Financial and Corporate Service Providers (Anti-Money Laundering and Countering the Financing of Terrorism) Rules, 2019

[Page 1]

EXTRAORDINARY OFFICIAL GAZETTE THE BAHAMAS PUBLISHED BY AUTHORITY

NASSAU 25th February, 2019

---

[Page 2]

FINANCIAL AND CORPORATE SERVICE PROVIDERS (ANTI-MONEY LAUNDERING AND COUNTERING THE FINANCING OF TERRORISM) RULES, 2019

Arrangement of Rules

Rule

PART I - PRELIMINARY 3

1. Citation...................................................................................................................3
2. Interpretation...........................................................................................................3

PART II - RISK RATING 3 3. Duty of licensee to implement risk rating framework...........................................3

PART III - INTERNAL CONTROLS 5 4. Duty of licensee concerning internal controls.......................................................5 5. Appointment of compliance officer.......................................................................5 6. Money Laundering Reporting Officer...................................................................6 7. Outsourcing............................................................................................................6 8. Suspicious transaction reporting............................................................................6

PART IV - VERIFICATION OF CUSTOMER IDENTITY 7 9. Due diligence measures.........................................................................................7 10. Verification of client identity................................................................................7 11. Nature and scope of activity.................................................................................8 12. Required information.............................................................................................8 13. Politically exposed persons..................................................................................11 14. Reliance on third party verification procedures..................................................12 15. Eligible introducer...............................................................................................13 16. Suspension or termination of activity or business...............................................14 17. Exemption from verification of identity..............................................................14 18. Ongoing monitoring.............................................................................................15

PART V - RECORD KEEPING 15 19. Maintenance of records.......................................................................................15 20. Transaction records..............................................................................................16 21. Other records.......................................................................................................16

PART VI - MISCELLANEOUS 17 22. Education and training........................................................................................17

---

[Page 3]

MINISTRY OF FINANCE S.I. No. 11 of 2019 FINANCIAL AND CORPORATE SERVICE PROVIDERS ACT (CHAPTER 369)

FINANCIAL AND CORPORATE SERVICE PROVIDERS (ANTI-MONEY LAUNDERING AND COUNTERING THE FINANCING OF TERRORISM) RULES, 2019

The Inspector, in exercise of the powers conferred by section 11(6) of the Financial and Corporate Service Providers Act (Chapter 369), makes the following Rules —

PART I - PRELIMINARY

1. Citation. These Rules may be cited as the Financial and Corporate Service Providers (Anti-Money Laundering and Countering the Financing of Terrorism) Rules, 2019.

2. Interpretation. In these Rules — "Act" means the Financial and Corporate Service Providers Act (Ch. 369); "licensee" means a person holding a license under the Act; "legal person" means a corporate or incorporate body; "Money Laundering Reporting Officer" or "MLRO" means the person appointed pursuant to regulation 5 of the Financial Intelligence (Transactions Reporting) Regulations.

PART II - RISK RATING

3. Duty of licensee to implement risk rating framework. (1) Every licensee shall implement a risk rating framework which assesses and identifies —

Page - 3

---

[Page 4]

(a) the risk profile of each facility holder; (b) its own risk profile in relation to the countries or jurisdictions in which it operates; and (c) the risk profile associated with its own products, services, transactions and delivery channels.

(2) The risk rating framework shall be approved by the licensee's senior management based on the scope of the licensee's activities, and shall be designed to — (a) take appropriate measures to manage and mitigate identified risks; (b) take account of any risk assessment carried out at a national level and any regulatory guidance issued by the Inspector; (c) categorize customer relationships and products to identify the risk associated with each customer relationship or product; (d) categorize customer relationships and products to take account of risk factors related to the particular customer relationship or product, including — (i) customer type or profession; (ii) country of domicile; (iii) complexity of ownership; (iv) complexity of legal structure; (v) source of business; (vi) type of assets; (vii) type, size and volume of transactions; (viii) level of cash transactions; and (ix) adherence to customer activity profile; (e) address which level of management can approve a decision for the licensee to enter into customer relationships at the various levels of risk rating categories; (f) establish Know Your Customer and due diligence information requirements appropriate for the risk profile of the customer relationship or product; (g) require the periodic review of the customer relationship or product to — (i) ensure that the categorizations are current and appropriate; and (ii) enable the licensee to determine whether any adjustment should be made to the risk rating;

Page - 4

---

[Page 5]

(h) require the re-categorization of a customer relationship or product offered by the regulated person in the event of a change in the risk profile of a customer relationship or product; and (i) require the documentation of the basis for the risk rating applied to a customer relationship or product and of any changes in the risk rating of a particular customer relationship or product.

(3) A licensee shall assess the risk profile of each new customer and carry out a risk assessment of each new product, business practice or technology prior to establishing a business relationship with such customer or introducing such product, business practice or technology.

(4) A licensee's risk rating framework shall be subject to review and the outcome of each client or product risk assessment conducted shall be documented and retained as part of document keeping requirements.

PART III - INTERNAL CONTROLS

4. Duty of licensee concerning internal controls. Every licensee shall, in order to be compliant with the Act, implement internal control procedures for the prevention of identified risks associated with money laundering and the financing of terrorism under the Financial Transactions Reporting Act, 2018¹ and — (a) have a compliance officer; (b) have a money laundering reporting officer; and (c) verify, on a regular basis, compliance with internal policies, procedures and controls relating to money laundering and terrorist financing activities.

5. Appointment of compliance officer. The compliance officer appointed by a licensee shall — (a) be a person of a senior level; and (b) have responsibility for establishing, implementing and maintaining policies, procedures and controls — (i) to deter the use of a facility for money laundering or the financing of terrorism; (ii) to ensure the timely detection and reporting of suspicious activity; and

¹No. 5 of 2018

Page - 5

---

[Page 6]

(iii) for the prompt investigation of suspicious activity.

6. Money Laundering Reporting Officer. (1) A Money Laundering Reporting Officer shall — (a) if an individual, be sufficiently senior in the organizational structure of the licensee's business operations to exercise the necessary authority to carry out his functions and duties; (b) if a legal person, be licensed under the Act to provide outsourced services as a MLRO; (c) have responsibility for making suspicious transactions reports to the Financial Intelligence Unit regarding money laundering and terrorist financing.

(2) A licensee shall submit the name of the person proposed to be the MLRO to the Inspector, and where the person is appointed as the MLRO, the licensee shall — (a) register the name of the person with the Financial Intelligence Unit; (b) ensure that the MLRO or any person appointed to assist the MLRO has timely access to systems, customer records and all relevant information required to perform his or its duties; (c) notify the Inspector prior to any change in such appointment and include in the notification a statement that the MLRO is a fit and proper person.

7. Outsourcing. (1) A licensee may outsource the role of the MLRO. (2) Notwithstanding paragraph (1), a licensee shall retain ultimate responsibility for ensuring compliance with the provisions of the Financial Intelligence (Transactions Reporting) Regulations.

8. Suspicious transaction reporting. (1) A licensee shall implement policies and procedures to facilitate an employee exercising his duty to report his knowledge or suspicions that a client is or may be engaged in money laundering or the financing of terrorism to the MLRO. (2) It shall be the responsibility of the MLRO to assess the sufficiency of the information contained in a report referred to under paragraph (1).

Page - 6

---

[Page 7]

PART IV - VERIFICATION OF CUSTOMER IDENTITY

9. Due diligence measures. (1) Except where specifically exempted by any Rules issued by the Inspector, the customer due diligence measures implemented by the licensee shall be reliable and independent source documents, data or information. (2) The risk rating framework of a client shall be applied by a licensee to its due diligence measures. (3) Once a business relationship has been established with a client, the licensee shall take reasonable steps to ensure that due diligence measures are periodically reviewed and kept up to date. (4) Enhanced due diligence measures shall be applied by a licensee for categories of clients, business relationships, or transactions that the licensee considers to present a higher risk for money laundering or terrorist financing based on the risk profile developed relative to the client, business relationship or transaction.

10. Verification of client identity. (1) A licensee shall not enter into a business relationship with any person without applying customer due diligence measures to verify such person's identity. (2) When identifying the identity of a person referred to in paragraph (1), the licensee shall — (a) satisfy itself that the prospective client is who the client claims to be; (b) ensure that sufficient information is obtained — (i) on the nature of the business that the client expects to undertake; and (ii) concerning any expected or predictable pattern of transactions; and (c) satisfy itself that any document produced by a prospective client in support of identification verification is authenticated.

(3) Where a prospective client fails or is unable to provide adequate evidence of identity, or a licensee is not satisfied that a new transaction with an exiting client is legitimate, the licensee shall — (a) determine whether — (i) other steps should be taken to verify the client's identity;

Page - 7

---

[Page 8]

(ii) it is appropriate to proceed or continue with the business relationship; and (b) file a suspicious transaction report with the Financial Intelligence Unit.

(4) When verifying the identity of a client, a licensee shall only accept certified copies of documents from a prospective client where submission of original documents is impractical or impossible. (5) A licensee shall apply enhanced customer due diligence measures where it is determined that a category of client, business relationship, or transactions presents a higher risk for money laundering or terrorist financing, which measures shall include taking additional verification measures. (6) Notwithstanding any provision of these Rules, a licensee shall in all cases verify the identity of a client, prospective or existing, where the licensee knows or suspects money laundering or terrorist financing, and where such suspicion or knowledge is confirmed, shall make a report to the — (a) Financial Intelligence Unit, in the case of money laundering; or (b) the Commissioner of Police, in the case of terrorist financing.

11. Nature and scope of activity. A licensee shall record the purpose and reason for establishing the business relationship and the anticipated level and nature of the activity to be undertaken.

12. Required information. (1) Every licensee shall obtain independent information and documentation appropriate to the nature and structure of the proposed client when verifying the proposed client's identity, which information and documents shall include, but may not be limited to, the following in the case of — (a) a natural person — (i) full and correct name(s); (ii) correct permanent address; (iii) date and place of birth; and (iv) the purpose of the account and nature of the business relationship; (b) a corporate client — (i) the original or a certified copy of the certificate of Incorporation, Registration or the equivalent;

Page - 8

---

[Page 9]

(ii) certificate of good standing or the equivalent evidence that the company has not been or is not about to be struck off the register or wound up; (iii) a copy of the relevant board resolution authorizing the establishment of the business relationship, or authorizing the opening of the account or facility with the requisite authorized signatories; (iv) satisfactory evidence of the identity of all account signatories and details of their relationship with the company; and (v) satisfactory evidence of identification of each natural person having a beneficial interest of 10 percent or more in the company, or having principal control over the company's assets or exercises control over the management of the company; (c) a partnership or unincorporated business — (i) a copy of the partnership agreement or document establishing the partnership agreement or document establishing the partnership or unincorporated business; (ii) a mandate authorizing the opening of an account, or the use of some other facility, and conferring permission on any person authorized to undertake transactions; (iii) satisfactory evidence of the identity of all partners and controllers of the firm or business; and (iv) satisfactory evidence of the identity of all authorized signatories; (d) other legal structures and fiduciary arrangements, such as trusts, fiduciary or nominee structures — (i) the applicable documents establishing the legal structure or fiduciary or nominee arrangement; (ii) all applicable documents, identifying persons exercising effective control over the legal structure or fiduciary or nominee arrangement, including the power to direct, withhold, consent to or veto the exercise of any power related to the legal structure or fiduciary or nominee arrangement; (iii) all applicable documents, identifying the known beneficiaries of the trust; (iv) all applicable documents, identifying all beneficiaries of a fiduciary or nominee structure; and

Page - 9

---

[Page 10]

(v) all applicable documents, appointing and identifying any signatory powers in relation to the legal structure or fiduciary or nominee arrangement; (e) a foundation — (i) the foundation Charter; (ii) the foundation's certificate of registration issued by the Registrar General, or the foreign equivalent; (iii) the source of funds, and where a person other than the founder provides funds for the foundation, verification of the identity of the third party providing the funds or for whom the founder may be acting; (iv) identification evidence of each founder, officer, and council member of the foundation as may be signatories for the accounts of the foundation; and (v) identification evidence of beneficiaries that hold a vested interest in the foundation; (f) a non-profit association or charity — (i) identification evidence of at least two signatories and anyone authorized to give instructions on behalf of the entity; (ii) the nature of the proposed association's or charity's purpose and operations; and (iii) the source of funds; (g) powers of attorney — (i) identification evidence of each done; (ii) identification evidence of the donor; and (iii) proof of any third party mandates.

(2) A licensee shall, in the case of services being provided to the estate of a deceased person, obtain identification evidence of each personal representative of the said estate, except where securities will be issued from an investment account established in the deceased's name(s) to the personal representative in accordance with the Certificate as to Grant of Probate or Grant of Letters of Administration solely for the purpose of winding up the estate.

(3) A licensee shall review its records periodically to ensure that the identification and other information kept by it is current and reflects the existing facts related to a client, and in all cases when there have been changes to — (a) authorized signatories;

Page - 10

---

[Page 11]

(b) mandates authorizing the opening of an account and permitting any person to undertake transactions; (c) partners, controllers, trustees, fiduciaries or nominees; and (d) the corporate structure of a client.

(4) Where there has been a change to any of the items specified in paragraph (3), the licensee shall undertake the verification process in compliance with the provisions of this paragraph.

(5) For the purpose of the verification process, a licensee shall exercise additional care in relation to the provision of the following — (a) escrow services; (b) financial intermediation; (c) online financial services; (d) financial leasing; and (e) financial advisory or consultancy services.

(6) Where one of the services specified in paragraph (5) is being offered, the licensee shall require the proposed facility holder to provide additional identification and other information capable of confirming the identity of the proposed facility holder.

(7) In all cases, a licensee shall maintain adequate documentation to evidence the implementation of due diligence measures and shall ensure that the verification of identification procedures implemented, are appropriate to the nature and structure of the proposed client being verified.

(8) A licensee shall as part of due diligence measures, implement procedures for the re-verification of clients, which at the minimum, shall require re-verification to occur where — (a) during the course of the business relationship, the licensee has reason to doubt the identity of the client; (b) there is a material change in the way a facility is operated; and (c) there is a reasonable suspicion that any transaction carried out by the client might have breached the law concerning money laundering or the financing of terrorism.

13. Politically exposed persons. (1) A licensee shall develop clear procedures and controls for the verification of a politically exposed person — (a) when establishing a business relationship with that politically exposed person, or a legal person in which the politically exposed person —

Page - 11

---

[Page 12]

(i) is a director, officer, founder, council member of the legal person; (ii) is a partner or trustee; (iii) is a signatory; or (iv) has — (aa) beneficial interest of ten per cent or more in the legal person; (bb) principal control over the legal person's assets; or (cc) exercises control over the management of the legal person; or (b) the licensee is continuing a business relationship with a client who has become a politically exposed person, subsequent to the establishment of the business relationship.

(2) For the purposes of this paragraph, a politically exposed person — (a) means an individual who holds or has held, within the preceding twelve-month period of a proposed business relationship, a position in the executive, legislative, administrative, military, or judicial branches of a government, whether elected or not, including the position of — (i) head of state or head of government; (ii) senior official; (iii) senior official in a major political party; and (iv) senior executive in a major statutory or government-owned corporation; (b) includes any parent, sibling, spouse or child of an individual referred to in subparagraph (a); and (c) includes any corporation, business or other entity formed by or for the benefit of the person referred to in subparagraph (a)(i).

14. Reliance on third party verification procedures. (1) A licensee may rely on the customer due diligence procedures implemented by another financial institution, provided that the financial institution is a regulated entity subject to AML or CFT obligations or is an entity located in a country which is not the subject of any list issued by an international organization relative to the issues of money laundering or terrorist activities and is able to — (a) provide written confirmation that it has verified the identity of the relevant client; and

Page - 12

---

[Page 13]

(b) confirm the existence of the facility provided to the client by the financial institution.

(2) Notwithstanding paragraph (1), a licensee shall only rely on the due diligence measures implemented by another financial institution with respect to those transactions, facilities or products which that other financial institution provides to the client, and in all other circumstances, must undertake its own verification procedures.

15. Eligible introducer. (1) In all cases, a licensee's duty to verify the identity of all prospective clients shall apply to any client introduced by another financial institution, except where a financial institution is an eligible introducer. (2) Where a licensee relies on the verification procedures of an eligible introducer, it shall obtain from that introducer — (a) written confirmation that the eligible introducer has verified the customer's identity in accordance with the national laws of the eligible introducer; (b) certification from the eligible introducer that any photocopies provided to the licensee are identical to the original document; and (c) clear and legible copies of all documentation, including where appropriate, certified translations, within thirty days of receipt of the written confirmation referred to in subparagraph (a).

(3) For the purposes of this paragraph, an eligible introducer shall be — (a) in relation to a domestic financial institution — (i) a person registered under Part VI of the Securities Industry Act, 2011 (No. 10 of 2011); (ii) an investment fund administrator licensed under section 34 of the Investment Funds Act (Ch. 369A); (iii) a bank or trust company licensed by the Central Bank of The Bahamas under the Banks and Trust Companies Regulation Act (Ch. 316); or (iv) a company carrying on life assurance business pursuant to section 2 of the Insurance Act (Ch. 347); (b) in relation to a foreign financial institution, an institution — (i) exercising functions similar to a domestic financial institution to which subparagraph (a)(i) through (iv) applies; (ii) licensed or functioning pursuant to Part VI of the Securities Industry Act, 2011 (No. 10 of 2011);

Page - 13

---

[Page 14]

(iii) located in a country which is not the subject of any list issued by an international organization relative to the issues of money laundering or terrorist activities; and (iv) having no obstacles administrative or otherwise which would prevent the licensee from accessing the original documentation.

16. Suspension or termination of activity or business. A licensee shall — (a) suspend activity on the account of a prospective client, if reasonable efforts have been made to directly verify the prospective client's identity without success; and (b) terminate the business relationship with a prospective client where it is unable to obtain the relevant information and documentation from the eligible introducer within thirty days of receiving the eligible introducer's confirmation.

17. Exemption from verification of identity. A licensee shall not be required to obtain documents and information for verification of a prospective client where that client is — (a) any financial institution licensed by the Central Bank of The Bahamas, the Securities Commission of The Bahamas, The Inspector, Financial Corporate Service Providers, The Insurance Commission of The Bahamas, or the Gaming Board; (b) a financial institution which — (i) is subject to anti-money laundering and countering the financing of terrorism obligations; (ii) is under supervision for compliance with the obligations referred to in subparagraph (i) and; (iii) has adequate procedures for compliance with customer due diligence and record keeping requirements; (c) any central or local government agency or statutory body; (d) a publicly traded company listed on The Bahamas International Stock Exchange or any other stock exchange licensed by the Securities Commission and specified in the Schedule to the Financial Transactions Reporting Regulations, 2018².

²(S.I. No. 35 of 2018).

Page - 14

---

[Page 15]

18. Ongoing monitoring. A licensee shall, after the verification procedures have been concluded and a business relationship has been established — (a) monitor the conduct of the relationship periodically; and (b) ensure, on an ongoing basis, that it is consistent with the nature of the business stated when the relationship was established.

PART V - RECORD KEEPING

19. Maintenance of records. (1) A licensee shall, in compliance with all relevant laws, prepare and maintain records of its business relationships and transactions that enable — (a) competent third parties to assess the licensee's compliance with AML or CFT policies and procedures; (b) transactions effected through the regulated person to be reconstructed; (c) the licensee to satisfy court orders or enquiries from the Inspector or appropriate authorities; and (d) the identification of the client.

(2) A licensee shall keep all records required to be maintained by these Rules, for a period of seven years from the date that the customer ceases to be a facility holder. (3) For the purpose of paragraph (2), a person ceases to be a facility holder from the date of — (a) the carrying out of a one-off transaction or the last transaction in a series of transactions; (b) the closing of the account or accounts or the ending otherwise of the business relationship; or (c) the commencement of proceedings to recover debts payable on insolvency.

(4) The seven-year period referred to in paragraph (2) commences on the date of the completion of the last transaction where formalities to end a business relationship have not been undertaken but a period of seven years has elapsed since the date of the last transaction.

Page - 15

---

[Page 16]

(5) Where the licensee is a company that is being liquidated, the liquidator shall retain the relevant records of the regulated person for the balance of the prescribed period remaining at the date of dissolution. (6) A licensee may maintain records in the form of — (a) original documents; (b) microfiche; or (c) other electronic media.

20. Transaction records. (1) A licensee shall maintain transaction records containing — (a) a description of the nature of the transaction; (b) details of the transaction, including the amount of the transaction and the denomination of the currency; (c) the date on which the transaction was conducted; (d) the identification verification details of the parties to the transaction; (e) where applicable, information on the facility through which the transaction was conducted and any other facility directly involved in the transaction; and (f) the files, business correspondence and records connected to the facility.

21. Other records. A licensee shall maintain records of — (a) suspicions raised internally by the Money Laundering Reporting Officer, but not disclosed to the relevant authorities; (b) suspicions which the Financial Intelligence Unit, the Commissioner of Police, or the relevant supervisory authority have advised are of no interest; (c) findings of inquiries conducted by the regulated person, into unusual activity.

Page - 16

---

[Page 17]

PART VI - MISCELLANEOUS

22. Education and training. (1) A licensee shall take appropriate measures to ensure that every employee is aware of — (a) policies and procedures put in place to detect and prevent money laundering and to counter the financing of terrorism, including those for the identification, record keeping, detection of unusual and suspicious transactions and internal reporting; and (b) the AML or CFT legislative framework. (2) A licensee shall provide every employee with the relevant training in the recognition and handling of suspicious transactions.

Made this 19th day of February, 2019.

Signed ROBERT LOTMORE Financial and Corporate Service Providers

Page - 17