FIAU Guidance Note on AML/CFT Obligations in relation to Payment Accounts with Basic Features

GUIDANCE NOTE on
AML/CFT OBLIGATIONS IN
RELATION TO PAYMENT ACCOUNTS
WITH BASIC FEATURES
A GUIDANCE NOTE ISSUED BY THE FIAU TO ASSIST CREDIT INSTITUTIONS TO COMPLY WITH THEIR OBLIGATIONS UNDER THE PREVENTION OF MONEY LAUNDERING AND FUNDING OF TERRORISM REGULATIONS WHEN OFFERING PAYMENT ACCOUNTS WITH BASIC FEATURES UNDER THE CREDIT INSTITUTIONS AND FINANCIAL INSTITUTIONS (PAYMENT ACCOUNTS) REGULATIONS Issued: 15 October 2018

Scope and Information

1. The Credit Institutions and Financial Institutions (Payment Accounts) Regulations1
   (“PAR”) transpose into Maltese law the requirements of Directive 2014/92/EU2 , including the requirement to open a payment account with basic features to consumers who are legally resident in Malta or another Member State of the European Economic Area (“EEA”).
2. The PAR are not intended to provide any derogation from anti-money laundering and
   combatting the funding of terrorism (“AML/CFT”) obligations that credit institutions are bound to apply. Nonetheless, to ensure that there are no misinterpretations of AML/CFT obligations that could hinder the process of opening a payment account with basic features, the Financial Intelligence Analysis Unit (“FIAU”) is issuing the present Guidance Note which sets out clearly how AML/CFT obligations, and especially verification of identity obligations, can be met by credit institutions obliged to offer the said product. Identification and Verification General Overview
3. The Prevention of Money Laundering and Funding of Terrorism Regulations (“PMLFTR”)
   require subject persons, including credit institutions, to identify their customers and to then verify the said identity by using independent and reliable sources. Identification consists in the collection of the personal details referred to in Section 3.1.1.2 (i) of Part I of the Implementing Procedures. The application of the risk-based approach will allow subject persons to vary the extent of identification. Thus, for example, in low risk scenarios subject persons can limit themselves to collect the name and surname, date of birth and permanent residential address of the customer for identification purposes, and need not collect the individual’s place of birth, nationality and an identification document number.
4. Moreover, the risk based approach also allows for the extent and/or timing of the verification
   measures undertaken to be varied on the basis of risk. Thus, in low risk scenarios, it is possible for a subject person to vary the timing and/or the extent of any identity verification measures. Thus, it is possible to carry out verification of identity upon the happening of pre-determined trigger events (e.g. pre-set transaction thresholds). Similarly, in any such scenario, it is equally possible to use documents of varying quality to meet verification of identity obligations However, it is necessary to bear in mind that verification does not only entail determining that a given person exists but that the person requesting one’s services or products is actually the person he declares himself to be. Thus, when using any such documentation for verification purposes, it may be necessary to take additional measures to verify properly the identity of a person.

1
Legal Notice 411 of 2016 as amended by Legal Notice 324 of 2018.
2
Directive 2014/92/EU of the European Parliament and of the Council of 23 July 2014 on the comparability of fees related to payment accounts, payment account switching and access to payment accounts with basic features.

5. The inability to carry out identification and verification of identity should result in the refusal
   or termination of the business relationship. Moreover, in line with Regulation 8(5) of the PMLFTR, the subject person has to consider whether there are grounds to submit a Suspicious Transaction Report to the FIAU. This is also reflected in the PAR3 . Consumers with no Fixed Address
6. One of the personal details that is required to be collected for identification purposes is the
   customer’s permanent residential address. Consumers with no fixed address however may not provide credit institutions with their permanent residential address and the credit institution would not be able to identify and verify the identity of their customers as required in terms of the Implementing Procedures.
7. The FIAU had already sought to cater for this eventuality through the last series of
   amendments carried out to Part I of its Implementing Procedures. Section 3.3 states that “where an applicant for business does not have a fixed residential address (either permanent or temporary), such as applicants who are homeless, members of the travelling community or persons residing on yachts … subject persons shall gather sufficient information, and where available, documentation on the applicant’s situation and frequent whereabouts”.
8. While the FIAU is revising its Implementing Procedures to ensure they reflect the amendments
   introduced as part of the transposition of Directive 2015/849/EU, it is important to note that circumstances such as the ones above are still to be dealt with in the same manner as under the current Implementing Procedures and credit institutions may therefore continue to rely on the same when considering whether to enter into a business relationship with a consumer who does not have a fixed address. Asylum Seekers and Refugees
9. Another category of consumers to whom credit institutions may have to provide a payment
   account with basic features is that of persons who enjoy any of the following status - refugees, beneficiaries of subsidiary protection, beneficiaries of other forms of humanitarian or international protection, stateless persons, asylum seekers and failed or rejected asylum seekers. The FIAU understands that there may be questions as to what identification documents should be acceptable by credit institutions for identity verification purposes.
10. Verification of identity has to be carried out on the basis of documents, data or
    information obtained from a reliable and independent source. The FIAU has always considered government-issued documents containing photographic evidence of identity as fulfilling the said criteria and as being the main source through which to verify an individual’s identity. Thus, if any of the aforementioned individuals are in a position to produce an official identity document which is unexpired, credit institutions would be able to verify the personal details of the said customer on the basis of such document and, unless the credit institution has any reason to believe that the document is forged or has

3 Vide Regulation 22 of the Credit Institutions and Financial Institutions (Payment Accounts) Regulations.

otherwise been tampered with, the credit institution would be considered to have met its obligations at law.
11. While it is unlikely that the said individuals will be able to produce any identification
document issued by the authorities of their country of origin, the FIAU considers any such document to be equivalent to a government issued document and therefore to be a sufficiently reliable and independent source of information for verification purposes. Caution should however be exercised as to the authenticity and veracity of any such documents.
12. With regards to the identification documents issued by the Maltese authorities, the FIAU
wishes to draw the attention of credit institutions to the Identity Card and Other Identity Documents Act4 which sets out what identification documents are to be issued to anyone legally residing in Malta, including anyone granted refugee status or subsidiary protection, as well as to asylum seekers and failed or refused asylum seekers. Moreover, in an effort to further assist credit institutions in determining which locally issued identification documents are acceptable for verification purposes, the FIAU is including templates of the said identification documents in Annex I hereto. Individuals who cannot be Expelled
13. The PAR also require credit institutions to provide a payment account with basic features
to all those individuals who for legal or factual circumstances cannot be returned back to their country of origin. In so doing, credit institutions are to note that the identification and verification of identity obligations already described have also to be met in relation to any such customer.
14. Individuals who cannot be expelled from Malta are issued with an identity document by
the Malta Police, a template of which is being attached hereto in Annex I to this Guidance Note. Credit institutions would still be considered to have met their obligation to verify the identity of their customers where they do so on the basis of the said document. EEA Residents
15. Any EEA resident can request to open a payment account with basic features. Where a
credit institution is willing to accede to such a request, it will also have to consider how it is going to verify the customer’s identity. As already highlighted, government-issued documents containing photographic evidence of identity are the main source through which to verify an individual’s identity. However, credit institutions may not always be familiar with the identity document presented by customers when requesting this particular product.
16. In this regard, credit institutions may wish to refer to the following resources which
contain templates of various identity documents issued by governments within the EEA and which they may find of use to determine if an identification document presented by an EEA resident can be relied upon for identity verification purposes:

4
Cap 258 of the Laws of Malta.

www.edisontd.net https://ec.europa.eu/home-affairs/sites/homeaffairs/files/e￾library/documents/policies/borders-and-visas/schengen/docs/handbook￾annex_23_part_1_and_2.pdf
17. In making use of the above resources, credit institutions should bear in mind that these
were not designed for the specific purpose of assisting them and that the templates made available may not reflect the latest identification documents made available by government authorities within the EEA. ON-GOING MONITORING
18. The PMLFTR require subject persons, including credit institution, to carry out on-going
monitoring of their business relationships on a risk sensitive basis. This includes not only ensuring that documentation is kept up-to-date but that any activity carried out in the course of the same is properly monitored to detect any unusual or suspicious activity. To this end, it is important that credit institutions collect sufficient information to construct an adequate profile of the customer concerned.
19. To this end credit institutions should understand the purpose why the customer is
requesting to open a payment account with basic features (e.g. savings, to receive social security benefits or government grants/allowances, to receive salary/wages etc.) and what level of activity can be expected to be transacted through the account. This includes an estimate of the amounts to be deposited on the said account, the expected source thereof, number of expected incoming or outgoing transactions, destination of any remittances to be effected etc.
20. It is the FIAU’s understanding that some credit institutions may already have had or still
have business relationships with customers that would fall within one or more of the consumer categories indicated in the PAR. Credit institutions may also draw on their past experience and data held to draw up a peer group profile against which to compare activity taking place on payment accounts with basic features. Moreover, credit institutions may already be able to draw up of red flag events to assist them in their on￾going monitoring activity.
21. Using the information collected from the customer and/or any data and information
already in their possession, credit institutions should have the necessary tools to detect any unusual activity on payment accounts with basic features. Credit institutions are reminded that any such unusual activity has to be questioned and, if found to give rise to a suspicion of ML/FT, reported to the FIAU. Credit institutions are reminded that any such report cannot be disclosed to the customer. Moreover, credit institutions should consider whether their customer risk assessment and client profile are to be updated so as to reflect any change in activity.
22. As to the level of on-going monitoring to be conducted, this has to be reflective of the
level of risk that the customer presents. It is expected that the level of on-going monitoring should be higher in high risk situations and that transactions involving any high

risk customers be scrutinised prior to their execution. Even when no triggering events take place, it is important that business relationships are reviewed from time to time to ensure that there have been no changes warranting a review of a customer’s risk and business profile. The same applies in relation to document updating. CONCLUDING PROVISIONS
23. Credit institutions are reminded that the application of CDD on a risk-sensitive basis
should result in a system of AML/CFT controls commensurate to the level and nature of ML/FT risk the said institutions find themselves exposed to. Thus, to the greatest extent possible, where the level and nature of risks arising from providing a payment account with basic features are equivalent or similar to the risks arising from providing similar products to customers other than those referred to in the PAR, these should be addressed through a similar approach.
24. Some of the individuals who may be entitled to open a payment account with basic
features may make use of cash. In determining the level of risk associated with the use of cash, credit institutions are not to limit themselves to the presence of cash itself but should also have regard to the amounts involved and the frequency with which cash deposits are made. Moreover, any risk assessment has to be a holistic one that takes account of all relevant risk indicators.
25. In determining what AML/CFT controls to impose in relation to payment accounts with
basic features, credit institutions are also invited to take into consideration the Opinion of the European Banking Authority on the application of customer due diligence measures to customers who are asylum seekers from higher-risk third countries or territories (EBA-Op￾2016-07) available at https://www.eba.europa.eu/documents/10180/1359456/EBA-Op￾2016-07+%28Opinion+on+Customer+Due+Diligence+on+Asylum+Seekers%29.pdf .
26. Any identification document templates provided in this Guidance Note have been
sourced by the FIAU from the authorities responsible for their issue and are intended for guidance purposes only. Subject persons remain responsible to keep themselves updated with any changes there may be in this regard and should not expect any changes to be necessarily notified to them by the FIAU or any other authority.
27. Any questions or clarifications in relation to the contents of this Guidance Note may be
addressed to the FIAU.
Email: info@fiumalta.org
Tel: +356 21 231 333

ANNEX I – TEMPLATE IDENTIFICATION DOCUMENTS
The following are a template of the identification documents issued by the Maltese authorities which credit institutions may use for verification of identity purposes:

1. Asylum Seekers
   The documents included under Fig. 1 to Fig. 4, referred to as certificates, are templates of the documents issued by the Office of the Refugee Commissioner to anyone who seeks international protection. The documents are issued at different stages of the decision-taking process as follows:
   Figure 1 Certificate issued once an applicant makes an initial application for protection.
   Figure 2 Certificate issued once an applicant lodges an appeal against the decision by the
   Office of the Refugee Commissioner rejecting his/her application for international protection.
   Figure 3 Certificate issued after an applicant makes a subsequent application with the Office
   of the Refugee Commissioner.
   Figure 4 Certificate issued to an applicant after having lodged an appeal against the decision
   by the Office of the Refugee Commissioner rejecting his/her subsequent application for international protection. It is important to note that these documents are only valid up to the date indicated thereon unless otherwise renewed. Moreover, the documents’ validity depends on the same having the following:
   i. The signature of the Officer who prepared the document;
   ii. The signature of the Refugee Commissioner or another Officer authorized to sign this
   document on her behalf;
   iii. The signature of the applicant;
   iv. The facial image of the applicant; and
   v. The stamp of the Office of the Refugee Commissioner.

Fig.1 Certificate issued once an applicant makes an initial application for protection

Fig.2 Certificate issued once an applicant lodges an appeal against the decision by the Office of the Refugee Commissioner rejecting his/her application for international protection.

Fig. 3 Certificate issued after an applicant makes a subsequent application with the Office of the Refugee Commissioner.

Fig. 4 Certificate issued to an applicant after having lodged an appeal against the decision by the Office of the Refugee Commissioner rejecting his/her subsequent application for international protection.

2. Refugees and Other Individuals Enjoying Subsidiary or Temporary Humanitarian Protection
   Fig. 5 Residence Permit issued by IDENTITY MALTA to Third Country Nationals

Individuals who have had their application for asylum accepted and have been awarded refugee status, or have otherwise been granted subsidiary protection or temporary humanitarian protection, are issued with a residence permit as shown in Figure 2 above with the following differences:
Status Field on the Front
“Tip ta’ Permess / Type of Permit”
Field on the Back
“Rimarki/Remarks”
Validity Period

1. Refugee Protezzjoni Internazzjonali Igawdi/Tgawdi minn
   status ta’ Refugjat
   (Refugee Comm Cert
   No)
   Three (3) Years
2. Subsidiary
   Protection
   Protezzjoni Internazzjonali Igawdi/Tgawdi minn status ta’ Protezzjoni Sussidjarja Three (3) Years
3. Temporary
   Humanitarian
   Protection
   Protezzjoni Umanitarja
   Temporanja
   Certificate Number
   (Refugee Comm Cert
   No)
   One (1) Year
   There may arise situations where a decision has been taken that an individual is entitled to refugee status or to subsidiary or temporary protection, but the authorities have not yet issued the individual with a residence permit. Should these situations arise, credit institutions may proceed to verify the individual’s identity on the basis of the following:
   A. Anyone enjoying some form of protection in terms of law is usually provided with a so￾called ‘Protection Card’ by the Office of the Commissioner for Refugees. This card is renewed until such time as the individual concerned remains entitled to protection. Pending the issue of a residence permit, credit institutions may rely on this card to verify the identity of any applicant for a payment account with basic features. Templates of the said card are being attached hereto as Fig. 6 to Fig. 9. B. If the applicant cannot present either a residence permit or a protection card because the said document has still to be issued, it may be possible to carry out verification of identity on the basis of one of the document set out in Fig. 1 to Fig. 4 as long as the applicant also produces a copy of the decision granting him refugee status or subsidiary or temporary protection. Credit institutions are to subsequently collect a copy of the individual’s residence permit or protection card when either is issued.

Fig. 6 Protection Card issued to individuals granted refugee status.

Fig. 7 Protection Card issued to individuals benefitting from subsidiary protection.

Fig. 8 Protection Card issued to individuals benefitting from temporary humanitarian protection N.

Fig. 9 Protection Card issued to individuals benefitting from temporary humanitarian protection.

3. INDIVIDUALS WHO CANNOT BE REPATRIATED
   Fig. 10 Identification Document issued by the Malta Police – Front The Malta Police issues an identification document to all those individuals that cannot be expelled and repatriated. It is important to note that, though this document has a period of validity which can be extended, it no longer remains valid as soon as the immigration authorities can proceed with the individual’s repatriation. Moreover, the extension of its validity is not uniform but depends on the holder’s particular circumstances. Credit institutions should therefore exercise caution when presented with this identification document for identity verification purposes.

Fig. 11 – Identification Document issued by the Malta Police – Details’ Page

Fig. 12 – Identification Document issued by the Malta Police – Dependents’ Details and Renewal Pages Fig. 13 – Identification Document issued by the Malta Police – Back Page