Instruction No. 8/2024

Instruction No. 8/2024 BO No. 5/2024 2nd Supplement • 2024/06/05 .................................................................................................................................................................................................. Topics Supervision :: Money Laundering Mod. 99999911/T – 01/14 Index Text of the Instruction Annex to the Instruction PART 1 – MAIN BODY PART 2 – INTRINSIC RISK PART 3 – AML/CFT PREVENTION POLICIES, PROCEDURES AND CONTROLS PART 4 — IDENTIFIED DEFICIENCIES IN AML/CFT PREVENTION PART 5 - CRIMINAL AND REGULATORY OFFENCES PART 6 - SELF-ASSESSMENT Text of the Instruction Subject: Instruction approving the annual reporting model for the prevention of money laundering and terrorist financing

On June 6, 2022, Bank of Portugal Notice No. 1/2022 was published, a legal instrument that repealed and replaced Bank of Portugal Notice No. 2/2018, of September 26, and Bank of Portugal Instruction No. 2/2021, of February 26, and which regulates the provisions of Law No. 83/2017, of August 18, in the context of the activities of financial entities subject to the supervision of the Bank of Portugal in the field of prevention of money laundering and terrorist financing.

Article 83 of Bank of Portugal Notice No. 1/2022, of June 6, provides for the obligation of said financial entities to send annually to the Bank of Portugal a specific report on their internal control system and other informative elements for AML/CFT prevention (hereinafter abbreviated as "RPB"), in accordance with the terms and according to the model to be defined by Instruction.

In implementation of the aforementioned norm, this Instruction defines the specific information elements to be reported, the respective model, and the other terms for sending the RPB to the Bank of Portugal, proceeding to the revocation of Bank of Portugal Instruction No. 5/2019, of January 30, and Bank of Portugal Instruction No. 6/2020, of March 6.

In accordance with paragraph 1 of Article 3 of this Instruction, the RPB must be sent to the Bank of Portugal by March 31 of each year, reporting on the period between January 1 and December 31 of the previous year. However, justified by the changes to be introduced in the RPB model, Article 8 of this Instruction provides for a transitional rule that derogates, for the current year, said norm, as it stipulates that the sending of the RPB referring to the period between January 1, 2023, and December 31, 2023, must occur by September 30, 2024.

This Instruction was subject to public consultation, in accordance with Article 101 of the Administrative Procedure Code.

Thus, in the exercise of the competence conferred upon it by Article 17 of its Organic Law, approved by Law No. 5/98, of January 31, by letter c) of paragraph 2 of Article 94 and letter b) of paragraph 2 of Article 95, both of Law No. 83/2017, of August 18, and by Article 83 of Bank of Portugal Notice No. 1/2022, of June 6, the Bank of Portugal determines the following:

Article 1. Object This Instruction defines the information elements to be reported annually to the Bank of Portugal by financial entities subject to its supervision in matters of prevention of money laundering and terrorist financing ("AML/CFT"), the respective model, and the other terms of submission, in compliance with the provisions of Article 83 of Bank of Portugal Notice No. 1/2022, of June 6 ("Notice No. 1/2022").

Article 2. Money Laundering and Terrorist Financing Prevention Report

1. Financial entities send annually to the Bank of Portugal a specific report on their internal control system for AML/CFT prevention, hereinafter designated as "RPB", containing the information provided for in the Annex to this Instruction.
2. The RPB is composed of: a) Part 1 – Main Body; b) Part 2 – Intrinsic Risk; c) Part 3 – AML/CFT Prevention Policies, Procedures and Controls; d) Part 4 – Identified Deficiencies in AML/CFT Prevention; e) Part 5 – Criminal and Regulatory Offences; f) Part 6 – Self-Assessment; g) Annex I – Global Opinion of the Administrative Body of the Financial Entity; h) Annex II – Opinion of the Supervisory Body.

Article 3. Submission of the RPB

1. The RPB is sent to the Bank of Portugal by March 31 of each year, reporting on the period between January 1 and December 31 of the previous year.
2. The submission of the RPB is carried out through the BPnet system, regulated by Bank of Portugal Instruction No. 16/2023, of July 11, by filling in the corresponding electronic form.
3. The RPB is considered not sent to the Bank of Portugal if it is not reported in accordance with the terms referred to in the preceding paragraphs.

Article 4. Subsequent Changes

1. Financial entities immediately communicate to the Bank of Portugal any changes that occur in the following data: a) Regarding the executive member of the administrative body designated in accordance with paragraph 4 of Article 13 of Law No. 83/2017, of August 18 ("Law No. 83/2017"), and Article 4 of Notice No. 1/2022: i) Name; ii) Email address; b) Regarding the person responsible for the general compliance function and the person responsible for the function of controlling compliance with the regulatory framework in matters of AML/CFT prevention ("Compliance Officer" – "RCN"), and their substitute: i) Name; ii) Job title; iii) Insertion in the hierarchical structure; iv) Start date of functions; v) End date of functions, in case of change of the responsible person or their substitute; vi) Direct telephone contact; vii) Email address.
2. The communication of the changes provided for in the preceding paragraph is carried out via email message sent to the address averiguacao.accao.sancionatoria@bportugal.pt.

Article 5. Specificities inherent to the Integrated System of Mutual Agricultural Credit

1. In compliance with the provisions of paragraph 1 of Article 61 of Notice No. 1/2022, the Central Box of Mutual Agricultural Credit ("Central Box") is responsible for sending the RPB with aggregated information regarding the Integrated System of Mutual Agricultural Credit ("SICAM"), without prejudice to the provisions in the following paragraphs.
2. The following information is subject to disaggregated reporting by the Central Box, with individualization of data or elements relating to the Central Box and each of the other Mutual Agricultural Credit Boxes ("CCAM") that are part of the SICAM: a) Institutional information contained in point 2 of Part 1 of the RPB, where applicable; b) Information relating to the nature, size, and complexity of the business, contained in point 1 of Part 2 of the RPB, where applicable; c) Information relating to the training duty, referred to in section E of Part 3 of the RPB; d) Information relating to deficiencies detected in AML/CFT prevention and to criminal and regulatory offences, as set out in Parts 4 and 5 of the RPB; e) Other information contained in the RPB that may be timely determined by the Bank of Portugal.
3. The opinion and opinion included in Annexes I and II of the RPB, respectively, are issued by the relevant bodies of the Central Box and cover the Central Box and the other CCAMs that are part of the SICAM.
4. Regarding the information reported in an aggregated manner, the Central Box adopts the necessary procedures to ensure that, upon request by the Bank of Portugal, it is in a position to immediately make available individualized information regarding any of the CCAMs that are part of the SICAM.
5. The Central Box complies with the provisions of Article 4 of this Instruction on behalf of all CCAMs that are part of the SICAM.
6. The CCAMs provide the Central Box, in due time, with all information necessary for the submission of the RPB on behalf of the SICAM, with the specificities given by this Article.
7. The provisions of this Article do not preclude the possibility that, under the provisions of paragraph 2 of Article 61 of Notice No. 1/2022, the Bank of Portugal requests the CCAMs that are part of the SICAM to send the RPB on an individual basis.

Article 6. Informational Support Any requests for information or clarification related to the application of this Instruction are directed to the Bank of Portugal through the "Risk Assessment and supervisory measures" service available in the "AML/CFT Prevention" Area of the BPnet System.

Article 7. Repealing Clause The following are repealed: a) Bank of Portugal Instruction No. 5/2019, of January 30; b) Bank of Portugal Instruction No. 6/2020, of March 6.

Article 8. Transitional Provision Financial entities send by September 30, 2024, the RPB referring to the period from January 1, 2023, to December 31, 2023.

Article 9. Entry into Force This Instruction enters into force on the day following its publication.

Annex to Instruction No. 8/2024 BO No. 5/2024 2nd Supplement • 2024/06/05 Topics Supervision :: Money Laundering ...................................................................................................................................................................................... Annex to the Instruction Annex (to which Article 2 refers) Money Laundering and Terrorist Financing Prevention Report ("RPB") PART 1 – MAIN BODY

1. REFERENCE PERIOD 1.1. Start; 1.2. End.
2. INSTITUTIONAL INFORMATION AS OF THE END OF THE RPB REFERENCE PERIOD (DECEMBER 31) 2.1. General Information a) Financial agent code; b) LEI Code ("Legal Entity Identifier"), if available; c) Corporate name; d) Institutional type of the financial entity; e) Tax Identification Number ("NIPC"); f) Identification of the parent company, in the case of financial entities or others of equivalent nature with headquarters abroad operating in national territory through a branch: i. Corporate name; ii. LEI Code ("Legal Entity Identifier"), if available; g) For payment institutions and electronic money institutions with headquarters in another Member State of the European Union operating in national territory through agents or distributors, where applicable, identification of the central contact point: i. Name or corporate name; ii. Address.

2.2. Member of the Administrative Body Identification of the executive member of the administrative body designated in accordance with paragraph 4 of Article 13 of Law No. 83/2017 and Article 4 of Notice No. 1/2022: a) Name; b) Assigned portfolios; c) Email address.

2.3. Person Responsible for the General Compliance Function Identification of the person responsible for the general compliance function: a) Name; b) Job title; c) Insertion in the hierarchical structure; d) Indication if the function is exercised jointly with that of the person responsible for the function of controlling compliance with the regulatory framework in matters of money laundering and terrorist financing prevention ("AML/CFT") – "Compliance Officer" or "RCN" –, designated in accordance with Article 16 of Law No. 83/2017 and Article 5 of Notice No. 1/2022; e) Start date of functions; f) Direct telephone contact; g) Email address.

2.4. Person Responsible for Regulatory Compliance ("RCN") 2.4.1. Identification of the person responsible for regulatory compliance ("RCN") designated in accordance with Article 16 of Law No. 83/2017 and Article 5 of Notice No. 1/2022, when the function of controlling compliance with the regulatory framework in matters of AML/CFT prevention is segregated from the general compliance function: a) Name; b) Job title; c) Insertion in the hierarchical structure; d) Start date of functions; e) Direct telephone contact; f) Email address.

2.4.2. Identification of the substitute for the person responsible for regulatory compliance ("RCN"): a) Name; b) Job title; c) Insertion in the hierarchical structure; d) Start date of functions; e) Direct telephone contact; f) Email address.

2.5. Audit Function 2.5.1. Internal Audit Information regarding the persons responsible for the internal audit function of the financial entity as of the end of the RPB reference period (December 31): a) Existence of an internal audit function in the financial entity; b) Identification of the internal auditor; c) Start date of functions.

2.5.2. External Audit Information regarding the external auditor(s) of the financial entity as of the end of the RPB reference period (December 31): a) Existence of external auditor; b) Identification of the external auditor; c) Start date of functions.

PART 2 – INTRINSIC RISK

1. NATURE, SIZE, AND COMPLEXITY OF THE BUSINESS 1.1 Financial Information a) Total assets (net, on an individual basis), in euros; b) Turnover¹, in euros. 1.2 Indication of the financial entity's business areas, with indication of the relative weight² and the number of clients associated with them 1.3 Human Resources a) Total number of employees; b) Number of relevant employees. 1.4 Activity in national territory and abroad 1.4.1 For financial entities with headquarters in national territory: a) Identification of subsidiaries and branches abroad, with indication of the country or jurisdiction in which they operate; b) For payment institutions, indication of the countries or jurisdictions where their agents operate, with indication of the number of agents per country or jurisdiction; c) For electronic money institutions, indication of the countries or jurisdictions where their agents operate, with indication of the number of agents per country or jurisdiction; d) For electronic money institutions, indication of the countries or jurisdictions where their distributors operate, with indication of the number of distributors per country or jurisdiction. 1.4.2 For branches of financial entities or others of equivalent nature with headquarters abroad ("parent company"), indication of the country or jurisdiction where the parent company's headquarters is located.

1 The concept of "turnover" to be considered for this purpose is defined in "Annex B – IRC – Simplified Business Information (financial sector entities – Decree-Law No. 298/92, of December 31)", approved by Ordinance No. 35/2019, of January 28. 2 Calculated based on turnover, the sum of the areas must total 100%.

1.4.3 For payment institutions with headquarters in another Member State of the European Union operating in national territory through agents, indication of the country or jurisdiction where the headquarters is located. 1.4.4 For electronic money institutions with headquarters in another Member State of the European Union operating in national territory through agents, indication of the country or jurisdiction where the headquarters is located. 1.4.5 For electronic money institutions with headquarters in another Member State of the European Union operating in national territory through distributors, indication of the country or jurisdiction where the headquarters is located.

2. CLIENT-INHERENT RISK 2.1 General Information as of the end of the RPB reference period (December 31) a) Total number of clients; b) Number of "individual" clients; c) Number of "corporate" clients; d) Number of "collective interest centers without legal personality" clients.

2.2 Information on "individual" clients as of the end of the RPB reference period (December 31) 2.2.1 Number of "individual" clients with Portuguese nationality. 2.2.2 "Individual" clients with foreign nationality: a) Number of clients with nationality of a Member State of the European Union; b) Number of clients with nationality of a third country; c) Identification of the 10 most relevant countries or jurisdictions of nationality, with indication of the number of clients per country or jurisdiction. 2.2.3 Number of "individual" clients with permanent residence in Portugal. 2.2.4 "Individual" clients with permanent residence abroad: a) Total number of clients; b) Number of clients with permanent residence in a Member State of the European Union; c) Number of clients with permanent residence in a third country; d) Identification of the 10 most relevant countries or jurisdictions of permanent residence, with indication of the number of clients per country or jurisdiction.

2.3 Information on "corporate" and "collective interest centers without legal personality" clients as of the end of the RPB reference period (December 31) 2.3.1 Number of "corporate" and "collective interest centers without legal personality" clients with headquarters in Portugal. 2.3.2 Number of "corporate" and "collective interest centers without legal personality" clients with headquarters abroad: a) Total number of clients; b) Number of clients with headquarters in a Member State of the European Union; c) Number of clients with headquarters in a third country; d) Identification of the 10 most relevant countries or jurisdictions of headquarters location, with indication of the number of clients per country or jurisdiction.

2.4 Information on beneficial owners as of the end of the RPB reference period (December 31) 2.4.1 Total number of beneficial owners. 2.4.2 Number of beneficial owners with Portuguese nationality. 2.4.3 Beneficial owners with foreign nationality: a) Number of beneficial owners with nationality of a Member State of the European Union; b) Number of beneficial owners with nationality of a third country; c) Identification of the 10 most relevant countries or jurisdictions of nationality, with indication of the number of beneficial owners per country or jurisdiction. 2.4.4 Number of beneficial owners with permanent residence in Portugal. 2.4.5 Beneficial owners with permanent residence abroad: a) Number of beneficial owners with permanent residence in a Member State of the European Union; b) Number of beneficial owners with permanent residence in a third country; c) Identification of the 10 most relevant countries or jurisdictions of permanent residence, with indication of the number of beneficial owners per country or jurisdiction.

2.5 Information on clients and beneficial owners with the status of "Politically Exposed Person" ("PEP") or other relevant statuses as of the end of the RPB reference period (December 31) 2.5.1 Those representing the Portuguese State a) Total number of clients with the status of "PEP". b) Total number of beneficial owners with the status of "PEP". 2.5.2 Those representing a foreign country or jurisdiction or international institution/organization a) Total number of clients with the status of "PEP" representing a foreign country or jurisdiction; b) Identification of the 10 most relevant countries or jurisdictions of representation, with indication of the number of clients with the status of "PEP" representing that country or jurisdiction; c) Total number of clients with the status of "PEP" representing an international institution/organization; d) Total number of beneficial owners with the status of "PEP". 2.5.3 Regarding the reference period, indication: a) Of the number of business relationships established with clients with the status of "PEP"; b) Percentage that the number indicated in a) represents relative to the total business relationships established in the same period. 2.5.4 Identification of the percentage of clients that, relative to the total number of clients, hold the status of: a) "PEP"; b) "Close family member"; c) "Person recognized as closely associated"; d) "Holder of another political or public office".

2.5.5 Identification of the percentage of beneficial owners that, relative to the total number of beneficial owners, hold the status of: a) "PEP"; b) "Close family member"; c) "Person recognized as closely associated"; d) "Holder of another political or public office".

2.6 Information on certain categories of clients 2.6.1 Clients with "high net worth"³ Total number of clients with high net worth as of the end of the RPB reference period (December 31). 2.6.2 "Non-profit organizations" clients a) Number of