of the internal control system in the area of risk management of MLFT, the entity shall provide:
     compliance of operations with regulations, including fulfillment of high professional standards by employees;  procedures and rules for the application of measures to prevent the risk of MLFT;  constant training of employees at the subject and agents;  internal control that will test the functioning of the PMLFT system.
46. The entity that has the obligation to establish a special PMLFT Department,
    should establish an independent audit function to test the entire internal system for prevention of MLFT. The entity under paragraph 1 of this item shall ensure adequate staffing of the organizational unit for internal audit with persons who have adequate knowledge in the prevention of MLFT and to enable their training on all new developments related to international standards and national regulations for the prevention of MLFT. MEASURES FOR PREVENTION OF MLFT TAKEN BY ENTITIES HAVING BRANCHES OR SUBSIDIARIES IN ANOTHER COUNTRY
47. The entity that has a subsidiary or a branch in another country should
    establish and implement group policies and procedures to prevent MLFT, at least in accordance with the requirements under item 5 of this Decision.
48. For each country where it has a branch or subsidiary, the entity should:

• perform assessment of risk of MLFT, include it in the risk assessment
  at the group level, document the assessment, ensure its regular updating and submit it for inspection at the request of the National Bank;
• include the risk assessment under paragraph 1 of this item in the
  policies and procedures for prevention of MLFT of the group;
• obtain approval from the group's senior management for the risk
  assessment and policies and procedures for prevention of MLFT;.
• provide training to employees in the branch or subsidiary for the
  appropriate application of the indicators for determining the risk of MLFT.

49. When the legislation of the other country prohibits or restricts the
    application of policies and procedures that are necessary to properly determine and assess the risk of MLFT arising from a business relationship or occasional transaction

due to restrictions on access to relevant client and beneficial owner data or restrictions about the use of such data for the needs of the client's due diligence process; prohibits or restricts the sharing and processing of client data within the group or prohibits or restricts measures for keeping the data, the entity shall:

• immediately inform the Office and the National Bank with an
  explanation of the prohibition or restriction;
• ensure that the affiliate or subsidiary has determined whether the
  restriction or prohibition can be overcome by securing the consent of clients and, where applicable, the consent of the beneficial owners;
• ensure that the branch or subsidiary has obtained the consent of its
  clients and, where applicable, the consent of the beneficial owners, in order to overcome the restriction or prohibition. If the consent cannot be provided, the entity shall take one or more additional measures provided for in item 52 of this Decision. When it cannot effectively manage the risk of MLFT by applying the measures under paragraphs 1 and 2 of this item, the entity should:
• ensure that the branch or subsidiary terminates the business
  relationship with the client;
• ensure that the branch or subsidiary refuses to carry out the occasional
  transaction;
• cease certain or all business activities of the branch or subsidiary.

50. When the legislation of the other country prohibits or restricts the sharing
    of suspicious transaction data, the entity should:

• immediately inform the Office and the National Bank with an
  explanation of the prohibition or restriction;
• instruct the branch or subsidiary to share data with the entity's senior
  management in order to assess the risk of MLFT associated with the branch or subsidiary's business activities and the impact of that risk on the group. The data under paragraph 1 indent 2 of this item shall refer to:
• the number of suspicious transactions reported in a certain time frame,
  and
• the aggregated statistical data that enable an overview of the
  typologies for identifying the suspiciousness of the transactions. The entity, in addition to the measures under paragraph 1 of this item, shall take one or more additional measures provided for in item 52 of this Decision. When it cannot effectively manage the risk of MLFT by applying the measures under paragraphs 1 and 3 of this item, the entity should terminate some or all business activities of the branch or subsidiary.

51. When the legislation of the other country prohibits or restricts the transfer
    of client data to a branch or subsidiary for the purposes of supervision, the entity should:

• immediately inform the Office and the National Bank with an
  explanation of the prohibition or restriction;

• conduct enhanced due diligence, including on-site supervision or
  independent audits equivalent to the risk of MLFT, to ensure that the branch or subsidiary applies the policies and procedures applicable at group level and appropriately identifies, assesses and manages the risk of MLFT;

• at the request of the Office and the National Bank, to submit them the
  conclusions of the enhanced due diligence under paragraph 1 indent 2 of this item;

• instruct the branch or subsidiary to regularly submit relevant data to
  the entity's senior management.
  The entity, in addition to the measures under paragraph 1 of this item, shall take one or more additional measures provided for in item 52 of this Decision. The data under paragraph 1 indent 4 of this item shall refer at least to the following:

• the number of high-risk clients and summary statistics that allow an
  overview of the reasons why clients are classified as high-risk;

• the number of identified unusual transactions and reported suspicious
  transactions and aggregate statistical data that enable an overview of the typologies for determining the suspiciousness of transactions.

52. In instances under items 49, 50 and 51 of this Decision, the entity shall
    take one or more of the following additional measures:

• limit the nature and type of financial products and services offered by the
  branch or subsidiary in the other country only to those that represent a low level of risk of MLFT and have a low impact on the exposure of the group;
• ensure that other members of the same group do not rely on the due
  diligence measures conducted by the branch or subsidiary from the other country where there are prohibitions or restrictions;
• conduct an enhanced inspection, field control or independent audit, in order
  to ensure that the branch or subsidiary adequately determines, evaluates and manages the risk of MLFT;
• ensure that the branch or subsidiary will secure the consent of the entity's
  senior management for establishing and continuing the business relationship with a high-risk client;
• ensure that the branch or subsidiary determines the source of funds and
  their use within the business relationship or the occasional transaction;
• ensure that the branch or subsidiary implements measures of enhanced
  due diligence and monitoring of the business relationship, to an extent that is sufficient to understand the risk of MLFT related to the business relationship;
• conduct enhanced monitoring on any branch or subsidiary client and where
  applicable, its beneficial owner, for whom a suspicious transaction report has been submitted by any member of the group;
• ensure that the branch or subsidiary will establish efficient systems for
  determining and reporting suspicious transactions;
• ensure that the branch or subsidiary updates the risk profile and client due
  diligence data with the latest data and keeps the data and documentation appropriately for at least the duration of the business relationship. TRANSITIONAL AND CLOSING PROVISIONS

53. With the entering into force of this Decision, the Decision on the
    methodology for managing risk of prevention of money laundering and financing terrorism (Official Gazette of the Republic of Macedonia No. 78/18 and 241/18) shall become void.
54. This Decision shall enter into force on the eighth day from the day of its
    publication in the Official Gazette of the Republic of North Macedonia. I No. 02-32963/4 Governor 5 October 2023 and Chairperson Skopje of the National Bank of the Republic of North Macedonia Council Anita Angelovska Bezhoska