DNB Good Practices Wtt 2018

DNB Good Practices Wtt 2018

DNB Good Practices Wtt 2018  Table of contents 2 Table of contents 1 Introduction 2 Sound and ethical operational management 3 Customer due diligence 4 Documentation 5 Education and training 6 Abbreviations 7 Glossary of terms

DNB Good Practices Wtt 2018  1 Introduction 3 Table of contents 1.1 DNB’s integrity supervision 3 1.2 Background 4 1.3 Good Practices status 4 1.4 Structure of these Good Practices 4 1.5 Future amendments 4 1.6 Status of other DNB policy statements on integrity supervision 5 1.7 Legal framework 5 1 Introduction 1 On 31 May 2024, the European Parliament and the Council published Regulation (EU) 2024/1624 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing (AMLR). The AMLR will largely apply from 10 July 2027. The Dutch Anti￾Money Laundering and Anti-Terrorist Financing Implementing Act was published for consultation on 3 July 2025. It will implement both the AMLR and Directive (EU) 2024/1640 (AMLD6), incorporating the amendments made to the Wtt 2018 under the AMLR. 2 For the definition of trust services, see Section 1 of the Wtt 2018 and the glossary of terms. 1.1 DNB’s integrity supervision De Nederlandsche Bank (DNB) supervises trust offices under the Act on the Supervision of Trust Offices 2018 (Wet toezicht trustkantoren 2018 – Wtt 2018)1 . A trust office is a legal entity, partnership or natural person providing one or more trust services in a professional capacity or on a commercial basis. Examples of common trust services include serving as a legal entity’s director or providing a postal address while rendering other services, such as keeping accounting records.2 Trust offices are gatekeepers of the Dutch financial system and must protect its integrity. Besides trust offices, a wide range of other (financial) institutions have been designated as gatekeepers. DNB and others supervise these institutions under the Anti-Money Laundering and Anti-Terrorist Financing Act (Wet ter voorkoming van witwassen en financieren van terrorisme – Wwft).

 Table of contents DNB Good Practices Wtt 2018  1 Introduction 4 1.2 Background In 2024, DNB published the Q&As and Good Practices on the Wwft for various reasons, including to provide Wwft institutions guidance in applying a risk-based approach to customer due diligence and ongoing monitoring. Trust offices must comply with the Wtt 2018 and the Wwft whenever they provide trust services. The Q&As and Good Practices on the Wwft do not specifically address the obligations imposed on trust offices under the Wtt 2018, which entered into force on 1 January 2019. Over the years – both before and after its entry into force – we released various policy statements related to the Wtt 2018 and the standards it incorporates.3 Following publication of the Q&As and Good Practices on the Wwft (the revised version of the DNB Guideline on the Anti-Money Laundering and Anti-Terrorist Financing Act) and discussions with sector participants, we have decided to publish a dedicated policy statement specifically on the Wtt 2018. 1.3 Good Practices status These good practices set out suggestions or recommendations for trust offices. They are examples of how trust offices can comply with legislative and regulatory requirements that, in our opinion, provide a good interpretation of the obligations arising from laws and regulations. Trust offices are free to adopt another approach, as long as they comply with the relevant laws and regulations, and are able to demonstrate this on reasoned grounds. The Good Practices Wtt 2018 provide trust offices with an up-to-date overview of their obligations under the Wtt 2018, as well as guidance in applying the relevant standards. It does not aim to provide an exhaustive overview of all obligations imposed on trust offices. 3 See, for example, the Fact sheet on the Act on the Supervision of Trust Offices 2018 and the Good practices in transaction monitoring for trust offices. 1.4 Structure of these Good Practices This policy statement consists of descriptions of the legal framework and overviews of relevant national and international policy statements, complemented by examples in the form of good practices. It is structured as follows: Section 2 discusses sound and ethical business operations. Section 3 addresses customer due diligence (CDD). The good practices that deal with customer due diligence assume that a trust office provides trust services a and b as referred to in Section 1 of the Wtt 2018. No good practices are included that pertain to customer due diligence in other types of trust services. Section 4 deals with documenting customer due diligence. Lastly, Section 5 sets out training requirements. 1.5 Future amendments This policy statement is based on currently applicable laws and regulations. The AMLR, although already in force, falls outside its scope, as this regulation is not yet applicable. Likewise, the Anti-Money Laundering and Anti-Terrorist Financing Implementing Act published for consultation at the time of publication of this document falls outside the scope of this policy statement, as it is a legislative proposal that has not yet entered into force. Despite future adjustments to the legal framework, we consider it important to provide trust offices with good practices in line with current laws and regulations. In our view, providing further guidance to sector participants now also helps them prepare carefully for future obligations, strengthening their role as gatekeepers.

 Table of contents DNB Good Practices Wtt 2018  1 Introduction 5 1.6 Status of other DNB policy statements on integrity supervision The Q&As and Good Practices on the Wwft apply to trust offices, with the exception of the provisions that deal with customer due diligence. The systematic integrity risk analysis (SIRA) that trust offices are required to have under Section 10 of the Decree on the Supervision of Trust Offices (Besluit toezicht trustkantoren – Btt 2018) does not form part of this policy statement, as relevant good practices for trust offices are included in the DNB SIRA Good Practices.4 The Sanctions Act 1977 (Sw) is not covered in the Q&As and Good Practices on the Wwft or in the present Good Practices on the Wtt 2018. The section of the former DNB Guideline on the Anti-Money Laundering and Anti-Terrorist Financing Act that deals with the Sw was published unchanged when the Q&As and Good Practices on the Wwft were published.5 The section on the sanctions regulations will be revised in due course when the Sw is updated. This policy statement can be consulted for guidance on sanctions. DNB has also issued a large number of policy statements regarding the Wtt 2018. This new policy statement aims to provide an updated and comprehensive framework, replacing previous policy statements that pertain to the Wtt 2018.6 Besides the Good Practices on the Wtt 2018 and the Q&As and Good Practices on the Wwft, DNB has published other policy statements on 4 The SIRA Good Practices can be accessed via this link. 5 See https://www.dnb.nl/en/sector-information/open-book-supervision/laws-and-eu-regulations/sanctions-act-1977/the-section-on-sanctions-regulations-in-the-former￾dnb-guideline-on-the-anti-money-laundering-and-anti-terrorist-financing-act-and-sanctions-act/. 6 The present Good Practices on the Wtt 2018 replace the Good Practices in transaction monitoring for trust offices, the Good Practices on tax integrity risks for customers of trust offices, the Fact Sheet on the Wtt 2018 (in Dutch), the Fact Sheet on Customer due diligence by trust offices in relation to the report ‘From recovery to balance’ (in Dutch) and the Fact Sheet with additional information for trust offices. Obviously, policy statements issued before the Wtt 2018 entered into force refer to previous laws and regulations. For example, some good practices cited in the Good Practices in transaction monitoring for trust offices have meanwhile been enshrined in current laws and regulations. In such situations, a trust office must obviously comply with applicable laws and regulations. The examples given are still relevant. It is up to a trust office to determine whether a specific policy statement or example applies to it. The Good Practices on the Wtt 2018 do not replace the Policy Rule on socially proper conduct by trust offices (in Dutch). 7 See Supervision of trust Offices. integrity legislation. An overview of all our general and sector-specific policy statements on integrity legislation is available on our Open Book on Supervision web page.7 1.7 Legal framework 1.7.1 Relevant Dutch and international laws and regulations Due to the specific integrity risks inherent in trust services, a dedicated sector regulation was introduced in 2004 – the Supervision of Trust Offices Act (Wtt), superseded by the Wtt 2018. DNB’s supervision of trust offices is based on the Wtt 2018, the Decree on the Supervision of Trust Offices 2018 (Btt 2018) and the Regulation on the Supervision of Trust Offices 2018 (Rtt 2018), as far as trust services are concerned. The Wwft also applies to trust offices pursuant to Section 1a(4), under f, of the Wwft in cases where a trust office provides services governed by the Wwft. Pursuant to Section 3(14) of the Wwft, customer due diligence within the meaning of Section 3(1) of the Wwft is to be understood as the measures prescribed under Chapter 4 of the Wtt 2018. In interpreting and applying the Wtt 2018 and the Wwft, trust offices must also comply with related laws and regulations, in particular, the General Data Protection Regulation (GDPR). For further clarification on obligations arising from those regulations, we refer to the competent authorities (in this case, the Dutch Data Protection Authority).

 Table of contents DNB Good Practices Wtt 2018  1 Introduction 6 1.7.2 Dutch and international policy statements Given the background of the Wtt 2018, the number of relevant international policy statements is limited. The FATF, the global organisation that develops binding standards on combating money laundering and terrorist financing, has published guidance for trust offices. This provides trust offices with tools for conducting adequate analysis of money laundering and terrorist financing risks and preparing an effective risk management framework.8 DNB was involved in the preparation of this guidance. European supervisory authorities, such as the European Banking Authority (EBA), have not published any guidance specifically for trust offices, but the EBA did publish guidance that also applies to trust offices.9 We expect trust offices to comply with this guidance. Furthermore, we expect trust offices to keep abreast of new European laws, regulations and guidance and – where appropriate – take them into account when drafting and applying policies, procedures and measures.10 Regarding the application of the Wwft by trust offices, they should read the Q&As and Good Practices on the Wwft and the present Good Practices on the Wtt 2018 in conjunction with the General Guidance issued by the Ministry of Finance and the Ministry of Justice and Security. 1.7.3 Risk-based approach (difference between Wwft and Wtt 2018) Given the importance we attach to the risk-based approach under the Wwft, we also consider it important to discuss the difference with the system that applies under the Wtt 2018. When introducing the Wtt 2018, due to the inherently high integrity risks associated with the provision of 8 See also https://www.fatf-gafi.org/en/publications/fatfrecommendations/documents/rba-trust-company-service-providers.html. 9 Such as the Guidelines on ML/TF risk factors. 10 Such as communications from the EU Anti-Money Laundering Authority (AMLA). 11 Parliamentary Papers II 2017/2018, 34910, no. 3, p. 9. 12 Parliamentary Papers II 2017/2018, 34910, no. 3, p. 3. 13 See also Q&As and Good Practices on the Wwft, p.7. trust services, the legislator chose to impose specific obligations of result for each aspect of customer due diligence. Best-efforts obligations are imposed only for those aspects of customer due diligence that by their nature cannot produce any results with certainty. By explicitly imposing the various customer due diligence measures in this way, the legislator inten￾ded to further clarify the obligation for trust offices to conduct customer due diligence and promote compliance.11 This means the Wtt 2018 has a different approach to carrying out customer due diligence than the risk-based approach under the Wwft. For example, Section 3(8) of the Wwft, which deals with tailoring the customer due diligence process to the customer’s risk sensitivity, business relationship, product or transaction, does not apply to trust offices pursuant to Section 3(14) of the Wwft. Similarly, simplified customer due diligence under the Wwft does not apply to trust offices. Trust offices cannot reduce the intensity of the measures they take in low-risk cases. This does not alter the fact that trust offices are expected to design their business operations in such a way as to identify and manage integrity risks.12 1.7.4 DNB’s risk-based supervision DNB takes a risk-based approach with regard to its supervision. This approach forms the basis of our supervision, including with regard to trust offices. We deploy our supervisory capacity in areas with the highest integrity risks. The intensity of our supervision increases as the potential materialisation of risks has greater implications for public trust in the sector. Our approach is aligned with the EBA’s guidelines on risk-based supervision.13

DNB Good Practices Wtt 2018  2 Sound and ethical operational management 7 Table of contents 2.1 Introduction 7 2.2 At least two day-to-day policymakers 7 2.3 Compliance and audit functions 8 2.4 Incidents 13 2.5 Risk classification 15 2 Sound and ethical operational management 14 Parliamentary Papers II 2017/2018, 34910, no. 3, p. 42. 15 Parliamentary Papers II 2017/2018, 34910, no. 3, p. 42. 2.1 Introduction This section addresses a number of obligations related to the sound and ethical operational management of a trust office. Section 2.2 considers the requirement for trust offices to have at least two day-to-day policymakers. Section 2.3 deals with the compliance and audit functions. Section 2.4 describes the duty to report incidents. Lastly, section 2.5 discusses risk classification. 2.2 At least two day-to-day policymakers Legal framework Section 11 of the Wtt 2018 requires that at least two natural persons determine the day-to-day policies of a trust office in the Netherlands. These persons must perform these activities from the Netherlands. A trust office must permanently comply with this requirement, which means that if one or more day-to-day policymakers are absent or unable to act, it must promptly arrange for replacement to ensure that at least two are available.14 On request, DNB may, whether or not temporarily, grant exemption from this requirement. The request must demonstrate that the requirement cannot reasonably be met and that the interests the requirement aims to protect are appropriately safeguarded. It follows from the explanatory memorandum to the Act that such exemption may be granted only in exceptional cases such as the death of a director.15 Furthermore, a trust office’s policies must be (co-)determined by persons who are fit and proper. Prior to a person’s appointment as a (co-)policymaker, DNB will establish their fitness and propriety. Similarly, a trust office’s ultimate beneficial owner (UBO) must be fit and proper. If a natural person holds a qualifying holding in the trust office, DNB will also establish their propriety.

 Table of contents DNB Good Practices Wtt 2018  2 Sound and ethical operational management 8 The following laws and regulations are particularly relevant: „ Section 10 of the Wtt 2018 „ Section 11 of the Wtt 2018 „ Sections 4 to 8 of the Btt 2018 The following other policy statements are particularly relevant: „ Our assessment of management and supervisory board members Rationale The two-headed day-to-day management requirement for trust offices is enshrined in law with a view to safeguarding continuity and quality in the conduct of a trust office’s business.16 In addition, having two day-to-day policymakers ensures adequate countervailing power, contributing to the safeguarding of sound and ethical operational management.17 Good practices Good practice: Appointing more than two day-to-day policymakers Having only two day-to-day policymakers may put a trust office at a greater risk of not being able to meet the requirement of having two day-to-day policymakers on a permanent basis. After all, if one of them should decide to leave office, e.g. to join another trust office, take up a position in a different sector, or retire, the trust office will need to appoint a new day-to-day policymaker. The trust office is aware that such a situation does not qualify as an exceptional situation for which the legislator has provided an exemption. To safeguard continuity, the trust office therefore appoints a third day-to-day policymaker. 16 Parliamentary Papers II 2017/2018, 34910, no. 3, p. 7. 17 Parliamentary Papers II 2017/2018, 34910, no. 3, p. 42. 18 Bulletin of Acts, Orders and Decrees 2018, 463, p. 19. Good practice: Taking into account the time needed for fit and proper assessment A trust office has two day-to-day policymakers. One of them announces that she is stepping down. The trust office is aware of the fitness and propriety requirements for a day-to-day policymaker. The trust office submits the assessment application for the new day-to￾day policymaker in a timely manner, taking into account DNB’s consideration period. The trust office also consults with the outgoing day-to-day policymaker about the timing of their departure, so that the requirement of having two day-to-day policymakers is permanently met. 2.3 Compliance and audit functions 2.3.1 Compliance function Legal framework The Wtt 2018 requires a trust office to have a compliance function, which must be performed in an effective and independent manner. Task The Wtt 2018 provides that the compliance function is aimed at monitoring the trust office’s compliance with statutory requirements and internal regulations. The Btt 2018 provides that the compliance function must, on an ongoing and systematic basis, identify, analyse and assess, advise on, monitor and report on the risk of inadequate compliance with the law and the trust office’s procedure manual, policies, procedures and measures.18

 Table of contents DNB Good Practices Wtt 2018  2 Sound and ethical operational management 9 Independence The Btt 2018 provides that the natural persons who perform the compliance function must not be involved in the activities they monitor, i.e. customer￾facing activities. Furthermore, the Btt 2018 provides that the compliance function must also not be performed by natural persons involved in performing the audit function. Lastly, it is important that one policymaker is designated as having executive responsibility for the compliance function. This policymaker must not also have executive responsibility for the audit function. It follows from the Btt 2018 that policymakers must not be directly involved in the activities of the compliance function. It follows from the explanatory memorandum to the Btt 2018 that this is in line with the concept of the compliance function being able to function fully independently.19 Ban on outsourcing compliance function To promote ongoing monitoring of the trust office’s compliance with the law and internal regulations, the Wtt 2018 requires the compliance function to be performed permanently and by the trust office’s own staff.20 Outsourcing the compliance function is not permitted. Sufficient authority, resources, expertise and access to information The Btt 2018 also requires that the organisational unit performing the compliance function has sufficient authority, resources, expertise and access to all the information it needs to perform its function effectively and independently. This means the staff members must have sufficient authority, knowledge and skills to do their work effectively. The training and experience this requires depend on the type of services provided by the trust office and the resulting integrity risks.21 19 Bulletin of Acts, Orders and Decrees 2018, 463, p. 19. 20 Bulletin of Acts, Orders and Decrees 2018, 463, p. 18. 21 Bulletin of Acts, Orders and Decrees 2018, 463, p. 18. 22 For example, see Parliamentary Papers II 2017-2018, 34910, no. 3, p. 7. 23 Bulletin of Acts, Orders and Decrees 2018, 463, p. 19. The Btt 2018 includes a number of further requirements pertaining to the activities and resources of the compliance function to ensure sufficient scope and quality. Some of these requirements are: „ The compliance function must perform a number of activities on a permanent basis to identify deficiencies on the part of the trust office. „ The compliance function must have a risk-based annual work programme in place, describing its working methods. „ In terms of staffing and hours spent, the trust office must take into account the number of customers and the nature of its activities and the associated integrity risks, quantified and substantiated in a written analysis. The following laws and regulations are particularly relevant: „ Section 15(1) of the Wtt 2018 „ Section 16(2) of the Wtt 2018 „ Section 17 of the Btt 2018 „ Section 19 of the Btt 2018 Rationale One of the main objectives of the Wtt 2018 and the Btt 2018 is to promote the further professionalisation of trust offices.22 Part of this is the three￾lines-of-defence model.23 In this model, the compliance function acts as a second line of defence, identifying and reporting deficiencies or defects to the management board, allowing management to adequately addressed them in the first line of defence.

 Table of contents DNB Good Practices Wtt 2018  2 Sound and ethical operational management 10 Good practices Good practice: Work programmes The compliance function of a trust office has established, in accordance with Section 17(3) of the Btt 2018, a risk-based annual work programme tailored to the number of customers, the nature of its activities and the associated integrity risks. For each component listed in Section 17(3) of the Btt 2018 it has specified: „ the activities it will perform and the number of hours it expects to spend „ the period over which these activities will extend „ how the activities will be performed As the work programme is risk-based, the activities to be performed each year depend on the risks identified. Deficiencies flagged by the audit function are addressed – as unforeseen circumstances – in the period immediately after the audit report is issued. There is sufficient scope to adequately address deficiencies that were not known at the time the work programme was drawn up along with ad hoc issues that arise. Good practice: Scope of compliance function and written analysis In its written analysis of the compliance function’s scope, the trust office has substantiated this not only based on the number of customers, the nature of the activities and the resulting integrity risks, but has also tailored it to the activities described in the work programme. The trust office ensures that the compliance function’s scope is sufficient to perform the elements listed in its work programme. Based on the specific responsibilities and activities of the staff members involved, it must be clear that they are effectively part of the compliance function. Good practice: Sufficient authority, resources, expertise and access to all information needed The trust office’s Compliance Charter explains that the compliance function has sufficient authority, resources, expertise and access to all information it needs, and this is also reflected in practice. For example, the compliance function provides the management board with solicited and unsolicited advice, the management board involves the compliance function in its decision-making on a regular basis, and advice set out in compliance reports is demonstrably followed up. The involvement of the compliance function is also reflected in the minutes of management board meetings. In addition to the meetings held to discuss compliance reports, consultations also take place on an ad hoc basis where needed, and these are adequately documented.

 Table of contents DNB Good Practices Wtt 2018  2 Sound and ethical operational management 11 Good practice: Ongoing systematic analysis and reporting The trust office’s policy documents and the compliance function’s work programme describe how the reporting requirement is met, including the frequency and manner of reporting. The compliance function issues compliance reports to the management board at least quarterly, and its findings are discussed in a meeting with the management board. The reports have depth and demonstrate ongoing systematic analysis of data. They include at least: „ a thorough identification, analysis and assessment of risks of inadequate compliance with legislation, the procedures manual, and internal policies and procedures „ a quality assessment of service files, indicating which files were monitored for which integrity risks, whether integrity risks were adequately addressed by the first line and whether relevant statutory provisions and internal regulations were complied with „ advice to the management board on specific risks arising from the customer due diligence carried out by the first line for a service file or overall, e.g. deficiencies in the procedures manual. The reports also describe how previously identified deficiencies were or are being remedied. 24 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 44-45. 25 Bulletin of Acts, Orders and Decrees 2018, 463, p. 19. 2.3.2 Audit function Legal framework The Wtt 2018 provides that trust offices must have an independent audit function. Tasks and activities The main task of the audit function is to monitor compliance with the provisions under or pursuant to the Wtt 2018, the Wwft and the Sw, and to monitor the compliance function. This applies specifically to checking the effectiveness of guidelines, procedures and measures in place to manage the integrity risks identified. Any deficiencies must be reported to the management board, allowing the day-to-day policymakers to make the necessary changes. The audit function’s staffing and resources must be tailored to the trust office’s risk profile.24 A well-equipped audit function must perform an audit at least once annually. This implies that the audit function must have sufficient expertise and access to all the information it needs. Independence The statutory independence requirement implies that persons performing this function must not be involved in the first- and second-line activities they audit. The Btt 2018 additionally requires one policymaker to be designated as having executive responsibility for the audit function. Policymakers must not be directly involved in the audit function’s activities. It follows from the explanatory memorandum to the Btt 2018 that this is in line with the concept of the audit function being able to function fully independently.25

 Table of contents DNB Good Practices Wtt 2018  2 Sound and ethical operational management 12 It follows from the explanatory memorandum to the Btt 2018 that the audit function must preferably be outsourced to ensure that the compliance function is assessed with sufficient criticality and unbiased. If the trust office chooses for the audit function to be performed by its own staff, it must safeguard that the function has the independence and expertise needed to conduct an integrity audit.26 The following laws and regulations are particularly relevant: „ Section 15(2) of the Wtt 2018 „ Section 16(1) of the Wtt 2018 „ Section 18(1) of the Btt 2018 „ Section 18(2) of the Btt 2018 „ Section 19 of the Btt 2018 Good practices Good practice: Audit report and follow-up The audit function of a trust office has performed at least one audit per year, in accordance with Section 18(1) of the Btt 2018, on the basis of a detailed (long-term) audit plan. Based on a robust risk analysis, the plan defines the scope of the audits. The number and scope of audits to be performed are demonstrably tailored to the risk profile of the trust office, with at least one audit carried out annually. Findings are reported directly to the management board, in accordance with Section 19(3) of the Btt 2018. The trust office uses them to tighten its controls. Each year, the audit function determines whether these interventions were sufficient. 26 Bulletin of Acts, Orders and Decrees 2018, 463, p. 17-18. Good practice: Audit report content A trust office has chosen to address the following elements in its audit report: „ the final date on which the report was completed „ a detailed description of the objectives „ a summary of previous audits conducted, stating the dates of the audit(s), their scope, the period(s) covered, a description of the conclusions or opinions, and the names of the auditor(s) „ a detailed description of the audit scope „ a brief description of the audit approach used, the methodology and a substantiation of the sample size „ dates of the audit(s) „ the period covered by the audit „ a description of the conclusions or opinion, including explanatory notes, and an opinion on the effectiveness of:

• the organisational structure
• the operational procedures and measures
• the compliance function „ a description of the audit results, with additional information „ the names of the auditors who conducted the audit „ the names and positions of the persons to whom the report was issued „ a management board response to the findings, including a plan setting a deadline for remedying any deficiencies.

 Table of contents DNB Good Practices Wtt 2018  2 Sound and ethical operational management 13 2.4 Incidents Legal framework The Wtt 2018 requires a trust office to report incidents to DNB without delay. Definition of an incident An incident is defined as behaviour or an event that poses a serious threat to the trust office’s ethical operational management. It follows from the explanatory memorandum to the Act that incidents can relate to a customer or an object company, as well as behaviour of staff members and directors of the trust office or a third party.27 The trust office must carefully consider whether the behaviour or event could potentially impact its ethical operational management. When in doubt whether a specific situation qualifies as an incident, it must be reported.28 Follow-up and documentation of incidents The trust office must take measures to manage risks and prevent recurrence, and must document the incidents and measures. It must ensure that this documentation can be made available to the supervisory authority. The duty to report an incident also applies if the trust office has taken mitigating measures.29 The following laws and regulations are particularly relevant: „ Section 20 of the Wtt 2018 „ Section 16 of the Btt 2018 „ Section 9 of the Rtt 2018 The following other policy statements are particularly relevant: „ Reporting incidents (Dutch) 27 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 46. 28 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 46. 29 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 47. Rationale It is important that wrongdoing in the financial sector is reported and investigated where needed, as this contributes to both an ethical sector and financial stability. Incident reports are a key source of information in DNB’s supervision. Based on incident reports, we can gather information for a specific trust office and check whether its ethical operational management is functioning properly. They also help us gain insight into any sector-wide integrity concerns. Good practices Good practice: Distinguishing between incidents and signals A trust office’s policy distinguishes between signals and incidents. Both are recorded in dedicated internal registers. As soon as an event occurs that potentially qualifies as an incident, the trust office considers whether it qualifies as an incident within the meaning of Section 20 of the Wtt 2018 and that must be reported to the supervisory authority without delay. If not, it qualifies the event as a signal and does not report it to the supervisory authority.

 Table of contents DNB Good Practices Wtt 2018  2 Sound and ethical operational management 14 Good practice: Documentation A trust office maintains a register to record incidents, as well as signals, if there are any. To the extent possible, the register lists the elements that must be reported, as mentioned in Section 9 of the Rtt 2018, such as a description of the incident, measures taken in response, and whether a report was made to FIU-NL. Good practice: Incident report A compliance officer notes that in the integrity risk profile is missing from a service file. Further sampling shows that this is the case for several service files. This means the trust office was unable to fulfil its obligation to carry out continuous monitoring of various object companies for an extended period of time. After seeking advice from the compliance officer, the management board decides to report the incident to DNB and follow the internal procedure for incident handling. Good practice: Clear incident procedures In its procedures, a trust office has clearly described the action to be taken when a staff member encounters an event that potentially qualifies as an incident. Is specifies actions for each person involved in the process, such as a management board member, a compliance officer and a staff member, as well as their responsibilities. Good practice: Joint decision-making In its procedures, a trust office provides that after an event has been reported to the management board or the compliance officer, it is still to be determined whether it qualifies as an incident, also considering the specific circumstances of the case. In accordance with the procedures, the decision whether the event qualifies as an incident is taken by the management board. For decision-making purposes, the compliance officer prepares an opinion, which the management board considers in reaching a decision as to whether the event qualifies as an incident. As such, the management board reaches a well-considered decision together with the compliance function, with the former bearing final responsibility. Regardless of the outcome, the decision is recorded in the appropriate register. Good practice: Investigating wider impact A trust office investigates whether an event that qualifies as an incident has a wider impact on its portfolio. In doing so, it considers the extent to which the event has a knock-on effect or impact on the rest of its portfolio and whether this warrants further action. Good practice: Monitoring controls and investigating following report Incidents must be reported to the supervisory authority without delay, meaning other required actions may not have been taken or completed at the time the report is submitted. These include conducting further investigation into the incident, implementing controls and analysing any knock-on effects. If the incident relates to a customer or object company, the trust office also documents the investigation and controls in the relevant service file. After submitting the report, the trust office keeps DNB informed of progress with regard to its controls and the results of its analysis.

 Table of contents DNB Good Practices Wtt 2018  2 Sound and ethical operational management 15 2.5 Risk classification Legal framework The Btt 2018 provides that for the purpose of ethical operational management, a trust office must have organisational and control structures in place to classify risks related to customers, products or services. The following laws and regulations are particularly relevant: „ Section 14 of the Wtt 2018 „ Section 26 of the Wtt 2018 „ Section 14 of the Btt 2018 Rationale The rules on risk classification aim to promote integrity risk analysis by trust offices.30 Linking a risk profile to customers, products and services helps detect anomalous transactions and manage integrity risks. 30 Bulletin of Acts, Orders and Decrees 2018, 463, p. 29 ff. Good practices Good practice: Risk classification model A trust office uses a (computerised) model on the basis of which it classifies its customers, services and products according to integrity risks, having analysed its integrity risks in the SIRA. It has assessed risks and their manifestations in the model. Using the model, the trust office classifies its customers and object companies into one of its risk profiles, which are: high risk, medium risk and low risk. It has tailored its controls to the risk profile of each customer and object company. High-risk customers and object companies are reviewed at least annually, medium-risk customers and object companies are reviewed at least once every two years, and low-risk customers and object companies are reviewed at least once every three years. Good practice: High-risk customers A trust office provides trust services to a number of object companies with holdings in high-risk countries and sectors. Based on its risk classification model, the trust office classifies the relevant object companies as high risk and takes mitigating measures. The trust office stipulates in its policy that the risk profile remains high despite any mitigating measures taken. The trust office considers it important to (re)assess the object company on a regular basis because of the integrity risks.

DNB Good Practices Wtt 2018  3 Customer due diligence 16 Table of contents 3.1 Introduction 16 3.2 Ban on premature service provision 17 3.3 Ban on service provision involving certain countries 18 3.4 Investigating integrity risks in service provision 19 3.5 Customer due diligence 22 3.6 Customer due diligence in high-risk cases 36 3 Customer due diligence 31 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 8. 3.1 Introduction Trust offices conduct customer due diligence to prevent their services from being abused for purposes such as money laundering, terrorist financing or tax evasion.31 The customer due diligence required of trust offices overlaps in certain respects with customer due diligence required under the Wwft. Additional obligations apply to trust offices under the Wtt 2018 due to the special nature of trust services and the associated higher integrity risks. This is why the investigation performed by a trust office considers not only customers but also object companies. This section looks at some of the obligations with respect to customer due diligence, without pretending to be exhaustive. Also, it only discusses customer due diligence in the case of trust services a and b. First, Section 3.2 discusses the ban on premature service provision. Section 3.3 deals with the ban on service provision involving certain countries. Section 3.4 considers investigation into integrity risk screening, and Section 3.5 sets out the various customer due diligence obligations. Lastly, Section 3.6 describes customer due diligence that must be conducted in case of higher risks.

 Table of contents DNB Good Practices Wtt 2018  3 Customer due diligence 17 3.2 Ban on premature service provision Legal framework The Wtt 2018 prohibits a trust office from entering into a business relationship or providing trust services unless it has first conducted customer due diligence. It follows from the explanatory memorandum to the Act that the trust office or a referring institution must conduct the customer due diligence.32 This must have yielded the result as stipulated in Sections 27 to 30a, 33 and 34 of the Wtt 2018. 33 This must be documented in accordance with the provisions of Section 37 of the Wtt 2018. This means that all data used for the investigation must be documented. The following laws and regulations are particularly relevant: „ Section 23 of the Wtt 2018 „ Section 22 of the Wtt 2018 „ Sections 27 to 30a of the Wtt 2018 „ Section 33 of the Wtt 2018 „ Section 34 of the Wtt 2018 „ Section 37 of the Wtt 2018 Rationale The information gathered through customer due diligence is needed to assess in advance whether there are integrity risks associated with the trust office’s services and whether these risks can be adequately managed.34 32 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 47. 33 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 47. 34 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 48. Good practices Good practice: CDD prior to commencement of services A trust office is approached by a potential customer requesting the provision of trust services a and b. Before the object company is incorporated and registered in the commercial register, the trust office investigates the customer and the object of the company to be incorporated. The trust office establishes that the customer provides too little information about the company’s objects and evades its questions. It sets a further deadline of five business days for the potential customer to provide the missing information, which the potential customer misses. The trust office lacks confidence in the accuracy and completeness of the information and has insufficient information to adequately identify integrity risks. It therefore decides not to accept the potential customer. Good practice: Investigating ownership structure prior to commencement of services A trust office is approached by a customer requesting the provision of trust services a and b to an existing company. The company is part of a complex cross-border ownership structure with entities in several jurisdictions, including several higher integrity risk countries. The trust office investigates the customer and the purpose of the ownership structure, not only relying on data provided by the customer, but also by conducting its own research. The trust office checks for all relevant entities in the structure whether they are subject to a registration requirement. For those that are, it checks whether they are indeed registered. In addition, the trust office considers any additional information about the relevant entities, such as media reports or public judicial information.

 Table of contents DNB Good Practices Wtt 2018  3 Customer due diligence 18 The trust office learns from its research that an entity in the group structure recently faced a criminal conviction. Its SIRA stipulates that it will not accept a customer if a relevant part of its structure has a criminal conviction. The trust office therefore decides not to accept the customer. Good practice: CDD prior to commencement of services and application of own policy A trust office is approached by a customer requesting the provision of trust service b to a company yet to be incorporated in the Netherlands. One of the customer’s staff members will be appointed as a director of this company. The company will use an existing bank account of the customer. The trust office has a policy regarding ongoing monitoring in cases where it provides trust service b for an entity of which it is not itself a director. Under this policy, it wishes to have insight into the bank account on an ongoing basis. It also has a policy on independent external directors who are not employed by the trust office. To mitigate the integrity risk associated with external directors, the policy provides that the trust office itself must be appointed as a director alongside the external director. 35 The European Commission identifies countries with strategic weaknesses in their national laws and regulations that pose a significant threat to the EU’s financial system. These countries are listed in the annex to Delegated Regulation (EU) 2016/1675. See also: https://finance.ec.europa.eu/financial-crime/anti-money-laundering-and￾countering-financing-terrorism-international-level_en. 36 Parliamentary Papers II 2021-2022, 36080, no. 3, p. 4. 37 Parliamentary Papers II 2021-2022, 36080, no. 3, p. 9. 38 Parliamentary Papers II 2021-2022, 36080, no. 3, p. 4. 3.3 Ban on service provision involving certain countries Legal framework Under Section 23a(1) of the Wtt 2018, a trust office is prohibited from providing trust services if customers, object companies, UBOs of customers or UBOs of object companies are resident or domiciled or have their registered offices in the Russian Federation, the Republic of Belarus, states identified as higher-risk states for money laundering or terrorist financing35 by delegated acts of the European Commission pursuant to Article 9 of the Fourth Anti-Money Laundering Directive, or states designated by the Council of the European Union, pursuant to the Council Conclusions on the criteria for and process leading to the establishment of the EU list of non￾cooperative jurisdictions for tax purposes (OJ 2016, C 461), as jurisdictions that are non-cooperative for tax purposes. The ban does not apply under Section 23a(2) of the Wtt 2018 in case the customer, the object company, the UBO of the customer or the UBO of the object company are subject to sanctions regulations.36 Under the sanctions regulations, there are restrictions on the provision of services during the period when the sanctions regulations apply. 37 Freezing measures also apply, meaning the trust office may not part with the customer but must do so within three months as soon as the sanctions regulations cease to apply. 38

 Table of contents DNB Good Practices Wtt 2018  3 Customer due diligence 19 Likewise, the ban does not apply under Section 23a(3) of the Wtt 2018 if the customer or UBO is a natural person who is a national of an EU Member State, a European Economic Area country or Switzerland, or holds a residence permit for one of these states. The following laws and regulations are particularly relevant: „ Section 23a of the Wtt 2018 „ Section 33 of the Wtt 2018 „ Section 34 of the Wtt 2018 Rationale Trust services often involve complex structures, involving the movement of large sums of money between companies. If this involves countries with strategic weaknesses in their anti-money laundering policies, integrity risks accumulate. The combination of trust services and these high-risk countries creates unjustifiably high integrity risks.39 In addition, trust services are typically tax-driven. Trust services combined with structures involving countries on the list of non-cooperative countries for tax purposes leads to an accumulation of tax integrity risks. This is why a ban was introduced.40 39 Parliamentary Papers II 2021-2022, 36080, no. 3, p. 3. 40 Parliamentary Papers II 2021-2022, 36080, no. 3, p. 4. 41 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 51. Good practices Good practice: Keeping abreast of changes to country lists A trust office keeps abreast of the relevant country lists, which are updated from time to time, and monitors any changes. It has set up an automatic news alert so that it is immediately aware of recent and impending changes. Whenever a change occurs, the trust office considers whether it provides any services affected by the ban, taking appropriate action. It documents any action taken. 3.4 Investigating integrity risks in service provision Legal framework The Wtt 2018 requires a trust office to investigate integrity risks in service provision. It follows from the explanatory memorandum to the Act that a trust office must be aware of the purpose of its services to the customer or object company and investigate whether there are integrity risks associated with the provision of trust services. 41 This obligation applies to all trust services provided by a trust office, as all trust services may involve integrity risks. Integrity risk It follows from the definition of integrity risk that a trust office must investigate, among other things, whether its services could be abused for the purpose of violating a statutory requirement. It follows from the explanatory memorandum to the Act that trust offices must prevent becoming involved in facilitating violations of Dutch or foreign laws through their services. This could include abuse of a corporate structure

 Table of contents DNB Good Practices Wtt 2018  3 Customer due diligence 20 for money laundering, or evasion of tax or other obligations in the Netherlands or another jurisdiction. The concept of integrity risks extends to the possible involvement of a trust office in acts contrary to what is required by unwritten law, e.g. using trust services for the sole purpose of anticipating a (national or international) asset freeze. 42 Investigation It also follows from the explanatory memorandum to the Act that investigating integrity risks requires trust offices to obtain sufficient information to prevent their services from being abused. The duty to investigate pursuant to Section 26 of the Wtt 2018 is therefore closely related to the obligations to obtain certain data and information as part of customer due diligence. As a minimum, those data must be considered when investigating integrity risks. They include the trust office’s knowledge of the customer and the purpose of the service provided or requested. This could include the fact that a customer or UBO qualifies as a PEP (see Section 34 of the Wtt 2018). In addition, the trust office must consider the context of the services provided or requested as part of its integrity risk investigation, including relevant characteristics of relevant jurisdictions and the activities of relevant (object) companies. The structure to which the customer or object company belongs can also pose integrity risks. One example of a high-risk structure is a structure in which the identity of the UBO(s) can be changed at short notice without the trust office’s involvement. The trust office must also identify and analyse the underlying transaction to assess the change of UBO(s). Furthermore, structures that separate legal and beneficial ownership have an intended or unintended concealment effect in almost all cases. 42 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 51. 43 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 51. 44 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 52. Ongoing obligation The duty to investigate is not limited to the commencement of a business relationship or the start of trust services. It is an ongoing obligation, meaning that a trust office must investigate the integrity risks of its service provision either when relevant circumstances change or periodically, depending on the integrity risks identified, i.e. the integrity risk profile.43 Adequately addressing risks Pursuant to Section 26(2) of the Wtt 2018, a trust office is also required to ensure that the integrity risks identified are adequately addressed. It can do so itself or third parties can do so, including the customer or the object company. For example, a risk of tax evasion could potentially be addressed by requiring a customer to provide copies of tax returns related or connected to the service. This could enable the trust office to satisfy itself that the trust services are not abused for tax evasion. The Act uses the phrase “adequately address” in recognition of the fact that not all integrity risks can always be eliminated. That said, a trust office is obliged to refuse or terminate a trust service if integrity risks are real or if it is unable to sufficiently satisfy itself that integrity risks have been addressed.44 Comprehensive analysis Section 26(3) of the Wtt 2018 requires that a trust office prepares a comprehensive analysis (customer acceptance memorandum) on the basis of which it decides whether to enter into the business relationship or provide trust services. The analysis must reflect the results of the investigations referred to in Section 26(1) and (2). The customer acceptance memorandum documents in writing how the results of customer due diligence and the investigation of integrity risks are assessed, as well as the extent to which and how identified integrity risks have been addressed. As such, it is a starting point on the basis of which the trust office decides whether or not to proceed with a customer. This may include considera­

 Table of contents DNB Good Practices Wtt 2018  3 Customer due diligence 21 tions not only as to whether the relationship can be entered into in terms of compliance (are the statutory standards being met?), but also whether it is desirable (is it in line with its policy?) and justified to do so, from a moral and ethical perspective. The management board seems best placed to make the latter consideration, reflecting on the desirability of providing services and assessing the results of the various investigations and analyses. If a customer is re-accepted or reviewed, if during service provision incidents occur or material changes are made to the customer’s structure, or if the nature of the services changes, a new customer acceptance memorandum must be prepared and a new decision must be taken regarding continuation of the business relationship or trust services.45 The following laws and regulations are particularly relevant: „ Section 1(1) of the Wtt 2018 „ Section 14(3) of the Wtt 2018 „ Section 26 of the Wtt 2018 „ Section 27(2), under a and k, of the Wtt 2018 „ Section 27(3), under d, of the Wtt 2018 „ Section 27(4), under a, of the Wtt 2018 Rationale The integrity risk investigation provides insight into the risks of trust service provision for the trust office and the Dutch financial system and the extent to which a trust office is able to mitigate these risks. Ongoing integrity risk investigation is important for trust offices to be able to identify, analyse and mitigate risks adequately and on a timely basis. 45 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 52. Good practices Good practice: Purpose of trust service provision and addressing integrity risks A trust office is approached by a customer requesting the provision of trust services to a newly incorporated company in the Netherlands to be added to an existing cross-border structure. The investigation into the structure of which the object company will be part reveals that its incorporation in the Netherlands is tax-driven. The trust office’s policy stipulates that it must check that at least 15% corporate income tax is levied in the case of cross-border structures. It requests the tax returns of the other group entities and analyses them to check whether tax is actually levied and whether this is in line with its tax policy. The trust office documents this investigation. Good practice: Customer acceptance memorandum A trust office has a customer for which it serves multiple object companies. It prepared a customer acceptance memorandum, including the integrity risk profile. This sets out the integrity risks of the object companies, the customer and the structure(s). The trust office made these risks explicit by, among other things, carefully investigating country risks and risks of certain activities and services and by applying relevant scenarios included in the SIRA to these structures, object companies and activities. The customer acceptance memorandum clearly shows that the trust office conducted investigations and clearly documented their outcomes. The memorandum also provides solid substantiation as to why the trust office believes certain identified integrity risks can be addressed. In the memorandum, the trust office refers to supporting documentation showing this. The trust office also explained why this customer was accepted and specified its risk classification.

 Table of contents DNB Good Practices Wtt 2018  3 Customer due diligence 22 3.5 Customer due diligence 3.5.1 Distinction between customer and object company Legal framework The customer due diligence to be conducted by the trust office under Chapter 4 of the Wtt 2018 includes obligations that pertain to the customer, obligations that pertain to the object company and obligations that pertain to both the customer and the object company. For example, see Section 27(4) of the Wtt 2018. Under specific circumstances, the object company may be regarded as a customer but, as reflected in the definition of trust service a, it is also common for a trust office to act as a director of the object company at the instruction of a natural person or another legal entity or company. Therefore, the customer and the object company need not be the same person or legal entity. This distinction is relevant to the due diligence obligations imposed on trust offices. Section 1 of the Wtt 2018 states that the customer is the natural person, legal person or company with which a trust office enters into a business relationship or which instructs a trust office to provide a trust service. The object company is the legal entity or company to which the trust services referred to in items a and b of the definition of a trust service are provided. The following laws and regulations are particularly relevant: „ Section 1 of the Wtt 2018 „ Section 27 of the Wtt 2018 „ Section 3 of the Wwft Good practices Good practice: Distinguishing between customer, object company and UBO(s) A trust office determines whether a customer and object company are the same persons or legal entities, concluding that they are not. The trust office then determines whether the customer is the object company’s UBO, concluding that it is not. The trust office then conducts an investigation to identify the UBO, documenting the investigation and its outcome in the customer acceptance memorandum and explicitly stating the names of the customer, the object company, the customer’s UBO and the object company’s UBO. Good practice: Documenting due diligence in customer acceptance memorandum A trust office enters into a business relationship with X B.V., whose UBO is person Y. The trust office provides services to object company XY B.V. as part of the business relationship. XY B.V. is wholly owned by X B.V. The trust office records in the customer acceptance memorandum that X B.V. is the customer, person Y is its UBO, and XY B.V. The object company also describing its investigations into X B.V., person Y and XY B.V. Given that the customer’s ownership and formal control structure are identical to those of the object company, it documents the due diligence, its efforts and the outcomes once, clarifying that they cover both the object company and the customer.

 Table of contents DNB Good Practices Wtt 2018  3 Customer due diligence 23 3.5.2 Integrity risk profile Legal framework The Wtt 2018 requires a trust office to prepare an integrity risk profile of the object company. Similarly, it requires a trust office to prepare an integrity risk profile of the customer if the customer is not the object company or its UBO. It follows from the explanatory memorandum to the Act that the integrity risk profile must describe circumstances that may affect the integrity risk associated with the object company and/or the customer.46 Examples include the object company’s country of incorporation, the market in which it operates and the nature of its activities. Section 3.4 deals with integrity risks, which are relevant in preparing the integrity risk profile. The following laws and regulations are particularly relevant: „ Section 1 of the Wtt 2018 „ Section 26 of the Wtt 2018 „ Section 27(2), under a, of the Wtt 2018 „ Section 27(4), under a, of the Wtt 2018 The following other policy statements are particularly relevant: „ Q&As and Good Practices on the Wwft „ DNB SIRA Good Practices Rationale Preparing an integrity risk profile of the object company and the customer contributes to the company’s ongoing monitoring during service provision.47 One of the purposes of such monitoring is the timely detection of unusual transactions or transaction patterns and situations that pose an increased integrity risk. Good practices 46 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 53. 47 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 53. Good practice: Integrity risk profiles A trust office has prepared two integrity risk profiles – one for the object company and one for the customer. Using a standard format, it identified the integrity risks that are relevant and common, based on its SIRA. The trust office documented the integrity risk investigation for each integrity risk in a concrete and substantiated manner, considering how each risk might materialise in the case of the object company and customer. It also described any other integrity risks identified in its investigation of the specific customer and object company, assessing these risks in the relevant integrity risk profile. Lastly, the trust office described in the integrity risk profile the controls it implemented to manage the identified risks, describing for each control how it mitigates the specific risk. The integrity risk profile is part of the customer acceptance memorandum. Good practice: Customer integrity risks A trust office provides trust services to a customer operating globally, including in a high-risk country. This customer has multiple object companies. The object company to which the trust office provides the services is a Dutch private limited liability company acting as a holding company. The trust office documents its investigation into the integrity risks associated with the customer in an integrity risk profile. It considers not only the risks associated with the customer, but also those associated with the customer’s direct and indirect holdings. Among other things, the trust office devotes attention to the risk of corruption that is relevant for some of these holdings. The trust office has included mitigating measures in the integrity risk profile, based on which it concludes that the risks can be managed.

 Table of contents DNB Good Practices Wtt 2018  3 Customer due diligence 24 3.5.3 Transaction profile Legal framework Under the Wtt 2018, a trust office must prepare a transaction profile of an object company. It follows from the explanatory memorandum to the Act that a transaction profile of the object company must specify the object company’s expected cash inflows and outflows, including the rights and obligations it enters into in respect of all its relevant activities. Although the transaction profile must be prepared prior to entering into a business relationship or providing a trust service (see also Section 23 of the Wtt 2018), a trust office can already prepare a preliminary transaction profile based on the information gathered about the object company as part of its customer due diligence. To make a meaningful contribution to transaction monitoring to comply with the reporting obligation under Section 16 of the Wwft, an integrity risk profile and a transaction profile must be up to date, complete and specific. For this reason, a trust office will need to update the integrity risk profile and transaction profile on a regular basis throughout the business relationship. This follows from Section 37(3) of the Wtt 2018 and can be done, for example, on the basis of transaction monitoring by the trust office, as well as on the basis of knowledge gained during regular customer contacts or by attending board meetings of the object company. The following laws and regulations are particularly relevant: „ Section 16 of the Wwft „ Section 23 of the Wtt 2018 „ Section 27(2), under b, of the Wtt 2018 „ Section 27(2), under k, of the Wtt 2018 „ Section 27(3), under d, of the Wtt 2018 „ Section 37(3) of the Wtt 2018 The following other policy statement is particularly relevant: „ Section 27(2), under k, of the Wtt 2018 (Section 4.2 Reporting unusual transactions) Rationale A transaction profile can make a valuable contribution to transaction monitoring, provided it is up to date, complete and specific. It assists in complying with the reporting obligation under Section 16 of the Wwft and detecting integrity risks. Good practices Good practice: Distinguishing between recurring and variable inbound and outbound transactions A trust office establishes a transaction profile prior to providing trust services to an object company. The transaction profile distinguishes between expected fixed annually recurring income and expenses and income or expenses that are variable in amount or frequency. Fixed annual income and expenses are substantiated and documented in the service file and monitored on an ongoing basis. Expenses and income that are variable in amounts or frequency are additionally substantiated by regular reviews, analysing the object company’s historical and expected cash flows or transactions. For example, the trust office analyses the history of dividend payments and on that basis makes a substantiated estimate of future dividend payments. It documents this analysis and its substantiation in the service file. This analysis is also used to specify the transaction profile, including a substantiated transaction bandwidth, and to carefully monitor transactions on an ongoing basis.

 Table of contents DNB Good Practices Wtt 2018  3 Customer due diligence 25 Good practice: Using bandwidths Each year, a trust office sets a dividend payment bandwidth in a transaction profile, based on recent data. Based on historical and recent dividend payment data and prospects for the coming year, the trust office sets a bandwidth that is up to date, complete and specific. This means:

1. Up to date: the transaction profile is up to date and is dated. All relevant and recent changes to the profile are made promptly.
2. Complete: the transaction profile specifies all bank account numbers, the names of beneficiaries and authorised representatives and all relevant activities.
3. Specific: the expected items and money flows are described clearly in terms of e.g. amounts, services and frequency. The stated (threshold) amounts are well substantiated and can effectively contribute to detecting unusual transactions and/or transaction patterns. In the service file, the trust office substantiates how it set the bandwidth. 3.5.4 Determining the source of an object company’s assets Legal framework Under the Wtt 2018, a trust office must establish the source of an object company’s assets. It follows from the explanatory memorandum to the Act that to do so, it must first list the object company’s assets in order to be able to subsequently investigate their origins. The investigation covers all of the object company’s assets, rather than just those involved in the trust service. Furthermore, no distinction is made between equity and debt.48 48 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 54. The following laws and regulations are particularly relevant: „ Section 23 of the Wtt 2018 „ Section 27(2), under b, of the Wtt 2018 „ Section 27(2), under c, of the Wtt 2018 „ Section 37(3) of the Wtt 2018 Rationale Investigating the source of the object company’s assets contributes significantly to the analysis of whether trust services are abused. Good practices Good practice: Source of object company’s assets A trust office is asked to provide trust services a and b to an object company in the Netherlands. Before accepting the customer, the trust office investigates both the customer and the object company. Infor￾mation obtained from the customer shows that the object company has been in existence for five years. However, the documentation provided only contains information relating to the past two years, such as annual reports, bank statements and loan documents. This loan is provided by another entity in the object company’s group structure. For the trust office, the various components of the object company’s assets are unclear, and it does not know whether the assets originate from legitimate sources. The trust office asks the customer to provide information from the past five years and specify its capital contribution to the object company upon its incorporation. The trust office needs this to be able to form an opinion on the source and legitimacy of the assets. In addition, the trust office inquires about the terms of the loan, such as the repayment schedule and the interest rate agreed. On this basis, the trust office analyses whether the loan makes sense.

 Table of contents DNB Good Practices Wtt 2018  3 Customer due diligence 26 It does so to verify that there are no structures such as a loan-back loan or a back-to-back loan that could pose high risks related to money laundering.49 The trust office also applies the relevant scenarios from the SIRA to assess whether there is an integrity risk. The trust office then determines the capital contribution to the object company. The trust office also documents the origins of the funds and how the assets have increased or decreased over the past five years. 3.5.5 Determining the asset position of the object company’s UBO and verifying the legitimacy of the source of assets Legal framework The Wtt 2018 requires a trust office to establish the asset position of the object company’s UBO(s). The investigation to be carried out by the trust office for this purpose must cover all of the UBO’s assets, regardless of whether their assets are related to the object company and how they were accumulated.50 The is subject to a best-efforts obligation, meaning that the trust office must determine the asset position with the greatest degree of certainty possible. Accordingly, it must make substantiated estimate the total size and composition of the UBO’s assets. Relevant information may be obtained from the UBO, an intermediaries or public sources.51 In addition, Section 27(2), under e, of the Wtt 2018 requires a trust office to establish that the assets of the UBO(s) originate from legitimate sources. This is also subject to a best-efforts obligation. The trust office must consider how the assets were acquired and ascertain that they do not originate from criminal practices or otherwise pose a risk to sound and ethical operations.52 To establish this, it must ask the customer targeted 49 See Witwassen-wat-is-dat-versie-2018.pdf (amlc.nl): loan-back structure: the criminal makes it appear as if they have legally obtained money in a loan from another party, while they are actually “lending” illicit funds to themselves. A back-to-back loan is a loan secured by another loan issued to the lender. 50 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 54. 51 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 54. 52 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 54. questions and check the information obtained against public sources. The results of the investigation must be documented. The following laws and regulations are particularly relevant: „ Section 1 of the Wtt 2018 „ Section 25 of the Wtt 2018 „ Section 27(2), under d, of the Wtt 2018 „ Section 27(2), under e, of the Wtt 2018 Good practices Good practice: Determining the entire asset position A trust office intends to enter into a business relationship with potential customer. Before entering into the business relationship, the trust office carries out customer due diligence. To establish the UBO’s asset position with the greatest degree of certainty possible, the trust office asks the customer’s representative several questions using a standard template or questionnaire. The trust office’s account manager notices that the customer’s representative limited the information about the UBO’s assets to those related to the customer’s operations, whereas she had previously learned that the UBO possesses an extensive real estate portfolio. For this reason, the trust office explicitly requests additional information – such as certified copies of pay slips, employer’s statements, a sales contract, an extract from the land registry, summaries of equity holdings, wills, annual accounts or tax returns – to establish with the greatest degree of certainty possible the UBO’s entire asset position, including their real estate portfolio.

 Table of contents DNB Good Practices Wtt 2018  3 Customer due diligence 27 After having received this information, the trust office prepares a summary of the UBO’s assets, with references to the supporting documents. The trust office then ascertains the legitimacy of each asset on the basis of the supporting documents. Lastly, based on the various assets, the trust office prepares a substantiated estimate of the total size of the UBO’s assets. Good practice: Assessing legitimacy To ascertain whether the UBO’s assets originate from legitimate sources, the trust office asks the customer specific questions about this. The trust office checks the information obtained against the supporting documents provided by the customer and publicly available information. The trust office has stipulated in its procedures manual that it may also ascertain the legitimacy the assets’ origin on the basis of statements made by reliable third parties, such as registered lawyers, civil-law notaries and chartered accountants, if their statements explain how they ascertained legitimacy. Good practice: Parting with customer after refusal to provide information As part of its periodic review, the trust office investigates the UBO’s asset position and its legitimacy to keep this information up to date. It requests the customer’s representative in writing to provide specific documentation evidencing the asset position. The customer’s represen￾tative fails to provide complete information, even after repeated reminders. In its third and final written reminder to the representative, the trust office reiterates that it cannot continue the relationship with the customer if the required information is not forthcoming. 53 Trust offices must, of course, also comply with the Wwft and the “feedback obligation” set out in that Act. Reference is made to the Q&As and Good Practices on the Wwft. 54 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 54-55. The trust office does not receive the complete information even after this final reminder, after which it decides to part ways with the customer as it cannot establish the UBO’s asset position with the greatest degree of certainty possible. 3.5.6 Establish compliance with registration requirement Legal framework The Wtt 2018 requires a trust office to check whether the object company or other relevant legal entity in the object company’s group is subject to a registration requirement.53 If it is, the trust office checks whether it is indeed registered. In the Netherlands, the relevant register is trade register of the Chamber of Commerce. There are similar registers abroad. Establishing this allows the trust office to ascertain that the authorities are aware of the entity’s existence. It follows from the explanatory memorandum to the Act that this may be a relevant factor in determining the integrity risks related to service provision.54 What qualifies as an “other relevant legal entity” depends on the specific case. It follows from the explanatory memorandum to the Act that, as a minimum, they are: „ all entities that have any direct or indirect formal control in the object company „ all entities directly held by the same shareholder(s) as the object company „ all entities in which the object company has any direct or indirect formal control „ all entities in the object company’s group that are relevant to the object company’s or customer’s risk profile due to the nature of their activities.

 Table of contents DNB Good Practices Wtt 2018  3 Customer due diligence 28 The following laws and regulations are particularly relevant: „ Section 1 of the Wtt 2018 „ Section 27(2), under f, of the Wtt 2018 „ Section 27(3), under f, of the Wtt 2018 Good practices Good practice: Foreign commercial register In order to fulfil its obligation to check the registration of foreign legal entities - which it has identified as relevant parts of the structure - the trust office consults relevant foreign registers comparable to the commercial register. The trust office has defined in its policy which registers abroad are comparable to the Dutch trade register. In preparing its policy, the trust office has used the Dutch Chamber of Commerce’s overview of foreign registers.55 Good practice: Integrity risks The shareholder of an object company administered by a trust office acquires a part of the ownership interest – and therefore control – in several entities in a high-risk country.56 Although these entities carry out different activities from the object company, the trust office considers them to be relevant parts of the structure due to the integrity risks they pose. The trust office therefore also investigates these entities and checks their registration in the relevant trade register. 55 See https://www.kvk.nl/en/about-the-business-register/registers-outside-of-europe/. 56 As referred to in Delegated Regulation (EU) 2016/1675. 57 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 55. 58 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 55. Good practice: Using a tool A trust office uses a reliable online database to check foreign legal entities subject to a registration requirement. Using this database, it checks the registration in the relevant registers of the relevant foreign legal entities identified as relevant parts of the group structure. The trust office documents its investigation in the service file, for example by retaining a digital trade register extract. 3.5.7 Establishing ownership structure and formal control structure Legal framework The Wtt 2018 requires a trust office to establish the object company’s ownership structure and formal control structure. In addition, a trust office must gain insight into the object company’s actual control structure and identify this structure with the greatest degree of certainty possible. If the customer is not the object company or its UBO, then a trust office must also establish the customer’s ownership structure and formal control structure. Furthermore, a trust office must gain insight into the customer’s actual control structure and to identify this structure with the greatest degree of certainty that is reasonably possible. The investigation to be carried out by the trust office for this purpose is closely linked to the investigation into the object company’s UBO.57 When mapping the ownership structure and the formal and actual control structures, the trust office must check that all UBOs of the object company have been identified, their identities verified and the nature and extent of their ultimate beneficial ownership in the object company determined.58

 Table of contents DNB Good Practices Wtt 2018  3 Customer due diligence 29 In addition, a trust office is expected to map the other relevant group structure of an object company so that it has knowledge of the composition of the group to which the object company belongs and has information to substantiate that knowledge.59 To this end, the trust office must have the information regarding the identities of all persons or companies that have formal control in the object company.60 Furthermore, the trust office must know which entities are held by the object company. This includes both entities in which the object company has a shareholding and entities in which the object company has any other type of control.61 Depending on the structure, it may also be necessary to include sister companies of the object company in this investigation. After all, if the trust office serves an object company that is in a group whose entities are engaged in high-risk activities, the trust office must be aware of this and consider it in its investigation of integrity risks related to service provision.62 The following laws and regulations are particularly relevant: „ Section 1 of the Wtt 2018 „ Section 25 of the Wtt 2018 „ Section 27(2), under g, of the Wtt 2018 „ Section 27(2), under h, of the Wtt 2018 „ Section 27(4), under b, of the Wtt 2018 „ Section 1a of the Wwft „ Section 1 of the Wwft The following other policy statements are particularly relevant: „ Q&As and Good Practices on the Wwft 59 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 55. 60 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 55. 61 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 55. 62 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 55. 63 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 55 ff. 64 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 55 ff. Good practices Good practice: Establishing ownership and control structure A trust office, before entering into a business relationship with a potential customer, investigates the ownership and control structure. Documenting its efforts in the service file, it describes how it has investigated the actual control structure, e.g. by requesting not only articles of association and extracts from the trade register, but also possible voting agreements and minutes of board meetings. It has documented the results of its investigation in a clear and unambiguously designed and dated group chart, which also shows the relevant parts of the structure. The chart shows that the trust office confirmed its contents with the customer. 3.5.8 Establishing purpose of the group structure Legal framework The Wtt 2018 requires a trust office to determine the purpose of the group structure of which an object company to which it provides services forms a part. If the purpose of an object company’s group structure is insufficiently clear, there is a risk of abuse of trust services.63 Examples include tax evasion or circumventing sanctions or trade restrictions. The purpose of the group structure may differ from the purpose of the object company. If this is the case, the trust office must investigate this and must be aware of the information the investigation produces. The trust office must make enquiries with the customer and subsequently determine whether the stated purpose of the structure is also its actual purpose.64

 Table of contents DNB Good Practices Wtt 2018  3 Customer due diligence 30 The following laws and regulations are particularly relevant: „ Section 27(2), under i, of the Wtt 2018 Rationale Determining the purpose of the structure helps prevent abuse of trust services.65 A trust office can take appropriate mitigating measures once it has correctly determined the purpose of the structure. Good practices Good practice: Comparing purpose of object company with purpose of group structure While conducting customer due diligence, a trust office asks the customer about the purpose of the object company’s group structure. The customer tells the trust office the object company will be used to develop operational activities in Europe. The customer also clarifies the purpose of the entire structure. The trust office’s services are needed to enter the European market. The trust office further investigates relevant parts of the object company’s group structure. In doing so, the trust office considers the relevant passage in the explanatory memorandum to the Act dealing with “relevant parts”, considering, among other things, customer integrity risk to determine which parts of the group structure it considers relevant.66 Based on its investi￾gation, the trust office concludes that the purpose of the structure differs from that of the object company, as the former seems to be primarily tax-driven. The trust office inquires about this with the customer and at the same time considers whether this purpose matches the trust office’s tax policy. 65 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 54. 66 For clarification of the term “relevant parts”, see Parliamentary Papers II 2017-2018, 34910, no. 3, p. 55. 67 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 54. 68 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 54. 69 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 8. 3.5.9 Source and destination of the object company’s funds Legal framework Section 27(2), under j, of the Wtt 2018 requires a trust office to establish the source and destination of the object company’s funds. It follows from the explanatory memorandum to the Act that such funds must be understood to include, as a minimum, the object company’s incoming and outgoing flows of money and goods.67 The rights and obligations the object company acquires or assumes are also important, because they also carry risks. It is important for a trust office to know the basis of every incoming and outgoing transaction. The obligation to establish the source and destination of the funds is closely related to their obligation to monitor the object company’s business relationship and transactions carried out on an ongoing basis.68 The following laws and regulations are particularly relevant: „ Section 1 of the Wtt 2018 „ Section 27(2), under c, of the Wtt 2018 „ Section 27(2), under e, of the Wtt 2018 „ Section 27(2), under k, of the Wtt 2018 „ Section 1 of the Wwft Rationale Trust offices conduct customer due diligence to prevent their services from being abused, for example, for money laundering or terrorist financing. Investigating the source and destination of funds contributes significantly to this.69

 Table of contents DNB Good Practices Wtt 2018  3 Customer due diligence 31 Good practices Good practice: Investigating a loan A trust office receives a request from a customer to make a loan from one of its object companies to another group entity. Before granting the request, the trust office investigates the rationale for the loan. It also examines the collateral for the loan and any guarantees. In addition, the trust office considers whether sufficient funds are available and – to the extent this was not done before – where they come from and whether their source is legitimate. It documents tits findings. In addition, the trust office examines what the loan will be used for and whether it is logical and matches the group structure, devoting heightened attention to potential integrity risks associated with the object company’s integrity risk profile, as well as the integrity risks associated with loans. For example, the trust office ascertains that the loan agreement does not conceal the true nature of the funds. The trust office also examines whether certain structures are involved that give rise to money laundering risks, such as a loan-back structure or a back-to-back loan70. It documents its findings. 3.5.10 Ongoing monitoring Legal framework The Wtt 2018 requires trust offices to monitor the business relationship and the transactions carried out by the object company on an ongoing basis. Under section 27(3), under d, of the Wtt 2018, this obligation additionally applies in respect of the business relationship the trust office enters into with the customer. 70 A back-to-back loan is a loan secured by another loan issued to the lender. 71 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 56. 72 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 56. 73 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 56. Ongoing monitoring, also known as transaction monitoring, aims to enable the trust office to verify that the transactions carried out are consistent with the integrity risk profile, transaction profile and other knowledge it has of both the object company and the customer.71 A trust office may monitor transactions before their execution (pre-transaction monitoring) or after their execution (post-transaction monitoring).72 The preferred type of monitoring depends, among other things, on the outcome of the investigation into the integrity risks related to trust services and the measures taken to manage these risks. The following laws and regulations are particularly relevant: „ Section 26 of the Wtt 2018 „ Section 27(2), under k, of the Wtt 2018 „ Section 27(3), under d, of the Wtt 2018 „ Section 16 of the Wwft The following other policy statements are particularly relevant: „ Q&As and Good Practices on the Wwft Rationale Ongoing monitoring allows trust offices to identify and address integrity risks in a timely manner. It also enables them to detect and report unusual transactions to FIU-NL.73

 Table of contents DNB Good Practices Wtt 2018  3 Customer due diligence 32 Good practices Good practice: Transaction monitoring form As part of its ongoing monitoring, a trust office has prepared a specific transaction monitoring web form in which it documents its assessment of the transactions carried out. The web form describes and analyses transactions in detail. The trust office has laid out the form very clearly. The form shows that the trust office has ascertained that a transaction is consistent with the trust office’s knowledge of the object company, its integrity risk profile and its transaction profile. The trust office considers all integrity risks in its analysis of the transaction, requests the underlying documents from the customer (such as agreements, but also tax returns), retaining these with the transaction monitoring form. In addition, the trust office monitors the transactions using the transaction profile. The trust office also includes this assessment in its analysis. In summary, the trust office includes the following items in the monitoring form: „ Transaction details (date, volume, counterparty) „ Who assessed the transaction „ What aspects of the transaction were assessed „ Which underlying documents were reviewed „ Whether the transaction qualifies as usual or unusual and whether the transaction does or does not match the customer’s usual transaction patterns „ Whether there has been (substantive) involvement of the compliance officer „ What decision was taken and on what grounds The transaction monitoring form (incl. supporting documents) is part of the service file. The data in the service file is easily accessible to a third party. 74 This does not alter the fact that trust offices must comply with the Sw and the Regulation on Supervision pursuant to the Sanctions Act 1977 (Regeling toezicht Sanctiewet 1977). Good practice: Distinguishing between pre-transaction and post-transaction monitoring A trust office has set out in its policy how it has structured its ongoing monitoring process. As a rule, it carries out pre-transaction monitoring, i.e. it reviews transactions before the agreement is signed or the transaction is executed. Only for a specific category of low-risk customers which it has defined does it carry out post-transaction monitoring. For these object companies and customers, the trust office monitors transactions retrospectively.74 The trust office has made clear, written agreements with the relevant customers about this, which depend on the transaction. This means for specific transactions, the trust office must always be informed about the transaction in advance and be provided with transaction documents in advance, even though it is allowed to monitor them afterwards. For transactions involving limited risks, the trust office need not be informed in advance, and it carries out only post-event monitoring. The trust office has set out in its policy how post-event monitoring is carried out. If it periodically requests bank statements, it has documented how it checks the transactions listed. Good practice: Reviewing previous and related transactions after detecting an unusual transaction A trust office has included in its policy that when it detects an unusual transaction, it reassesses the object company’s and/or customer’s previous and related transactions. This allows the trust office to gain insight into possible unusual transaction patterns. After the trust office has detected and reported an unusual transaction, it reviews the object company’s and customer’s integrity and transaction profiles where needed.

 Table of contents DNB Good Practices Wtt 2018  3 Customer due diligence 33 Good practice: Securitisation structure A trust office is approached by a customer requesting the provision of trust services to a special purpose vehicle (SPV) that is a Dutch private limited liability company.75 The SPV is part of a securitisation structure set up for a customer operating in the textile sector in Europe, the Middle East and Asia. The SPV’s shares are held by a foundation. The trust office acts as the board of the SPV and the foundation. Neither the SPV nor the foundation are part of the customer’s ownership and control structure. The trust office has a full overview of the structure, including all parties involved, such as the originator, the administrator, the trustee, the trust agent, the lenders, and the auditor and (legal) advisers involved. In addition, the trust office has prepared an integrity risk profile that incorporates all integrity risks. For this purpose, the trust office particularly takes into account (i) all involved (third) parties in the structure, (ii) the sector and/or jurisdiction for which the securitisation structure is set up and (iii) all transactions related to the structure. Furthermore, regardless of the form of the securitisation, the availability of a bank account or rights of inspection of a bank account, the trust office has prepared a sufficiently clear and specific transaction profile. As a minimum, in the object company’s transaction profile, the trust office has registered all expected inbound and outbound transactions, including dates, frequencies, threshold amounts and counterparties. The transaction profile includes all monetary and non-monetary transactions. Non-monetary transactions could include all other legal transactions related, for example, to the transfer of securities such as bonds and shares. 75 Securitisations involve the bundling of loans extended to households and businesses, which are then repackaged and sold as bonds through dedicated securitisation firms. See also: https://www.dnb.nl/en/general-news/statistical-news/2022/value-of-outstanding-dutch-securitisations-below-that-of-covered-bonds-for-the-first-time/. Lastly, the trust office carries out adequate ongoing monitoring in respect of all transactions based on the integrity risk profile and transaction profile it has prepared. Good practice: Integrity risk assessment A trust office has a long-standing customer relationship with a European company in the pharmaceutical industry. It has classified the object company to which it provides trust services in the ‘medium’ risk category. According to the trust’s policy, it reviews the file once every two years. The trust office carries out pre-transaction monitoring. The company informs the trust office’s account manager that it wishes to obtain a loan through the object company to develop a specific product. The company sends the transaction documents to the trust office. As part of ongoing monitoring, the trust office determines that entering into the transaction matches the object company’s transaction profile. Its review of the transaction documents reveals which drug will be developed. The trust office notes that there has been recent negative media coverage of a similar product and asks the customer questions about this before signing the transaction documents. Based on the customer’s answers and following its own further investigation, the trust office concludes that the measures cited by the customer have a sufficient mitigating impact. The trust office changes the object company’s risk category from ‘medium’ to ‘high’ to allow it to monitor the business relationship with the customer more closely.

 Table of contents DNB Good Practices Wtt 2018  3 Customer due diligence 34 3.5.11 Identifying the ultimate beneficial owner of the customer and the object company Legal framework Section 25 of the Wtt 2018 requires a trust office to identify all UBO(s) with the greatest degree of certainty possible, verify their identities, and verify the nature and extent of the UBOs’ ultimate beneficial ownership.76 Section 27 sets out this obligation in more detail. Section 27(3), under b, of the Wtt 2018 requires a trust office to identify the customer’s UBO(s). Section 27(4), under c, of the Wtt 2018 additionally requires a trust office – where appropriate – to also identify the UBO(s) of the object companies. The following laws and regulations are particularly relevant: „ Section 1 of the Wtt 2018 „ Section 25 of the Wtt 2018 „ Section 27(3), under b, of the Wtt 2018 „ Section 27(4), under c, of the Wtt 2018 The following other policy statements are particularly relevant: „ Q&As and Good Practices on the Wwft Good practices Good practice: Actual control A trust office determines that a natural person has no formal position in the organisation, but exercises influence. For example, the natural person has the power to block important decisions, such as financial decisions. 76 Pursuant to the Wwft, when entering into a new business relationship, a trust office is also obliged to consult the trade register (which includes the UBO register) to determine whether the customer’s UBOs are registered. With regard to this obligation, and the related “feedback obligation” under the Wwft applicable to trust offices, reference is made to the Q&As and Good Practices on the Wwft. The trust office infers this from the voting agreement, board minutes of the object company, and other sources. For this reason, it designates the natural person as a UBO in the service file. Good practice: Complex structure An object company has a complex, tiered structure. Some entities in the ownership and control structure are located in high-risk jurisdictions. The trust office takes reasonable measures to map the customer’s ownership structure (using trade register extracts, UBO register extracts (where possible) and additional sources) and identifies three individuals with more than 25% indirect formal control as UBOs. It then verifies the identity of these UBOs through certified copies of identity documents. It documents its findings (the sources, analysis and conclusions) in the service file. Good practice: Identifying a UBO A trust office intends to provide trust services to an object company yet to be incorporated for a new customer. The customer is not the object company or its UBO. As part of customer due diligence, the trust office establishes the customer’s ownership and formal control structure. It also gains insight into the actual control structure. The trust office concludes that there are five different natural persons with varying ownership interests between 4% and 12%. Arguing that none of these persons qualify as a UBO of the customer on the basis of ownership or (actual) control, it identifies the senior executives, who are the customer’s two statutory directors, as pseudo-UBOs.

 Table of contents DNB Good Practices Wtt 2018  3 Customer due diligence 35 3.5.12 Establishing purpose and intended nature of business relationship in relation to customers Legal framework The Wtt 2018 requires a trust office to establish, in relation to the customer, the purpose and intended nature of the business relationship. The following laws and regulations are particularly relevant: „ Section 1 of the Wtt 2018 „ Section 27(3), under c, of the Wtt 2018 „ Section 1 of the Wwft The following other policy statements are particularly relevant: „ Q&As and Good Practices on the Wwft Good practices Good practice: Investigating purpose and intended nature of business relationship in relation to customer A trust office is approached by a customer requesting the provision of trust services to various entities in the Netherlands These entities are part of a large international structure of interconnected entities. One of the Dutch entities acts as the parent company for Dutch tax purposes and thus also as head of the fiscal unity. The customer told the trust office that it had opted for the Netherlands because of its logistical benefits and high degree of knowledge and expertise. The trust office then investigates whether the customer also has a tax motive by, for example, requesting corporate income tax returns from all entities and checking these against the trust office’s tax policy. The trust office concludes that there is also a tax motive and considers that potential integrity risks, such as tax avoidance/evasion, could arise in the structure. It documents both the investigation and its findings. 3.5.13 Establishing and verifying the representative’s identity and authorisation Legal framework The Wtt 2018 provides that customer due diligence enables a trust office to determine whether the natural person representing the customer is authorised to do so. The following laws and regulations are particularly relevant: „ Section 27(3), under e, of the Wtt 2018 Good practices Good practice: Power of representation A trust office enters into a business relationship with a large South Asian company. Ms X is one of the company’s directors and has signed a service agreement with the trust office on its behalf. Mr Y will liaise with the trust office on behalf of the company and instruct the trust office. In the service agreement, the trust office stipulates that Ms X is a director of the Indian company and that Mr Y is authorised to instruct the trust office. The trust office verifies the identities of both Ms X and Mr Y through authenticated copies of their passports. It also requests the company’s articles of association and consults the trade register to verify that Ms X is authorised to represent the company. The trust office documents the outcome of its investigation, retaining the supporting documents.

 Table of contents DNB Good Practices Wtt 2018  3 Customer due diligence 36 3.5.14 Verifying whether a customer is acting on its own behalf Legal framework The Wtt 2018 requires a trust office to verify whether a customer is acting on its own behalf or on behalf of a third party. If it is clear that a customer is acting on behalf of another person, the other person also qualifies as a customer, meaning that the customer due diligence obligations arising from the Wtt 2018 also apply to this person. The following laws and regulations are particularly relevant: „ Section 1 of the Wtt 2018 „ Section 27(3), under f, of the Wtt 2018 „ Section 1 of the Wwft The following other policy statement is particularly relevant: „ Q&As and Good Practices on the Wwft Rationale It is important for trust offices to verify whether the customer is acting on its own behalf to prevent its services from being abused by criminal third parties. Good practices Good practice: Straw man risk A trust office has established indicators that point to a straw man risk: a concealment scheme in which a person pretends to act on their own behalf but in fact acts on behalf of another party. It uses these indicators in its customer due diligence. Examples of indicators include instances where a person is unable to answer certain questions, for example about the source of funds, or where someone give vague and unclear reasons for a transaction. 77 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 61. If the trust office suspects that the customer is a straw man for a third party, this is treated as an unacceptable risk. The trust office also reports the customer to FIU-NL. In the customer acceptance memorandum it describes both the investigation and its findings. 3.6 Customer due diligence in high-risk cases 3.6.1 Enhanced customer due diligence Legal framework The Wtt 2018 requires enhanced customer due diligence in some cases, e.g. when a PEP is involved. Section 33 of the Wtt 2018 aligns with the articles of the fourth anti-money laundering directive and the Wwft that deal with enhanced customer due diligence. A trust office is required to make a risk assessment before providing its services.77 The trust office identifies in the risk assessment whether there is a higher risk related to the business relationships or trust services that by their nature represent a higher risk. Annex III of the fourth anti-money laundering directive lists risk factors that the trust office takes into account. The following laws and regulations are particularly relevant: „ Section 1 of the Wtt 2018 „ Section 33 of the Wtt 2018 „ Section 34 of the Wtt 2018 „ Section 1 of the Wwft „ Section 8 of the Wwft „ Section 9 of the Wwft The following other policy statements are particularly relevant: „ Q&As and Good Practices on the Wwft

 Table of contents DNB Good Practices Wtt 2018  3 Customer due diligence 37 Good practices Good practice: Reviewing service files A trust office has established in its policy that it annually reviews service files with higher integrity risk. It also performs unscheduled reviews after an incident has occurred 3.6.2 Politically exposed persons Legal framework Section 34(1) of the Wtt 2018 requires a trust office to determine, through appropriate risk management systems, whether the customer, its UBO or the object company’s UBO is a PEP. 78 A PEP is a national person who holds or has held a prominent public position. The Wtt 2018 uses the same definition of politically exposed person as the Wwft. The Wwft Implementation Decree includes a non-exhaustive list of prominent public positions. The Tax and Customs Administration has published a list of prominent public positions in the Netherlands.79 The law sets no further requirements out as to how a PEP should be identified. A trust office must rely primarily on the information it obtains from customer due diligence, but may also consult public sources or request information. “Appropriate risk management systems” are expected to be based on several information sources.80 78 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 61. 79 See also: https://www.belastingdienst.nl/wps/wcm/connect/bldcontentnl/themaoverstijgend/brochures_en_publicaties/wwft-prominente-publieke￾functies (available in Dutch). In addition, the European Commission has published a list of prominent public positions at the national level of each member state, at the level of international organisations and at the level of Union institutions and bodies. See https://eur-lex.europa.eu/legal-content/ AUTO/?uri=CELEX:52023XC00724&qid=1756031159416&rid=2. 80 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 61. 81 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 62. 82 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 62. A trust office must take measures if the customer, its UBO or the object company’s UBO is a PEP. Before entering into a business relationship involving a PEP, a trust office must obtain approval from a person who determines day-to-day policy. Moreover, a business relationship with a PEP must be subject to close scrutiny and intensive transaction monitoring on an ongoing basis. That means that the intensity of this ongoing monitoring is enhanced.81 If the customer or UBO no longer holds a prominent public position, the trust office must apply appropriate risk-based measures. It must do this for as long as necessary until the person in question no longer poses a higher risk due to their former PEP status, but at least for 12 months. It follows from the explanatory memorandum to the Act that potential risk factors that could be considered in this respect are the type of position previously held by the person in question, and the extent of the influence that the person could exercise after holding the politically prominent position.82 If an existing customer or UBO becomes or is found to be a PEP, the trust office must take the additional measures without delay as soon as this becomes apparent. The following laws and regulations are particularly relevant: „ Section 33 of the Wtt 2018 „ Section 34 of the Wtt 2018 „ Section 1 of the Wwft „ Section 2 of the Wwft Implementation Decree

 Table of contents DNB Good Practices Wtt 2018  3 Customer due diligence 38 The following other policy statements are particularly relevant: „ Q&As and Good Practices on the Wwft „ EBA ML/TF Risk Factors Guidelines „ FATF Recommendations 12 and 22 Rationale Because of the potential corruption risks (and the attendant money laundering and reputation risks) associated with PEPs, the Wtt 2018 requires institutions to pay special attention to these individuals. It is important for a trust office to know whether it is dealing with a PEP, as this enables it to identify and manage the risks more effectively. Good practices Good practice: Additional risk management measures A trust office takes additional risk management measures, such as asking additional questions, setting limits on transaction amounts and explicitly pre-assessing transactions the PEP wishes to execute. It independently assesses in which cases the risk is still manageable and acceptable. If this is no longer the case, it terminates, refuses or limits its services. In all cases, it is important to properly document the consideration(s) a trust office makes and the additional management measures it takes. 83 It is common for countries to publish lists of names of PEPs as well as lists of positions that are considered to warrant PEP status. See also FATF (2013), FATF Guidance. Politically Exposed Persons (Recommendations 12 and 22), Chapter 5, under E, “Government-Issued PEP Lists”. In addition, the European Commission publishes its own list of PEP positions in EU Member States, and at EU institutions and international organisations. Good practice – PEP screening A trust office has a policy on PEP screening under which it assesses, both at customer acceptance and on an ongoing basis, whether the customer, its UBOs or the object company’s UBOs qualify as PEPs. The assessment includes: „ Screening against general and “local” PEP lists, including lists of relevant positions. These lists are audited periodically.83 „ Internet research on customers and prospects with a public position (e.g. using the local trade register) to determine whether the public position should be classified as a prominent public position with the associated higher corruption and reputation risks. „ Using a targeted questionnaire during customer due diligence to determine, among other things, whether there is a family member or close relative to whom the PEP rules apply mutatis mutandis. „ Carrying out a PEP check combined with other ongoing screenings, including monitoring for any negative media coverage. If a customer, its UBO or the object company’s UBO qualifies as a PEP, the trust office will first assess the risk level. The trust office then takes mandatory and appropriate measures for the PEP, subjecting them to enhanced monitoring on an ongoing basis. Good practice: Compliance function A trust office’s compliance function has an advisory role when a customer involves a PEP. It has the resources and position to operate independently so that it can properly carry out its advisory role. The compliance function is actively involved in acceptance of customers involving a PEP and in assessing the risks the trust office could face if it accepts the customer. The compliance function’s advice on the risks plays an important role day-to-day policy on the relationship.

 Table of contents DNB Good Practices Wtt 2018  3 Customer due diligence 39 Good practice: Enhanced customer due diligence Because a PEP inherently poses a higher risk, a trust office focuses specifically on these risks. The intensity of enhanced customer due diligence into the source of funds and assets depends on the risks.

DNB Good Practices Wtt 2018  4 Documentation 40 Table of contents 4.1 Introduction 40 4.2 Documenting customer due diligence and the service file 40 4 Documentation 84 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 63. 85 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 63. 4.1 Introduction This section deals with documentation by trust offices. The Wtt 2018 includes obligations regarding the documentation of data in a service file. 4.2 Documenting customer due diligence and the service file Legal framework Section 37 of the Wtt 2018 requires a trust office to document the data used to comply with its customer due diligence obligations. It covers both the information and data obtained from customer due diligence and the measures taken by the trust office to obtain it. This information is particularly important with regard to those elements of customer due diligence that are subject to a best-efforts obligation.84 This information must be included in a service file pursuant to Section 39 of the Wtt 2018. A trust office must have a service file for each customer. In addition to the data used to comply with customer due diligence obligations, the service file must include the agreements between the trust office, the customer and the object company, as well as the customer acceptance memorandum and information about the trust services.85 Service files must be permanently available at a trust office and must be retained for at least five years after the termination of the business relationship or provision of the trust service. Section 37 of the Wtt 2018 provides that the data used or obtained in customer due diligence must be documented and kept up to date, meaning a trust office must periodically check and update the data obtained. The retention period of a service file is five years after the termination of the business relationship or provision of the trust service.

 Table of contents DNB Good Practices Wtt 2018  4 Documentation 41 The following laws and regulations are particularly relevant: „ Section 37 of the Wtt 2018 „ Section 39 of the Wtt 2018 „ Section 1 of the Wwft „ Section 16 of the Wwft „ Section 33 of the Wwft „ Section 2 of the Wwft Implementation Decree The following other policy statements are particularly relevant: „ Q&As and Good Practices on the Wwft Rationale The documentation of customer due diligence contributes significantly to a trust office’s risk assessment in relation to the intended service provision.86 Adequate documentation in the form of a service file is important for the ongoing monitoring of an object company’s transactions and for verifying that they match the information known about the customer and the trust services. This also makes the service file relevant for detecting and reporting unusual transactions under Section 16 of the Wwft. Adequate documentation is important not only for the trust office itself, but also because it enables a compliance officer or auditor to quickly take cognisance of the trust service provided to a customer, the associated integrity risks and the manner in which the trust office complies with the obligations set out in the relevant legislation.87 It allows the trust office to comply with its statutory obligations, including the requirement of sound and ethical operational management. 86 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 63. 87 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 64. Good practices Good practice: service file on object company A trust office provides trust services to multiple object companies for a single customer. In addition to an up-to-date service file on the customer, the trust office has up-to-date service files for each individual object company. It has documented the required data in an orderly manner in its service files. Service files are structured in an insightful, understandable and verifiable manner. The trust office has structured the files according to the statutory requirements, describing, with regard to the results of the customer due diligence, for each standard, what investigation was carried out, what documents were used – with verifiable links to the supporting data – and what the outcome of the investigation was. The outcome of the investigation is as set out in the customer acceptance memorandum. Good practice: Using applications and documenting information A trust office uses an application or digital system for carrying out customer due diligence in which it also documents the results for each customer and object company, as well as the data it has used. The application is set up so that a complete, insightful, comprehensible and verifiable file can be printed out on each customer, thus meeting the statutory requirement to have a service file. The trust office has also ensured that the other required information is included in the service file. This also allows the trust office to share the file both internally and externally, e.g. with the auditor or supervisory authority.

 Table of contents DNB Good Practices Wtt 2018  4 Documentation 42 Good practice: Linking different applications/systems A trust office stores the information and documents from a customer’s service file in different applications or digital systems. It has organised the applications such that the information can be linked and it forms a single service file. In addition, the trust office is able to submit it as a single file to the supervisory authority or an external auditor, allowing them to verify that the trust office has carried out customer due diligence and that it had the outcome prescribed by law. Good practice: Weighing up interests In addition to the obligations of the Wtt 2018, a trust office’s policy on the collection and retention of data and documents takes sufficient account of other interests, in particular the importance of privacy.

DNB Good Practices Wtt 2018  5 Education and training 43 Table of contents 5.1 Introduction 43 5.2 Training requirements 43 5 Education and training 88 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 81. 89 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 81. 90 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 81. 91 Parliamentary Papers II 2017-2018, 34910, no. 3, p. 81. 5.1 Introduction This section discusses the training and screening of employees and day-to-day policymakers of trust offices. 5.2 Training requirements Legal framework Section 67 of the Wtt 2018 requires trust offices to ensure that all persons performing work for the trust office are sufficiently trained to be able to comply with the requirements of the law, e.g. carrying out customer due diligence. It follows from the explanatory memorandum to the Act that the training requirement applies regardless of whether the work is performed under an employment contract, or, for example, under an outsourcing or agency agreement.88 In view of rapid societal and legal developments, training must be followed periodically. It must be noted that a similar requirement is set out in Section 35 of the Wwft, which also applies to trust offices. Trust offices must ensure that the persons performing work for the trust office undergo training both in the context of compliance with the Wtt 2018 and in the context of the Wwft and the Sw.89 In addition, it follows from the definition of integrity risk that training must also cover relevant aspects of, for example, civil law and domestic or international tax law where needed.90 After all, the first element of the definition of integrity risk is the risk of inadequate compliance with statutory provisions. The second element of integrity risk is the risk of involvement by the trust office or its employees in acts or conduct that conflict to such an extent with commonly accepted practices that they may seriously damage confidence in the trust office or in the financial markets. This is an obvious element of the training, e.g. an expert-led module on ethics. 91

 Table of contents DNB Good Practices Wtt 2018  5 Education and training 44 As mentioned above, trust offices must also comply with the Wwft. The training requirement under the Wwft is largely similar to that under the Wtt 2018, but there are some differences. The training requirement under the Wtt 2018 refers to the rules promulgated under or pursuant to the Wtt 2018, whereas the training requirement under the Wwft refers to the provisions of the Wwft. In addition, unlike the Wwft, the Wtt 2018 does not have a screening obligation, requiring trust offices to screen day-to-day policymakers and specific employees. However, given that trust offices must fully comply with the training requirements of both the Wwft and the Wtt 2018, the screening obligation therefore also applies to trust offices. In the Q&As and Good Practices on the Wwft, DNB has set out four good practices, including one on meeting the screening obligation. All of these good practices are relevant for trust offices. The following laws and regulations are particularly relevant: „ Section 1 of the Wtt 2018 „ Section 14 of the Wtt 2018 „ Section 67 of the Wtt 2018 „ Section 35 of the Wwft The following other policy statements are particularly relevant: „ Q&As and Good Practices on the Wwft Good practices Good practice: Concrete training programme and range A trust office’s training programme contains detailed descriptions of the various training courses it offers to its employees and directors, stating which are mandatory and which are optional. Its training programme obliges employees and directors to attend annual courses on developments in the Wtt 2018, Wwft and Sw. The trust office also requires employees who deal mainly with tax issues to take an annual specialist course on domestic and international tax law. It reviews the content of the range of training courses from time to time. Good practice: Responsibility A list of participants is kept of each training course the trust office offers. Participants receive a certificate of participation after completion. A manager in the trust office’s HR department is responsible for keeping the record up to date showing who has taken which training courses. The board is briefed quarterly on the status of training courses attended. The trust office takes action against employees who fail to attend the required training courses.

 Table of contents DNB Good Practices Wtt 2018  6 Abbreviations 45 6 Abbreviations AMLA Anti-Money Laundering and Counter-Terrorism Financing Authority Btt 2018 Decree on the Supervision of Trust Offices 2018 2018 EBA European Banking Authority FATF Financial Action Task Force FIU-NL Financial Intelligence Unit Netherlands PEP Politically exposed person Rtt 2018 Regulation on the Supervision of Trust Offices 2018 SIRA Systematic integrity risk analysis Sw Sanctions Act 1997 UBO ultimate beneficial owner Wtt 2018 Act on the Supervision of Trust Offices 2018 Wwft Anti-Money Money Laundering and Anti-Terrorist Financing Act

 Table of contents DNB Good Practices Wtt 2018  7 Glossary of terms 46 7 Glossary of terms Term Definition Customer A natural person or legal entity with which a business relationship is entered into or who has a trust service effected. Cross-border structure A complex of legal entities established in more than one European Union (EU) Member State or in an EU Member State and a third country. Object company Legal entity or company to which the trust services referred to in items a and b of the definition of trust service are provided. Policy Procedures, processes and measures referred to in Section 14 of the Wtt 2018. Pre-transaction monitoring Transaction monitoring before a transaction is completed. Post-transaction monitoring Transaction monitoring after a transaction has been completed. Three lines of defense An organisational structure consisting of a first line, second line and third line, where each line has its own tasks and responsibilities with regard to assessing and managing risks within the trust office. Transaction An act or a combination of acts performed by or on behalf of a customer of which the institution has taken note in the provision of its services to that customer. Trust service a Acting as a director of a legal entity or as a partner of a company not belonging to the same group as the person who is a director or partner for the benefit of a customer. Term Definition Trust service b Natural persons, legal entities or companies providing an address or postal address, as referred to in Sections 11(1)(c) and 14(1)(c) of the Trade Register Act 2007, to a legal entity or company not belonging to the same group as the trust office, provided that least one of the following additional services is provided on behalf of that legal entity’s or company’s behalf or on behalf of a natural person, legal entity or company belonging to the same group as that legal entity or company:

1. providing legal advice or assistance, with the exception of reception services
2. preparing tax returns and related services
3. providing services relating to the preparation, assessment or auditing of the annual accounts or the keeping of records and/or accounts
4. recruiting a director for a legal entity or company
5. performing other additional services designated by order in council

De Nederlandsche Bank N.V. PO Box 98, 1000 AB Amsterdam +31 (0) 20 524 91 11 dnb.nl/en Follow us on: Instagram LinkedIn X