Guidelines on Identification of Beneficiaries of Insurance and Investment Related Insurance Policies

Page 1 of 18 TO: LONG-TERM INSURERS GUIDELINES NO: AML/02/2025 DATE: 5 April 2025 SUBJECT: GUIDELINES ON THE IDENTIFICATION OF BENEFICIARIES OF INSURANCE AND INVESTMENT RELATED INSURANCE POLICIES

Page 2 of 18

1. DEFINITIONS AND ACRONYMS “AI/AIs” Accountable Institution/s, which means a person/s or entity/ies listed in Schedule 1 of the Financial Intelligence Act, No. 13 of 2012 (“FIA”) as amended by the Financial Intelligence Amendment Act 2023 (Act No.6 of 2023). “BO” Beneficial Owner as defined in terms of section 1 (d) of FIA. “Beneficiary/Beneficiaries” refers to beneficiaries of life insurance and investment related insurance policies. “Business relationship” means an arrangement between a client or contracting party and a Long-Term Insurer for the purpose of concluding transactions on a regular basis. “Customer Due Diligence” (CDD) means a process that involves establishing the identity of a beneficiary, the identity of the beneficiary’s beneficial owners in respect of a beneficiary who is a legal person or legal arrangement, and monitoring transactions in respect of payments to beneficiaries. “CFT” Combating the Financing of Terrorism as defined in terms of PACOTPAA. “CPF” Combating Proliferation Financing as defined in terms of PACOTPAA. “Enhanced Due Diligence” (EDD) means doing more than the basic CDD which includes, amongst others, taking measures as per FIA to identify, as far as reasonably possible, the source of wealth, funds and any other assets of the client or beneficial owners whose activities may pose a risk of ML, TF or PF. “Establish Identity” means a two-tier process consisting of the ascertainment or collecting of certain identification information, and verification of some of the information against reliable documentation or information. "FATF" means the Financial Action Task Force.

Page 3 of 18 “FIA” refers to the Financial Intelligence Act, 2012 (Act No. 13 of 2012) as amended. “FIC” means the Financial Intelligence Centre. “LTI” means Long Term Insurer. “LTIs” means Long Term Insurers. “ML” means Money-Laundering. “Monitoring” as defined in the FIA. “PIPs” means Prominent Influential Persons as envisaged in FIA. “PF” means proliferation financing. “Records” means any material on which information is recorded or marked, and which is capable of being read or understood by a person, or by an electronic system or other device. “Regulations” refer to the FIA Regulations unless otherwise specified. “SAR” refers to a suspicious activity report submitted to the FIC in terms of sections 33 (1) & (2) of FIA. “Single Transaction” means a transaction other than a transaction concluded in the course of a business relationship. “STR” refers to a suspicious transaction report submitted to the FIC in terms of sections 33 (1) & (2) of the FIA. “TF” means terrorist financing.

Page 4 of 18 “Transaction” means a transaction concluded between a client and an accountable or reporting institution in accordance with the type of business carried on by that institution and includes attempted transactions. 2. BACKGROUND 2.1 NAMFISA in terms of schedule 2 of FIA read with section 35(2) of FIA has a statutory obligation to supervise, monitor, and enforce compliance with the provisions of FIA or any regulation, order, circular, notice, determination or directive issued in terms of FIA, in respect of all AIs supervised by it. 2.2 Furthermore, section 35(15) (d) of FIA confers the mandate upon NAMFISA to: “issue guidelines to assist accountable institutions in detecting suspicious patterns of behavior in their clients and these guidelines shall be developed taking into account modern and secure techniques of money management and will serve as an educational tool for accountable institutions’ personnel”. 2.3 In light of the above, NAMFISA issues these guidelines to LTIs to: 2.3.1 identify beneficiaries of insurance and investment related insurance policies; and 2.3.2 effectively identify suspicious behavior in their clients and take the necessary actions to mitigate ML/TF/PF risks. 3. IDENTIFY BENEFICIARIES OF LIFE INSURANCE AND OTHER INVESTMENT RELATED INSURANCE POLICIES 3.1 The LTIs are expected to ensure that sufficient information is obtained on the beneficiaries of insurance and investment related insurance policies as soon as such beneficiaries are known or designated at the onboarding

Page 5 of 18 stage and in the course of the business relationship. This will enable the LTIs to verify the identity of the beneficiaries of insurance and investment related insurance policies at the pay-out stage. The information to be obtained includes – 3.1.1 The name of the natural person, legal person, trust, partnership or other legal arrangement, in the case of a beneficiary who is identified as a natural person, legal person, trust, partnership or other legal arrangement; 3.1.2 Sufficient information such as the ID number or birth date in the event of natural persons, and registration number in the event the beneficiary is a legal person or legal arrangement so that at the claim stage, the beneficiary’s identity can be verified. 3.2 In order to establish whether application of EDD measures is required, LTIs are required to include in a risk assessment the beneficiaries of insurance and other investment related insurance policies as risk factors. In this regard, the LTIs are expected to assess the ML/TF risks posed by beneficiaries (natural persons, legal persons and legal arrangements, BOs and PIPs where applicable). 3.3 In the event the ML/TF risks posed by beneficiaries of insurance and other investment related insurance policies are high, the LTI should apply the measures as outlined under paragraphs 5.3.5 to 5.3.9, following the guidance provided therein. 3.4 In the event the beneficiary is not known/designated at the policy inception, information to be collected at the onboarding stage and in the course of the business relationship should be sufficient to enable identification and verification of the identity of the beneficiary at the claim stage. 3.5 Where there are changes to the nomination/designation of a beneficiary at any given time, sufficient information on the beneficiary should be obtained

Page 6 of 18 at that time so as to enable verification of the identity of the beneficiary at the pay-out stage. 3.6 LTIs are expected to familiarize themselves with the guidance provided below in terms of internal policy matters as well as the effectiveness of the process of identification of beneficiaries of insurance and investment related insurance policies. 4. AML/CFT/CPF POLICIES, PROCEDURES AND CONTROLS 4.1 The LTI’s AML/CFT/CPF Policies, Procedures, Internal Rules and Controls are expected to outline internal guiding principles on the identification of beneficiaries of insurance and investment related insurance policies. 4.2 Therefore, the LTIs AML/CFT/CPF Policies, Procedures, Internal Rules and Controls should be aligned to the national legal framework on identification of beneficiaries of insurance and investment related insurance policies notably; the FIA as amended, the guidelines provided herein, and any relevant subordinate instruments. 4.3 Similarly, the ML/TF/PF institutional risk assessments conducted by LTIs should include the ML/TF/PF risks posed by beneficiaries of insurance and investment related insurance policies, taking into account the following risk factors: 4.3.1 The type and nature of a client (natural person, legal person, legal arrangement, PIPs and the level of ML/TF/PF risks posed by clients); 4.3.2 The type of insurance or investment related insurance product [product features taking into account the sums involved (premium values, the value of benefits or cover amount, value of investment, etc.);

Page 7 of 18 4.3.3 The delivery channel, which in most cases involves the product offering platform (face-to-face and non-face-to-face, solicited and unsolicited business); 4.3.4 Payment methods such as the use of cash, electronic funds transfer, third-party payment if applicable, etc.; and 4.3.5 Geographical factors (domestic or foreign clients/cross border transactions, non-cooperative jurisdictions including jurisdictions published by FATF as jurisdictions requiring application of enhanced measures, as well as jurisdictions under increased monitoring). 4.4 In short, the level of due diligence required when identifying beneficiaries of insurance and investment related insurance policies depends upon the outcome of an ML/TF/PF risk assessment. LTIs are expected to develop risk understanding when identifying beneficiaries of insurance and investment related insurance policies. It is the understanding of the ML/TF/PF risks that guides the identification process. 5. CUSTOMER DUE DILIGENCE (CDD) MEASURES 5.1 The nature, extent and type of CDD are key to the effective functioning of the AML/CFT/CPF framework. The application thereof depends on the ML/TF/PF risks an individual beneficiary is posing. 5.2 CDD measures include ascertaining the risk profiles of beneficiaries of insurance and investment related insurance policies, which helps the LTIs to identify any unusual or suspicious activities. 5.3 The LTIs should be able to demonstrate that the extent of the CDD measures applied in respect of each beneficiary of insurance and investment related insurance policy are appropriate to mitigate the ML/TF/PF risks posed by such beneficiary.

Page 8 of 18 5.3.1 Simplified Due Diligence of beneficiaries who are natural persons: 5.3.1.1 Simplified Due Diligence in principle suggests reduced or less extensive CDD measures. 5.3.1.2 It is also applicable to the beneficiaries who are natural persons when acting on behalf of legal persons such as Close Corporations or Companies and legal arrangements such as Trusts and Partnerships. Simplified CDD for beneficiaries who are natural persons when they receive benefits or disinvestment in their personal capacities is explained below. 5.3.2 Extent of Simplified CDD 5.3.2.1 FIA Regulations 6 to 11 provides guidance on the basic identification procedures that should be followed for the various types of clients. However, where ML/TF/PF risks are lower, LTIs are allowed to apply simplified CDD measures. 5.3.2.2 The simplified measures should be commensurate with the lower risk factors. Examples of possible measures are: (a) Verifying the identity of the beneficiary or BO of the beneficiary when establishing the risk profile of the beneficiary at the pay-out stage; (b) Reducing the level of scrutiny of the transaction(s), based on the CDD or monetary threshold; and

Page 9 of 18 (c) Not collecting specific information or carrying out specific measures to understand the purpose but inferring the purpose and nature from the type of transaction(s), or the nature of the business relationship established. 5.3.3 Ascertainment and Verification of Information 5.3.3.1 When simplified due diligence is applicable, LTIs are still required to verify or ascertain beneficiaries’ identification information. Below is the type of beneficiaries’ information to be ascertained/verified in respect of beneficiaries who are natural persons. This information is obtained at the policy inception or at any point in the course of a business relationship when the beneficiary is nominated or designated, including instances when a contracting party changed the nomination/designation of the beneficiaries: (a) Verification: Full names; (b) Verification: Nationality; (c) Verification: If citizen – national ID no./ passport no./date of birth; (d) Verification: Non-citizen – passport no./national ID no./date of birth; (e) Obtain: Namibia residential address for citizens OR if non-citizen, residential address in his/her country or in Namibia, if any; and (f) Obtain: Contact details. 5.3.3.2 Below is identification information of beneficiaries who are legal persons and legal arrangements: (a) Verification: Registered name; (b) Verification: Country of origin;

Page 10 of 18 (c) Verification: Registration no./ license no; (d) Verification: Date of registration/licensing; (e) Verification: Place of registration/licensing; (f) Obtain: Address of registered office/physical address; and (g) Obtain: Contact details. 5.3.3.3 LTIs to ensure due verification of identification information is conducted before making any payment to the beneficiaries of insurance and investment related insurance policies. Verification for natural persons should ideally be done with the Ministry of Home Affairs’ National Population Register. However, that is not possible at the time of issuing this guidance. Therefore, in the interim LTIs should use other reliable means to verify the identity of clients using documents such as passports, voter’s cards, birth certificates and other reliable mechanisms. Verification of legal persons can be done against the database of the Business and Intellectual Property Authority (“BIPA”), while verification for legal arrangements such as Trusts can be done against the database of the Master of the High Court. 5.3.4 Pre-requisites for Simplified Due Diligence 5.3.4.1 To apply simplified due diligence, the LTI must ensure that: (a) the risk assessment it has conducted revealed low ML/TF/PF risks in respect of the beneficiaries of insurance and investment related insurance policies, the product, delivery channel and geography;

Page 11 of 18 (b) there is nothing unusual or suspicious about the payment; (c) the beneficiary is not from, nor associated with a high-risk jurisdiction; (d) the beneficiary is a domestic PIP who is posing low ML/TF/PF risks, or a family member, or a known domestic close associate of a PIP who is posing low ML/TF/PF risks; (e) the beneficiary is seen face-to-face (and not having others receiving on his/her/its behalf the benefit or investment to evade detection); (f) the beneficiary is not dealing through a shell or shelf company; (g) the beneficiary is not dealing through a complex legal structure to hide the identification of true BOs or those who will ultimately control the company or trust; and (h) the transaction is not complex, unusual or unusually large. 5.3.5 When to cease Simplified Due Diligence and commence EDD: 5.3.5.1 When there is a suspicion of ML/TF/PF; 5.3.5.2 When there is doubt about whether documents obtained for identification are genuine; 5.3.5.3 When there is doubt whether the beneficiary is indeed the one nominated/designated;

Page 12 of 18 5.3.5.4 When there are indications that the beneficiary is not the BO and there is an attempt to hide the identification of some or all BOs; 5.3.5.5 When the structure or nature of the beneficiary makes it difficult to identify the BO. The LTIs should be careful of controllers or BOs who do not wish to be recorded on company or trust documents. They usually present high ML/TF/PF risks. For example, checks can be done via BIPA, Master of the High Court, etc., to verify certain information. If a beneficiary is a corporate person and the LTI cannot identify the BO, the LTI should: (a) keep records in writing of all the actions taken to identify the BO/s; (b) take reasonable measures to verify the identity of the senior and/or authorised person/s and/or authority figure(s) in (or associated with others) the beneficiary (who is a legal person or legal arrangement responsible for managing the beneficiary) and keep records in writing of the actions taken to do so, and any difficulties encountered; (c) consider carefully the risks associated with BOs and (d) consider filing a SAR with the FIC. 5.3.5.6 Suspect that the documents obtained for identification may be lost, stolen or otherwise fraudulently acquired; 5.3.5.7 Circumstances changed and in terms of the risk assessment the beneficiary, the transaction, or location are no longer considered as low risk; and

Page 13 of 18 5.3.5.8 Any other considerations that do not render the beneficiary or specific transaction(s) low risk. 5.3.6 Enhanced Due Diligence (EDD) 5.3.6.1 It is critical that an LTI has measures to identify circumstances that require escalating controls from simplified due diligence to EDD. For example, identifying that a beneficiary is from a high-risk jurisdiction and poses high ML/TF/PF risks. 5.3.6.2 EDD applies when a client’s risk profile or transaction is not low. EDD builds on simplified due diligence by taking additional measures to identify and verify the beneficiary’s identity and creating the beneficiary’s risk profile. 5.3.6.3 The EDD in this section applies to beneficiaries who are natural persons unless otherwise indicated. The below high-level summary expands on EDD measures and requirements for LTIs: (a) General training for appropriate personnel on ML/TF/PF methods and risks; (b) Targeted training for appropriate personnel to increase awareness of higher risk beneficiaries or transactions; (c) Increased levels of KYC/counterparty or EDD; and (d) Escalation to management required for approval. 5.3.6.4 The same measures and controls may often address more than one of the risk criteria identified and it is not

Page 14 of 18 necessarily expected that LTIs will establish specific controls that target each criteria. 5.3.6.5 Given the above, if the LTI encounters increased risks such as online platforms, cryptocurrencies/assets, or any platform on non-face-to-face engagements and limited verification opportunities, the LTI must subject transactions and beneficiaries to EDD measures. 5.3.7 Nature and Type of EDD Measures It is essential to keep in mind that Regulation 12 provides for the nature and type of EDD measures or obtaining additional information 1 . 5.3.8 When to undertake EDD 5.3.8.1 As per own risk assessment, the LTI has determined that there is a high risk of ML/TF/PF associated with a beneficiary; 5.3.8.2 a beneficiary originates from or has ties to a high-risk jurisdiction; 5.3.8.3 a beneficiary is evasive, and has given the LTI false or stolen documents to identify themselves (immediately consider reporting this as a suspicious transaction/activity to the FIC); 5.3.8.4 a beneficiary is a foreign PIP, an immediate family member or a close associate of a foreign PIP; 1 the extent of which is dependent on the risk the beneficiary/transaction may pose to the LTI.

Page 15 of 18 5.3.8.5 a beneficiary is a domestic PIP, immediate family member or close associate of a domestic PIP and such a beneficiary is posing high ML/TF/PF risks; 5.3.8.6 the transaction is complex, or unusually large, or with an unusual pattern and has no apparent legal or economic purpose; 5.3.8.7 a beneficiary unreasonably refusing to continue with the transaction after being prompted to avail CDD information; and 5.3.8.8 any other considerations enhancing the ML/TF/PF risks. 5.3.9 Additional EDD Measures In order for EDD to be duly undertaken, the LTI must do more to identify, verify and scrutinize the background and nature of the beneficiary and their relevant conduct. This is usually more extensive than simplified due diligence measures. The extent to which EDD goes beyond Simplified Due Diligence (SDD) must be clearly stated in the AML/CFT/CPF Policies, Procedures, Internal Rules and Controls. For example, the LTI should make provision to: 5.3.9.1 obtain additional information or evidence to establish the identity from independent sources, such as supporting documentation on identity or address or electronic verification alongside manual checks; 5.3.9.2 take additional measures to verify the documents supplied such as by checking them against additional independent sources, or requiring that copies of the beneficiaries’ documentation are certified;

Page 16 of 18 5.3.9.3 the following measures must be taken when dealing with a beneficiary who is a foreign PIP: (a) obtain senior management approval before a benefit or investment is paid to a foreign PIP and (b) take adequate steps to establish the nature of business activities in the event of the beneficiary being a legal person. 5.3.9.4 The following measures must be applied when dealing with a domestic PIP: (a) Understand the ML/TF/PF risks posed by a domestic PIP and (b) In the event the domestic PIP poses high ML/TF/PF risks, apply measures specified under paragraph 5.3.9.1 to 5.3.9.4 above; 5.3.9.5 Measures to be applied when a beneficiary originates from or has ties to a high-risk jurisdiction: (a) Obtain additional information on the beneficiary and the BO of the beneficiary, if the ML/TF/PF risks are high-risk; (b) Obtain the approval of senior management for paying out a benefit or investment to the beneficiary; and (c) Where possible, e.g. for ongoing relationships, enhance monitoring of the pay-out transactions by increasing the number and timing of controls applied

Page 17 of 18 and select patterns of transactions that require further examination. 5.3.10 Extent and Nature of EDD 5.3.10.1 The EDD measures explained herein are extensive but not exhaustive. The extent of EDD cannot be fully prescribed. Circumstances of each scenario should ideally dictate the extent of relevant EDD measures. Generally, LTIs are not obliged to obtain information about BOs other than to enable the LTI to satisfy itself with who the BOs are or identify whether any named beneficiary who has received a benefit or investment is high-risk. 6. SCREENING AGAINST THE UNITED NATIONS SECURITY COUNCIL (UNSC) SANCTIONS LISTS 6.1. LTIs are required to screen the beneficiaries of insurance and investment related insurance policies at the pay-out stage before a benefit or investment is paid to such beneficiaries. It will enable the LTIs to avoid paying a benefit or investment to designated persons (persons on the UNSC sanctions lists). 7. CONSIDERATION OF OTHER SOURCES 7.1 The factors, indicators and measures referred to herein may not be exhaustive. LTIs are advised to consider the SRA and NRA results. Local and international trends and typology reports issued by domestic supervisory bodies or regional and international bodies such as ESAAMLG and FATF (available on their websites) may also be considered. 8. GENERAL 8.1 These guidelines are issued without prejudice to the FIA and its complementing Regulations. The information contained in this document is

Page 18 of 18 intended to guide LTIs on the matters highlighted herein and may not be exhaustive. The Guidelines can be accessed at: www.namfisa.com.na.

---

KENNETH S. MATOMOLA CHIEF EXECUTIVE OFFICER HOW TO CONTACT NAMFISA: All correspondence and enquiries must be directed to: The CEO NAMFISA P.O. Box 21250 51-55 Werner List Street, Gutenberg Plaza, Windhoek Republic of Namibia Tel: +264 (61) 290 5000 Fax: +264 (61) 290 5194 amlinspections@namfisa.com.na; or info@namfisa.com.na;