FATF Guidance for a Risk-Based Approach for the Life Insurance Sector

GUIDANCE FOR A RISK-BASED APPROACH
LIFE INSURANCE SECTOR
OCTOBER 2018
OCTOBER 2018

The Financial Action Task Force (FATF) is an independent inter-governmental body that develops and promotes policies to protect the global financial system against money laundering, terrorist financing and the financing of proliferation of weapons of mass destruction. The FATF Recommendations are recognised as the global anti-money laundering (AML) and counter-terrorist financing (CFT) standard. For more information about the FATF, please visit www.fatf-gafi.org This document and/or any map included herein are without prejudice to the status of or sovereignty over any territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area. Citing reference:
FATF (2018), Guidance for a Risk-Based Approach for the Life Insurance Sector, FATF, Paris, www.fatf-gafi.org/publications/fatfrecommendations/documents/rba-life-insurance.html © 2018 FATF/OECD. All rights reserved. No reproduction or translation of this publication may be made without prior written permission. Applications for such permission, for all or part of this publication, should be made to the FATF Secretariat, 2 rue André Pascal 75775 Paris Cedex 16, France (fax: +33 1 44 30 61 37 or e-mail: contact@fatf-gafi.org) Photocredits coverphoto ©Thinkstock

GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR │ 1 © 2018 | FATF
TABLE OF CONTENTS
ACRONYMS ......................................................................................................................................... 3
RISK-BASED APPROACH GUIDANCE FOR THE LIFE INSURANCE SECTOR................... 4
EXECUTIVE SUMMARY................................................................................................................... 4
RISK-BASED APPROACH GUIDANCE FOR THE LIFE INSURANCE SECTOR................... 6
INTRODUCTION................................................................................................................................. 6
BACKGROUND AND CONTEXT.................................................................................................... 6
PURPOSE OF THIS GUIDANCE...................................................................................................... 6
TARGET AUDIENCE, STATUS AND CONTENT OF THE GUIDANCE ..................................... 7
TERMINOLOGY AND KEY FEATURES OF THE LIFE INSURANCE SECTOR RELEVANT
FOR AML/CFT ................................................................................................................................... 8
Life insurance products and other investment-related insurance products ...................................... 8
Insurance distribution channels and intermediaries ....................................................................... 11
SECTION I – THE FATF’S RISK-BASED APPROACH (RBA) TO AML/CFT........................ 13
WHAT IS THE RBA?......................................................................................................................... 13
THE RATIONALE FOR A NEW APPROACH.............................................................................. 13
APPLICATION OF THE RISK-BASED APPROACH.................................................................. 14
CHALLENGES AND METHODOLOGY FOR AN EFFECTIVE RBA ...................................... 14
Allocating responsibility under a RBA.............................................................................................. 15
Identifying ML/TF risk .................................................................................................................. 15
Assessing ML/TF risk .................................................................................................................... 16
Mitigating ML/TF risk ................................................................................................................... 16
Developing a common understanding of the RBA......................................................................... 17
Financial inclusion............................................................................................................................. 17
SECTION II – GUIDANCE FOR PRIVATE SECTOR ................................................................. 19
RISK ASSESSMENT.......................................................................................................................... 19
RISK MITIGATION .......................................................................................................................... 24
Customer Due Diligence (CDD).................................................................................................... 25
Ongoing Risk Monitoring and Mitigation...................................................................................... 27
Reporting Suspicious Transactions................................................................................................ 28
INTERNAL CONTROLS, GOVERNANCE AND MONITORING.............................................. 28
Internal controls................................................................................................................................. 28
Control Environment – Entity Level Controls (Group and Subsidiary)......................................... 28
Assessment of controls................................................................................................................... 28
Policies and Procedures.................................................................................................................. 31
Culture and “Tone –from the Top”.................................................................................................... 31
Human Resources - Personnel ........................................................................................................... 33
Training and communication ............................................................................................................. 33
SECTION III – GUIDANCE FOR SUPERVISORS ....................................................................... 34

2 │ GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR

© 2018 | FATF
RISK BASED APPROACH TO SUPERVISION ............................................................................ 34
Understanding and assessing the ML/TF risks.................................................................................. 34
Risks, threats and vulnerabilities of the life insurance sector ........................................................ 34
Risks, threats and vulnerabilities of life insurance products.......................................................... 35
Risks, threats and vulnerabilities of distribution channels............................................................. 36
Risks, threats and vulnerabilities associated to the geographical implantations of life insurers
and intermediaries’ part of insurance/financial groups. ................................................................. 36
Risks, threats and vulnerabilities of individual life insurers and intermediaries............................ 37
Mitigating ML/TF risks..................................................................................................................... 38
AML/CFT supervision and mitigation of ML/TF risks at group level .......................................... 40
AML/CFT Supervision of life insurers and intermediaries sharing the same risk profile and
characteristics................................................................................................................................. 41
SUPERVISION OF THE RISK BASED APPROACH................................................................... 41
General Approach.............................................................................................................................. 41
Training and awareness ..................................................................................................................... 43
Guidance ............................................................................................................................................ 43
Supervisory enforcement actions and sanction.................................................................................. 44
ANNEX A. EXAMPLES OF RISK FACTORS RELEVANT FOR THE ML/TF RISK
ASSESSMENTS OF INSURANCE ENTITIES ............................................................................... 46
ANNEX B. EXAMPLES OF DIFFERENT SUPERVISORY PRACTICES FOR THE
IMPLEMENTATION OF THE RBA ............................................................................................... 56
ANNEX C. GUIDANCE PROVIDED BY SUPERVISORS TO PRIVATE SECTOR
RELEVANT TO THE APPLICATION OF THE RBA .................................................................. 60

GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR │ 3 © 2018 | FATF ACRONYMS AML/CFT Anti-Money Laundering / Countering the Financing of Terrorism CDD Customer Due Diligence EDD Enhanced Due Diligence FATF Financial Action Task Force FI Financial Institution FIU Financial Intelligence Unit IAIS International Association of Insurance Supervisors ICP IAIS Insurance Core Principle INR. Interpretive Note to Recommendation MER Mutual Evaluation Report ML Money Laundering PF Proliferation (of weapons of mass destruction) Financing R. Recommendation RBA Risk-based approach SDD Simplified Due Diligence STR Suspicious Transaction Report TF Terrorist Financing

4 │ GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR

© 2018 | FATF
RISK-BASED APPROACH GUIDANCE FOR THE LIFE INSURANCE SECTOR EXECUTIVE SUMMARY The risk-based approach (RBA) is central to the effective implementation of the FATF Recommendations. It means that supervisors, financial institutions, and intermediaries identify, assess, and understand the money laundering and terrorist financing (ML/TF) risks to which they are exposed, and implement the most appropriate mitigation measures. This approach enables them to focus their resources where the risks are higher. The FATF RBA Guidance for the Life Insurance Sector aims to support the implementation of the RBA, taking into account national ML/TF risk assessments and AML/CFT legal and regulatory frameworks. It includes a general presentation of the RBA and provides specific guidance for life insurers and intermediaries, and for their supervisors. The guidance was developed in partnership with the private sector, to make sure it reflects expertise and good practices from within the industry. The Guidance underlines some of the specificities of the life insurance sector, which need to be taken into consideration when applying a RBA. In particular, it highlights the nature and level of ML/TF risk of life insurance products, which is generally lower than that associated with other financial products, such as loans or payment products. Indicative risk ratings are provided for a set of life insurance products, as well as examples of products’ inherent risk factors. The Guidance also looks at the involvement of intermediaries in the distribution of life insurance, and how it affects the split of AML/CFT responsibilities. It also insists on the need for life insurers to factor in their distribution network and channels when performing their ML/TF risk assessment. The Guidance underlines that the development of the ML/TF risk assessment is a key starting point for the application of the RBA by life insurers and intermediaries. It should be commensurate with the nature, size and complexity of the business. This means that a simple risk assessment might be enough for smaller or less complex life insurers or intermediaries, and that where life insurers or intermediaries are part of a group, risk assessments should take into account group-wide risk appetite and framework. The Guidance also recalls that the intensity and depth of risk mitigation measures including customer due diligence (CDD) checks depend on the ML/TF risks. The guidance emphasises in particular that the identity and status of parties to life insurance contracts, including the beneficiary and where relevant the beneficial owner(s), will determine the extent of the controls to be performed, in particular if/when a Politically Exposed Person (PEP) is involved. The Guidance also insists on the importance of life insurance entities’ internal controls, whose structure and organisation depend on the ML/TF risks identified and for which, in any case, the “tone from the top” i.e. the involvement of senior management,
plays a central role.

GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR │ 5 © 2018 | FATF The Guidance clarifies that the obligation to report suspicious transactions is not riskbased, but applies regardless of the amount of the transactions. The action of reporting suspicious transactions does not discharge a life insurer or intermediary of their other AML/CFT obligations. On AML/CFT supervision, the Guidance stresses the importance of the group level approach to mitigate ML/TF risks, including the development of group-wide assessment of ML/TF risks, and the sharing of relevant information between supervisors involved. It also highlights the relevance of allocating supervised entities which share similar characteristics and risk profiles into groupings (or clusters) for supervision purposes.

6 │ GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR

© 2018 | FATF
RISK-BASED APPROACH GUIDANCE FOR THE LIFE INSURANCE SECTOR This Guidance paper should be read in conjunction with:

The FATF Recommendations, especially Recommendations (R.) 1, 10, 12,
17, 18 and 26 and their Interpretive Notes (INR), and the Glossary.
Other relevant FATF documents, such as the FATF Guidance on National
Money Laundering and Terrorist Financing Risk Assessment, the FATF Guidance on Politically Exposed Persons, the FATF Risk-Based Approach Guidance - Effective Supervision and Enforcement by AML/CFT Supervisors of the Financial Sector and Law Enforcement, the FATF Risk-Based Approach Guidance for the Banking Sector, the FATF Guidance Private Sector Information Sharing and the FATF Guidance on AML/CFT and Financial Inclusion. INTRODUCTION BACKGROUND AND CONTEXT

The risk-based approach (RBA) is central to the effective implementation of
the revised FATF International Standards on Combating Money Laundering and the Financing of Terrorism and Proliferation, which were adopted in 2012.1 The FATF has reviewed its 2009 RBA Guidance for the life insurance sector, in order to bring it in line with the revised FATF requirements.2
This updated RBA Guidance for the life insurance sector was drafted by a
group of FATF members and observers, and representatives of the private sector, coled by representatives of France and Manulife.3 It was adopted by the FATF at its October 2018 Plenary. PURPOSE OF THIS GUIDANCE
The purpose of this Guidance is to:
1
. www.fatf-gafi.org/media/fatf/documents/recommendations/pdfs/FATF%20Recommendations%202012.pdf. The FATF Standards are comprised of the FATF Recommendations, their Interpretive Notes and applicable definitions from the Glossary. 2 . The FATF has already reviewed its RBA Guidance papers for the banking sector (2014) and for the MVTS sector (2016). It is in the process of developing a new RBA Guidance for the Securities sector. The other RBA Guidance papers adopted between 2007 and 2009 (real estate agents, accountants, trust and company service providers, legal professionals, dealers in precious metals and stones, casinos) will also be reviewed to be consistent with the 2012 FATF Recommendations. 3 The FATF Drafting Group was composed of representatives from FATF members and observers (France, IAIS, Luxembourg, Singapore and South Africa) and from the private sector (Aon UK, AXA, Generali, Manulife).

Outline the key elements involved in applying a RBA to AML/CFT associated
with life insurance;
Assist countries, competent authorities, insurers4 and intermediaries5 in the
design and implementation of a RBA to AML/CFT by providing general guidelines and examples of current practice;
Support the effective implementation and supervision of national AML/CFT
measures, by focusing on risks and associated mitigation measures; and
Support the development of a common understanding of what a RBA to
AML/CFT entails.
TARGET AUDIENCE, STATUS AND CONTENT OF THE GUIDANCE

This Guidance addresses:

Countries and their supervisors and competent authorities, including life
insurance supervisors, other supervisors or competent authorities involved in the AML/CFT compliance of life insurers and intermediaries and/or of life insurance entities part of a financial group;
Insurers and intermediaries providing life insurance and other investmentrelated insurance products6 defined as financial institutions in the FATF
Glossary (see para 14 and 48).

The Guidance covers the life insurance sector7 and consists of three sections.
Section I sets out the key elements of the RBA, Section II provides guidance to life
insurers and insurance intermediaries providing life insurance and other investmentrelated insurance products, and Section III provides guidance to supervisors.
This Guidance does not target :

non-life insurance activities. The FATF Glossary excludes non-life insurance
activities from the activities performed by “financial institutions” which fall under the scope of the FATF requirements. As a result, the FATF Recommendations do not apply to non-life insurance (even if the non-life insurance activities are within the scope of financial sanctions regimes)8 . However, as with almost all commercial activities, there may be some scenarios in which non-life insurance products might be misused for ML and TF purposes. That is why a minority of jurisdictions included non-life insurance activities in their AML/CFT framework, based on their specific, national risk evaluations. In this case, insurance supervisors and other competent authorities should provide interested stakeholders with information on specific, potential ML/TF risks and typologies, and provide 4 In accordance with IAIS Insurance Core Principles (ICPs), the term “insurer” means insurance legal entities, insurance groups and insurance-led financial conglomerates. 5 See IAIS ICP 18 for activities performed by intermediaries. 6 See FATF glossary of financial institutions (point 12) “underwriting and placement of life insurance and other investment-related insurance.” 7 Life insurance activities are activities or operations described in the FATF Glossary under “Financial institutions”, in particular 12. Further details are provided in para 9 of the present paper. 8 The asset freeze obligations of the targeted financial sanctions regimes for terrorism financing and proliferation financing apply, through relevant implementing legislation, to all natural and legal persons in the country holding or receiving funds and other assets, including all financial institutions and DNFBPs, and non-life insurers (INR. 6.6 (a) and INR. 7.6 (a)).

8 │ GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR

© 2018 | FATF tailored guidance for the application of AML/CFT measures to non-life insurance activities. An example where non-life insurance products might be misused for ML and TF is the utilization of illicit funds for the payment of premiums, or a significant overpayment of premiums followed by a refund request for the full amount or the amount overpaid.

reinsurance activities. The customers of reinsurers are insurers or other
reinsurers. As a matter of good practice, reinsurers should, through their regular commercial diligence, seek to transact only with life insurers that have adequate AML/CFT compliance programmes in place. The due diligence process may include gathering information (including information from lead underwriters and reinsurance intermediaries, such as brokers) related to the ceding life insurers’ AML/CFT compliance programmes prior to entering into contracts. Reinsurers should use the STR process if they suspect, or have reasonable grounds to suspect, that funds are proceeds of a criminal activity, or related to terrorist financing.

This Guidance recognises that an effective RBA will build on, and reflect, a
country’s legal and regulatory approach, the nature, diversity and maturity of its life insurance sector and its overall risk profile. It sets out recommendations for what countries should consider when designing and implementing a RBA; but it does not override the purview of national competent authorities. When considering the general principles outlined in the Guidance, national authorities should take into consideration their national context, including the supervisory approach and legal framework.
This Guidance paper is non-binding. It draws on the experiences of countries
and of the private sector and may assist competent authorities and financial institutions to effectively implement the applicable FATF Recommendations. TERMINOLOGY AND KEY FEATURES OF THE LIFE INSURANCE SECTOR RELEVANT FOR AML/CFT Life insurance products and other investment-related insurance products
For the purpose of this Guidance, “life insurance products and other
investment-related insurance products”, as referred to in the FATF Glossary, are understood as contracts primarily designed to financially protect the customer/policyholder and its related third parties (who include the insured, the beneficiary/ies of the contract, and the beneficial owners) against the risk of an uncertain future event – such as death or critical illness. Related third party beneficiaries may be the policyholder, or another nominated or a designated beneficiary, and can be a natural person as well as a legal entity or a legal arrangement. Life insurance products can also be bought as investment or saving vehicles and to support estate planning or pension plans.
Most life insurance products are designed for the long-term and some will only
pay out on the occurrence of a verifiable event, such as death or retirement. However, some have saving or investment features, which may include the options for full and/or partial withdrawals or surrenders at any time. Life insurance policies can be individual policies or group policies - for example, companies may provide life insurance for their employees as part of a benefits package.

GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR │ 9 © 2018 | FATF
11. Generally the ML/TF risks associated to the life insurance sector is lower than
that associated with other financial products (e.g., loans, payment services) or other sectors (e.g., banking, gambling, precious stones and metal dealers). Indeed, many life insurance products are not sufficiently flexible to be the first vehicle of choice for money launderers. However, as with other financial services products, there is a risk that the funds used to purchase life insurance may be the proceeds of crime. There is also a risk, even limited, that funds withdrawn from life insurance contracts could be used to fund terrorism.
12. The AML/CFT regime applicable to life insurance in a given jurisdiction will
have to be determined based on the results of the national ML/TF risk assessment, on the local sectoral life insurance ML/TF risk assessment, as well as on the specific individual insurer (and/or intermediary where relevant) ML/TF risk assessment.9
Table 1 - Examples of life insurance products and indicative risk ratings
(without prejudice to the other ML/TF risk factors such as transaction, distribution, geographical or customer risks) EXAMPLE OF PRODUCT DESCRIPTION TYPICAL FEATURES INDICATIVE RISK RATING Complex products with potential multiple investment accounts; and /or products with returns linked to the performance of an underlying financial asset Example of product names:
Universal Life
Variable Universal Life
Wrapper Insurance
Investment Linked Policies
Unit Linked Policies
Investment Linked Assurance
Schemes

offers the ability to
hold funds and/or assets
may offer the option
of asset transfers into the policy
full or partial
underlying investments under control of the customer
may have a high
upper limit for the amounts of funds held
higher risk compared
with other life insurance products
Products designed for High
Net Worth (HNW) persons or products for individual generally with guaranteed returns Example of product names:
HNW Individual Life Insurance
Traditional Whole Life
offers the ability to
hold funds
only with high limit
for funds held
underlying
investments managed by the insurer
higher/moderately high
risk compared with other life insurance products 9 This Guidance focuses solely on the abuse of the life and similar insurance products for ML/TF purposes. It does not purport to describe controls which financial institutions may be required to implement to prevent or detect insurance fraud, which describes situations where a false or fraudulent claim is made against a life insurance policy (ICP 21). In some cases, insurance fraud is associated to ML/TF activities.

10 │ GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR

© 2018 | FATF
EXAMPLE OF PRODUCT
DESCRIPTION
TYPICAL FEATURES INDICATIVE RISK RATING
Product that pays a periodic income benefit for the life of a person Example of product name:
Fixed and Variable Annuities

offers the ability to
hold funds
may have a high limit
for funds held
accumulation period
followed by a liquidation period
underlying
investments managed by the insurer
moderate risk compared
with other life insurance products
Product designed to provide endowments for an individual or an institution Example of product name:
Endowments
may offer the ability
to hold funds
underlying
investments managed by the insurer
moderate risk compared
with other life insurance products
Product subscribed by a company to pay a periodic income benefit for the life of employees Example of product name:
Group Annuities
typically used for
retirement savings and pension schemes
generally subscribed
by a company in order to provide a future benefit to its employees
underlying
investments managed by the insurer
lower risk compared with
other life insurance products
Product that pays a lump sum, or a regular payout (annuity) to the beneficiary, in the event of the death of the insured, in the event of a long-term care or critical illness Example of product name:
Term Life Individual
Group Long-term Care
Critical Illness
no ability to hold
funds
generally payments
only in case of a specific external event
lower risk compared with
other life insurance products

GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR │ 11 © 2018 | FATF Insurance distribution channels and intermediaries
13. Life insurance is sold through a variety of distribution channels. A significant
proportion of life insurance policies are sold through intermediaries where the life insurer will have limited or no direct contact with the policy holder. In a number of cases, the intermediaries have the initial interaction with the customer. Life insurance policies are also sold online, where there may not be any face to face interaction with the customer by the insurer or intermediary. When identifying and evaluating the ML/TF risk associated with the method through which the product is sold, the life insurer, and supervisors, should consider the risks related to the intermediary used and the nature of their relationship with the life insurer and the customer.
14. Life insurance intermediation can take a number of different forms, with
varying relationships with the life insurer, which may affect the nature and the extent of their AML/CFT responsibilities:

Intermediaries acting as financial institutions, as defined in the FATF Glossary,
and subjected as such to AML/CFT requirements:
o Where intermediaries act primarily on behalf of the customer, they are independent of the life insurer whose products they sell and are often referred to as “independent agents”10. These intermediaries are able to select from a range of products across the market and as they are “financial institutions” per the FATF Glossary, they are subject to AML/CFT requirements. o Bancassurance is an agreement between a bank and an insurer, under which the bank sells the insurer’s life insurance products to its clients. If the bank and the insurer belong to the same financial group or conglomerate, a group-wide AML/CFT programme should be in place, including policies and procedures for timely sharing of information within the group for AML/CFT purposes.11
Intermediaries not acting as financial institutions: intermediaries may sell
products for and on behalf of a single life insurer and are sometimes referred to as “tied” or “captive” agents. Where intermediaries are tied to a life insurer, they are generally required to follow the life insurer’s AML/CFT policies and procedures.
There are also “trade specific agents” whose core business is not life insurance
and who typically may sell only one or a limited number of types of life insurance products as ancillary to their core business activities. By exception, if the core business of this trader is mentioned in the FATF glossary as a financial institution, in particular if it is acting on behalf of a customer, then, it is subjected to AML-CFT requirements. For example a mortgage provider may offer its clients term life or critical illness insurance as an optional add-on to the mortgage agreement.

When identifying the risks associated with delivery channels and the
management of the product, the life insurer should also take into account the reliance on any third-party; and whether the arrangement is under a third party reliance or outsourcing model. 10 The term “broker” is frequently used in some countries (e.g. France) 11 See FATF Recommendation 18 and 2017 FATF Guidance on Private Sector Information sharing.

12 │ GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR

© 2018 | FATF
16. Third-party reliance - Where local legislation permits life insurers to rely on
the identification and verification work completed by life insurance intermediaries, life insurers must comply with FATF R.17. Life insurers should satisfy themselves that the intermediary is a financial institution, as defined in the FATF Glossary, regulated, and monitored or supervised for AML/CFT, including CDD and record keeping requirements. The life insurer should immediately obtain the necessary CDD information, and also take adequate steps to satisfy itself that copies of identification data and other relevant documentation relating to CDD requirements will be made available to the life insurer by the intermediary upon request and without delay. As a best practice, it is recommended that life insurers receive a copy of the CDD record(s), or have access to the database where the information is held, in order to facilitate ongoing monitoring of the business relationship and if applicable, the filing of suspicious transactions reports and for a complete assessment record in case of a change of intermediary servicing the policy. Ultimate responsibility for CDD remains with the life insurer even when relying on third-parties.
17. Outsourcing - When life insurers outsource a part of their AML/CFT function,
including the distribution of the products, to a third party which is not regulated, supervised or monitored for AML/CFT, they should include these third parties in their own AML/CFT internal control processes, and monitor them for compliance with their AML/CFT programmes. Life insurer retains full responsibility for AML/CFT controls in such an outsourcing arrangement, i.e. the outsourced entity applies the CDD measures on behalf of the life insurer, in accordance with its procedures, and is subject to its control of the effective implementation of those procedures.

GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR │ 13 © 2018 | FATF
SECTION I – THE FATF’S RISK-BASED APPROACH (RBA) TO AML/CFT
WHAT IS THE RBA?
18. An RBA to AML/CFT means that countries, competent authorities and financial
institutions,12 are expected to identify, assess and understand the ML/TF risks to which they are exposed and take AML/CFT measures commensurate with those risks in order to mitigate them effectively.
19. When assessing ML/TF risk, countries, competent authorities, and financial
institutions should analyse and seek to understand how the ML/TF risks they identify affect them; the risk assessment therefore provides the basis for the risk-sensitive application of AML/CFT measures.13
20. The RBA process should be dynamic, with risk assessments and mitigation
measures being refreshed on an on-going basis. It is recognised that there may be occasions where an institution has taken all reasonable measures to identify and mitigate ML/FT risks, but its products are used for ML or TF purposes. THE RATIONALE FOR A NEW APPROACH
21. In 2012, the FATF updated its Recommendations to strengthen global
safeguards and to further protect the integrity of the financial system by providing governments with stronger tools to take action against financial crime.
22. One of the most important changes was the increased emphasis on the RBA to
AML/CFT, especially in relation to preventive measures and supervision. Whereas the 2003 Recommendations provided for the application of a RBA in some areas, the 2012 Recommendations consider the RBA to be an “essential foundation” of a country’s AML/CFT framework.14 This is an over-arching requirement applicable to all relevant FATF Recommendations.15
23. According to the Introduction to the 40 Recommendations, the RBA ‘allows
countries, within the framework of the FATF requirements, to adopt a more flexible set of measures in order to target their resources more effectively and apply preventive measures that are commensurate to the nature of risks, in order to focus their efforts in the most effective way’. 12 Including both physical and natural persons, see definition of “Financial institutions” in the FATF Glossary. 13 FATF Guidance National Money Laundering and Terrorist Financing Risk Assessment, par. 10. See also Sections II A and III A for further details on identifying and assessing ML/TF risk. 14 R.1. 15 Two important rule-based sets of AML/CFT measures have to be highlighted as they are part of the important steps to CFT or of counter-proliferation of weapons of mass destruction (PF). First, FATF R. 26 requires countries to ensure that life insurers and intermediaries are licensed or registered by a competent authority, and that supervisors implement controls to prevent criminals and their associates from holding, or being the beneficial owner of a significant or controlling interest or holding a management function in companies of the insurance sector. Second, all reporting entities, including life insurers and intermediaries, have to comply with targeted financial sanctions directed at people or organisations sanctioned for reasons related to terrorism or the financing of proliferation. Measures should be taken to comply with national and international sanctions legislation by screening the customer, the beneficial owners, the beneficiary of the life insurance contract and its beneficial owners against the UN and other applicable sanctions lists. This regime is not subject to a RBA as it is a rule-based requirement. Consequently, it falls outside the scope of this Guidance (FATF Recommendations 6 and 7).

14 │ GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR

© 2018 | FATF
24. The application of a RBA is therefore not optional, but a prerequisite for the
effective implementation of the FATF Standards.16 APPLICATION OF THE RISK-BASED APPROACH
25. R. 1 sets out the scope of the application of the RBA. It applies in relation to:

Who and what should be subject to a country’s AML/CFT regime: in addition
to the sectors and activities included in the scope of the FATF Recommendations,17 countries should extend their regime to additional institutions, sectors or activities if they pose a higher risk of ML/TF. Countries could also consider exempting certain institutions, sectors or activities from some AML/CFT obligations where specified conditions are met, such as an assessment that the ML/TF risks associated with those sectors or activities are proven to be low.18
How those subject to the AML/CFT regime should be supervised for
compliance with this regime: AML/CFT supervisors should consider life insurers’ and intermediaries’ own risk assessment and mitigation measures, and acknowledge the degree of discretion allowed under the national RBA. Supervisors must themselves adopt a RBA to AML/CFT supervision (INR. 26); and
How those subject to the AML/CFT regime should comply: life insurers and
intermediaries are obliged to assess and understand the ML/TF risks to which they are exposed .Where the ML/TF risk associated with a situation is higher, enhanced mitigation measures should be taken. This means that the range, degree, frequency or intensity of controls conducted will be stronger. Conversely, where the ML/TF risk is lower, standard AML/CFT measures may be simplified, which means that each of the required measures must be applied, but the degree, and frequency or the intensity of the controls conducted will be lower.19 CHALLENGES AND METHODOLOGY FOR AN EFFECTIVE RBA

Implementing a RBA can present a number of challenges. In implementing an
effective RBA, countries and competent authorities should therefore consider the following steps. 16 The effectiveness of risk-based prevention and mitigation measures is assessed as part of the mutual evaluation of the national AML/CFT regime. The effectiveness assessment measures the extent to which a country achieves a defined set of outcomes that are central to a robust AML/CFT system and analyses the extent to which a country’s legal and institutional framework is producing the expected results. Assessors need to take the risks, and the flexibility allowed by the RBA, into account when determining whether there are deficiencies in a country’s AML/CFT measures, and their importance - FATF Methodology for assessing technical compliance with the FATF Recommendations and the Effectiveness of AML/CFT systems (2013). 17 See Glossary, definitions of “Financial institutions” and “Designated non-financial businesses and professions”. 18 INR 1, paragraph 6. 19 R. 10; INR 10, footnote 33.

GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR │ 15 © 2018 | FATF Allocating responsibility under a RBA
27. An effective risk-based regime builds on, and reflects, a country’s legal and
regulatory approach, the nature, diversity and maturity of its financial sector, and its overall risk profile.
28. When deciding the extent to which life insurers and intermediaries are able to
decide how to mitigate risk, countries should consider, inter alia, the mitigating measures already in place (e.g., laws prohibiting anonymous life insurance products and/or cash payments in relation to any life insurance products), their life insurance sector’s ability to effectively identify and manage ML/TF risks as well as their supervisors’ expertise and resources.
29. Countries may also take into account evidence from competent authorities
regarding the level of compliance in the life insurance sector, and the sector’s approach to dealing with ML/TF risk. Countries whose financial services sectors or whose legal, regulatory and supervisory frameworks are still developing, may determine that life insurers and intermediaries are not yet sufficiently equipped to effectively identify and manage ML/TF risk and any flexibility allowed under the riskbased approach should therefore be limited. In such cases, a more prescriptive implementation of the AML/CFT requirements may be appropriate until the sector’s understanding and experience is strengthened.20
30. Institutions should not be exempted from AML/CFT supervision even where
their capacity (ability and expertise) and compliance are good. However, the RBA should allow competent authorities to direct more supervisory resource to higher risk institutions.21 Identifying ML/TF risk
31. Life insurers and intermediaries may be granted flexibility in deciding on the
most effective way to identify ML/TF risk. Life insurers and intermediaries should take into account the supra (if any) and national legal and regulatory framework, any areas of prescribed significant risk and any mitigation measures defined at the legal or regulatory level. If a national risk assessment is available, this should be taken into account.
32. Competent authorities and supervisors should consider issuing guidance to
life insurers and intermediaries, on how they are expected to meet their legal and regulatory AML/CFT obligations, including when insurers operate on a cross-border basis. Ongoing and effective communication between competent authorities and life insurers and intermediaries is an essential prerequisite for the successful implementation of a RBA.
33. Access to accurate, timely and objective information about ML/TF risks is also
a prerequisite for an effective RBA. INR 1.3 requires countries to have mechanisms to provide appropriate information on the results of the risk assessments to all relevant competent authorities, financial institutions and other interested parties. The methodology and input on those risk assessments should also be shared, to the extent 20 This could be based on a combination of elements described in Section II, as well as objective criteria such as mutual evaluation reports, follow-up reports or FSAP. 21 See FATF Guidance on effective supervision and enforcement by AML/CFT supervisors of the financial sector and law enforcement.

16 │ GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR

© 2018 | FATF possible and when such information is not classified or its use restricted for law enforcement or national security reasons. Information sharing plays a vital role in allowing financial institutions and supervisory and law enforcement authorities to better deploy resources on a risk based approach, and to develop innovative techniques to combat ML/TF.22 Enabling greater information sharing is a key element of collaboration whether it involves sharing across borders, between entities of the same financial group, between different financial groups or between the private and public sector. This is relevant also in a life insurance context, because insurers can be
part of financial groups, involving different types of financial institutions, at the
domestic and cross-border level. Where information is neither readily available nor adequate, it will be difficult for life insurers and intermediaries to correctly identify (i.e., find and list) ML/TF risk and therefore they may fail to assess and mitigate it appropriately. Assessing ML/TF risk
34. Assessing ML/TF risk means that countries, competent authorities, life
insurers and intermediaries must determine how the identified ML/TF threats will affect them. They should analyse the information obtained to understand the likelihood of these risks occurring as well as the impact that the risks would pose on the individual life insurers and intermediaries, the life insurance sector and related financial institutions, and possibly on the national economy. Risks identified through this process are often known as inherent risks, and risks which remain after the risk mitigation process are known as residual risks.
35. As a result of a risk assessment, ML/TF risks are often classified as low,
medium and high, with possible combinations between the different categories (medium-high; low-medium, etc.). The same risk may be regarded as high in one jurisdiction while in another jurisdiction it may be regarded as lower risk depending on the circumstances prevailing in the jurisdiction. Such a classification is meant to assist understanding and prioritizing ML/TF risks. Assessing ML/TF risk therefore goes beyond the mere collection of quantitative and qualitative information: it forms the basis for effective ML/TF risk mitigation and should be kept up-to-date to remain relevant.
36. Assessing and understanding risks implies that competent authorities and life
insurers and intermediaries should have skilled and trusted personnel, recruited through fit and proper tests, where appropriate. This also requires personnel to have and maintain technical competence and expertise commensurate with the complexity of the life insurers and intermediaries’ products and operations. Mitigating ML/TF risk
37. The FATF Recommendations require that, when applying a RBA, life insurers
and intermediaries, countries and competent authorities decide on the most appropriate and effective way to mitigate the ML/TF risk they have identified. They should take enhanced measures to mitigate situations in which the ML/TF risk is higher; and, correspondingly, simplified measures may be applied in lower risk situations23:
22 See R. 2, R.18, R. 20, R. 21 and FATF Guidance on private sector information sharing. 23 Consistently with the national risk assessment

Countries and life insurers and intermediaries considering applying simplified
measures should conduct an assessment of the risks connected to the category of customers or products targeted and establish the lower level of the risks involved, and define the extent and the intensity of the required AML/CFT measures. Specific FATF Recommendations set out in more detail how this general principle applies to particular requirements.
Where ML/TF risks are higher, life insurers and intermediaries should always
apply enhanced due diligence measures commensurate with the risks posed, although national law or regulation might not prescribe exactly how these higher risks are to be mitigated (e.g., varying the degree of enhanced ongoing monitoring).

Only countries may decide to grant exemptions from some Recommendations
in proven low-risk situations (INR. 1. 2 A. 6).
Developing a common understanding of the RBA
The effectiveness of a RBA depends on a common understanding by competent
authorities and life insurers and intermediaries of what the RBA entails, how it should be applied and how ML/TF risks should be addressed.
It is important that competent authorities recognize that in a risk-based
regime, not all life insurers and intermediaries will adopt identical AML/CFT controls and that a single isolated incident of insignificant, crystallised risk may not necessarily invalidate the integrity of life insurers and intermediaries’ AML/CFT controls. On the other hand, life insurers and intermediaries should understand that a flexible RBA does not exempt them from applying effective AML/CFT controls and that they must demonstrate to their competent authorities the effectiveness of the AML/CFT controls implemented, which should be commensurate with the risks identified.
In the case of life insurers and/or intermediaries who are part of a financial
group or conglomerate, countries and competent authorities should take into account the benefits of effective consolidated supervision at the group level, including effective cooperation and information sharing between the respective AML/CFT supervisors of various entities within the group and the supervisor of the parent entity (the home supervisor responsible for the supervision of the group-wide AML/CFT policies not always being an insurance supervisor). Financial inclusion
FATF is committed to financial inclusion, which contributes to greater
transparency and traceability of financial flows.24 The primary focus of financial inclusion is access to banking account and payment services. However, it is important to support, progressively or concurrently, improved access to the larger range of needed financial services, including tailored life insurance products.
Adopting a RBA may help foster financial inclusion, especially in the case of
low-income or other vulnerable individuals who experience difficulties in accessing the regulated financial system. When applying a RBA, jurisdictions may establish 24 FATF Guidance on AML/CFT and Financial Inclusion.

18 │ GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR

© 2018 | FATF specific cases for exemptions in the application of FATF Recommendations (based on proven low risks), or allow life insurers and intermediaries to be more flexible in their application of CDD measures in case of lower ML/TF risks (see Section II), at the condition that they can justify to their supervisors that the CDD measures taken are commensurate to the risks posed (e.g. individuals with part-time or short-term jobs in unsecure employments who are subscribed to a pension scheme through their employer. 25 25 See FATF Guidance on AML/CFT and Financial Inclusion, para 51 to 60

GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR │ 19 © 2018 | FATF
SECTION II – GUIDANCE FOR PRIVATE SECTOR
44. The RBA consists of identifying the ML/TF risks and adopting mitigation
measures that are commensurate with the ML/TF risks identified. In the case of life insurers and intermediaries, this applies to the way they allocate their compliance and risk management resources, organise their internal controls and internal structures, and implement policies and procedures to deter and detect ML/TF, including, where relevant, at the group level.
45. This section provides an outline of the risk assessment process and a wide
range of mitigating measures which life insurers and intermediaries may wish to apply. There is no one size fits all approach and life insurers and intermediaries should take into consideration the nature, scale and complexity of their business in order to determine the appropriate mitigating measures to put in place.
46. Where supervisors’ guidance remains high-level and principles-based,
guidance written by industry sectors on how to meet the legal and regulatory obligations may be useful for explanatory and operational purposes. The supervisors’ guidance could also be elaborated in conjunction with the industry. Life insurers and intermediaries should note, however, that the private sector guidance they take into consideration should be consistent with national legislation, and based on international standards and guidelines issued by competent authorities. RISK ASSESSMENT
47. The ML/TF risk assessment forms the basis of a life insurer’s and
intermediary’s RBA. The key purpose of such an assessment is to understand and mitigate inherent ML/FT risks, and enable the life insurer/intermediary to effectively manage residual risks.26
Table 2 –Examples of Inherent Risk factors in a life insurance context27
This table should be read together with Table 1 concerning the risk factors linked to life insurance products. RISK FACTOR CATEGORIES EXAMPLES RISK FACTOR EXAMPLE DESCRIPTION Customers and related third parties (policyholder and if any, its Customer base growth Rapid growth and/or turn-over of customer base in terms of amount and customer diversity pose higher ML/TF risks. Therefore, an insurer should pay extra attention to a new campaign aimed at increasing the customer base significantly, to a subscription of a high net worth life policy by a new customer 26 Wolfsberg Frequently Asked Questions on Risk Assessments for Money Laundering, Sanctions and Bribery & Corruption. 27 Examples of risk factors, simplified and enhanced customer due diligence measures can also be found in “The Risk Factors Guidelines” (2017) of the European Supervisory Authorities (ESAs), which include the European Banking Authority (EBA), the European Insurance and Occupational Pensions Authority (EIOPA) and the European Securities and Markets Authority (ESMA). See also Annex A for examples of risk factors relevant for the ML/TF risk assessments of insurance entities.

20 │ GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR

© 2018 | FATF
RISK FACTOR
CATEGORIES
EXAMPLES RISK FACTOR EXAMPLE DESCRIPTION beneficial owner, the beneficiary and if any, its beneficial owner) compared to a well-known customer with already other business relationships with the insurer for long time. Individuals who are more difficult to identify Difficulty in identifying the person on whose behalf the business relationship or transaction is being conducted, generally with involvement of thirdparties (e.g., policy holder different from the insured person and beneficiary and with no apparent relationships with them, or third-party payer on the contract with no apparent relationship with the policy holder). Structures that make it difficult to identify the beneficial owner of the policyholder or of the beneficiary Complex ownership and control structures involving multiple layers of shares registered in the name of legal entities and/ or non-transparent structures (e.g., trusts and other legal arrangements designated as beneficiaries of life policies, enabling a separation of legal ownership and beneficial ownership of assets). Unusual circumstances associated with the customer’s business relationships or transactions Customer activity not consistent with the customer’s known profile and lacks business rationale or economic justification causing economic losses (e.g., an early surrender for a large amount without understandable rationale or transactional activity causing economic losses). PEPs exposure28 Business relationships involving a person(s) (i.e., policyholder, beneficiary, beneficial owner of the policyholder or of the beneficiary) defined as a Politically Exposed Person including his/her family members or close associates, as covered under R. 12. (e.g., a PEP designated as a beneficiary by an unrelated policy holder could hide a corrupt activity – additional caution should be exercised to identify these situations, as the PEP may not be identified until the end of the policy, at pay-out). Payment methods Payment methods which may contribute to increased ML/TF risks (e.g., cash or other forms of payment vehicles fostering anonymity; payments from different bank accounts without explanation; 28 See FATF Guidance on Politically Exposed Persons (Recommendations 12 and 23)

GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR │ 21 © 2018 | FATF RISK FACTOR CATEGORIES EXAMPLES RISK FACTOR EXAMPLE DESCRIPTION payments received from unrelated third parties, see
Annex A, para 155 and 163).
Origin or source of funds and wealth
Unclear or suspicious source of wealth and/or source of funds that are involved in the business relationship. (e.g., large investment in a unit-linked product by a low-income person without a clear source of wealth). Higher risk individuals Customers which are classified as higher risk including persons previously reported by the insurer/intermediary to the FIUs or who operate in a higher risk industry or profession from an AML/CFT perspective This includes persons active in charities and non-profit organization, precious metals and stone dealers, money services businesses, cash intensive businesses such as "cash for gold" or casinos, arms dealers.29 Products and Services Products associated with high risk payment Product that may inherently favour international customers, cash, third parties and complex payments or have features that allow for pay-outs not limited to pre-defined events (e.g., international life insurance products designed for expatriates). Product which accumulate large funds, transact large sums, or allow high amount withdrawals Product that are designed for the accumulation of large funds and/or allow a large transaction (e.g., insurance wrapper products). Products which favour anonymity or are easily transferable Products or services that may inherently favour anonymity, or products that can readily cross international borders, or are easily transferred, (e.g., life insurance policy issued to the bearer or negotiated on secondary market). Products which allow early surrender Products which allow for early surrender and have a surrender value Products with low value policy benefits Products have simple features and are low in value may carry lower ML/TF risks 29 E.g., insurers could be required by local insurance laws and regulations to maintain a business relationship or provide insurance services even to a person designated and/or reported to local FIU – in those cases the insurer should act in close collaboration with the local authorities.

22 │ GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR

© 2018 | FATF
RISK FACTOR
CATEGORIES
EXAMPLES RISK FACTOR EXAMPLE DESCRIPTION and simple product features Distribution channels Non face to face sales channels Channels which do not provide for a physical meeting between the customer and an employee or intermediary, and is not supported by other mitigation measures like identification performed by an obliged or authorized person such as a public notary (e.g., life insurance policy sold on-line) or without adequate safeguards for confirmation of identification or to mitigate the risks of identity fraud (see Annex A, para 147 and 155). Reliance and outsourcing Reliance on intermediaries and /or outsourcing to third parties which are not subjected to the same AML/CFT obligations as the life insurer or is not well known to the life insurer (e.g., life insurance policy sold by small independent intermediaries or by third parties which may have less sophisticated controls in place). Management of the customers payments Intermediaries which manage the investments and the flow of funds on behalf of the customer on their accounts (e.g., life insurance policy sold by intermediaries accepting cash payments and/or payments on their own accounts). Geography Products and services, Products and services that are marketed or sold in higher ML/TF risk countries. Customers Customers, beneficiaries, policy holder and/or related third parties are based in or linked to higher ML/TF risk countries; or reside in countries considered to be uncooperative in providing beneficial ownership information. Intermediaries Intermediaries that are based in or sell to higher ML/TF risk jurisdictions (e.g., intermediaries owned and/or controlled by persons established in higher ML/TF risks jurisdictions) (see para 108).
48. In performing a risk assessment. life insurers which distribute their products
and services through intermediaries should consider the following:

Size and status of the intermediary - Intermediary operations range from local
sole proprietors to large international organisations. Intermediary

GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR │ 23 © 2018 | FATF organisations sometimes operate as independent enterprises or divisions of insurers or other financial institutions, such as bancassurance. Smaller intermediaries may have less sophisticated AML/CFT framework and may benefit from more direction from the insurer.

Legislative and supervisory approach – Some jurisdictions do not distinguish
between different insurance intermediary categories, and supervision is conducted according to the activity performed. In other jurisdictions, supervision of intermediaries may vary depending on the customer relationship and service offered. Life insurers should consider the status of the intermediaries they work with when assessing ML/TF risks, and especially if they are financial institutions, as defined in the FATF Glossary, regulated, monitored or supervised, for the relevant activities undertaken, by the AML/CFT supervisor.
Role of the intermediary in handling customer’s funds - When identifying the
risk associated with an intermediary, the insurer should also take into account whether the intermediary handles funds directly from the customer - including in relation to handling pay-outs of the contract, or whether the intermediary plays a purely facilitating/introducing role. It should be noted that insurance intermediation may also be facilitated by digital (e.g., online internet portals and mobile phone applications, etc.) or other means (e.g., telemarketing, call centres, etc.).

The risk assessment should be commensurate with the nature, size and
complexity of the business. For smaller or less complex life insurers or intermediaries (for example where customers fall into similar categories and/or where the range of life insurance products offered are very limited), a simple risk assessment might suffice. It should take into account all risk factors, which the life insurer and intermediaries consider to be relevant, including product, geography, distribution and customer risk factors.
Life insurance may be employed for legitimate tax planning purposes. Life
insurers and intermediaries should nevertheless consider tax-related aspects as part of their risk assessment, since certain characteristics of life insurance products may make them attractive to individuals seeking to hide income, commit tax fraud, and evade tax or tax reporting requirement.
Life insurers and intermediaries should define a clear methodology for the
development of their risk assessment, especially in the case of complex organizations such as large, cross-sectoral multinational groups or national multi-business groups.
In the case of life insurers or intermediaries that are part of a group, risk
assessments should take into account group wide risk appetite and framework, where relevant. Depending on the circumstance and local jurisdictional requirements, the parent company should perform a consolidated risk assessment for the entire group, taking into account the geographic situations of each relevant life insurance entity and if any, the legal obstacles preventing foreign entities from applying AML-CFT groupwide procedures, including exchange of information within the group. This will ensure that there is adequate oversight and consistent mitigating measures across all relevant entities of the group. Where applicable, they can consider synergies,

24 │ GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR

© 2018 | FATF interaction and consistency with other risk assessments performed by other internal functions, such as compliance and operational risk management.
53. Where appropriate, life insurers and intermediaries may cooperate, for
example, at an industry or country level to produce guidance to inform the production of their risk assessments.
54. ML/TF risk assessments should be periodically reviewed and refreshed in line
with the requirements of the competent supervisory authority, or guidelines or typologies from national competent authorities, including FIUs, or international bodies. Risk assessments should be reviewed promptly in response to internal factors, such as launch of new product, acquisition, or significant change of characteristics of customers due to a merger; and external factors such as regulatory changes, change in the national or supranational risk assessment, or new/emerging AML/CFT typologies. RISK MITIGATION
55. Having assessed ML and TF risks in their business, life insurers and
intermediaries should then develop and implement mitigating controls proportionate to the ML and TF risks identified and to the complexity, nature and size of the entity. Consistent with the RBA, life insurers and intermediaries should allocate relatively more resources to mitigating their most significant risks.
56. Customer Due Diligence (CDD) processes are intended to ensure that life
insurers and intermediaries know the identity of each customer and related third parties, understand and obtain relevant information on the type of transactions that the customer undertakes; evaluate the intended nature of the business relationship and conduct ongoing monitoring on the business relationship and transactions. This will enable life insurers and intermediaries to assess the overall risk of their business relationships with these parties, associating a dynamic risk rating (i.e. evolving with the nature and level of risks identified) to each overall relationship which will help determine the level of due diligence to be applied to each of the customers.
57. In case of group life insurance policies, when the insured persons have active
powers on the contract (e.g., to inject sums in the contract, establish the beneficiary, exercise early surrender of the amounts), those persons should be considered equal to customers. Life insurers and intermediaries should therefore also conduct CDD on those people, as well as on their related third parties. In cases where the insured persons have no active powers, their names have to be screened against sanctions lists, but it is not mandatory to conduct full CDD checks, unless the legal or regulatory requirement in a particular jurisdiction requires this.
58. Consistent with a risk based approach, life insurers and intermediaries should
subject higher risk customers to more intensive (enhanced) due diligence measures, and should also monitor their subsequent transactions with greater sensitivity. Conversely, a life insurer or intermediary may be able to apply less intense (simplified) due diligence to lower risk customers, if the relationships with those customers are considered lower risk (e.g., customers with no characteristics of ML/TF risks, who hold only lower risk products).

GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR │ 25 © 2018 | FATF
59. Life insurers and intermediaries should be mindful that customer risk profiles
may change, for example if a customer with only low risk products subsequently purchases a higher risk product. Life insurers and intermediaries should have processes in place to trigger more extensive due diligence in these circumstances.
60. Assessments of customer ML/TF risks are performed using a documented,
ongoing process that assigns and updates customer risk ratings. Customer risk ratings can be enhanced through automated solutions that automatically assigns risk scores, and to adjust the level of customer due diligence and monitoring dependent on the scoring. Depending on the nature and complexity of the business, these may not be appropriate for all life insurers and intermediaries. Customer Due Diligence (CDD)
61. Consistent with applicable law, and in line with R. 10, the life insurer’s or
intermediary’s initial CDD procedures should include procedures to:

Identify and verify the identity of each customer, or persons acting on his/her
behalf, before establishing a business relationship;
Identify the beneficial owner(s) of customers and beneficiary (if any), and take
reasonable measures to verify their identity30;
As soon as the beneficiary of the contract is identified/designated, take the
name of the person, or if the beneficiary is designated by category or by class, or by other means, obtain sufficient information to be able to identify the beneficiary at the time of payout but before funds are disbursed. In both cases, the identity of the beneficiary should be verified at the time of the payout. The beneficiary, if known, should be part of the risk factors on the basis of which the life insurer or intermediary will determine if the relationships is higher risk and enhanced due diligence measures should be applied (e.g. in case the known beneficiary is a PEP).
Obtain appropriate information to understand the customer’s circumstances
and business, including the purpose and the expected nature of the relationship (for example for natural persons: income, wealth, profession, activity; for legal entities: financial statement). Considering the risk profile of the customer and of the beneficial owner, life insurers and intermediaries should, if necessary, extend this to the customer’s tax residency.

In accordance with Recommendation 12, in addition to the required checks on
the PEP status of the policyholder, beneficial owner where applicable, and other relevant parties, the life insurer or intermediary should also take reasonable measures to determine whether the beneficiaries of the life insurance policy and/or, where required, the beneficial owner of the beneficiary are politically exposed persons (PEPs). In case of higher risk (assessed for example on the basis of the relationship between the policyholder and the beneficiary identified as PEP), enhanced scrutiny on the whole business relationship should be conducted (especially on the source of funds). These measures should be implemented at the latest at the time of the payment of the benefit and would benefit from being implemented as soon as the beneficiary is known and identified as a PEP. 30 See FATF Guidance on Transparency and beneficial ownership

26 │ GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR

© 2018 | FATF
63. CDD measures also apply to existing customers, and their beneficial owners,
on the basis of materiality and risk, and taking into account whether and when CDD measures have previously been undertaken and the adequacy of data obtained. The various transactions or “trigger events” that occur after the life insurance contract effective date indicate where due diligence should be performed, for example, claims notification, surrender requests, renewal of the policy, assignments and policy alterations, such as changes in beneficiaries, increase of assurance amounts. 31
64. In accordance with R. 10, where life insurers and intermediaries cannot apply
the appropriate level of CDD, they should be required not to enter into the business relationship or instead terminate the business relationship (R.10, para 7). In some countries, some insurance law requirements are difficult to reconcile with the obligation to terminate a business relationship (e.g. term insurance or life insurance tied to mortgage credits). Measures to restrict the services available and prohibit any further transactions on the contracts in question could be considered as an alternative. For example, a contract could be ‘frozen’, and the payment would only be made to the beneficiary once full and proper CDD measures have been successfully conducted. Simplified Due Diligence (SDD)
65. In some lower risk scenarios, and subject to applicable local laws, the standard
level of due diligence may be simplified. Examples of lower risk scenarios are:

Products that only pay out at death and/or in the event of disability;
Customers that are publicly listed companies on exchanges with adequate
disclosure requirements for transparency of beneficial ownership;
Transactions involving de minimis amounts, such as life insurance policies
where the annual premium is no more than USD/EUR 1 000 or a single premium of no more than USD/EUR 2 500;
Insurance policies for pension schemes if there is no surrender clause and the
policy cannot be used as collateral;
A pension, superannuation or similar scheme that provides retirement
benefits to employees, where contributions are made by way of deduction from wages and the scheme rules do not permit the assignment of a member’s interest under the scheme (e.g., small insurance premiums);
Financial products or services that provide appropriately defined and limited
services to certain types of customers, so as to increase access for financial inclusion purposes.

In those situations, SDD may include verifying the identity of the customer and
the beneficial owner after the establishment of the business relationship (e.g., if account transactions rise above a defined monetary threshold); reducing the frequency of customer identification updates; reducing the degree of on-going monitoring and scrutinising transactions, based on a reasonable monetary threshold; not collecting specific information or carrying out specific measures to understand the purpose and intended nature of the business relationship, but inferring the 31 ICP 22 Application Paper, para 42

GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR │ 27 © 2018 | FATF purpose and nature from the type of transactions or business relationship established (R. 10). Enhanced Due Diligence (EDD)
67. In higher risk scenarios, EDD should be performed. Higher risk scenarios could
include, for example, situations involving risk indicators such as the request for a payment to a third-party who is not the beneficiary and has no apparent relationship with him or where multiple surrenders seem to have no apparent economic justification or where the origin of funds is not clear.
68. EDD should include obtaining additional information including on the
intended nature of the business relationship, and on the source of wealth or source of funds of the customer (R. 10). Life insurers and intermediaries should also extend the range of information collected to the customers’ ownership structure, or review his/her tax residency, connected parties or other risk factors; and seeks to independently corroborate customer information through public or other available sources.
69. EDD is also required for business relationships with all foreign PEPs and with
higher risk domestic PEPs or international PEPs. This involves obtaining senior management approval before establishing or continuing the relationship, take reasonable steps to establish the source of wealth and the source of funds and conduct enhanced monitoring on the relationship (R. 12). In instances where higher risks are identified in relation to beneficiaries of life insurance policies or their beneficial owners, R. 12 requires senior management to be informed and enhanced scrutiny to be conducted on the whole business relationship with the policyholder, prior to a payout being made. This includes determining whether filing a STR is appropriate.
70. Additional controls for higher risk situations may include closer monitoring
such as increased monitoring of transactions (frequency, thresholds, volumes, etc.) (R. 10). In some cases, life insurers and intermediaries also require compliance review or approval on the establishment of or the offering of any additional account/policy/contract or relationship, or conduct more frequent customer reviews. Ongoing Risk Monitoring and Mitigation
71. Monitoring involves the scrutiny of activity to determine whether it is
consistent with the information held on the customer and the nature and purpose of the business relationship. Monitoring can be manual, automated or a combination of both. It takes into account all products held by the customer, and also involves identifying changes to the customer risk profile (for example, the customer’s behaviour, use of products and the amount of money involved), and keeping information in relation to this up to date, which may trigger the application of enhanced CDD measures.
72. Not all transactions, accounts/policies/contracts, or customers will
necessarily be monitored in the same way or to the same degree. Where appropriate, insurers or intermediaries may use automated tools to monitor transactions. Life insurers and intermediaries should define adequate thresholds or scenarios to filter out unusual transactions with regard to the risk profile of a given customer. These

28 │ GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR

© 2018 | FATF thresholds or scenarios may change over time based on various factors, such as specific experience with a customer, or new typologies. Reporting Suspicious Transactions
73. If life insurers or intermediaries suspect, or have reasonable grounds to
suspect, that funds are the proceeds of a criminal activity, or related to terrorist financing, they should promptly report their suspicions to the financial intelligence unit. Reporting suspicious transactions is a rule-based requirement which should be made regardless of the amount of the transaction (R. 20).
74. The reason for reporting and dismissing suspicious transactions should be
documented. This process should create a comprehensive audit trail and be maintained according to applicable recordkeeping requirements.
75. The obligation to report suspicious transactions is not risk based, hence life
insurers and intermediaries are obliged to report all suspicious transactions. The act of reporting does not discharge a life insurer or an intermediary of their other AML/CFT obligations. INTERNAL CONTROLS, GOVERNANCE AND MONITORING
76. The senior management and Board of Directors (or equivalent body) are
ultimately responsible for ensuring that the life insurer or intermediary establishes and maintains an effective system of internal controls.
77. The precise nature and extent of AML/CFT controls will depend upon a
number of factors, including the nature, scale and complexity of a life insurer or intermediary’s business, the diversity of its operations, including geographical diversity, its customer base, product and activity profile, the degree of risk associated with each area of its operations and distribution channels, i.e., the extent to which the life insurer is dealing directly with the customer or is dealing through intermediaries, agents, third parties, or in a non-face-to-face setting without appropriate risk mitigating measures. Internal controls Control Environment – Entity Level Controls (Group and Subsidiary)
78. The control environment is the set of standards, policies, processes, and
structures that provide the basis for carrying out internal control across the organization. A life insurer’s or intermediary’ s control environment sets the tone of the entity’s AML/CFT operations, significantly influences the control consciousness of people within the organization and is the foundation for all other components of the system of internal controls. Many of the entity level controls that comprise the control environment are subjected to independent testing and assessment as part of the life insurer’s or intermediary’s annual external financial reporting. Assessment of controls
79. The assessment of design adequacy and operating effectiveness of AML/CFT
controls should be a continuous process within the organization, coupled with a

GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR │ 29 © 2018 | FATF recommended comprehensive assessment and formal conclusion by the AML/CFT officer (see below) regarding the effectiveness of the overall AML/CFT programme. This should occur on a periodic basis and include reporting to the relevant governance body (senior management, and the Audit Committee, if relevant). An effective AML/CFT programme supports the assessment of associated controls reported to senior management and Board (through the Audit and Risk Committees).
80. Governance - Responsibility for the consistency and effectiveness of AML/CFT
controls should be clearly allocated to an individual of sufficient seniority within the life insurer or intermediary to signal the importance of ML/TF risk management and compliance, and to ensure that ML/TF issues are brought to senior management’s attention. Depending on the scale and complexity of the business, this may include the appointment of a skilled compliance officer at the management level. The compliance officer should have the necessary independence, authority, seniority, resources and expertise to carry out these functions effectively, including the ability to access all relevant internal information (including across lines of business, geographies, subsidiaries and agents).
81. There are numerous risk management models that may be used. The life
insurer/intermediary should select the model most relevant to its own business practices. Box 1 below provides an example of an AML/CFT programme supported by the combination of three lines of defence risk model and the COSO internal control framework, both of which have been widely adopted by life insurers globally. Box 1. Example of an Internal Control Framework 1st Line of Defence (Business Front Line Management) – A company’s businesses operational management owns and manages the risks, including AML/CFT risks, inherent in or arising from their business processes, and is responsible for having properly designed and effectively

30 │ GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR

© 2018 | FATF operating controls in place to mitigate significant risks, performing ongoing assessments of internal controls, and promoting a culture of compliance and control. AML/CFT specific activities related to the continuous control assessment might include: (1) Ongoing quality assurance, (2) Tracking training completion, (3) Periodic testing of data feeds into scanning and transaction monitoring systems, (4) Annual selfassessments of risks and controls, (5) Review of routine and ad hoc data analytic reports, and (6) Monthly analysis of key performance indicators. 2nd Line of Defence (Control Functions) – The independent mandates of an organization’s control functions. This generally includes Compliance and Risk, but may also include other support functions such as finance, actuarial and legal. Second line functions typically include setting standards related to the expectations associated with managing and overseeing risks, including compliance with applicable laws, regulatory requirements, policies, procedures, and standards of ethical conduct. In addition, the control functions provide advice and training to the 1st line of defence and establish tools, methodologies, processes and monitoring of controls used by the Businesses to foster a culture of compliance to satisfy those standards. The designated AML Officer and Compliance Function, which may or may not be held by the same person, support their respective businesses by providing regulatory compliance expertise and guidance in an advisory capacity to business management. Specific activities related to the continuous control assessment might include: (1) Coordination and review of 1st line annual AML/CFT risk and control selfassessments, (2) Site visits and ongoing meetings with 1st line, (3) Separate testing of 1st line quality assurance, training, etc. (3) Engagement of outside consultants to perform control assessments, (4) Review and follow-up related findings and action plans stemming from Internal Audit, Regulatory or 3rd party examinations, and (5) Independent challenge related to compliance with new and existing local regulations. The above activities support the AML Officer’s annual report to the organization’s Audit Committee, which includes the overall effectiveness of the AML/CFT Programme for the most recent year. 3rd Line of Defence (Internal Audit) – The Internal Audit function independently reviews activities of the first two lines of defence supported by a risk-based audit plan and methodology generally approved by the Audit Committee of the Board of Directors. The 3rd line’s independent assessment of AML/CFT controls are produced with an overall rating for the audit unit and individual ratings for the specific findings, which form the basis for regular reporting to the Audit Committee and the Chief Auditor’s assessment of the effectiveness of the system of internal controls supporting the overall AML/CFT programme.

GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR │ 31 © 2018 | FATF Policies and Procedures
82. As best practice, policies and procedures should:

Take into account national or sectoral risk assessments to ensure control
processes address the level and types of ML/TF risk in their geographic region;
Place priority on the life insurer’s or intermediary’s operations (products,
services, distribution, customers and geographic locations) that are more vulnerable to abuse, e.g., high premium, cash value products, non-resident policies or products that offer tax advantages to proposers or investors;
Provide for regular review of the risk assessment and risk management
processes;
Ensure that adequate risk assessment and controls are in place before new
products are offered;
Inform senior management of compliance initiatives, identified compliance
deficiencies, corrective action taken, and relevant regulatory reporting (e.g., suspicious transaction reports (STRs);
Focus on meeting all appropriate regulatory record keeping and reporting
requirements;
Be updated regularly to take into account regulatory and operational
developments;
Enable the timely identification and filing of STRs; and
Provide for adequate supervision of employees who handle customer
onboarding, transactions (including non-financial transactions such as assignments), management reporting, grant exemptions, monitor for suspicious activity, or engage in any other activity that forms part of the business’s AML/CFT programme.

Policies and procedures applicable to AML/CFT controls should be consistent
and can be integrated with the broader set of controls in place to address business, financial and operating risks generally. This means that some of the above recommended policies and procedures might be specific to AML/CFT, whereas others might be incorporated into other policies and procedure with broader applications.
For domestic and international insurance groups, and insurers or
intermediaries that are part of financial groups or conglomerates, there should be policies and internal controls in place for a consistent approach to AML/CFT controls across the group. The group policies and guidelines should be further supplemented to include regulatory requirements specific to the local jurisdiction, and take into account the relevant recommendations in the IAIS’s ICP 22, ICP 23 and ICP 2532. Culture and “Tone –from the Top”
The successful implementation and effective operation of a RBA to AML/CFT
depends on strong support and active oversight from senior management. Senior management should promote AML/CFT compliance as a core value by sending clear messages that ML/TF risks should be identified and mitigated before entering into business relationships, and that business relationships should not be established 32 ICP 22 on AML/CFT, 23 on Group-wide supervision and 25 on supervisory cooperation and coordination. Other potentially relevant ICPs are listed in Box 3.

32 │ GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR

© 2018 | FATF when ML/TF risks cannot be properly mitigated and managed in a manner consistent with internal AML/CFT compliance procedures.
86. In the case of international insurance groups, senior management at group
level should ensure that senior management within each entity also promote AML/CFT as a core value.
87. An essential element of “Tone from the Top” is that senior management and
the Board of Directors (or equivalent body) should require and receive periodic updates on the status of AML/CFT compliance programme, review, and engage with those updates. To that end, employees at all levels need to be involved in preventing ML/TF, and the relevant information collected needs to be reported to the top management (e.g. frequency and profile of customers refused based on unsatisfactory/unsuccessful CDD checks; data on customers’ applications escalated to 2nd and 3rd lines of defence; situations where STR filing was considered; frequency and nature of filed STRs etc.). Senior management, with the oversight and support of the Board of Directors (or equivalent body), should also ensure that sufficient compliance resources are in place to meet the requirements of the AML/CFT compliance programme.
88. While responsibility for the consistency and effectiveness of AML/CFT
controls rests with the AML/CFT compliance officer, the execution of these controls is conducted by first line operational staff and is the responsibility of senior and operational management. Senior management is responsible for approving measures needed to mitigate ML/TF risks and for determining the level of residual risk the life insurer or intermediary is prepared to accept; and is responsible to adequately resource the life insurer’s or intermediary’s AML/CFT function. Accordingly, senior management should not only know about the ML/TF risks to which the life insurer or intermediary is exposed but also understand how its AML/CFT control framework operates to mitigate those risks.
89. The top of the governance hierarchy for AML/CFT compliance at the life
insurer or intermediary is the Board of Directors (or equivalent body), which itself or through a Board committee should set the tone for the programme and ensure it is satisfied that senior management has implemented an appropriate AML/CFT compliance programme that is commensurate to the ML/TF risks of the life insurer or intermediary.
90. The responsibilities of the Board of Directors (or equivalent body) of the life
insurer and, in many cases, intermediaries, includes having an awareness of the relevant ML/FT risks. It also requires them to be satisfied that senior management has implemented an appropriate AML/CFT compliance programme that is commensurate to the ML/TF risks of the life insurer or intermediary. This responsibility can be met through periodic updates on the AML/CFT compliance programme being given to the Board or a committee of the Board such as an Audit or Risk Committee.
91. Life insurers or intermediaries are required to have an (external or internal)
independent audit function periodically test the AML/CFT compliance programme with a view to establishing the effectiveness of its AML/CFT policies and processes. A summary of these audits should be included in the periodic AML/CFT updates provided to the Board or Board committee. In the case of international life insurance

GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR │ 33 © 2018 | FATF groups, the Boards of Directors at both group level and individual entity level have these responsibilities. Human Resources - Personnel
92. A life insurer’s or intermediary’s internal control environment should be
conducive to assuring the integrity, competence and compliance of staff through relevant policies and procedures.
93. The level of vetting procedures of staff should reflect the ML/TF risks to which
individual staff are exposed and not focus merely on senior management roles. It is good practice to manage potential conflicts of interest for staff with AML/CFT responsibilities. Training and communication
94. Effective application of AML/CFT policies and procedures depends on the
employees of life insurers and intermediaries understanding the control procedures they are required to follow, and the risks (including possible consequences) these controls are designed to mitigate. It is therefore important that employees, and where relevant intermediaries, receive AML/CFT training, which should be:

Relevant to the life insurer’ or intermediary’s business activities and ML/TF
risks
Up to date with the latest internal and regulatory requirements
Tailored to operational areas of the life insurer or intermediary
Ongoing and not just a one-off exercise when staff are hired
Complemented by updates on AML/CFT requirements and awareness
initiatives

Life insurers and intermediaries should have processes to confirm that
employees have integrity, are adequately skilled and possess the knowledge and expertise necessary to carry out their function.
Senior management and the Board of Directors (or equivalent body) should
also receive periodic AML/CFT training to support their understanding and oversight of the life insurer or intermediary’s AML/CFT programme.
Training should be supported by a communication strategy, which ensures
any changes to policies are notified to all staff and to ensure that staff is periodically reminded of their responsibilities. The communications can be prompted by external or internal issues and can take a number of different forms.

34 │ GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR

© 2018 | FATF
SECTION III – GUIDANCE FOR SUPERVISORS
98. The RBA to AML/CFT aims to develop prevention or mitigation measures
which are commensurate with the ML/TF risks identified. In the case of supervision, this applies to the way supervisory authorities allocate their resources. It also applies to supervisors adapting their functions in a way that is conducive to their own risk assessment of the life insurance market in their country. RISK BASED APPROACH TO SUPERVISION
99. R. 26 requires countries to subject life insurers and intermediaries to effective
systems for AML/CFT supervision and/or monitoring. INR 26 requires supervisors to allocate greater supervisory resources to areas of higher ML/TF risk, on the basis that they understand the ML/TF risk in their country and in the market subjected to their control and have on-site and off-site access to all relevant information for determining insurers or intermediaries’ risk profile. Box 2. Recommendation 26:
Regulation and Supervision of Financial Institutions […..] For financial institutions (insurers) subject to the Core Principles, the regulatory and supervisory measures that apply for prudential purposes, and which are also relevant to money laundering and terrorist financing, should apply in a similar manner for AML/CFT purposes. This should include applying consolidated group supervision for AML/CFT purposes. Other financial institutions (for intermediaries) should be licensed or registered and adequately regulated, and subject to supervision or monitoring for AML/CFT purposes, having regard to the risk of money laundering or terrorist financing in that sector. […..] Understanding and assessing the ML/TF risks Risks, threats and vulnerabilities of the life insurance sector
100. Life insurers’ and intermediaries’ supervisors should develop a deep
understanding of the life insurance market, its products, its structure (including distribution channels), target markets (including domestic and international, if sales to non-residents are permitted) and role in the financial system and the country’s economy to better inform risk assessment of the sector in accordance with the main findings of the national risk assessment.
101. Supervisors should determine whether features of certain life insurance
products, such as the part of investment products (i.e., unit linked as higher risk products), pose a higher ML/TF risk. Amongst other features is the part of lifeinsurance business invested in premium that is concentrated in bank-owned insurance entities. In the case of insurance undertakings that are part of banking groups, there is a leveraging effect of the compliance function by the holding company.

GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR │ 35 © 2018 | FATF Therefore at the group level, similar AML/CFT policies, processes and controls apply to the banking parent company and amongst insurance subsidiaries and branches.
102. A sectoral life insurance risk assessment should be done by the insurance
supervisor by taking advantage of the analyses conducted as part of the national risk assessment process, and of the conclusions of this assessment. This is a continuous process where the sectoral risk assessment will feed into the national risk assessment and vice-versa. Where applicable, supervisors could take into account international typologies and FIU feedback. Supervisors could also look at the risks identified within individual firms and determine how this could impact or whether this is relevant to the national sector as a whole.
103. At a national level, the country and competent authorities should determine
and assess the main characteristics and ML/TF risks of the life insurance sector to determine their approach to supervision. Relevant risks factors may include the following:

Political and legal environment.
Country's economic structure and tax policies.
Cultural factors and the nature of civil society.
Sources, location and concentration of criminal activity.
Size of the life insurance industry.
Composition of the life insurance industry.
Ownership structure of life insurers and intermediaries.
Corporate governance arrangements in life insurers and intermediaries and
the wider economy.
The nature of payment systems and the prevalence of cash-based transactions.
Geographical spread of insurance industry's operations and customers.
Types of products and services offered by life insurers (including, if any, life
insurance wrappers).
Types of customers serviced by life insurers.
Types of most frequently occurring predicate offences.
Amounts of illicit money generated domestically.
Amounts of illicit money generated abroad and laundered domestically.
Main channels or instruments used for ML/TF.
Weight of the informal economy
Risks, threats and vulnerabilities of life insurance products

The sectoral risk assessment should also include determining the potential
risks presented by other products and services delivered by life insurers. Life insurance supervisors should be mindful of the risk associated with certain products

36 │ GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR

© 2018 | FATF or services not specifically being offered by life insurers, but that make use of life insurer services to deliver the product, for example life insurance wrappers.
105. RBA supervision should take into consideration risks, threats and
vulnerabilities associated to each different type of life insurance and investment products available within its life insurance market. In this regards, a good starting point would be to emphasize products which are more often considered as presenting higher risks and specific vulnerabilities to ML/TF. See examples in Tables 1 and 2 above. Risks, threats and vulnerabilities of distribution channels
106. Intermediaries engaged in the business of providing life insurance products
can take different forms and have different status, which will bear on their role and responsibilities in the AML/CFT approach, including for the conduct of the customer due diligence process (see Section II). In all cases, in the RBA context, supervisors should take into consideration the quality of the on-going CDD applied by intermediaries to determine their respective risk profile.
107. Where local provisions permit life insurers to rely on the CDD conducted by
life insurance intermediaries (provided that they qualify as FIs), supervisors should check that life insurers apply appropriate internal controls to these intermediaries to determine if the reliance on third parties is appropriate (R. 17). (See para 16). Risks, threats and vulnerabilities associated to the geographical implantations of life insurers and intermediaries’ part of insurance/financial groups.
108. There is no universally agreed upon definition or methodology for
determining whether a particular country or geographic area (including the country/geographical area within which the insurer or intermediary operates) represents a higher risk for ML/TF. Country/area risk, in conjunction with other risk factors, provides useful information as to potential ML/TF risks. Factors that may be considered as indicators of risk include:

Countries/areas identified by credible sources33 as providing funding or
support for terrorist activities or that have designated terrorist organisations operating within them.
Countries identified by credible sources as having significant levels of
organized crime, corruption, or other criminal activity, including source or transit countries for illegal drugs, human trafficking and smuggling and illegal gambling.
Countries subject to sanctions, embargoes or similar measures issued by
international organisations such as the United Nations Organisation,
Countries identified by credible sources as having weak governance, law
enforcement, and regulatory regimes, including countries identified by FATF statements as having weak AML/CFT regimes, and for which financial institutions should give special attention to business relationships and transactions. 33 “Credible sources” refers to information that is produced by reputable and universally recognised international organisations and other bodies that make such information publicly and widely available. In addition to the FATF and FATFstyle regional bodies, such sources may include, but are not limited to, supra-national or international bodies such as the International Monetary Fund, the World Bank and the Egmont Group of Financial Intelligence Units.

GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR │ 37 © 2018 | FATF Risks, threats and vulnerabilities of individual life insurers and intermediaries
109. In determining the risk profiles of life insurers and intermediaries,
supervisors should take into account multiple factors including:

their business models, including products and services offered, customer base
and characteristics, distribution channels, geographic locations where they operate, and relevant financial information;
controls in place, including governance arrangements, the quality of the risk
management and AML/CFT system, and the effectiveness mitigating measures;
the fitness and properness of the management and holders of
qualifying/controlling interest;

Some of this information can be obtained through prudential supervision
(when the life insurer is subject to prudential supervision), including information collected from reporting entities either off-site or on-site, the results of examinations and supervisory processes etc. This involves appropriate information-sharing and collaboration between prudential and AML/CFT supervisors, especially when the responsibilities belong to two separate agencies. In other regulatory models, such as those focusing on licensing/registration at the national level, but with shared oversight and enforcement at the local level, information sharing should include the sharing of examination findings. Supporting ongoing and effective communication between supervisors and life insurers and distribution channels is an essential prerequisite for the successful implementation of a RBA.
Where relevant, information from other stakeholders such as other
supervisors (including overseas supervisors, the FIU and law enforcement agencies) may also be helpful in determining the extent to which a life insurer or intermediary is able to effectively manage the ML/TF risk to which it is exposed. Box 3. IAIS sources of information for the implementation of a RBA to supervision to life insurance ICP 3 – Information Exchange and Confidentiality Requirements ICP 5 – Suitability of Persons ICP 7 – Corporate Governance ICP 18 – Intermediaries ICP 19 – Conduct of Business ICP 22 – Anti Money Laundering and Combating the Financing of Terrorism ICP 23 – The Group-wide Supervisor ICP 25 – Supervisory Cooperation and Coordination IAIS Application Paper on Approaches to Supervising the Conduct of Intermediaries (November 2016) IAIS Application Paper on the Regulation and Supervision of Captive Insurers (November 2015) IAIS Application Paper on Combating Money Laundering and Terrorist Financing (October 2013)

38 │ GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR

© 2018 | FATF
Mitigating ML/TF risks
112. The FATF Recommendations require supervisors to allocate and prioritize
more supervisory resources to areas of higher ML/TF risk. This implies that supervisors should determine the frequency and intensity of off-site and on-site controls assessments based on the level of ML/TF risks identified, both at sectoral level and the level of individual life insurers and intermediaries, including at group level. Supervisors should give priority to the areas of higher risk, identified either in a particular individual life insurer or intermediary or group; or to life insurers, intermediaries or group operating in a particular life insurance line of business. Moreover, supervisors should regularly conduct targeted inspection on a risk sensitive basis, for example, on certain higher risk business lines, like life insurance products linked to wealth management, or types of customers or on certain parts of AML/CFT systems or policies.
113. A good understanding of the ML/TF risks present in the sector is important to
help supervisors decide the approach to supervision and allocate supervisory resources effectively.34 This understanding should come from a process of continuous evaluation of the sector, to account for new developments and risks.35 In deciding the approach to supervision, supervisors should not be overly reliant on the numbers of on-site visits, but focus on the range, number and quality of supervisory actions.36
114. Examples of ways in which supervisors can adjust their approach include:

Enhancing the amount of information required for registration/authorisation:
if there is an issue of integrity of the sector, supervisors can adjust the level of information they require for the authorisation process in order to prevent criminals or their associates from holding a significant or controlling interest in a life insurer or intermediary. For example, where the ML/TF risk associated with the sector is considered to be low, the opportunities for ML/TF associated with a particular business activity may be limited and thus supervisors may decide to base their approval decisions on a review of relevant documentation. Where the ML/TF risk associated with the sector is considered to be higher, supervisors may ask for additional information.
Adjusting the type of AML/CFT supervision: supervisors should have both onsite and off-site access to all relevant risk (including risk arising from offshore
operations of an insurance group) and compliance information. However, to the extent permitted by their regime, supervisors can determine the correct mix of on-site and off-site supervision of life insurers and intermediaries, based on supervisory findings in previous examinations (either off-site or onsite). Supervisory resources can be allocated to focus on higher risk life insurers and intermediaries. In that case, lower risk life insurers and intermediaries could be supervised off-site, for example through questionnaires. 34 Ireland FATF Mutual Evaluation Report, www.fatf-gafi.org/media/fatf/documents/reports/mer4/MER-Ireland2017.pdf 35 Austria Mutual Evaluation Report, www.fatf-gafi.org/media/fatf/documents/reports/mer4/MER-Austria-2016.pdf 36 Sweden Mutual Evaluation Report, www.fatf-gafi.org/media/fatf/documents/reports/mer4/MER-Sweden2017.pdf

Adjusting the frequency and nature of ongoing AML/CFT supervision:
supervisors should adjust the frequency of AML/CFT supervision in line with the risks identified and combine periodic reviews and ad hoc AML/CFT supervision as issues emerge, e.g., as a result of whistleblowing, information from law enforcement, analysis of financial reporting or other supervisory findings resulting from, for example, general prudential supervision or a life insurer or intermediary’s inclusion in thematic review samples for new business underwriting.
Adjusting the intensity of AML/CFT supervision: supervisors should decide on
the appropriate scope or level of assessment in line with the risks identified, with the aim of assessing the adequacy of life insurers and intermediaries’ policies and procedures that are designed to prevent them from being abused. Examples of more intensive supervision could include: detailed testing of systems and files to verify the implementation and adequacy of the life insurer and intermediary’s risk assessment, CDD, reporting and record keeping policies and processes, internal auditing, interviews with operational staff, compliance and risk, senior management and the Board of directors and AML/CFT assessment in particular lines of business.

Examples of different ways life insurers and intermediary supervisors adjust the
frequency and intensity of ML/TF supervision in line with the risks identified can be found in Annex B.
Supervisors should document and use their findings to review and update
their ML/TF risk assessments and, where necessary, consider whether their approach to AML/CFT supervision and their AML/CFT rules and guidance remain adequate. Whenever appropriate, and in compliance with relevant confidentiality requirements, these findings should be communicated to life insurers and intermediaries, to enable them to enhance their RBA. Supervisors should also consider, where appropriate, sharing good and bad practices with the sector.
In line with R. 26, only for undertakings subject to prudential requirements
(i.e., for life insurers and not for intermediaries) supervisors could consider the results of other prudential or financial supervision in their AML/CFT supervisory activities (see above). Similarly, they should check that the broader prudential findings that drive the overall supervisory strategies of the life insurer are informed by, and adequately address, the findings of the AML/CFT supervisory programme.
Under FATF R. 27 and 35, supervisors should have the power to impose
adequate sanctions on life insurers and intermediaries when they fail to comply with AML/CFT requirements. Supervisors should use proportionate actions, which may include a range of supervisory interventions, including remedial/corrective actions to ensure proper and timely correction of identified deficiencies as well as punitive sanctions for more egregious non-compliance, taking into account that identified weaknesses can have wider consequences. Generally, systemic breakdowns or significant failure in controls will result in a more severe supervisory response. Supervisors should take proportionate and adequate measures taking into account the level of ML/TF risks’ exposure of the entity.

40 │ GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR

© 2018 | FATF
AML/CFT supervision and mitigation of ML/TF risks at group level
119. In implementing supervision at the group level, the supervisor of the parent
entity of an insurance group or a group that includes insurance entity/ies should also develop a RBA to group wide supervision of AML/CFT compliance that is consistent with FATF standards37 and international standards for group-wide supervision.38 This approach should be applicable both to domestic entities and to those with entities in multiple jurisdictions, and should consider, for the purposes of this Guidance, groups headed by an insurer, as well as those headed by another FI (for example, a bank) or by a non-financial entity (including a holding) and who have at least one insurance subsidiary. Supervisors should seek agreement amongst themselves on the identification of the insurance group, including the parent entity, and the scope of group wide supervision to ensure that gaps and duplication in regulatory oversight are minimized. Supervisors should have a holistic approach of the scope of the group.
120. In the case of a group operating in multiple jurisdictions, group supervision
should not lead the home supervisor of the parent entity to extend to affiliates in other jurisdictions the application of AML/CFT requirements to non-life insurance, when this is the case in the home jurisdiction. In any case, the home supervisor should take into consideration the peculiarities of local ML/TF risks and laws, and AML/CFT policies of the various jurisdictions where the group operates.
121. In the case of a mixed group of banking and insurance entities at national level
which involves more than one competent supervisor, coordination and cooperation amongst banking and insurance supervisors are encouraged.
122. To facilitate effective group supervision, supervisors are encouraged to
implement effective mechanisms for information exchange, including relevant information related to AML/CFT impacting one or more entities within the group, or the group itself. Supervisory colleges may wish to consider a structure for information sharing, in accordance with IAIS guidance,39 and supervisory colleges dedicated to AML/CFT could be envisaged on a risk-sensitive basis (taking into account the size, nature and ML/TF risks of the group). It is on the responsibility of the parent entity to organize the sharing of information at group level without prejudice to local laws.
123. The challenges in terms of sharing of information within the group and other
responsibilities amongst the competent supervisors and authorities from the relevant jurisdictions should also be considered. When obstacles to information sharing exist due to local laws, those obstacles should be made known to the supervisory authorities of the parent entity, in line with R.18.
124. Supervisors of the parent entity (or group-wide supervisors) should identify
the group’s life insurance entity or entities that may be more vulnerable to ML/TF, in cooperation with supervisors of these entities. The college of supervisors (or other means if a college is not established) should discuss and evaluate the overall ML/TF risks both at national and international level. To encourage a comprehensive overview of risks in this process, the supervisors of the parent entity may wish to focus on a consolidated risk sensitive basis. Supervisory activities should include information requests on policies and operational issues relevant to the ML/TF risks 37 See R. 18 and R. 26. 38 See ICP 22 and 23 of IAIS and in the case where the parent entity is a bank, see BCBS CP 8 and 12. 39 IAIS Application Paper on Supervisory Colleges (2014).

GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR │ 41 © 2018 | FATF and AML/CFT internal processes and procedures, on-site inspections within the group, and formal discussions with the board, senior management and person in charge of compliance of the group and of single entities, in cooperation with competent supervisors.
125. Where the group is operating internationally, cooperation and coordination
expectations are encouraged. Cooperation and coordination should include information sharing regarding the exposure of the entities in the group to ML/TF risks. The home supervisor should, in cooperation with the host supervisor(s), consider the option to inspect overseas branches and subsidiaries (subject to the laws of the jurisdiction that the overseas branch/ subsidiary operates in). Where applicable, the home supervisor may wish to share the main findings of such inspection with the host supervisor.
126. When the group is exposed to excessive ML/TF risks that, in the view of the
home supervisor in consultation with the host supervisor, cannot be properly managed (for example, because of legal impediments to implement group-wide policies and procedures in one or more entities of the group, or to exchange information within the group), supervisors of the parent entity may limit the range of activities of the group and subject it to escalating supervisory measures, including directing the financial group to close the foreign offices in extreme cases.40 AML/CFT Supervision of life insurers and intermediaries sharing the same risk profile and characteristics
127. In adopting a RBA to supervision, countries and competent authorities may
choose to consider allocating supervised entities which share similar characteristics and risk profiles into groupings41 for supervision purposes. Examples of characteristics and risk profiles could include the size of business, type of customers serviced, geographic areas of activities and delivery channels. The setting up of such groupings could allow competent authorities to take a comprehensive view of the life insurance sector, as opposed to an approach where the supervisors concentrate on the individual risks posed by the individual life insurer or intermediary. If the risk profile of a life insurer or intermediary within a grouping changes, the supervisor may wish to reassess the supervisory approach, which may include removing the life insurer or intermediary from the grouping. SUPERVISION OF THE RISK BASED APPROACH General Approach
128. It is important that supervisors discharge their functions in a way that takes
into consideration the adoption of a RBA by life insurers and intermediaries. This implies that supervisors have to take steps to check that their staff is equipped to assess whether a life insurer’s or an intermediary’s policies, procedures and controls are appropriate and proportional in view of the life insurer’s or the intermediary’s risk assessment and risk management procedures. Supervisors should ensure that 40 See FATF Guidance on Private Sector Information Sharing 41 Groupings are also designated as “clusters” in some jurisdictions

42 │ GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR

© 2018 | FATF the life insurer or the intermediary adheres to its own policies, procedures and controls, and that decisions are made using sound judgment so that the life insurer or intermediary manages the ML/TF risks it is exposed to appropriately. It also implies that supervisors articulate and communicate clearly their expectations of the measures needed for life insurers and intermediaries to comply with the applicable AML/CFT framework. The aim is that supervisory actions are in most cases predictable, consistent and proportionate and to this end, training of supervisory staff and the effective communication of expectations to life insurers and intermediaries are key points.
129. The comprehensive understanding of ML/TF risks faced by the sector and by
individual (or groupings of) life insurers and intermediaries allows supervisors to form a sound judgment about the proportionality and adequacy of AML/CFT controls set up by the obliged entities. As part of their supervisory procedures, supervisors should communicate their findings and views about the individual life insurer’s or intermediary’s AML/CFT controls or about the group wide AML/CFT policies and procedures. Supervisors should be able to provide appropriate guidance to reporting entities on the flexibility available under a RBA. They could also provide further guidance where appropriate, especially in cases where supervised entities engage in instances which go beyond the law (also called conservative or over-compliance; for instance, refusing to on-board PEPs).
130. In order to support supervisors’ understanding of the overall strength of
measures in the life insurance sector, comparative analysis between life insurers’ and intermediaries’ AML/CFT programmes could be considered as a means to inform their judgment of the quality of an individual life insurer’s or intermediary’s controls. Supervisors should note, however, that under the RBA, there may be valid reasons why AML/CFT controls differ among life insurers and intermediaries. Hence, supervisors should be equipped to evaluate the merits of these differences, especially when considering comparable entities with differing levels of operational complexity.
131. In the context of the RBA, the primary focus for supervisors should be to assess
whether the life insurer or the intermediary, in its own risk assessment, has reasonably and fairly gauged the ML/TF risks to its business, taking into account the characteristics of its products, customers, transactions, type of distribution channel, and origin and destination of funds. In addition to the overall sector risk, supervisors should take into account the individual business circumstances (risk profile of the business relationships). Supervisors should also determine whether or not the life insurer’s or intermediary’s AML/CFT compliance and risk management programme is adequate to a) meet the regulatory requirements, and b) appropriately and effectively mitigate and manage the risks. Supervisors should assess whether the entity’s risk assessment is effectively implemented in its CDD process and AML/CFT systems and monitoring and assess the robustness of its internal control measures and procedures dedicated to AML/CFT. For example, in their on-site inspections, the CDD process should be tested through the examination of some customers’ files.
132. Moreover, the supervisor should consider the adequacy of the on-going
monitoring conducted by the life insurer or the intermediary with the risk’s profile of the supervised entity. This could involve checking, through off-site and on-site supervisory activities, that supervised entities have duly implemented clear procedures and measures to monitor transactions on an ongoing basis, taking into

GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR │ 43 © 2018 | FATF account nature and level of risks. Transaction monitoring should be commensurate to the risk identified. Training and awareness
133. Training is important for supervision staff in order to have appropriate
knowledge of the applicable legal/regulatory AML/CFT framework and to understand the life insurance sector and the various business models that exist. In particular, supervisors should ensure that staff are suitably qualified and trained to assess the quality of life insurers’ and intermediaries’ ML/TF risk assessments and to consider the adequacy, proportionality, effectiveness and efficiency of life insurers’ and intermediaries’ AML/CFT policies, procedures and internal controls in light of their risk assessments.
134. Training should also aim at achieving consistency in the supervisory approach
at a national level, in cases where there are multiple competent authorities or when the national supervisory model is devolved or fragmented. Supervision staff may also benefit from knowledge sharing among competent authorities.
135. Supervisors should make sure that staff’s AML/CFT expertise remains up to
date and relevant, and includes awareness of emerging risks as appropriate. Guidance
136. Supervisors should communicate their expectations of life insurers and
intermediaries’ compliance with their legal and regulatory obligations, after engaging in a consultative process with relevant stakeholders. This guidance may be in the form of high-level requirements based on desired outcomes, risk-based rules and information about how supervisors interpret relevant legislation or regulation, or more detailed guidance about how particular AML/CFT controls are best applied.
137. Additionally, supervisors should consider issuing proportional guidance to
different types of life insurers and intermediaries that take into account the level of inherent risk including the nature and complexity of the life insurers and intermediaries’ products and services, their size, business model, corporate governance arrangements, financial and accounting information, delivery channels, customer profiles and geographic footprint.
138. Supervisors should recognize that some life insurers and intermediaries may
have limited experience in, or ability to, identify relevant ML/TF risk factors. Life insurers and intermediaries with lower capacity may need specific and more practical guidance, in particular regarding how to conduct a risk assessment and implement a RBA. Supervisory guidance could include tools that enable small and emerging life insurers and intermediaries with lower capacity to undertake assessments and develop risk mitigation and compliance management systems to meet their legal obligations.

44 │ GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR

© 2018 | FATF
139. Supervisors should also consider including in their guidance for life insurers
and intermediaries information on how to comply with their legal and regulatory AML/CFT obligations in a way that fosters financial inclusion.42
140. Supervisors should consider liaising with other relevant domestic regulatory
and supervisory authorities to secure a coherent interpretation of the legal obligations and to minimize disparities. This is particularly important where more than one supervisor is responsible for a given sector (for example, where life insurers and intermediaries are supervised by two different agencies or in separate divisions of the same agency). Multiple guidance should not create opportunities for regulatory arbitrage, loopholes or unnecessary confusion among life insurers and intermediaries. When possible, relevant regulatory and supervisory authorities should consider preparing joint guidance.
141. Examples of different approaches to insurance supervisory guidance can be
found in Annex C.
Supervisory enforcement actions and sanction
142. When applying enforcement actions and supervisory sanctions, supervisors
should take into account the level of mitigation of ML/TF risks by life insurers and intermediaries while using RBA. In fact, AML/CFT shortcomings could be due to inadequate RBA implementation by the entities (see Box 4 for an example of sanctions issued by the French Supervisor, first bullet point on insufficient analysis of the ML/TF risks). Box 4. Example: sanction against a life insurer in France Disciplinary sanctions –blame and pecuniary sanction- were imposed to a life insurer for serious failures in its AML/CFT system and policy, in particular in:

The business-wide risk assessment established by the institution which did
not take into account all of the ML/TF risks it was exposed to, especially those related to the customers and the activities (those gaps translated into vigilance failures with regards to the business relationships);
The on-going monitoring system was insufficient for efficient detection of
atypical and suspicious transactions;
The customer due diligence measures and in particular, cases of absence of
verification of the identity of the beneficial owner and insufficient knowledge of the business relationships;
The detecting process of politically exposed persons which was inefficient;
42 November 2017 FATF Guidance on AML/CFT measures on Financial Inclusion (focus on CDD measures); June 2017 Joint IAA-IAIS project on Actuaries and Inclusive Insurance, FIRST Initiative; October 2012 IAIS Application Paper on Regulation and Supervision supporting Inclusive Insurance Markets; November 2015 IAIS Issues Paper on Conduct of Business in Inclusive Insurance; November 2017 IAIS Application paper on Product Oversight in Inclusive Insurance ; June 2018 IAIS Issues Paper on Index-based Insurances particularly in Inclusive Insurance Markets.

The reporting of suspicious transactions, with identification of several
suspicious transactions of high amounts for which no STR has been performed.

When asset repatriation, voluntary tax compliance programmes or tax
amnesty incentives are in place43, the risks of misuse of such programmes for ML purposes is significant. Supervisors should therefore pay particular attention to elements of tax-related fraud while considering and applying enforcement actions or sanctions. See Box 5 for an example from the French supervisor (ACPR). Box 5. Example: sanction against a life insurer in France involving potential tax requirements breaches Life insurer breaches of the duty to report suspicious transactions, with identification of several suspicious transactions of high amounts involving repatriation of funds potentially linked to tax breaches for which no STR had been performed.
See FATF Best practice paper on managing the AML/CFT policy implications of voluntary tax compliance
programs (revised 2012).

46 │ GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR

© 2018 | FATF
ANNEX A. EXAMPLES OF RISK FACTORS RELEVANT FOR THE ML/TF RISK ASSESSMENTS OF
INSURANCE ENTITIES
144. This Annex provides examples of different categories of risk factors relevant
in an insurance context, highlights red flags and outlines mitigating factors which an insurer or intermediary may wish to take into account when performing risk assessments. The same risk may be regarded as higher in one jurisdiction while in another jurisdiction it may be regarded as lower risk depending on the circumstances prevailing in the jurisdiction. This Annex should be read in conjunction Section II of this Guidance, as well as the applicable national and sectoral risk assessments.
145. Where a risk factor is coupled with one or more red flag indicators, insurers
and intermediaries may wish to apply a more stringent approach to CDD and monitoring. The following are risk factors which an insurer or intermediary can consider when performing their risk assessment. The overall risk level of a business relationship is usually the result of a combination of several risk factors. By exception, it could be based on one single risk factor, if deemed significant. Product risk factors
146. Product risk is assessed by identifying how vulnerable a product is to money
laundering and terrorist financing based on the product’s design. Product risk should be assessed periodically and when significant changes are made to product offerings (including the development of new products/services). Product risk is a significant factor in identifying unusual activity.
147. The following table describes attributes used to assess the vulnerability of
product offerings and provides lower and higher risk examples.
Attribute Lower risk example Higher risk example Ability to hold funds or transact large sums Product design that does not hold a balance or can’t be withdrawn against, such as group benefits Product design that allows funds to be held on behalf of the customer; high-value or unlimited-value premium payments, overpayments or large volumes of lower value premium payments Customer anonymity or third-party transactions Product design that only allows transactions from customers with identification, or where all funds flow back to customer Product design that allows deposits and payments by third parties or that provide for nonface-to-face transactions (for example, mobile apps if payment source unknown) Liquidity Product design that includes significant fees or other penalties for early withdrawals Product design that has no (or no significant) fees or other penalties for early withdrawal

GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR │ 47 © 2018 | FATF Attribute Lower risk example Higher risk example Time horizon Products that are typically held for a long period of time, such as years, until retirement or death Products that are typically held for a shorter time period Purpose and intended use of product Product design makes it easy to identify if products are not being used as intended Product design makes it difficult to identify if products are not being used as intended
148. The following product features tend to increase the risk profile of a product:

Flexibility of payments, for example the product allows payments from
unidentified third parties or high-value or unlimited-value premium payments, overpayments or large volumes of lower value premium payments or cash payments;
Ease of access to accumulated funds, for example the product allows partial
withdrawals or early surrender at any time, with limited charges or fees;
Negotiability, for example the product can be traded on a secondary market or
used as collateral for a loan; and
Anonymity, for example the product facilitates or allows the anonymity of the
customer.

The following product features tend to decrease the risk profile of a product:

Product only pays out against a pre-defined event, for example death, or on a
specific date, such as in the case of credit life insurance policies covering consumer and mortgage loans and paying out only on death of the insured person;
No surrender value;
No investment element;
No third party payment facility;
Total investment is curtailed at a low value;
Life insurance policy where the premium is low;
Accessibility only through employers, for example a pension, superannuation
or similar scheme that provides retirement benefits to employees, where contributions are made by way of deduction from wages and the scheme rules do not permit the assignment of a member’s interest under the scheme;
Product cannot be redeemed in the short or medium term, as in the case of
pension schemes without an early surrender option; and
No cash payments.

48 │ GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR

© 2018 | FATF
Service and transaction risk factors
150. Service and transaction risk can be assessed by identifying how vulnerable a
product is to use by a third party or unintended use based on the methods of transaction available. Service and transaction risk is influenced by product design. Understanding potential service and transaction risks in the business is a significant factor in recognizing unusual activity at a customer level.
151. Service and transaction risk is considered higher when the features or services
of a product make it possible for customers to use the product in a way that isn’t consistent with the purpose of the product. For example, an insurance policy with investment funds may be intended as a long-term investment, but could be vulnerable to frequent transactions because it allows for low fee transactions and there may be no disincentive to withdrawing money at any time.
152. The following tables describe attributes used to assess service and transaction
risk and provide lower and higher risk examples.
Attribute Lower risk example Higher risk example Difficulty to trace ownership of funds Preprinted cheques, bill payments, EFT payments with verified banking records Cash, bank drafts in bearer form, travellers cheques, and counter cheques (where the ownership information is handwritten or typed in a different font than the rest of the cheque) Potentially: Some Digital Currencies Customer is not the payer or recipient of the funds The funds are moved from or to another financial institution The third party paying or receiving funds has not previously been disclosed Payment source or recipient is based outside of country The recipient or payer is the owner and is in a low risk country The recipient or payer is the owner and is in a higher risk country The recipient or payer is a third party outside of country (More difficult to trace or confirm source of funds) Number of transactions Low number of transactions or transaction frequency that is typical for the product. Large number of transactions back and forth with the customer or third parties is normal for the product design Transactional patterns Regular and expected customer account activity. Significant, unexpected and unexplained change in the customer’s typical activity, such as early surrenders or withdrawals is a service offered.

GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR │ 49 © 2018 | FATF Distribution / intermediary channel risk factors
153. The distribution channel is the method a customer uses to open a new policy
or account. The distribution channel risk is identified by assessing how vulnerable the channel is to money laundering or terrorist financing activities based on attributes that may make it easier to obscure customer identity.
154. The risk of failing to correctly identify a customer may be higher for
distribution channels that use an intermediary, or do not require face-to-face contact. Depending on product, distribution channel risk is mitigated using distributors who are also subject to AML/CFT legislation, which requires a compliance programme to be in place, or a pension scheme subscribed through the customer’s employer.
155. The following table describes attributes used to assess the vulnerability of a
distribution channel and provides lower and higher risk examples. Attribute Lower risk example Higher risk example Distributor has AML/CFT obligations Distributor is overseen by a regulatory authority and subject to AML/CFT laws equivalent to life insurer or stronger Distributors not subject to AML/CFF requirements Payment to life insurer Customer pays Life Insurer directly from their account at a bank or securities dealer Customer pays a distributor, who then pays the Life Insurer. Risk: The intermediary obscures the source of payment. Direct relationship of customer to Life Insurer Contracted agents and banking consultants Products distributed by Life Insurer employees No face-to-face relationship with Life Insurer employee or an agent. For example, trusts or insurance sold by telephone or online without adequate safeguards for confirmation of identification.

The following distribution/intermediary risk factors may contribute to higher
risk:
o Non-face-to-face sales, such as online, postal or telephone sales, without adequate safeguards to mitigate the risks of identity fraud; o The intermediary is involved in the management of claims. o Long chains of intermediaries; and

50 │ GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR

The following factors may contribute to lower risk:
o Distribution is done through certain companies that have a contract with the insurer to provide life insurance for their employees, for example as
part of a benefits package.
Geographic risk factors

Life insurers should periodically assess geographic risk by identifying how
vulnerable the business is to money laundering or terrorist financing activities based on business connections to regions and countries which are perceived to present a higher risk (see para 108). Customer risk factors
Customer-based risk factors are assessed to evaluate the level of vulnerability
to money laundering and terrorist financing threats posed by customers based on their characteristics. Understanding the inherent risks helps us effectively identify appropriate mitigating controls and manage residual risks. Customer risk factors combined with business risk factors, can be used as criteria for risk scoring to identify high risk customers. Customer based risk factors include:

Customer identity
Third party involvement
Customer’s source of wealth/funds
Politically exposed customers
Known criminal or terrorist

The following table describes customer-based risk attributes used to assess
vulnerability to money laundering and terrorist financing.
Attribute Lower risk example Higher risk example Identification Customer provides photo identification or can be identified using third party sources Customer has difficulty producing identification or the authenticity of the identification provided is questionable Third party relationships No third party involvement Controlled by a third party, or multiple indicators of third party deposits or payments Controlled by a Gatekeeper without any interaction with the beneficial owner

GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR │ 51 © 2018 | FATF Attribute Lower risk example Higher risk example Customer’s legal form Customer is a living person Customer is a large, publicly traded legal entity with clear ownership and control Customer is a legal entity with a complex structure difficult to ascertain those who own or control the entity. Policy holder and/or the beneficiary of the contract are companies with nominee shareholders and/or shares in bearer form Source of funds and wealth; including occupation or business type Customer’s business type or occupation is in a lower risk industry Customer’s business or occupation is in a higher risk industry (such as involved in one or more of cash intensive business, international exposure or associated with crime typologies) Customer’s business or occupation is associated with a lower income for a high value deposit without a confirmed source of funds/wealth (inheritance/ real estate/ beneficiary of insurance) Depth and duration of relationship with customer Customer has a long history with the life insurer or its agents and additional information is on file (such as credit underwriting, life insurance underwriting, KYC) Customer is new to life insurer with little or no experience with the customer. Customer only holds accounts with lower risk products and services Customer holds policies or accounts that are registered with the government, e.g., Registered Retirement Savings Plan Customer only holds nonregistered policies or accounts, e.g., investment or bank account with an affiliate

52 │ GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR

© 2018 | FATF
Attribute Lower risk example Higher risk example Attribute Lower risk example Higher risk example Other factors Customer does not have negative news media or media confirms what is known about the customer (such as career confirmation or community engagement) Customer has ties to or is on a designated sanctions list. Customer has a history of predicate offences or is associated with negative news. Political exposure Customer does not have any ties to politically exposed persons Customer is considered a politically exposed foreign person Customer identity
159. Customer identity risk refers to the risk that the life insurer is doing business
with a customer who is not who they say they are, or is involved with money laundering or terrorist financing.
160. To mitigate customer identity risk, the identity of customers may be
ascertained by reviewing customer identification and the customer profile is supplemented with underwriting information or any existing relationships with the customer.
161. The customer profile may include:

The length of customer relationship with the insurer;
History of suspicious or unusual transactions;
Negative news which may affiliate the customer with allegations of criminal
behaviour; and
Notices or requests from law enforcement.
Red Flags for customer risk factors
Customers that are legal entities whose structure makes it difficult to identify
the ultimate beneficial owner or controlling interests. (Note: This can happen at inception or, subsequently, an individually owned insurance policy can be assigned to a legal entity. KYC/CDD processes should apply at both stages.)
Policy holder and/or the beneficiary of the contract are companies whose
structure makes it difficult to identify the beneficial owner, e.g., multiple layers or because the entity’s ownership structure crosses jurisdictions;

Policy holder and/or the beneficiary of the contract are companies with
nominee shareholders and/or shares in bearer form;
Occupation with a low average income and the policy has high ongoing
deposits
A history within an occupation with a higher risk for ML/TF due to local crime
typologies, high access to cash based businesses or international exposure
Customers who are reluctant to provide identifying information when
purchasing a product, or who provides minimal or seemingly fictitious information.
Customer transfers the contract to another insurer; (low risk after a long
relationship, higher risk if after a short period of time, especially with high fees)
Insurer is made aware of a change in beneficiary only when the claim is made;
and Customer incurs a high cost by seeking early termination of a product; and
Customer’s request to change or increase the sum insured and/or the
premium payment are unusual or excessive.
Third party involvement

Third party involvement in an insurance product may increase the money
laundering and terrorist financing risk, as unknown parties may have an interest in, or control of the policy or account.
When an unusual transaction or series of transactions involving a third-party
source or recipient of funds is identified, additional information similar to customer due diligence may help mitigate risk. Enhanced due diligence steps can include requesting the relationship to the customer, the involvement with the policy or account, and the source of wealth. Some products do not allow or restrict deposits or payments by third parties. Third party Red Flags

Gatekeepers such as accountants, lawyers, or other professionals holding
accounts/policies/contracts at an insurer, acting on behalf of their customers, and where the insurer places unreasonable reliance on the gatekeeper.;
Customers who assign or otherwise transfer the benefit of a product to an
apparently unrelated third party; and
Customer changes the beneficiary clause and nominates an apparently
unrelated third party.
Payments are regularly received from third parties that are no apparent
relationship with the policy holder.
Customer’s source of wealth

To mitigate the risk of not understanding the customer’s source of wealth, life
insurer risk based approach programmes may monitor higher value transactions, and responds to red flags by reviewing for consistency with the customer’s source of wealth in combination with the customer’s:

54 │ GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR

Policies and accounts with the insurer; and
Business type, occupation and industry, geographic residency and political
exposure.
Geographic risk

A customer’s geographic location or connections may indicate higher risk for
money laundering or terrorist financing activities. To mitigate risk, controls are recommended based on domestic and international geographic risk factors. Domestic geographic risk factors
Where data is available, the assessment of higher domestic geographic risk
based on data from internal insurer historical case experiences or government data based on crimes applicable to money laundering and other predicate offenses by region can be used as a risk factor or within monitoring programme. Attribute Lower risk example Higher risk example Higher crime regions Customer does not reside in a region with higher frequency and severity of crimes with money laundering risk Customer resides in a region with high frequency and severity of crimes with money laundering risk History of high risk activity or fraud Customer does not reside in a region that experiences a higher incidence of high risk activity or fraud Customer resides in a region that experiences a higher incidence of high risk activity or fraud International geographic risk factors
Customer risk is higher among customers with connections outside country,
especially connections to higher risk countries (see para 108).
Attribute Lower risk example Higher risk example Foreign tax or physical residency of customer Countries risk ranked as low by the Life Insurer Countries risk ranked as high by the Life Insurer Foreign ties or transactions Customer does not have any indicators of foreign residency or transactions outside of country Customer has requested or performed transactions with ties to high risk countries

Geographic risk: significant and unexplained geographic distance between
residence or business location of the customer and the location where the product sale took place (or the location of the insurer’s representative).
Has the customer provided certification of their domestic tax residency that is
supported by other information that the insurer or intermediary knows about the customer?
What is the tax residency of the customer
Are all communications sent internationally without foreign residency ties
Does the source of wealth, source of funds or other known relationship include
ties to higher risk countries?
Death claim payments to a beneficiary residing in a high-risk country due to
terrorism.
Premiums and/or settlements are paid through accounts held with financial
institutions established in jurisdictions associated with higher ML/TF risk; and
Intermediary is based in, or associated with, jurisdictions associated with
higher ML/TF risk

56 │ GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR

© 2018 | FATF
ANNEX B. EXAMPLES OF DIFFERENT SUPERVISORY PRACTICES FOR THE IMPLEMENTATION OF
THE RBA
Bermuda
168. All life insurers (insurers) are required to file an Anti-Money
Laundering/Countering Financing of Terrorism (AML/CFT) annual return as part of their annual statutory filing. Broadly, the annual return requires an insurer to provide a range of information which includes the insurer’s Inherent Risk (i.e., customer type, the products and services it offers, geographic distribution of its customers and/or beneficiary owners, and channels of distribution). The insurer is also required to provide information about the controls it has in place (Control Effectiveness), including corporate governance structure, internal controls, AML/CFT policies and procedures, employees’ level of experience, integrity, AML/CFT training and knowledge, and other measures taken by the insurer to monitor and/or reduce its ML/TF risk exposure. The information obtained from the annual returns helps the BMA to identify and achieve a better understanding of each individual insurer’s exposure or potential exposure to ML/TF risks.
169. The annual return is embedded within the insurance prudential statutory
return. This allows both the AML/CFT and prudential supervisors to have a holistic view of the insurers’ risk, and eliminates any duplication of information and reduces the burden on insurers since they will only be required to file a single statutory return. In addition, asking insurers to integrate their AML/CFT and prudential filings will ensure ML/TF risk is intrinsic to the insurer’s universal risk management and prioritisation framework.
170. The BMA also takes into consideration the size (Exposure Level) of each
insurer. The exposure level adjustment is built upon the basis that the size of the insurer directly correlates with the level of ML/TF it is exposed to in light of the insurer’s volume and/or size of activities. Larger insurance entities can also be systemically important institutions that can adversely impact the stability of the sector if major ML/TF events were to occur, with downstream effects on the reputation of Bermuda.
171. In addition, the BMA’s understanding of ML/TF risks is further enhanced and
refined through information obtained from onsite and offsite results, insurers’ independent AML/CFT audit reports , enforcement actions, and information from other local competent and law enforcement authorities (Other Variable). Furthermore, and to facilitate comparison of the insurance entities with other AML/CFT regulated entities outside the life insurance sector, the BMA takes into consideration the risk inherent within the life insurance sector as a whole in comparison to the inherent risk of other sectors. The sectorial inherent risk is largely based on the National Risk Assessment (NRA) results. The NRA results are used to inform and cross-calibrate the overall understanding of ML/TF risk within the life insurance sector.
172. The BMA assesses this information using an internally-developed risk
assessment model (the Model), an analytical tool providing a formal and systematic process for assessing the level of ML/TF risk in a consistent way across all insurers. As a mathematical function, the model calculates the insurer’s entity risk score (ERS) using the following equation:

GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR │ 57 © 2018 | FATF ERS = (IR – CE) x EL +/- OV Whereby:
IR = Inherent Risk
CE = Control Effectiveness
EL = Exposure Level
OV = Other Variables
IR – CE = RR (Residual Risk)
173. After taking into consideration all the factors described above, the BMA Model
derives the insurer’s ML/TF risk score broadly classified as low, medium or high risk. The weight allocated to each factor is determined based on the importance and or materiality of that factor in assessing the overall ML/TF risk of the insurer. These results constitute the basis for further actions taken by the BMA. It enables the BMA to give priority and allocate more supervisory resources to insurance entities of higher ML/TF risk, and determine the frequency, scope and intensity of periodic assessments (including offsite monitoring and onsite reviews) of an insurer’s ML/TF risk. France
174. On the assessment on ML/TF risks, the ACPR issues an annual AML/CFT
questionnaire to be submitted by life insurers and groups (as well as banking entities and groups). The questionnaire was reviewed to include a dedicated part to specific AML/CFT risk based approach, which takes into account that insurers are required to undertake of their own a risk assessment including products, channels, transactions and characteristics of customers and to extend the type of statistics information in line with AML-CFT activity/system. Additionally, insurers (as well as banks) are requested to submit annually an internal control report dedicated to AML-CFT aspects. The ACPR determines a risk profile for each life insurer, taking into account answers to the annual questionnaire, the analysis of the internal control report, and where an inspection has been performed, the results of on-site inspection and information received. For intermediaries that are small entities and that do not receive funds, the ACPR also determines a risk profile at the level of a cluster.
175. At the sectoral level, the ACPR has undertaken a review of the sectoral risk
assessment by analysing and aggregating the responses submitted to the aforementioned questionnaire and from the outcomes of insurer internal control reports. The ACPR engages with the private sector and other public authorities within dedicated consultative fora. The ACPR supports a cross-sectoral approach in AMLCFT (including both banking and insurance sectors) since a lot of banking institutions in France are distributing insurance contracts on behalf of insurers and a lot of them are bancassurance entities.
176. The areas of inspection in the insurance sector are currently driven by risk
factors. On average, on-site missions are performed on seven to ten insurance companies annually. Over the past years, targeted missions which focused on specific risk areas were carried out.
177. At an insurance group level, the ACPR has carried out off-site inspections, in
particular in the context of the Panama papers. The ACPR has also conducted on-site

58 │ GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR

© 2018 | FATF inspections at the parent undertaking group level, including extended inspections at certain foreign entities, with the authorization of the competent host country authority. These inspections aim to ensure that groups are effectively managing the risks inherent in business undertaken by foreign entities, and to supplement action taken by authorities in the host country, which are responsible for checking that locally applicable AML/CFT arrangements are properly implemented.
178. More generally, in the insurance sector, inspections mainly have focused on
large life insurers and a few brokers, particularly following reports to the ACPR by TRACFIN. Specific focus was given to due diligence measures implemented by institutions with regard to the repayment of bearer guaranteed investment contracts, which carry a higher risk of money laundering and legal persons or arrangements as customers and the issue of identification of BOs. Netherlands Example 1: Off-site AML/CFT thematic review of branches of life insurance companies
179. In 2016, DNB has conducted an off-site thematic review in which it
investigated by means of a short survey all branches of life insurance companies who have been notified in the Netherlands, among which six life insurance companies. The questionnaire consisted of approximately 50 questions and focused on both compliance with AML/CFT legislation and compliance with sanctions legislation. The overall outcome was that most branches are familiar with the Dutch AML regulation. In certain cases improvement to the internal AML/CFT compliance procedures of the branches was needed, for example with respect to the PEP detection process or the reporting of unusual transactions to the FIU. This has been addressed. Some issues in relation to non-compliance with sanctions law legislation were followed up by the supervisor. Example 2: Sectoral risk analysis Insurance Companies
180. The Dutch insurance supervisor annually performs a sector-wide analysis
amongst insurance companies by sending them a questionnaire. The aim of the project is to acquire data-driven input to determine signal values for non-financial risks. This project focuses on the following non-financial risks:

Business models and strategy,
Information technology,
Operational,
Governance, behavior & culture,
Integrity (including AML/CFT and sanction law)

The output of the analysis is one of the indicators that is be used to determine
the ultimate risk score of an insurance company. Other indicators that can be combined with the signal value are results of studies and signals from the regular supervision.
The ultimate aim of the project is to achieve:

Structured, data-driven input for the context or focalizes for non-financial
risks, signal value, prioritization, and direction to further research. In addition, also make the development visible over time, per institution and sector-wide.

Increase of awareness of the sector with regard to these risks and risk
management.
Reduction of inherent risks and / or improved risk management of the nonfinancial risks.

60 │ GUIDANCE FOR A RISK-BASED APPROACH FOR THE LIFE INSURANCE SECTOR

© 2018 | FATF
ANNEX C. GUIDANCE PROVIDED BY SUPERVISORS TO PRIVATE SECTOR RELEVANT TO THE
APPLICATION OF THE RBA
Canada
183. Canada provides guidance to the private sector in the form of a workbook,
which includes risk assessment and risk factors. Further information on the guidance provided to the private sector can be found on: www.fintrac-canafe.gc.ca/guidancedirectives/compliance-conformite/rba/rba-li-eng.asp France
184. The French supervisor issues guidance to the private sector, including
examples of money laundering and TF typologies with respect to insurance sector, provided in cooperation with the French FIU (https://acpr.banquefrance.fr/sites/default/files/20150218-principes-d-application-sectoriels-acpr-lcbft.pdf). United States
185. As part of fulfilling its mission to safeguard the financial system and promote
national security, the United States Financial Crime Enforcement Network (FinCEN), a bureau of the U.S. Department of the Treasury, through its Financial Institution Advisory Program, issues public and non-public advisories to financial institutions concerning money laundering or terrorist financing threats and vulnerabilities for the purpose of enabling financial institutions to guard against such threats. Advisories often contain illicit activity typologies, red flags that facilitate monitoring, and guidance on complying with FinCEN regulations to address those threats and vulnerabilities. Financial institutions may use this information to enhance their AML monitoring systems for more valuable suspicious activity reporting. Information is on: www.fincen.gov/resources/advisoriesbulletinsfact-sheets.
186. FinCEN’s “Important Information for Insurance Industry,” is on:
www.fincen.gov/resources/financialinstitutions/insurance?field_date_release_value=&field_date_release_value_1=&type=Al l&=Apply&page=0.
187. FinCEN has published “Insurance Industry Suspicious Activity Reporting, An
Assessment of Suspicious Activity Report Filings,” on:
www.fincen.gov/sites/default/files/shared/Insurance_Industry_SAR.pdf.
188. Financial institutions may obtain information directly from FinCEN by
telephone through the FinCen Resource Center, contact information on:
www.fincen.gov/fincen-resource-center.
189. Information and guidance for industry is published by the Federal Financial
Institutions Examination Council (FFIEC) in its Bank Secrecy Act / Anti-Money Laundering Examination Manual, which includes a section directed to banks engaged in insurance sales, on: www.ffiec.gov/bsa_aml_infobase/pages_manual/OLM_073.htm.

GUIDANCE FOR A RISK-BASED APPROACH
LIFE INSURANCE SECTOR
The risk-based approach (RBA) is central to the effective implementation of the revised FATF International Standards on Combating Money Laundering and the Financing of Terrorism and Proliferation, which were adopted in 2012. The FATF has reviewed its 2009 RBA Guidance for the life insurance sector, in order to bring it in line with the revised FATF requirements. This updated RBA Guidance for the life insurance sector was drafted by a group of FATF members and observers, and representatives of the private sector, co-led by representatives of France and Manulife. www.fatf-gafi.org | October 2018

FATF Guidance for a Risk-Based Approach for the Life Insurance Sector

Lineage: In force

Similar documents from other regulators