Instruction No. 5/2019 - Annual Reporting Model for AML/CFT Prevention

Instruction No. 5/2019 BO No. 1/2019 2nd Supplement • 2019/01/30 .................................................................................................................................................................................................. Topics Supervision :: Money Laundering Mod. 99999911/T – 01/14

Index Text of the Instruction Annex to the Instruction

Text of the Instruction

Subject: Annual single reporting model in the matter of prevention of money laundering and terrorist financing

Law No. 83/2017, of August 18 (“Law No. 83/2017”), establishes preventive and repressive measures to combat money laundering and terrorist financing (“AML/TF”), partially transposing into the internal legal order Directive 2015/849/EU of the European Parliament and of the Council, of May 20, 2015, on the prevention of the use of the financial system for the purposes of AML/TF. It also establishes, in that instrument, the implementing measures for Regulation (EU) 2015/847 of the European Parliament and of the Council, of May 20, 2015, on information on the payer and payee accompanying transfers of funds.

Law No. 97/2017, of August 23, regulates the application and execution of restrictive measures approved by the United Nations Organization or by the European Union and establishes the sanctioning regime applicable to the violation of these measures.

Both Law No. 83/2017, in its Article 94, and Law No. 97/2017, of August 23, in its Article 27, provide for the possibility of approving sectoral regulation, intended essentially to adapt the duties and obligations provided for in those cross-sectoral legal instruments to the concrete operational realities to which they apply.

Following the legal provisions mentioned above, Bank of Portugal Notice No. 2/2018, of September 26 (“Notice No. 2/2018”), was approved in the matter of AML/TF prevention, a regulatory instrument that, among other aspects, defined:

a) The conditions for exercising the preventive AML/TF duties provided for in Chapters IV and V of Law No. 83/2017; b) The means and mechanisms necessary for financial entities to comply with the duties provided for in Law No. 97/2017, of August 23, with a view to the application and execution of restrictive measures approved by the United Nations Organization or by the European Union; c) The measures that payment service providers must adopt to detect fund transfers where information on the payer or payee is missing or incomplete, and the appropriate procedures to manage fund transfers not accompanied by the information required by Regulation (EU) 2015/847.

Instruction No. 5/2019 BO No. 1/2019 2nd Supplement • 2019/01/30 Topics Supervision :: Money Laundering .................................................................................................................................................................................................. Mod. 99999911/T – 01/14

Notice No. 2/2018 also revoked the following instruments: • Notice No. 5/2013, of December 18; • Notice No. 9/2012, of May 29; • Instruction No. 46/2012, of December 17; • Instruction No. 9/2017, of July 3.

Among the listed instruments, Notice No. 9/2012 of the Bank of Portugal, of May 29, which approved the Money Laundering and Terrorist Financing Prevention Report (“RPB”), and Instruction No. 46/2012, of December 17, which approved the Self-Assessment Questionnaire (“QAA”), stand out, with their annual completion and submission to the Bank of Portugal through the BPnet system being established for both.

In the exercise of its regulatory and supervisory functions, it is incumbent upon the Bank of Portugal to ensure that supervised entities have solid AML/TF prevention systems, so that through the submission of periodic reports, it is intended to obtain systematic information on the tools and procedures implemented by supervised entities in the matter of AML/TF prevention.

The RPB and QAA now give way to a single report, designated as the “Money Laundering and Terrorist Financing Prevention Report,” which will bring together information that until now was transmitted to the Bank of Portugal through two distinct mandatory reports.

In the reformulation of the report in question, on the one hand, the content of this instrument was adjusted to the assessment of compliance with the new legal and regulatory framework applicable, and on the other hand, uniform and quantitative information was collected, capable of being used in comparative analyses between sectors and subsectors subject to the supervision of the Bank of Portugal.

The Bank of Portugal also had the concern of guiding the design of this Instruction in conformity with the principles of proportionality, adequacy, and risk-based supervision.

Financial entities will thus be obliged, under point d) of paragraph 2 of Article 53 of Law No. 83/2017, to comply with the periodic communication duty established in this Instruction, under the terms and deadlines set, under penalty of incurring non-compliance provided for and punishable by Chapter XII of Law No. 83/2017.

It should be noted that this Instruction was subject to public consultation, in accordance with Article 101 of the Administrative Procedure Code, and several of the contributions presented were accepted in the final text of this regulatory instrument.

Thus, in the exercise of the competence conferred upon it by Article 17 of its Organic Law, by point c) of paragraph 2 of Article 94 and point b) of paragraph 2 of Article 95, both of Law No. 83/2017, and by paragraph 2 of Article 73 of Notice No. 2/2018, the Bank of Portugal determines the following:

Article 1. Object and Scope of Application

1. This Instruction defines the information requirements to be reported periodically to the Bank of Portugal by entities subject to its supervision in the matter of AML/TF prevention.

2. The addressees of the provisions contained in this Instruction are the financial entities provided for in Article 3 of Law No. 83/2017, provided they are subject to the supervision of the Bank of Portugal under the provisions of Articles 86 and 88 of the same legal instrument.

Article 2. Money Laundering and Terrorist Financing Prevention Report

1. Financial entities must send annually to the Bank of Portugal a specific report on their internal control system for the prevention of money laundering and terrorist financing, hereinafter designated as “RPB,” containing the information provided for in the Annex to this Instruction.

2. The RPB is composed of: a) Part 1 – Main Body; b) Part 2 – Payment Institutions and E-Money Institutions with headquarters in Portugal; c) Part 3 – Payment Institutions and E-Money Institutions with headquarters abroad; d) Part 4 – Self-Assessment Questionnaire; e) Annex I – Global opinion of the administrative body of the financial entity; f) Annex II – Opinion of the supervisory body.

Article 3. Submission of the RPB

1. The RPB must be sent to the Bank of Portugal by February 28 of each year, reporting on the period between January 1 and December 31 of the previous year.

2. The submission of the RPB must be carried out through the BPnet system, regulated by Instruction No. 5/2016, published in the Official Bulletin No. 4/2016, of April 15, 2016, by filling in the corresponding electronic form.

3. In cases of force majeure or technical unavailability of the BPnet system, institutions may exceptionally use email to send the RPB, for which they must: a) Previously request the Bank of Portugal to make the corresponding file available, via an email message sent to the address das.aia.npb@bportugal.pt or another subsequently communicated for this purpose by the Bank of Portugal; b) Proceed to send the completed file to the email address referred to in the previous point.

4. RPBs that are not reported in accordance with the terms referred to in the preceding paragraphs are considered not to have been sent to the Bank of Portugal.

Article 4. Subsequent Changes

1. Financial entities must immediately communicate to the Bank of Portugal any changes that occur: a) Regarding the following identification elements of the member of the administrative body designated under paragraph 4 of Article 13 of Law No. 83/2017 and Article 3 of Notice No. 2/2018: i) Name; ii) Email address;

Instruction No. 5/2019 BO No. 1/2019 2nd Supplement • 2019/01/30 Topics Supervision :: Money Laundering .................................................................................................................................................................................................. Mod. 99999911/T – 01/14

b) Regarding the following identification elements of the heads of the general compliance function and the compliance officer: i) Name; ii) Position and respective insertion in the hierarchical structure; iii) Date of commencement of duties; iv) Direct telephone contact; v) Email address; vi) Insertion in the organizational structure; vii) Assigned functions; c) Regarding the following identification elements of the heads of the internal audit function and external auditors: i) Name; ii) Date of commencement of duties; iii) Direct telephone contact; iv) Email address.

2. The communication of the changes provided for in the preceding paragraph must be carried out via an email message sent to the address das.saa@bportugal.pt.

Article 5. Specificities inherent to the Integrated System of Mutual Agricultural Credit

1. Without prejudice to the provisions in the following paragraphs, the Central Savings Bank of Mutual Agricultural Credit (“Caixa Central”) is responsible, in compliance with the provisions of paragraph 1 of Article 51 of Notice No. 2/2018, for sending the RPB, with aggregated information regarding the Integrated System of Mutual Agricultural Credit (“SICAM”).

2. The following information is reported disaggregated by the Caixa Central, with individualization of data or elements relating to the Caixa Central and each of the other Mutual Agricultural Credit Banks (“CCAM”) that are part of the SICAM: a) Institutional information contained in point 2 of Part 1 of the RPB, where applicable; b) Information contained in points 3.1 to 3.5 of Part 1 of the RPB; c) Information regarding training actions, referred to in point 18.2 of Part 1 of the RPB; d) Information regarding deficiencies detected in the matter of AML/TF prevention and criminal and regulatory offenses, as set out in points 20 and 21 of Part 1 of the RPB; e) Self-assessment questionnaire contained in Part 4 of the RPB, to which is added the preparation of a questionnaire by the Caixa Central, pronouncing on the SICAM as a whole; f) Other information contained in the RPB that may be timely determined by the Bank of Portugal.

3. In responding to point 3.7 of Part 1 of the RPB, the Caixa Central takes into account the risks inherent to the operational reality of the SICAM as a whole, as well as the specific risks referred to in paragraph 3 of Article 47 of Notice No. 2/2018, indicating the specific CCAM, including the Caixa Central, where such risks occur.

4. The opinion and opinion included in Annexes I and II of the RPB, respectively, are issued by the relevant bodies of the Caixa Central and cover the Caixa Central and the other CCAM that are part of the SICAM.

5. Regarding the information reported in an aggregated manner, the Caixa Central adopts the necessary procedures to ensure that, upon request by the Bank of Portugal, it is able to immediately make available individualized information regarding any of the CCAM that are part of the SICAM.

6. The Caixa Central complies with the provisions of Article 4 of this Instruction on behalf of all CCAM that are part of the SICAM.

Instruction No. 5/2019 BO No. 1/2019 2nd Supplement • 2019/01/30 Topics Supervision :: Money Laundering .................................................................................................................................................................................................. Mod. 99999911/T – 01/14

7. The CCAM provide the Caixa Central, in due time, with all the information necessary for the submission of the RPB on behalf of the SICAM, with the specificities given by this article.

8. The provisions of this article do not preclude the possibility that, under the provisions of paragraph 2 of Article 51 of Notice No. 2/2018, the Bank of Portugal may request the CCAM that are part of the SICAM to send the RPB on an individual basis.

Article 6. Informational Support

Any requests for information or clarification related to the application of this Instruction must be directed to the Preventive Supervision Area for Money Laundering and Terrorist Financing of the Investigation and Sanctioning Action Department of the Bank of Portugal, via electronic communication, through the BPnet system.

Article 7. Entry into Force

This Instruction enters into force on the day following its publication.

Article 8. Transitional Provision

1. Under the provisions of paragraph 8 of Article 78 of Notice No. 2/2018, financial entities send, by April 15, 2019, the RPB referring to the period from January 1, 2018, to December 31, 2018.

2. Regarding the period between June 1, 2017, and December 31, 2017, financial entities provide a detailed description, in point 22.2 of Part 1 of the RPB, of all qualitative information that is not coincident with the information to be reported under the preceding number for the calendar year 2018.

3. Without prejudice to the obligation to describe in detail all qualitative information that is not coincident with the information to be reported for the calendar year 2018, financial entities, in compliance with the preceding paragraph, always make express mention, in point 22.2 of Part 1 of the RPB: a) To the activity developed by internal audit, as provided for in point 3.4.2 of Part 1 of the RPB; b) To the activity developed by external audit, as provided for in point 3.5.2 of Part 1 of the RPB; c) To the assessments made on the quality, adequacy, and effectiveness of policies and procedures and controls in the matter of AML/TF prevention, as provided for in point 3.8 of Part 1 of the RPB; d) To the documents approved by the administrative body, as provided for in point 3.9 of Part 1 of the RPB; e) To the existence of impediments to the implementation of control mechanisms for AML/TF prevention in group relationships and establishments abroad, as provided for in point 3.10.2 of Part 1 of the RPB; f) To the summary indication of irregularity communications, and their processing, received under Article 20 of Law No. 83/2017 and Article 11 of Notice No. 2/2018, as provided for in points a) and b) of point 3.13 of Part 1 of the RPB; g) To cross-border correspondent relationships established, as provided for in points 6.1.1, 6.1.3, and points a) and b) of point 6.2 of Part 1 of the RPB; h) To third entities designated under Article 41 of Law No. 83/2017 and Article 35 of Notice No. 2/2018, as provided for in points a) to c) of point 7 of Part 1 of the RPB;

Instruction No. 5/2019 BO No. 1/2019 2nd Supplement • 2019/01/30 Topics Supervision :: Money Laundering .................................................................................................................................................................................................. Mod. 99999911/T – 01/14

i) To the indication of the use of credit intermediaries, promoters, or other intermediaries, as provided for in point a) of points 8 and 9 of Part 1 of the RPB; j) To the use of third-party service providers, as provided for in point 10 of Part 1 of the RPB; k) To the training actions carried out, as provided for in point 18.2 of Part 1 of the RPB; l) To the deficiencies detected in the matter of AML/TF prevention, as provided for in points 20.1 and 20.2 of Part 1 of the RPB; m) To criminal and regulatory offenses related to AML/TF or to the non-compliance of procedures intended for its prevention, as provided for in point 21 of Part 1 of the RPB.

4. The quantitative information regarding the period between June 1 and December 31, 2017, is reported through an autonomous file, under the terms and according to a model to be defined by Circular Letter.

Annex to Instruction No. 5/2019 BO No. 1/2019 2nd Supplement • 2019/01/30 Topics Supervision :: Money Laundering .................................................................................................................................................................................................. Annex to the Instruction Annex (to which Article 2 refers) Money Laundering and Terrorist Financing Prevention Report

PART 1 – MAIN BODY

1. Reference Period a) Start; b) End.

2. Institutional Information as of the end of the reference period 2.1. General Information a) Financial agent code; b) Corporate name; c) Collective Person Identification Number (“NIPC”); d) Address: i) Of the headquarters, for financial entities with headquarters in Portugal; ii) Of the branch, for branches of financial entities with headquarters in another Member State of the European Union or in a third country; or iii) Of the Central Contact Point, whenever applicable, for payment institutions or e-money institutions with headquarters in another Member State of the European Union, operating in Portugal through agents and/or distributors; e) Type of financial entity.

2.2. Administrative Body and Human Resources a) Identification of the members of the administrative body and, whenever applicable, indication of their respective portfolios; b) Total number of collaborators [in the sense of point e) of paragraph 1 of Article 2 of Bank of Portugal Notice No. 2/2018 (“Notice No. 2/2018”)]; c) Number of relevant collaborators [in the sense of point f) of paragraph 1 of Article 2 of Notice No. 2/2018]: i) Internal; ii) External.

2.3. Activity and Business Areas

Instruction No. 5/2019 BO No. 1/2019 2nd Supplement • 2019/01/30 Topics Supervision :: Money Laundering ..................................................................................................................................................................................................

a) Total assets (net, on an individual basis); b) Turnover; c) Business areas of the financial entity (defined in the strategic plan or in an equivalent document), with indication of their relative weight (calculated based on turnover, the sum of the areas must total 100%) and the number of clients associated with them.

2.4. Activity Developed on Behalf Activity developed on behalf (as agents and/or distributors) of payment institutions or e-money institutions with headquarters in other Member States of the European Union, with identification: a) Of the payment institutions, with headquarters in another Member State of the European Union, for which the supervised entity is an agent in Portugal, with indication of their respective jurisdiction; b) Of the e-money institutions, with headquarters in another Member State of the European Union, for which the supervised entity is an agent in Portugal, with indication of their respective jurisdiction; c) Of the e-money institutions, with headquarters in another Member State of the European Union, for which the supervised entity is a distributor in Portugal, with indication of their respective jurisdiction.

2.5. Presence Abroad a) Countries or jurisdictions of subsidiaries; b) Countries or jurisdictions of branches; c) Countries or jurisdictions of agents (payment institutions/e-money institutions); d) Countries or jurisdictions of distributors (e-money institutions); e) Identification of foreign correspondent financial entities and their respective countries or jurisdictions where they are located; f) Identification of foreign respondent financial entities and their respective countries or jurisdictions where they are located.

2.6. Financial entity with headquarters abroad, when operating in national territory through branches: Identification of the headquarters address.

2.7. Payment institution with headquarters in another Member State of the European Union, when operating in national territory through agents: Identification of the headquarters address.

2.8. E-money institution with headquarters in another Member State of the European Union, when operating in national territory through agents: Identification of the headquarters address.

2.9. E-money institution with headquarters in another Member State of the European Union, when operating in national territory through distributors: Identification of the headquarters address.

3. Duty of Control 3.1. Member of the Administrative Body

Instruction No. 5/2019 BO No. 1/2019 2nd Supplement • 2019/01/30 Topics Supervision :: Money Laundering ..................................................................................................................................................................................................

Identification elements of the member of the administrative body responsible, as of the end of the reference period, for the execution of the provisions of Law No. 83/2017, of August 18 (“Law No. 83/2017”), of the provisions of Notice No. 2/2018, and other relevant regulation, designated under the terms of paragraph 4 of Article 13 of Law No. 83/2017 and Article 3 of Notice No. 2/2018: a) Name; b) Email address.

3.2. Compliance Function 3.2.1. Information regarding the general compliance function as of the end of the reference period, namely: a) Insertion in the organizational structure; b) Whether the number of collaborators, excluding administrators, is less than 6, and whether the operating profits in the last financial year are less than € 1,000,000; c) Whether the function is autonomous, i.e., if it has no direct link to the functional areas subject to evaluation; d) Number of collaborators assigned to the function; e) Number of collaborators assigned to the function on an exclusive basis.

3.2.2. If segregation between the compliance function and the functional areas that are subject to evaluation does not occur, a description of the additional control mechanisms existing that intend to ensure the independence of the compliance function and that allow mitigating the potential conflicts and increased risks arising therefrom.

3.2.3. Identification elements of the head of the general compliance function as of the end of the reference period: a) Name; b) Position and respective insertion in the hierarchical structure; c) Indication of whether the position of head of the general compliance function is exercised on an exclusive basis; d) Date of commencement of duties; e) Direct telephone contact; f) Email address; g) Detailed professional curriculum and training curriculum (attach as annex).

3.3. Function of Control of Compliance with the Regulatory Framework in the Matter of Prevention of Money Laundering and...