Horizontal letter: application of financial sanctions regime (Counter terrorism financing)

THE GOVERNOR Reference Contact person Prudential Policy and Financial Stability Arthur Van Damme National Bank of Belgium nv/sa Company number: Phone: +32 2 221 35 04 Boulevard de Berlaimont 14 0203.201.340 Our reference fax: +32 2 221 31 04 1000 Brussels RPM (Trade Register) TA/2016/12/L287.VA.AnG arthur.vandamme@nbb.be BELGIUM Brussels www.bnb.be Brussels, 6 December 2016 Dear Sir, Dear Madam, In view of the recent national and international developments, the Bank expects the financial institutions, within the bounds of their possibilities, to take all appropriate steps to combat the financing of terrorism. Against this background, the Bank has recently carried out a horizontal analysis of the replies submitted by the institutions under supervision to the periodic questionnaire on the prevention of money laundering1. This horizontal analysis covered in particular the questions about the application of financial sanctions, including the freezing of funds and economic resources of certain persons and entities in the context of the fight against terrorism (questions 4.12, 4.13, 4.14 , 5.4, 5.5, 6.7 and 6.152). Following the analyses performed, the Bank recently contacted several institutions to obtain additional information regarding the way in which the application of the financial sanctions is ensured by them. Based on the analyses made and the additional information obtained, the Bank identified clear shortcomings in the procedures and control systems of some institutions. The Bank also noted that not all institutions are sufficiently familiar with the financial sanctions regime and the obligations deriving from it. In both cases, there is a serious risk of violation by the institutions of the financial sanctions regime. Such violations may give rise to penal sanctions and also involve a high reputational risk. With this letter, the Bank wishes to emphasize the importance of complying properly with the obligations under the sanctions regime. Below is a report of the Bank's main findings resulting from the aforementioned analysis of the replies to the periodic questionnaire and from the additional information received, followed by its expectations and recommendations.

1 Circulars NBB_2015_26 of 7 October 2015 and NBB_2015_27 of 7 October 2015. 2 Questions 6.7 and 6.15 did not need to be answered by life insurance companies; the reference to the questions listed is not applicable for the institutions which were invited to reply to the short-form questionnaire annexed to Circular NBB_2015_27.

THE GOVERNOR Page 2/7 – 2016-12-06 The Bank wishes to emphasize that these findings, expectations and recommendations are in no way exhaustive. Each institution must conduct its own analysis of the vulnerability of its organisation to violations of the sanctions regime. If necessary, measures must be taken with regard to its internal organisation, procedures and/or the systems used. The companies that were previously contacted by the Bank regarding their replies to the periodic money laundering questionnaire, must consider this letter as a first response to the additional information or the action plan they recently submitted to the Bank. If necessary, the Bank may recontact these institutions in the coming months, based on a risk-based analysis, for further follow-up on an individual basis. The Dutch and/or French version of this letter and of the Bank’s findings, expectations and recommendations is available upon request. E-mail applications may be sent to supervision.ta.aml@nbb.be. Yours faithfully, Jan Smets

• * Copy: to the accredited auditor3

3 If applicable.

THE GOVERNOR Page 3/7 – 2016-12-06

Main findings resulting from the aforementioned horizontal analysis and the additional information obtained. I. Financial sanctions regime in Belgium The European Union and Belgium each establish lists of persons or entities in respect of whom a decision imposing financial sanctions has been taken. The funds and economic resources of persons and entities that are included in these lists, must be frozen. The financial sanctions regime is an instrument that is used for several purposes by the European institutions and the Belgian authorities, including in the context of European and Belgian foreign policy, the fight against terrorism and terrorist financing or the fight against the proliferation of weapons of mass destruction. Any violation of this sanctions regime may give rise to penal sanctions and to serious reputational damage. In applying financial sanctions, financial institutions should take account of the sanctions adopted by the European Union4 and the Belgian government. The Bank notes that the Belgian government recently made use for the first time of the possibility to designate itself persons and entities to whom the freezing of funds and economic resources should apply5. Financial institutions should therefore ensure that they do not restrict themselves to applying the European sanctions. II. Scope The obligation to freeze funds and economic resources applies to both the public and the private sector. All financial institutions supervised by the Bank are therefore subject to the sanctions regime. However, the Bank noted that some institutions considered that they were not subject to the sanctions regime, inter alia for the following reasons (non-exhaustive list):

• they only offer life insurance products presenting a ‘low risk’ of being misused for money laundering or terrorist financing purposes;
• they do not hold client funds and are not directly involved in the execution of transactions on behalf of clients;
• they do not accept foreign customers. None of these elements gives rise to an exemption from the application of financial sanctions.
• The obligation to apply financial sanctions does not depend on a risk-based analysis;
• The obligation to freeze funds and economic resources is generally broadly defined. Besides the obligation to freeze the funds of targeted persons and entities, financial institutions also have the obligation to freeze the economic resources of those persons and/or entities, which implies, inter alia, that these economic resources may not be used to obtain funds, goods or services6. Consequently, providing services to such persons or entities also falls under the restrictive measures imposed;

4 The consolidated EU sanctions list is available on the following website: http://eeas.europa.eu/cfsp/sanctions/consol￾list/index_en.htm. 5 See Royal Decrees of 30 May 2016 (Belgian Gazette of 1 June 2016), 21 July 2016 (Belgian Gazette of 27 July 2016) and 3 November 2016 (Belgian Gazette of 9 November 2016) establishing the list of persons and entities referred to in Articles 3 and 5 of the Royal Decree of 28 December 2006 on specific restrictive measures directed against certain persons and entities with a view to combating terrorist financing. 6 Note that, depending on the legal source from which the obligation to freeze or to take restrictive measures is derived, the definition of the measures to be taken against the targeted persons and/or entities may sometimes differ from one sanction to another.

THE GOVERNOR Page 4/7 – 2016-12-06

• Persons and entities of Belgian nationality or resident in Belgium may also be included in the sanctions lists. The Bank also noted that certain institutions confuse the checks to be carried out in order to verify the proper application of the sanctions regime, with the checks to be carried out by the institutions under the anti-money laundering and counter-terrorist financing regulations, such as customer due diligence measures (KYC7) and the detection of atypical transactions. These checks should however be clearly distinguished from each other, which does not mean that they cannot be complementary. Where an institution finds that a customer or a counterparty of the customer is included in any of the applicable sanctions lists, this is obviously an element that should be taken into consideration when examining the customer concerned in accordance with the anti￾money laundering legislation (KYC). The Bank expects financial institutions to have a good knowledge of the financial sanctions regime and the obligations arising from it as regards internal organisation, checks to be carried out (screening of customer data, screening of transactions and counterparties), verification of possible matches, reporting to the Minister of Finance (Treasury Administration), etc. III. Risk assessment and appropriate organisation In the light of the findings listed in section II, the Bank expects each financial institution to carry out an analysis of the vulnerability of its organisation to violations of the financial sanctions regime. On this basis, it must take the necessary measures. In this context, the Bank expects the institutions to comply with at least the following conditions:
• adopt a clear policy and written internal procedures relating to the application of financial sanctions, both approved by a sufficiently high hierarchical level within the institution;
• provide appropriate training of staff with regard to the application of financial sanctions (knowledge of the sanctions regime, availability of internal procedures, clear instructions, etc.);
• provide appropriate and independent internal monitoring of compliance in practice with the established policies and procedures. IV. Screening of new customers, agents and beneficial owners as part of the customer acceptance procedure The Bank noted that, as part of the customer acceptance procedure, most institutions under its supervision screen their new customers against the sanctions lists. However, the Bank also noted that the agents and beneficial owners of the customers are not always screened against the sanctions lists, which significantly increases the risk of violation of the sanctions regime. The Bank expects the institutions to systematically screen all new customers, their agents and beneficial owners, without exception, against the sanctions lists, as part of the customer acceptance procedure. The Bank also noted that some institutions only screen their new customers against the sanctions lists if a customer has been identified by it as a customer representing a higher risk of money laundering and/or terrorist financing (see also above in section II, the confusion between checks carried out in the context of the sanctions regime and checks carried out under the anti-money laundering legislation). The Bank believes that such a policy seriously increases the risk of violations of the sanctions regime. As already noted above, the Bank expects the screening to be carried out systematically and without exception for every customer, his agents and beneficial owners, regardless of his or her risk profile.

7 KYC stands for 'Know your customer'.

THE GOVERNOR Page 5/7 – 2016-12-06 The Bank also noted that institutions do not always rescreen new clients which were referred to it by another financial institution against the sanctions lists, but that they refer to the screenings carried out by the referring institution. Where institutions rely on the checks carried out earlier by another institution, the Bank expects this institution to make sure that this check has actually been carried out and to check the quality of these screenings. The Bank also noted that some institutions document their checks against the sanctions lists and that they systematically keep this documentation in the customer's records. Thus, an audit trail is kept of the checks carried out. The Bank considers this a good practice. The Bank also noted that several institutions have systems that allow fuzzy matching between, on the one hand, the data of customers (agents, beneficial owners, counterparties), and, on the other hand, data on targeted persons and/or entities provided in the sanctions lists. Fuzzy matching is a technique that allows to find similarities between pieces of text, even if the data does not correspond 100%, for instance if any of the data compared contains a typing error, a double space, an additional initial, etc ...). The Bank considers it good practice for institutions to use systems that allow fuzzy matching. Finally, the Bank noted that many institutions already have automated systems to perform screenings against the sanction lists. The Bank emphasizes that the institutions which do not currently have an automated system, should, based on their own analysis and taking into account their activities, nature and size (number of customers, number of transactions), examine whether an automated system is necessary for the purpose of carrying out the aforementioned checks in an efficient manner. It may be perfectly acceptable for smaller institutions (limited number of customers, few transactions) not to have an automatic screening tool or to have a tool with less sophisticated functions (e.g. as regards fuzzy matching), because the limited amount of data to be screened allows them to ensure a good quality of the manual checks. V. Continuous screening of customers, agents and beneficial owners The Bank noted that some institutions do not periodically repeat the screening carried out as part of the customer acceptance procedure. As the sanctions lists are updated on a very regular basis by adding or deleting persons or entities, there is a serious risk that in such cases, the institutions violate the sanctions regime. Therefore, the Bank expects the financial institutions to rescreen the customer data (including the information on agents and beneficial owners) within a reasonable period of time after every update of the sanctions lists. Based on their own analysis, certain institutions may also decide not to carry out these checks immediately after every update of the sanctions lists, but only after a predetermined period or interval. This is possible if because of the nature of the services, the risk of violation of the sanctions regime following an update of the sanctions lists is very low. The Bank also emphasizes the importance of updating the records the institutions maintain on customers, their agents and their beneficial owners. Not having up-to-date information about these persons may significantly increase the risk of violation of the sanctions regime. As regards the continuous screening of customers, agents and beneficial owners, the expectations and recommendations contained in section IV apply. VI. Screening of the information available on counterparties of customers in carrying out transactions The Bank notes that some institutions do not have the procedures and/or systems required to screen transactions carried out by customers. Where institutions have information concerning customers' counterparties involved in these transactions, the Bank expects this information to be screened against the sanction lists. The Bank reiterates that the obligation to freeze funds and economic resources is broadly defined and that this obligation is not restricted to the funds and economic resources of customers.

THE GOVERNOR Page 6/7 – 2016-12-06 Thus, the Bank expects the institutions to screen the information available about their customers' counterparties against the sanctions lists, and, if there is a match, to freeze the funds or economic resources of these persons or entities. The Bank also noted that some institutions believe that the screening of the information available on the counterparties should be performed only where there is a legal obligation for the institution to have information on the counterparties. This is not true. As soon as the institution actually has access to information about the counterparties, it should screen this information against the sanctions lists. Some concrete examples:

• In case of transfers of funds within the European Union, payment service providers are in principle only required to provide the account numbers of the payer and the payee as part of the transfer of funds. Where a customer of an institution receives a transfer of funds which is accompanied only by the account number of the payer, this information can in principle not be screened against the sanctions lists. In practice, transfers of funds within the European Union are often also accompanied by information on the payer, such as his (corporate) name and/or surname. Conversely, in the case of transfers of funds carried out by customers, institutions usually ask to mention the name of the payee on the transfer form. Thus, it has information on the payer and the payee of the transfer of funds. This information must be screened against the sanction lists.
• The Bank noted that institutions offering life insurance products do not always verify whether the beneficiary individuals and entities of these contracts are included in the sanctions lists. Where these institutions have information on the payee, which is in principle always the case, this information should also be screened against the sanctions lists, before any payment of funds to this payee. The Bank also noted that only a very limited number of institutions have indicated that they check whether or not third parties other than the policyholder which make premium payments on behalf of the policyholder, are included in the applicable sanctions lists. The Bank emphasizes that institutions which have relevant information on these third parties (e.g. the name of the payer of the premium that accompanies a transfer of funds) are at risk of violating the sanctions regime if they do not screen this information against the sanctions lists.
• Institutions offering services with regard to financial instruments to their customers are expected to screen the information available on theirs customers' counterparties against the sanctions lists. This is for instance the case where financial institutions need to deposit the income from customers' investments in an account held in the name of a third party, or where a financial institution receives funds from third parties through transfers of funds, in order to purchase financial instruments on behalf of their customers. VII. Procedure to be followed in case of a match with the sanctions lists Where the screening of the information referred to above reveals a match with one of the persons or entities included in the sanctions lists, the Bank expects the financial institutions to have clear procedures for examining and monitoring these matches. The institutions must adopt procedures for:
• examining whether there is a real match (hereinafter a 'positive match') with a person included in the sanctions list;
• the freezing and/or blocking of funds and economic resources in case of positive matches.

THE GOVERNOR Page 7/7 – 2016-12-06 In case of a positive match with the sanctions lists, or where it cannot be determined with sufficient certainty whether the match is positive or 'falsely positive'8, the Bank considers it good practice that someone with a sufficiently high hierarchical position within the institution (e.g. the person responsible for money laundering or the compliance officer) is informed of this match. This person can then decide on any further follow-up to be given to the findings. The Bank noted that various institutions provide that in case of a match with the sanctions lists, a clear audit trail should be kept of the examinations made as a result thereof and of the follow-up given to the findings. The Bank believes that this is a good practice. If a positive match is confirmed, institutions are under the obligation to inform the Minister of Finance at the address of the General Treasury Administration, besides their obligation to freeze the funds and economic resources of these persons and entities. If necessary, the Financial Intelligence Processing Unit must also be informed if the institution knows or suspects that the transactions carried out by the customer in respect of whom a positive match with the sanctions list has been found, are linked to money laundering or terrorist financing.

• *

8 For instance: the name of a counterparty of a customer matches with the name of a person included in a sanctions list, but an examination reveals that this counterparty is not the person included in the sanctions list.