Instruction No. 2/2021

Instruction No. 2/2021 BO No. 2/2021 2nd Supplement • 2021/02/26 .................................................................................................................................................................................................. Topics Supervision :: Money Laundering Mod. 99999911/T – 01/14 Index Text of the Instruction Annex I to the Instruction Annex II to the Instruction Text of the Instruction Subject: Low and high risk factors for money laundering and terrorist financing and specific identification and due diligence measures, simplified or enhanced

Law No. 83/2017, of August 18, which establishes preventive and repressive measures to combat money laundering and terrorist financing (“Law No. 83/2017”), provides, in its Articles 35 and 36, for the adoption by obligated entities of simplified or enhanced identification and due diligence measures regarding business relationships, occasional transactions, or operations that identify a proven low risk or an increased risk, respectively, of money laundering or terrorist financing.

For this purpose, among others identified by the obligated entities or by the sectoral authorities, the factors of potentially lower and higher risk enumerated, in an exemplary manner, in Annexes II and III of Law No. 83/2017 are relevant.

Under the authorization conferred by subparagraph b) of paragraph 3 and paragraph 6 of Article 35, and by paragraphs 1 to 3 and subparagraph b) of paragraph 5 of Article 36, both of Law No. 83/2017, the Bank of Portugal may define the concrete content of the simplified or enhanced measures that prove adequate to address certain reduced or increased risks, respectively, of money laundering or terrorist financing, as well as other situations indicative of potentially lower or higher risk beyond those legally provided for.

For its part, Bank of Portugal Notice No. 2/2018, of September 26 (“Notice No. 2/2018”), expressly provides in subparagraphs a), b), and c) of paragraph 5 of Article 72, for the possibility of the Bank of Portugal, in the exercise of powers legally conferred upon it, among others, by Articles 94 and 120 of Law No. 83/2017, to complement the lists of factors and types indicative of risk contained in Annexes II and III to Law No. 83/2017 and to define other simplified and enhanced identification and due diligence measures beyond those resulting from Law No. 83/2017 and Notice No. 2/2018.

Instruction No. 2/2021 BO No. 2/2021 2nd Supplement • 2021/02/26 Topics Supervision :: Money Laundering .................................................................................................................................................................................................. Mod. 99999911/T – 01/14 In compliance with the aforementioned regulatory mandates, the Bank of Portugal hereby defines, through this Instruction, other risk factors and specific, simplified, and enhanced identification and due diligence measures.

This Instruction also complements the provisions of Article 6 of Notice No. 2/2018, concretizing the incorporation of the Guidelines on risk factors and simplified and enhanced due diligence measures (“JC/GL/2017/37”)1, issued by the European Supervisory Authorities in accordance with Article 17 and paragraph 4 of Article 18 of Directive (EU) 2015/849 of the European Parliament and of the Council, of May 20, 2015, on the prevention of the use of the financial system and of activities and professions especially designated for the purposes of money laundering and terrorist financing.

This Instruction was subject to public consultation, in accordance with Article 101 of the Administrative Procedure Code.

Thus, in the exercise of the competence conferred upon it by Article 17 of its Organic Law, by subparagraph b) of paragraph 3 and paragraph 6 of Article 35, by paragraphs 1 to 3 and subparagraph b) of paragraph 5 of Article 36, by paragraph 1 and subparagraph a) of paragraph 2 of Article 94, all of Law No. 83/2017, by paragraph 3 and sub-subparagraph v) of subparagraph b) of paragraph 4 of Article 28, by Article 30, and by subparagraphs a), b), and c) of paragraph 5 of Article 72, all of Notice No. 2/2018, the Bank of Portugal determines the following:

Chapter I Scope of application and general provisions Article 1. Object This Instruction complements:

a) The non-exhaustive list of factors and types indicative of potentially lower risk contained in Annex II of Law No. 83/2017, of August 18 (hereinafter, “Law No. 83/2017”), and defines the concrete content of simplified identification and due diligence measures, beyond those provided for in Law No. 83/2017 and in Bank of Portugal Notice No. 2/2018, of September 26 (hereinafter, “Notice No. 2/2018”), complying with the provisions of paragraph 3 and sub-subparagraph v) of subparagraph b) of paragraph 4 of Article 28, and subparagraphs a) and b) of paragraph 5 of Article 72, both of Notice No. 2/2018;

b) The non-exhaustive list of factors and types indicative of potentially higher risk contained in Annex III of Law No. 83/2017 and defines the concrete content of enhanced identification and due diligence measures, beyond those provided for in Law No. 83/2017

1https://eba.europa.eu/regulation-and-policy/anti-money-laundering-and-e-money/guidelines-on-risk-factors-and-simplified-and-enhanced-customer-due-diligence.

Instruction No. 2/2021 BO No. 2/2021 2nd Supplement • 2021/02/26 Topics Supervision :: Money Laundering .................................................................................................................................................................................................. Mod. 99999911/T – 01/14 and in Notice No. 2/2018, complying with the provisions of Article 30 and subparagraph c) of paragraph 5 of Article 72, both of Notice No. 2/2018.

Article 2. Scope of application The norms contained in this Instruction are addressed to the financial entities provided for in Article 3 of Law No. 83/2017, provided they are subject to the supervision of the Bank of Portugal in accordance with the provisions of Articles 86 and 88 of the same legal instrument.

Article 3. Definitions

1. For the purposes of applying this Instruction, the following are understood to be:

a) “Jumbo account”, an account held by the financial entity itself and used by it on behalf of its clients or counterparties;

b) “Jurisdictions associated with a higher risk of ML/TF”, jurisdictions that, based on the assessment of potentially higher risk factors, present a higher risk of money laundering or terrorist financing, including “high-risk third countries”, within the meaning of subparagraph bb) of paragraph 1 of Article 2 of Law No. 83/2017;

c) “Pooled account”, an account opened by a client to hold funds belonging to its clients, who do not have powers to move the account;

d) “Private banking”, the provision of banking and other financial services to individuals who possess a high net worth, as well as to their close family members and entities controlled by them, including the vehicles they use to hold or manage assets (“asset holding vehicles” and “asset management vehicles”, respectively);

e) “Trade finance”, the provision of trade financing services especially used to facilitate the movement of goods at the national or cross-border level, notably through the availability of financing instruments that allow reducing the risks incurred by importers or exporters of the traded goods.

2. Without prejudice to the provisions of the following paragraph, the definitions contained in Law No. 83/2017 and Notice No. 2/2018 are applicable to this Instruction, and the concepts used in this Instruction must be interpreted in the sense attributed to them in those instruments.

3. For the purposes of this Instruction, the definitions of “close family members” and of “persons recognized as closely associated” provided for, respectively, in subparagraphs w) and dd) of paragraph 1 of Article 2 of Law No. 83/2017, are applicable, as the case may be, by reference to any client, representative, or beneficial owner, even if the quality of “politically exposed person” or “holder of other political or public offices” has not been identified for them.

Article 4. Guidelines of the European Supervisory Authorities In compliance with this Instruction, financial entities shall take into account the sources of information provided for in Article 6 of Notice No. 2/2018, in particular, the Joint Guidelines of the European Supervisory Authorities, which establish simplified or enhanced identification and due diligence measures and other factors that must be considered in the adoption of the following procedures:

a) In the assessment, weighting, and management of the risk of money laundering and terrorist financing associated with business relationships and occasional transactions;

b) In defining the scope of the measures to be adopted under the duty of identification and due diligence, depending on the risk concretely identified.

Chapter II Factors and types indicative of risk of money laundering and terrorist financing Article 5. Other indicative risk situations

1. In complement to the provisions of Annex II of Law No. 83/2017 and Annex II of Notice No. 2/2018, in the analysis of money laundering and terrorist financing risks that may motivate the adoption of simplified measures, financial entities shall take into account the factors and types indicative of potentially lower risk enumerated in Annex I to this Instruction.

2. In complement to the provisions of Annex III of Law No. 83/2017, in the analysis of money laundering and terrorist financing risks that may motivate the adoption of enhanced measures, financial entities shall take into account the factors and types indicative of potentially higher risk enumerated in Annex II to this Instruction.

3. In the analysis of money laundering and terrorist financing risks carried out under Law No. 83/2017 and Notice No. 2/2018, financial entities shall also consider other situations, factors, and types indicative of risk that prove adequate to their specific operational reality.

4. Without prejudice to the cases expressly provided for in Law No. 83/2017 and Notice No. 2/2018, the isolated presence of the factors and types indicative of risk referred to in the preceding paragraphs does not necessarily determine the automatic attribution of a high or reduced risk degree to the business relationship or occasional transaction.

5. In weighing the risk factors, financial entities ensure that:

Instruction No. 2/2021 BO No. 2/2021 2nd Supplement • 2021/02/26 Topics Supervision :: Money Laundering .................................................................................................................................................................................................. Mod. 99999911/T – 01/14

a) Economic considerations or regarding profit generation do not influence the risk rating;

b) The weighting does not lead to a situation where it is impossible for any business relationship to be classified as high risk;

c) The automatic creation of risk degrees is subject to manual review;

d) The decision to manually review the automatically assigned risk degrees is always justified and falls to the compliance officer or another employee of the financial entity who is not directly involved in the commercial relationship with the client, under the supervision of the former.

Chapter III Simplified Measures Article 6. General provisions

1. In accordance with the provisions of paragraph 6 of Article 35 of Law No. 83/2017 and paragraph 3 and sub-subparagraph v) of subparagraph b) of paragraph 4 of Article 28 of Notice No. 2/2018, financial entities may adopt the simplified measures provided for in the following articles, provided that the specific prerequisites established therein are verified and compliance with the other applicable obligations provided for in Law No. 83/2017, Notice No. 2/2018, and this article is ensured.

2. The provisions of this Chapter do not prevent the adoption of other simplified measures provided for in Law No. 83/2017, Notice No. 2/2018, or defined by financial entities under the regime provided for in sub-subparagraph vi) of subparagraph b) of paragraph 4 of Article 28 of Notice No. 2/2018, including for situations indicative of potentially lower risk provided for in Law No. 83/2017, Notice No. 2/2018, and Annex I to this Instruction.

3. Whenever simplified measures are applied, financial entities, in complement to the monitoring provided for in paragraph 7 of Article 35 of Law No. 83/2017, adopt mechanisms that allow verifying, on a continuous basis, the maintenance of a proven low risk of money laundering and terrorist financing.

4. Whenever, in accordance with the provisions of Article 28 of Law No. 83/2017 and Article 27 of Notice No. 2/2018, the risk analysis carried out on the business relationship or occasional transaction justifies an increased degree of knowledge of the client, their representative, or beneficial owner, financial entities:

a) Request additional information or elements with the scope adequate to the risk concretely identified;

b) Require, also with the scope adequate to the risk concretely identified, a higher level of verification of the identifying elements and information obtained.

5. The extension of services or products provided by the financial entity to the client, beyond those covered by the simplified measures provided for in the following articles, does not require the establishment of a new business relationship, but determines the application of the identification and due diligence procedures due in accordance with Law No. 83/2017, Notice No. 2/2018, and this Instruction, at a time prior to the availability of the new services or products.

Article 7. Payment initiation services and account information services

1. In the contracting of payment initiation and account information services referred to in subparagraphs g) and h) of Article 4 of the Legal Regime of Payment Services and Electronic Money (“RJSPME”), annexed to Decree-Law No. 91/2018, of November 12, financial entities proceed to the collection and registration of the full name or company name of the client, their representatives and beneficial owners, and also of the following identifying elements:

a) When they are natural persons:

i) Type, number, validity date, and issuing entity of the identification document; or

ii) Tax identification number or, if they do not have a tax identification number, the equivalent number issued by a competent foreign authority.

b) When they are legal entities, the corporate identification number or, if none exists, the equivalent number issued by a competent foreign authority.

2. The application of the provisions of the preceding paragraph may only take place when the following prerequisites are met:

a) In the provision of payment initiation services, the financial entity adopts mechanisms that allow ensuring that payment operations are initiated with payment service providers headquartered or established in a Member State of the European Union or in a third country where there is a regulatory and supervisory framework compatible with that provided for in Law No. 83/2017 and Notice No. 2/2018.

b) In the provision of account information services, the financial entity adopts mechanisms that allow:

i) Accessing data from, at least, one account held by the client with payment service providers headquartered or established in a Member State of the European Union or in a third country where there is a regulatory and supervisory framework compatible with that provided for in Law No. 83/2017 and Notice No. 2/2018; and

ii) Ensuring knowledge of the capacity in which the client intervenes in the accounts associated with them, whenever a new account is added to the account information service.

Article 8. Electronic money Financial entities may apply the regime provided for in paragraph 1 of the preceding article to the provision of services related to the use of electronic money, provided that the following prerequisites are cumulatively met:

a) The services provided to the client by the financial entity are limited to electronic money products that meet all the risk mitigation conditions specified in subparagraph c) of paragraph 2 of Annex II of Notice No. 2/2018;

b) The funds used in the acquisition or loading of the electronic money product originate from an account domiciled in a financial entity headquartered or established in a Member State of the European Union or in a third country where there is a regulatory and supervisory framework compatible with that provided for in Law No. 83/2017 and Notice No. 2/2018.

Chapter IV Enhanced Measures Article 9. General provisions

1. In accordance with the provisions of paragraphs 1 to 3 and subparagraph b) of paragraph 5 of Article 36 of Law No. 83/2017 and subparagraph b) of Article 30 of Notice No. 2/2018, financial entities adopt the enhanced measures provided for in the following articles.

2. The provisions of this Chapter do not prevent the adoption of other enhanced measures that are defined by financial entities under the regime provided for in paragraph 4 of Article 36 of Law No. 83/2017.

3. For the purposes of adopting enhanced measures, financial entities define different degrees of high risk that reflect their specific operational reality, contemplating at least the aspects provided for in subparagraph a) of paragraph 2 of Article 14 of Law No. 83/2017, and proceed to their respective review in accordance with the provisions of Article 4 of Notice No. 2/2018.

Article 10. Clients, representatives, and beneficial owners

1. For the purposes of the provisions of subparagraph a) of paragraph 6 of Article 36 of Law No. 83/2017, examples of concrete measures for obtaining additional information about clients, their representatives, or beneficial owners are considered to be the collection of information on:

Instruction No. 2/2021 BO No. 2/2021 2nd Supplement • 2021/02/26 Topics Supervision :: Money Laundering .................................................................................................................................................................................................. Mod. 99999911/T – 01/14

a) The origin and legitimacy of the assets;

b) The legitimacy of the funds involved in the business relationship;

c) Their reputation;

d) Close family members and persons recognized as closely associated;

e) Previously developed activities;

f) The number, size, and frequency of transactions estimated to be carried out within the scope of the business relationship.

2. Whenever they carry out additional due diligence to verify the information obtained, in accordance with the provisions of subparagraph b) of paragraph 6 of Article 36 of Law No. 83/2017, financial entities resort to independent and credible sources of information, defining their type and number according to the guarantees of authenticity they offer and the increased risks concretely identified.

3. In verifying the origin of the assets, financial entities weigh the use of the following means of proof:

a) Income declarations and, where applicable, wealth control reports;

b) Financial statement reports or audit certificates prepared by independent auditors;

c) Pay slips;

d) Certificates extracted from public records;

e) Document proving successive acquisition;

f) Public information, including that from media outlets, provided it is from an independent and credible source.

4. In situations of increased risk where the client, representative, or beneficial owner presents some element of connection with other jurisdictions, financial entities obtain, at least, information on:

a) The relationships they have with those jurisdictions;

b) The existence of associated persons who may influence their operations;

c) In cases where they have their headquarters or domicile in another jurisdiction, the reason why it is intended to establish a business relationship or carry out an occasional transaction outside their jurisdiction of origin.

5. In addition to reducing the time interval for updating information in accordance with the provisions of subparagraph e) of paragraph 6 of Article 36, financial entities proceed, at least annually, to the re-analysis of the risk and other elements associated with business relationships to which a higher degree of risk is assigned.

Article 11. Jumbo accounts Financial entities that use jumbo accounts ensure the traceability of any operation to or from that account, in terms that allow the identification of the origin and destination of the funds underlying each operation, whenever necessary.

Article 12. Pooled accounts

1. In addition to adopting all identification and due diligence procedures due, financial entities treat the clients of the holder client of a pooled account as beneficial owners, adopting identification and identity verification measures according to the risk concretely identified.

2. Whenever they identify an increased risk situation associated with the use of pooled accounts, financial entities weigh the adoption of the following measures:

a) The obtaining of additional information in compliance with the complementary procedures provided for in Article 27 of Law No. 83/2017, in accordance with the provisions of subparagraph a) of paragraph 6 of Article 36 of the same legal instrument;

b) The intervention of higher hierarchical levels for the authorization of the establishment of the business relationship, in accordance with the provisions of subparagraph c) of paragraph 6 of Article 36 of Law No. 83/2017;

c) The intensification of the depth and frequency of the monitoring procedures of the business relationship or of certain operations, set of operations, or products made available, in accordance with the provisions of subparagraph d) of paragraph 6 of Article 36 of Law No. 83/2017;

d) The monit