Lei n.º 83/2017, de 18 de agosto - Estabelece medidas de combate ao branqueamento de capitais e ao financiamento do terrorismo (Law No. 83/2017 of 18 August establishing measures to combat money laundering and terrorist financing)

English translation of the Portuguese text from info.portaldasfinancas.gov.pt (the Portuguese text is the official one). Retrieved 2026-10-26.

Classification: 060.01.01 Security: Public Process:

Direção de Serviços de Comunicação e Apoio ao Contribuinte Av.ª João XXI, 76 - r/c, 1049-065 LISBOA Tel: (+351) 217 610 000 Fax: (+351) 217 610 132 Email: dscac@at.gov.pt www.portaldasfinancas.gov.pt Centro de Atendimento Telefónico: 217 206 707 MOD. 4.3 Legislation Diploma - Law No. 83/2017, of 18 August Status: in force Summary: Establishes measures to combat money laundering and terrorist financing, partially transposes Directives 2015/849/EU of the European Parliament and of the Council of 20 May 2015 and 2016/2258/EU of the Council of 6 December 2016, amends the Penal Code and the Industrial Property Code and repeals Law No. 25/2008 of 5 June and Decree-Law No. 125/2008 of 21 July.

Publication: Diário da República No. 159/2017, Series I of 2017-08-18, pages 4784 - 4848 Associated legislation: - History of amendments from the republication by Law No. 58/2020 of 31 August: Law No. 58/2020 of 31/08 Note: Does not exempt consultation of the original diploma published in the Electronic Diário da República.

ASSEMBLEIA DA REPÚBLICA Law No. 83/2017 of 18 August (Republished by Law No. 58/2020 of 31 August)

CHAPTER I General provisions

SECTION I Object and definitions

Article 1 Object 1 - This law establishes preventive and repressive measures to combat money laundering and terrorist financing and partially transposes into domestic law Directive 2015/849/EU of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system and of specially designated activities and professions for the purposes of money laundering and terrorist financing, as well as Directive 2016/2258/EU of the Council of 6 December 2016 amending Directive 2011/16/EU as regards access to anti-money-laundering information by tax authorities.

2 - This law also establishes the national measures necessary for the effective application of Regulation (EU) 2015/847 of the European Parliament and of the Council of 20 May 2015 on information accompanying transfers of funds and repealing Regulation

(EC) 1781/2006 [hereinafter referred to as “Regulation (EU) 2015/847”].

3 - This law also amends:

a) the Penal Code, approved by Decree-Law No. 400/82 of 23 September;

b) the Industrial Property Code, approved by Decree-Law No. 36/2003 of 5 March.

Article 2 Definitions 1 - For the purposes of this law, the following shall mean:

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 2 / 122

a) “Agent”, a natural or legal person who provides payment services on behalf of a payment institution or an electronic money institution;

b) “Real estate activities”, any of the following economic activities:

i) Real estate brokerage;

ii) Purchase, sale, purchase for resale or exchange of real estate;

iii) Leasing;

iv) Real estate development;

c) “Auditors”, the statutory auditors, the firms of statutory auditors, the auditors of Member States of the European Union and the auditors of third countries registered with the CMVM;

d) “European Supervisory Authorities”, the European Banking Authority, created by Regulation

(EU) 1093/2010 of the European Parliament and of the Council of 24 November 2010, the European Insurance and Occupational Pensions Authority, created by Regulation

(EU) 1094/2010 of the European Parliament and of the Council of 24 November 2010, and the European Securities and Markets Authority, created by Regulation (EU) 1095/2010 of the European Parliament and of the Council of 24 November 2010;

e) “Police authorities”, the criminal police bodies competent to investigate the crimes of money laundering and terrorist financing, in accordance with the law, as well as to investigate their respective predicate offences;

f) “Sectoral authorities”, the Insurance and Pension Funds Supervisory Authority, the Bank of Portugal, the Securities Market Commission (CMVM), the Inspectorate-General of Finance, the Inspectorate-General of the Ministry of Labour, Solidarity and Social Security, the Gaming Regulation and Inspection Service of Turismo de Portugal, I. P., the Institute of Public Markets, Real Estate and Construction, I. P. (IMPIC, I. P.), and the Food and Economic Safety Authority (ASAE);

g) “Shell bank”, any entity that carries on an activity of its own or equivalent to that of a financial entity that:

i) Is incorporated in a country or jurisdiction in which it has no physical presence involving effective direction and management, and the mere existence of a local agent or subordinate employees does not constitute physical presence; and

ii) Is not part of a regulated financial group;

h) “Beneficial owners”, the natural person or persons who ultimately own or control the client and/or the natural person or persons on whose behalf a transaction or activity is carried out, in accordance with the criteria set out in Article 30;

i) “Assets”, any:

i) Funds, financial assets, economic resources or other assets of any kind, corporeal or incorporeal, movable or immovable, tangible or intangible, regardless of the form in which they are acquired, as well as documents or legal instruments in any form, including electronic or digital, proving the right of ownership or other rights over the assets, including bank credits, traveller's cheques, bank cheques, payment orders, bonds, shares, other securities, drafts and letters of credit;

ii) Interest, dividends or other income or revenue generated by the assets referred to in the preceding subparagraph;

j) “Money laundering”:

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 3 / 122

i) The conducts provided for and punished by Article 368-A of the Penal Code;

ii) (Repealed); and

iii) Participation in one of the acts referred to in subparagraph i), association to commit the said act, attempt and complicity in its practice, as well as facilitating its execution or advising someone to practice it;

k) "Centres of collective interests without legal personality", autonomous patrimonies, such as condominiums of properties in horizontal property, foreign law trusts and collective entities analogous to these, when and under the terms in which they are given relevance by domestic law, considering as analogous to trusts the collective entities that present at least the following characteristics:

i) The assets constitute a separate patrimony and do not integrate the patrimony of their administrator;

ii) The administrator, or whoever represents the collective entity, appears as the holder of the assets; and

iii) The administrator is subject to the obligation to administer, manage or dispose of the assets and, if applicable, to render accounts, under the terms of the rules that regulate the collective entity.

l) "Coordination Commission", the Commission for the Coordination of Policies for the Prevention and Combating of Money Laundering and Terrorist Financing, created by Council of Ministers Resolution No. 88/2015, of 6 October;

m) "Correspondent transfer accounts (payable-through accounts)", the accounts made available by correspondents that, directly or through a sub-account, allow the execution of operations, on their own account, by the respondent's clients or other third parties;

n) "Top management", any manager or employee with sufficient knowledge of the obliged entity's exposure to the risk of money laundering and terrorist financing and with a sufficiently high hierarchical level to take decisions that affect the risk exposure, not necessarily being a member of the management body;

o) "Distributor", the natural or legal person authorized to distribute and redeem electronic money on behalf and under the responsibility of an electronic money institution;

p) "Financial entities", the entities referred to in Article 3;

q) "Non-financial entities", the entities referred to in Article 4;

r) "Obliged entities", the entities referred to in Articles 3 and 4;

s) "Terrorist financing", the conducts provided for and punished by Article 5-A of Law No. 52/2003, of 22 August, the law on combating terrorism, amended by Laws No. 59/2007, of 4 September, 25/2008, of 5 June, 17/2011, of 3 May, and 60/2015, of 24 June;

t) "Group", a set of entities constituted by:

i) A legal person or other entity that ultimately exercises control over another or other legal persons or entities that integrate the group (parent company), its subsidiaries or other entities in which the parent company or the subsidiaries hold a participation, namely when one or more control indicators are verified; or

ii) Other entities linked to each other by a control relationship, namely when one or more control indicators are verified;

u) "Control indicators", any of the following situations:

i) A parent company exclusively controls another entity, under the terms of paragraphs 3 and 4;

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 4 / 122

ii) An entity and one or more other entities, with which the first is not related as described in the previous subparagraph, are placed under a single management, by virtue of a contract celebrated with that first entity or of statutory clauses of these other entities;

iii) The management or supervisory bodies of an entity and those of one or more other entities, with which the first is not related as described in subparagraph i), are, in their majority, composed of the same persons in functions during the current financial year and until the preparation of the consolidated financial statements;

iv) The effective control of an entity is exercised by a limited number of partners and the decisions relating to it result from common agreement among them (situation of joint control);

v) "Financial institution", any of the following entities:

i) A company that, not being a credit institution, carries out one or more of the operations mentioned in Annex I to this law, of which it is an integral part;

ii) An insurance company or mediator, to the extent that it carries out activity within the scope of the Life branch;

iii) An investment firm as defined in point 1 of paragraph 1 of Article 4 of Directive 2004/39/EC of the European Parliament and of the Council, of 21 April 2004, on markets in financial instruments;

iv) A collective investment undertaking that markets its shares or units of participation;

v) Branches, located in the European Union, of the financial institutions referred to in the previous subparagraphs, regardless of whether their head office is located in a Member State or in a third country;

w) "Close family members":

i) The spouse or de facto partner of a politically exposed person;

ii) Relatives and relatives by affinity in the 1st degree, in the direct line or in the collateral line, of the politically exposed person;

iii) The de facto partners of the relatives of the politically exposed person referred to in the previous subparagraph, to the extent that they do not benefit from the status of affinity;

iv) Persons who, in other legal systems, occupy similar positions;

x) "Electronic money", the monetary value stored electronically, including in magnetic form, represented by a credit on the issuer and issued after the receipt of banknotes, coins and scriptural money, to carry out payment operations and that is accepted by a natural or legal person different from the electronic money issuer;

y) «Professional associations», the Portuguese Bar Association, the Order of Certified Accountants, the Order of Notaries, the Order of Statutory Auditors and the Order of Bailiffs and Enforcement Agents, within the scope of the powers they exercise, under this law, in relation to their respective members;

z) «Non-profit organization», a legal person, entity without legal personality or organization that, in pursuit of its purposes of social interest, namely charitable, religious, cultural, educational or fraternal or other types of charitable works, carries out or promotes the collection and distribution of funds;

aa) «Management body», the plural or singular body of the obliged entity responsible for carrying out the material and legal acts necessary for the execution of its will;

bb) «High-risk third countries», the countries or jurisdictions not belonging to the European Union identified by the European Commission as having national regimes to combat money

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 5 / 122 laundering and terrorist financing that present strategic deficiencies that constitute a significant threat to the financial system of the European Union;

cc) «Politically exposed persons», natural persons who perform, or have performed in the last 12 months, in any country or jurisdiction, the following prominent public functions at a senior level:

i) Heads of State, heads of Government and members of the Government, namely ministers, secretaries and under-secretaries of State or equivalent;

ii) Members of Parliament or other members of parliamentary chambers;

iii) Members of the Constitutional Court, the Supreme Court of Justice, the Supreme Administrative Court, the Court of Auditors, and members of supreme courts, constitutional courts, courts of auditors and other high-level judicial bodies of other States and international organizations;

iv) Representatives of the Republic and members of the self-governing bodies of autonomous regions;

v) Ombudsman, Councillors of State, and members of the National Data Protection Commission, the Superior Council of the Judiciary, the Superior Council of Administrative and Tax Courts, the Attorney General's Office, the Superior Council of the Public Prosecution Service, the Superior Council of National Defence, the Economic and Social Council, and the Regulatory Entity for Social Communication;

vi) Heads of diplomatic missions and consular posts;

vii) General Officers of the Armed Forces and of the National Republican Guard (GNR) on active duty, as well as the Chief Superintendents of the Public Security Police (PSP);

viii) Presidents and councillors with executive functions of municipal councils;

ix) Members of management and supervisory bodies of central banks, including the European Central Bank;

x) Members of management and supervisory bodies of public institutes, public foundations, public establishments and independent administrative entities, whatever the mode of their appointment;

xi) Members of management and supervisory bodies of entities belonging to the public business sector, including the business, regional and local sectors;

xii) Members of the executive management bodies of political parties of national or regional scope;

xiii) Directors, deputy directors and members of the board of directors or persons performing equivalent functions in an international organization;

dd) «Persons known to be closely associated»:

i) Any natural person, known to be a co-owner, with a politically exposed person, of a legal person or of a centre of collective interests without legal personality;

ii) Any natural person who owns share capital or holds voting rights of a legal person, or of assets of a centre of collective interests without legal personality, known to have a politically exposed person as beneficial owner;

iii) Any natural person, known to have corporate, commercial or professional relations with a politically exposed person;

ee) «Correspondent relationship», the provision of services by a bank, financial entity or other entity providing similar services (the correspondent), to a bank, financial entity or other entity of equivalent nature that is its client (the respondent), which includes the provision of a current account or other account that generates an obligation and related services, such as management of

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 6 / 122 cash, processing of fund transfers and other payment services on behalf of the respondent, cheque clearing, payable-through accounts, foreign exchange services and transactions with securities;

ff) «Business relationship», any relationship of a business, professional or commercial nature between the obliged entities and their clients, which, at the time it is established, is or is expected to be lasting, tending to be stable and continued over time, regardless of the number of individual operations that integrate or may integrate the established relational framework;

gg) «Holders of other political or public offices», natural persons who, not being qualified as politically exposed persons, perform or have performed, in the last 12 months and in national territory, any of the following offices:

i) The offices listed in paragraph 3 of article 4 of Law No. 4/83, of 2 April, public control of the wealth of holders of political offices, amended by Laws No. 38/83, of 25 October, 25/95, of 18 August, 19/2008, of 21 April, 30/2008, of 10 July, and 38/2010, of 2 September, when they do not determine the qualification of the respective holder as a «politically exposed person»;

ii) Members of a representative or executive body of a metropolitan area or of other forms of municipal association;

hh) "Occasional transaction", any transaction carried out by obliged entities outside the scope of an already established business relationship, characterised, in particular, by its expected one-off nature;

ii) "Transfer of funds", any transfer within the meaning of paragraph 9 of Article 3 of Regulation

(EU) 2015/847;

jj) "Financial Intelligence Unit", the national central unit with competence to:

i) Receive, analyse and disseminate information resulting from suspicious transaction reports under this law and from other sources when relating to criminal activities from which funds or other assets derive; and

ii) Cooperate with international counterparts and other competent entities for the prevention and combating of money laundering and terrorist financing.

kk) "Fiat currency", banknotes and coins designated as having legal tender, book money and electronic money;

ll) "Virtual asset", a digital representation of value that is not necessarily linked to a legally established currency and that does not have the legal status of fiat currency, but that is accepted by natural or legal persons as a means of exchange or investment and that can be transferred, stored and traded electronically;

mm) "Activities with virtual assets", any of the following economic activities, carried out in the name or on behalf of a client:

i) Exchange services between virtual assets and fiat currencies;

ii) Exchange services between one or more virtual assets;

iii) Services through which a virtual asset is moved from one address or wallet to another (transfer of virtual assets);

iv) Custody or custody and administration services of virtual assets or of instruments that allow controlling, holding, storing or transferring such assets, including private cryptographic keys.

nn) "Collective investment undertaking", the institutions referred to in subparagraph aa) of paragraph 1 of Article 2 of the General Regime of Collective Investment Undertakings, approved in annex to Law No. 16/2015, of 24 February, as well as collective investment undertakings regulated by special legislation.

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 7 / 122 2 - The knowledge, intent or motive required as an element of the conducts described in subparagraphs

j) and s) of the previous paragraph may be inferred from objective factual circumstances.

3 - For the purposes of the provisions of subparagraph i) of subparagraph u) of paragraph 1, a parent company is considered to exclusively control another entity when:

a) It holds the majority of the voting rights of the holders of the capital of that entity;

b) It has the right to appoint or dismiss the majority of the members of the management or supervisory body of that entity, while simultaneously holding capital of the same;

c) It has the right to exercise a dominant influence over that entity, being one of the holders of its capital, by virtue of a contract concluded with the said entity or of a clause in its articles of association;

d) It holds capital of an entity whose majority of the members of the management or supervisory body in office, during the current financial year, as well as in the previous financial year and until the preparation of the consolidated accounts, has been exclusively appointed by effect of its voting rights;

e) It controls by itself, by virtue of an agreement concluded with other partners of that entity, the majority of the voting rights of the holders of the capital of the same;

f) It may exercise, or effectively exercises, dominant influence or control over that entity; or

g) It manages that entity as if both constituted a single entity.

4 - For the purposes of applying subparagraphs a), b), d) and e) of the previous paragraph, the following are:

a) Added to the voting, appointment and dismissal rights of the parent company are the rights of any other subsidiary of its and those of the subsidiaries of the latter, as well as those of any person acting in their own name, but on behalf of the parent company or any other subsidiary;

b) Deducted from the total voting rights of the holders of capital of the subsidiary are the voting rights relating to own shares or quotas held by this entity, by a subsidiary of its or by a person acting in their own name, but on behalf of these entities.

SECTION II Scope of application

Article 3 Financial entities 1 - The following entities with head office in national territory are subject to the provisions of this law, with the exception of the provisions in chapter XI:

a) Credit institutions;

b) Payment institutions;

c) Electronic money institutions;

d) Investment firms and other financial companies;

e) Securities investment companies and self-managed real estate investment companies;

f) Venture capital companies, venture capital investors, social entrepreneurship companies, venture capital fund management companies, self-managed venture capital investment companies and self-managed specialised alternative investment companies;

g) Credit securitisation companies and credit securitisation fund management companies;

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 8 / 122

h) Companies that market, to the public, contracts relating to investment in tangible assets;

i) Consultants for investment in securities;

j) Pension fund management companies;

k) Insurance companies, insurance intermediaries and ancillary insurance intermediaries, which carry out activities within the scope of the Life branch;

l) Securities investment companies for the promotion of the economy;

m) Qualified venture capital fund managers;

n) Qualified social entrepreneurship fund managers;

o) Self-managed long-term investment funds of the European Union with the designation "ELTIF";

p) Real Estate Investment and Management Companies in Portugal.

2 - The following are also subject to the provisions of this law, with the exception of the provisions of chapter XI:

a) Branches located in Portuguese territory of the entities referred to in the previous paragraph, or of others of an equivalent nature, which have their head office abroad, as well as external financial branches;

b) Payment institutions with their head office in another Member State of the European Union, when they operate in national territory through agents;

c) Electronic money institutions with their head office in another Member State of the European Union, when they operate in national territory through agents or distributors;

d) The entities referred to in the previous paragraph, or others of an equivalent nature, which operate in Portugal under the free provision of services regime, only for the purposes set out in article 73. 3 - This law also applies, to the extent that they offer financial services to the public, with the exception of the provisions of chapter XI:

a) To entities that provide postal services;

b) To the Treasury and Public Debt Management Agency, E. P. E. (IGCP, E. P. E.).

4 - For the purposes of the applicability of the provisions contained in this law, entities equated to payment institutions under the Legal Regime of Payment Services and Electronic Money, approved in annex to Decree-Law No. 91/2018, of 12 November, are considered included in payment institutions.

Article 4. Non-financial entities 1 - The following entities that carry out activity in national territory are subject to the provisions of this law, under the terms set out in this article, with the exception of the provisions of chapter XI:

a) Concessionaires for the operation of gambling in casinos and concessionaires for the operation of bingo halls;

b) Entities paying betting and lottery prizes;

c) Entities covered by the Legal Regime of Online Games and Betting (RJO), approved by Decree-Law No. 66/2015, of 29 April;

d) Entities not provided for in the previous article that carry out any real estate activity;

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 9 / 122

e) Auditors, certified accountants and tax consultants, incorporated as companies or in individual practice, as well as any other person who undertakes to provide, directly or through other persons with whom they have some type of relationship, material aid, assistance or consultancy in tax matters, as their main commercial or professional activity;

f) Lawyers, solicitors, notaries and other independent professionals in the legal area, incorporated as companies or in individual practice;

g) Providers of services to companies, to other legal persons or to centres of collective interests without legal personality;

h) Other professionals who intervene in operations of disposal and acquisition of rights over professional sports activity practitioners;

i) Economic operators that carry out auctioneering activity or pawnbroking activity;

j) Other persons who store, trade or act as intermediaries in the trade of works of art, including when it occurs in free zones, when payment for the goods transacted or services provided, regardless of whether it is carried out through a single operation or several operations, is made:

i) In cash, if the value of the transaction is equal to or greater than €3000; or

ii) Through another means of payment, if the value of the transaction is equal to or greater than €10 000;

k) Economic operators that carry out the activities of import and export of rough diamonds;

l) Entities authorised to carry out the activity of transport, safekeeping, processing and distribution of funds and valuables, provided for in subparagraph d) of paragraph 1 of article 3 of Law No. 34/2013, of 16 May;

m) Traders who transact goods of high unit value, namely gold and other precious metals, precious stones, antiques, aircraft, vessels and motor vehicles, when payment for the goods transacted, regardless of whether it is carried out through a single operation or several operations, is made:

i) In cash, if the value of the transaction is equal to or greater than €3000;

ii) Through another means of payment, if the value of the transaction is equal to or greater than €10 000;

n) Other traders and service providers who transact goods or provide services, when payment for the transaction is made in cash and the value thereof is equal to or greater than €3000, regardless of whether the payment is made through a single operation or several operations;

o) Entities that carry out any activity with virtual assets.

2 - The professionals covered by subparagraph f) of the previous paragraph are subject to the provisions of this law, when they intervene or assist, on behalf of a client or in other circumstances, in:

a) Operations of purchase and sale of real estate, commercial establishments or shareholdings;

b) Operations of management of funds, securities or other assets belonging to clients;

c) Operations of opening and management of bank, savings or securities accounts;

d) Operations of creation, incorporation, operation or management of companies, partnerships, other legal persons or centres of collective interests without legal personality, which involve:

i) The making of contributions and inputs of any type necessary for that purpose;

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 10 / 122

ii) Any of the services referred to in subparagraphs a) to f) of the following paragraph;

e) Operations of disposal and acquisition of rights over professional sports activity practitioners;

f) Other financial or real estate operations, in representation or assistance of the client.

3 - The professionals referred to in paragraph g) of no. 1 are subject to the provisions of this law when they do not fall within the professional categories provided for in paragraphs e) and f) of the same number and provide third parties with the following services, in the exercise of their professional activity:

a) Formation of companies, other legal persons or centres of collective interests without legal personality;

b) Provision of registered offices, commercial, administrative or postal addresses or other services related to companies, other legal persons or centres of collective interests without legal personality;

c) Performance of the functions of director, secretary, partner or member of a company or other legal person, as well as carrying out the necessary steps for another person to act in those capacities;

d) Performance of the functions of trustee of an express trust or similar function in a centre of collective interests without legal personality of an analogous nature, as well as carrying out the necessary steps for another person to act in those capacities;

e) Acting as a nominee shareholder on behalf of another person that is not a company listed on a regulated market subject to information disclosure requirements in accordance with European Union law or subject to equivalent international standards, as well as carrying out the necessary steps for another person to act in that capacity;

f) Provision of other related representation, management and administration services to companies, other legal persons or centres of collective interests without legal personality.

4 - Except for casino gaming concessionaires, the Government, through an order of the members of the Government responsible for the areas of finance and gaming, may exempt, in whole or in part, from the application of this law, the gaming services provided for in the final part of paragraph a) and in paragraphs b) and c) of no. 1, based on a demonstrative assessment of the existence of a proven low risk of money laundering and terrorist financing and based on, at least, the consideration of the following specific aspects:

a) Nature and, if applicable, scale of operations of the services in question;

b) Degree of vulnerability of the transactions associated with the services in question, including with regard to the payment methods used;

c) Conclusions arising from the reports and respective updates referred to in no. 4 of Article 8, in the applicable part, and the granting of any exemption must be preceded by an indication of how such conclusions were taken into account.

5 - The exemptions granted under the previous number:

a) Are notified by the Government to the European Commission, together with the specific risk assessment on which they are based;

b) Are subject to regular and risk-based monitoring, through the adoption of measures, to be specified in the order referred to in the previous number, that prove adequate to ensure that such exemptions are not misused for the purposes of money laundering and terrorist financing;

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 11 / 122

c) Are subject to immediate revocation, whenever there is an increase in the risk of money laundering and terrorist financing that was the basis for granting the exemption.

Article 5 Entities equivalent to obliged entities This law is also applicable:

a) To natural and legal persons who act in Portugal as agents of payment institutions headquartered in another Member State, or as agents or distributors of electronic money institutions headquartered in another Member State, only for the purposes provided for in Articles 72 and 107;

b) Under the terms provided for in Chapter X, to the following entities that carry out activity in national territory:

i) Management entities of crowdfunding platforms, in the lending and equity modalities;

ii) Management entities of crowdfunding platforms, in the donation and reward modalities;

iii) Non-profit organisations.

Article 6 Payment service providers subject to Regulation (EU) 2015/847 1 - Regardless of whether or not they are subject to the other provisions of this law, Chapters XI and XII are applicable to payment service providers established in Portugal that are covered by no. 1 of Article 2 of Regulation (EU) 2015/847, without prejudice to the provisions of the following number.

2 - In addition to the situations provided for in nos. 2 to 4 of the respective Article 2, the Regulation

(EU) 2015/847 is also not applicable to payment service providers established in Portugal, when transfers of funds are involved that are entirely carried out in national territory to the payment account of a beneficiary for the purpose of exclusive payment for the provision of goods or services, if the following conditions are cumulatively met:

a) The payment service provider of the beneficiary is a financial entity, within the meaning of this law;

b) The payment service provider of the beneficiary is able to trace, through the beneficiary and by means of a unique transaction identifier, the transfer of funds from the person who has an agreement with the beneficiary for the provision of goods or services;

c) The amount of the transfer of funds does not exceed €1000.

3 - The provisions of Regulation (EU) 2015/847 do not prejudice the application of the other provisions contained in this law and the regulations that implement it.

Article 7 Registrars and registry officials 1 - The registrars and registry officials are auxiliary entities in the prevention and combating of money laundering and terrorist financing.

2 - Registrars and registry officers are subject, in the exercise of their functions:

a) To the duty of communication provided for in Article 43;

b) To the duty of cooperation provided for in Article 53;

Directorate of Communication and Taxpayer Support DocBaseV/2017 12 / 122

c) The duty of non-disclosure provided for in Article 54, with regard to communications made under the preceding items.

3 - Whenever acts of titling are involved, registrars and registry officers are also subject to the duties of examination and abstention provided for in this Law.

4 - For the purposes of the preceding number, acts of titling are those in which legal form is conferred on a given act or legal transaction, namely, through the drawing up of titles under special law, the authentication of private documents or the recognition of signatures.

5 - The obligations arising from the provisions of this Law and the regulations implementing it form part of the public functions employment relationship of registrars and registry officers, applying the regime provided for in the event of non-compliance.

6 - The Institute of Registries and Notariado, I. P., constitutes an entity equivalent to a sectoral authority, applying to it, with the necessary adaptations, the respective regime.

7 - (Repealed.)

CHAPTER II National Risk Assessment

Article 8 National Risk Assessment 1 - The conduct of national assessments of money laundering and terrorist financing risks falls, without prejudice to the competences and autonomy of the different authorities that comprise it, to the Coordination Commission, which is responsible for:

a) Monitoring and coordinating the identification, assessment and understanding of the money laundering and terrorist financing risks to which Portugal is or may become exposed;

b) Coordinating the national response necessary to mitigate the risks referred to in the preceding item.

2 - The Coordination Commission promotes, with a frequency appropriate to the specific risks identified, the assessment and updating exercises necessary to comply with the provisions of the preceding number, developing the instruments, procedures and mechanisms necessary for that purpose.

3 - The assessment and updating exercises referred to in the preceding number aim to:

a) Contribute to the formulation and adjustment of national policies and action plans for the prevention and combating of money laundering and terrorist financing, documenting possible changes or other improvements to the respective national regime;

b) Identify sectors or areas that present a lower or higher level of risk of money laundering and terrorist financing, flagging the specific risk factors that contributed to the occurrence of those risk levels;

c) Propose response measures proportionate to the specific risks identified, namely:

i) Of rules appropriate to each sector or area of activity of the obliged entities; and

ii) Domains in which the obliged entities must adopt simplified or reinforced measures, specifying the content of the respective proposed measures;

d) Identify sectors that are at risk of abusive uses at the level of money laundering or terrorist financing and that are not covered by the definition of obliged entities;

Directorate of Communication and Taxpayer Support DocBaseV/2017 13 / 122

e) Assist in the distribution and prioritization of the allocation of the own resources of the competent authorities, contributing to improve any risk assessments they may have carried out, namely at sectoral level;

f) Contribute to improving the assessments of money laundering and terrorist financing risks carried out by the obliged entities, making relevant information available to them;

g) Assess the main trends and threats of money laundering and terrorist financing, as well as the vulnerabilities of the national prevention and combating of money laundering and terrorist financing system to the aforementioned threats.

4 - The assessment and updating exercises referred to in n.º 2 make use, in any case:

a) Of the reports, and respective updates, that may be made available by the European Commission on the identification, analysis and assessment of the money laundering and terrorist financing risks related to cross-border activities to which the internal market of the European Union is exposed;

b) Of the opinions, and respective updates, that may be made available by the Joint Committee of the European Supervisory Authorities on the money laundering and terrorist financing risks to which the financial sector of the European Union is exposed.

5 - The sectoral authorities, to the extent legally admissible:

a) Provide the Coordination Commission with the collaboration and information necessary for the good and expeditious conduct of the assessment and updating exercises referred to in n.º 2;

b) Have access, within the scope of those exercises, to all information relevant to the supervision or oversight activity, in accordance with their respective areas of competence;

c) Take into account the information referred to in the preceding item in the planning and execution of their respective supervision or oversight activity, as well as in the conduct of risk assessments, of a sectoral or other nature, that they decide to promote;

d) Make available promptly to the obliged entities, in accordance with their respective areas of competence and by the most expeditious and appropriate means, any information that facilitates the risk assessments to be conducted by those entities.

6 - The entities competent for the purpose make available to the European Commission, the European Supervisory Authorities and the other Member States:

a) The results of each assessment and updating exercise referred to in n.º 2;

b) Information relating to the institutional structure and general procedures of the prevention and combating regime for money laundering and terrorist financing, including the Financial Intelligence Unit, the Tax and Customs Authority and the Attorney General's Office;

c) To the extent that the information is available, information on human and financial resources allocated to combating money laundering and terrorist financing.

7 - The information and results to be made available under item d) of paragraph 5 and paragraph 6 may not contain information liable to compromise the prevention, detection and investigation of money laundering and terrorist financing, nor constitute an impediment to inquiries or proceedings pending, whether of a criminal nature or otherwise.

8 - At the end of each assessment and update exercise referred to in paragraph 2, the Coordination Commission shall cause a summary report of the respective exercise to be published, through the portal provided for in Article 121.º or another source accessible to the general public, containing information of general interest.

9 - In determining the risk response measures referred to in item c) of paragraph 3, the Coordination Commission shall take into account the recommendations that may be directed to the

Directorate of Communication and Taxpayer Support DocBaseV/2017 14 / 122 Portuguese State by the European Commission, following the supranational risk assessment and its respective updates, referred to in item a) of paragraph 4.

10 - Whenever the Coordination Commission considers that the recommendations referred to in the preceding paragraph cannot be adopted, it shall notify the competent governmental body of the fact and the respective justification, which shall in turn forward the information to the European Commission.

11 - The provisions of this Article shall not prejudice the carrying out of risk assessments, sectoral or otherwise, by the sectoral authorities provided for in this Law or by other entities with responsibilities in the field of the prevention and repression of money laundering and terrorist financing.

Article 9.º Guarantees regarding personal data 1 - Whenever, in the course of national risk assessments and their subsequent updates, concerns arise regarding the protection of personal data, the Coordination Commission shall bring them to the attention of the National Data Protection Commission, which shall issue an opinion on them within 30 days of the communication.

2 - Once the period provided for in the preceding paragraph has elapsed, the Coordination Commission shall propose the measures necessary to safeguard the effectiveness of the national system for the prevention and combating of money laundering and terrorist financing.

CHAPTER III Limits on the use of cash

Article 10.º Limits Obligated entities shall refrain from entering into or in any way participating in any transactions that, in the course of their professional activity, result in a violation of the limits on the use of cash provided for in specific legislation.

CHAPTER IV General duties

SECTION I General provision

Article 11 Preventive duties 1 - Obliged entities are subject, in their conduct, to compliance with the following preventive duties:

a) Duty of control;

b) Duty of identification and diligence;

c) Duty of communication;

d) Duty of abstention;

e) Duty of refusal;

f) Duty of conservation;

g) Duty of examination;

h) Duty of cooperation;

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 15 / 122

i) Duty of non-disclosure;

j) Duty of training.

2 - The extent of the duties of control, identification and diligence and training shall be proportionate to the nature, size and complexity of the obliged entities and of the activities pursued by them, taking into account the characteristics and specific needs of smaller obliged entities.

3 - Obliged entities are prohibited from carrying out acts that may result in their involvement in any money laundering or terrorist financing operation and shall adopt all appropriate measures to prevent such involvement.

SECTION II Duty of control SUBSECTION I General provisions

Article 12 Internal control system 1 - Obliged entities shall define and ensure the effective application of policies and procedures and controls that are adequate:

a) For the effective management of the money laundering and terrorist financing risks to which the obliged entity is or may become exposed;

b) For compliance, by the obliged entity, with the legal and regulatory rules on the prevention of money laundering and terrorist financing.

2 - The policies and procedures and controls referred to in the previous paragraph shall be proportionate to the nature, size and complexity of the obliged entity and of the activity pursued by it, comprising at least:

a) The definition of an effective risk management model, with practices appropriate for the identification, assessment and mitigation of the money laundering and terrorist financing risks to which the obliged entity is or may become exposed;

b) The development of policies, procedures and controls regarding customer acceptance and compliance with the applicable regulatory framework, namely the preventive duties provided for in this law;

c) The definition of adequate programmes of continuous training for the employees of the obliged entity, applicable from the moment of admission of those employees, whatever the nature of their employment relationship;

d) The designation, where appropriate, of a person responsible for monitoring compliance with the applicable regulatory framework;

e) The establishment of formal systems and processes for the collection, processing and archiving of information that support, in a timely manner:

i) The analysis and decision-making by the relevant internal structures, in particular with regard to the monitoring of clients and operations and the examination of potential suspicions;

ii) The exercise of the duties of communication and cooperation;

iii) The establishment of secure channels that allow the total confidentiality of requests for information to be preserved, whenever applicable;

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 16 / 122

f) The dissemination, among the employees of the obliged entity whose functions are relevant for the purposes of preventing money laundering and terrorist financing, of updated and accessible information on the respective internal implementing rules;

g) The establishment of vetting procedures that ensure the application of high standards in the process of hiring employees whose functions are relevant for the purposes of preventing money laundering and terrorist financing, whatever the nature of the employment relationship;

h) The establishment of mechanisms to control the actions of the employees of the obliged entity whose functions are relevant for the purposes of preventing money laundering and terrorist financing, whatever the nature of their employment relationship;

i) The definition of adequate tools or information systems;

j) The establishment of mechanisms that allow their quality, adequacy and effectiveness to be regularly tested, including through the establishment, where applicable, of an independent audit function;

k) The definition of adequate internal means that allow the employees of the obliged entity, whatever the nature of the employment relationship, to report, through a specific, independent and anonymous channel, any breaches of this law, of the regulations implementing it and of the internally defined policies, procedures and controls;

l) The development of policies and procedures on the protection of personal data.

3 - The obliged entities review, at a frequency adequate to the existing risks or another defined by regulation, the currency of the policies and procedures and controls referred to in the preceding paragraphs.

4 - The policies and procedures and controls referred to in paragraphs 1 and 2, as well as their updates, shall be put in writing, and must be kept in accordance with the terms provided for in Article 51 and placed, permanently, at the disposal of the sectoral authorities.

Article 13 Responsibility of the management body 1 - The management body of the obliged entities is responsible for the implementation of the policies and procedures and controls on the prevention of money laundering and terrorist financing.

2 - For the purposes of the provisions of the preceding paragraph, the management body shall in particular:

a) Approve the policies and procedures and controls referred to in the preceding article, as well as proceed to their updating;

b) Have adequate knowledge of the money laundering and terrorist financing risks to which the obliged entity is exposed at all times, as well as of the processes used to identify, assess, monitor and control those risks;

c) Ensure that the organisational structure of the obliged entity allows, at all times, the adequate implementation of the policies and procedures and controls referred to in the preceding article, preventing conflicts of interest and, whenever necessary, promoting the separation of functions within the organisation;

d) Promote a culture of preventing money laundering and terrorist financing that covers all employees of the obliged entity whose functions are relevant for the purposes of preventing money laundering and terrorist financing, supported by high standards of ethics and integrity and, whenever necessary, by the definition and approval of appropriate codes of conduct;

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 17 / 122

e) Proceed with the appointment of the compliance officer or the employee referred to in paragraphs 1 and 7 of Article 16, respectively, ensuring the rigorous verification of the conditions of paragraph 3 of the same article;

f) Monitor the activity of the other members of top management, insofar as they oversee business areas that are or may become exposed to money laundering and terrorist financing risks;

g) Monitor and periodically assess the effectiveness of the policies and procedures and controls referred to in the preceding article, ensuring the implementation of adequate measures to correct the deficiencies detected therein.

3 - In compliance with the provisions of the preceding paragraph, the management body:

a) Refrains from any interference in the exercise of the duty of communication provided for in Article 43, whenever, in compliance with the examination duty that precedes it, it is concluded that potential suspicions exist;

b) Ensures the critical review of decisions not to exercise the said duty of communication, whenever, in compliance with the examination duty that precedes it, it is concluded that no potential suspicions exist.

4 - Whenever appropriate, the sectoral authorities may require their respective obliged entities to designate a member of the management body responsible for the implementation of the provisions of this law and the regulations implementing it, without prejudice to the individual and collegial responsibility of the other members of the management body.

SUBSECTION II Specific provisions

Article 14 Risk management 1 - The obliged entities identify, assess and mitigate the specific money laundering and terrorist financing risks existing in the context of their specific operational reality.

2 - For the purposes of the provisions of the preceding paragraph, the obliged entity shall:

a) Identify the specific risks of money laundering and terrorist financing inherent to their specific operational reality, including the risks associated with:

i) The nature, size and complexity of the activity pursued;

ii) Their respective clients;

iii) The business areas developed, as well as the products, services and operations made available;

iv) The distribution channels for the products and services made available, as well as the means of communication used in contacting clients;

v) The countries or territories of origin of the obliged entity's clients, or in which they are domiciled or, in some way, pursue their activity;

vi) The countries or territories in which the obliged entity operates, directly or through third parties, whether or not belonging to the same group;

b) Assess the risk of money laundering and terrorist financing associated with their specific operational reality, namely by determining:

i) The degree of probability and impact of each of the specifically identified risks, taking into account, for this purpose, all relevant variables in the context of their operational reality, including the

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 18 / 122 purpose of the business relationship, the level of assets deposited per client or the volume of operations carried out and the regularity or duration of the business relationship;

ii) The overall risk of the obliged entity and, if applicable, of its respective business areas, to be assessed based on the weighting of each of the specifically identified and assessed risks;

c) Define and adopt the control means and procedures that prove adequate for mitigating the specific risks identified and assessed, adopting especially reinforced procedures when there is an increased risk of money laundering and terrorist financing;

d) Review, with a periodicity adequate to the identified risks or another defined by regulation, the currentness of the risk management practices referred to in the preceding paragraphs, so that they adequately reflect any changes recorded in the specific operational reality and risks associated with it.

3 - The risk management practices referred to in the previous paragraph, as well as their updates:

a) Have an extent proportional to the nature, size and complexity of the obliged entity and the activity pursued by it;

b) Consider the risks identified:

i) In the information made available by the sectoral authorities, under the provisions of paragraph d) of no. 5 of Article 8;

ii) In the reports and opinions referred to in no. 4 of Article 8, as well as in their updates;

iii) In any other information relevant to the conduct of those exercises, namely those that may be indicated by the sectoral authorities, through publication on their official Internet pages or by other means, or by the Coordination Commission, through the portal referred to in Article 121;

c) Are contained in written documents or records that demonstrate in detail:

i) The risks inherent to the specific operational reality of the obliged entity and the way in which it identified and assessed them;

ii) The adequacy of the control means and procedures aimed at mitigating the identified and assessed risks, as well as the way in which the obliged entity monitors their adequacy and effectiveness.

4 - The documents or records prepared under the provisions of paragraph c) of the previous paragraph are kept under the terms provided for in Article 51 and placed, permanently, at the disposal of the sectoral authorities.

5 - If the specific risks inherent to a given sector of activity subject to the application of this law are clearly identified and understood, the sectoral authorities may, through regulation:

a) Waive the carrying out of individual and documented risk assessments or allow them to be carried out in simplified terms, to be defined by the respective authority;

b) Establish alternative procedures to the carrying out of individual or simplified risk assessments.

Article 15. Risk management in the use of new technologies and products likely to favour anonymity

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 19 / 122 1 - Obliged entities pay special attention to the risks of money laundering and terrorist financing that may derive from:

a) The offering of products or operations likely to favour anonymity;

b) The development of new products and new business practices, including new distribution mechanisms and new payment methods;

c) The use of new or developing technologies, both for new products and for existing products.

2 - In compliance with the provisions of the previous paragraph, before launching new products, practices or technologies, obliged entities:

a) Analyse the specific risks of money laundering and terrorist financing related to them;

b) Foresee and adopt specific procedures for mitigating the risks associated with those products, practices or technologies.

3 - The risk analyses referred to in paragraph a) of the previous paragraph are integrated into the written documents or records referred to in paragraph c) of no. 3 of Article 14. 4 - In conducting their risk analyses and when making information available to obliged entities under this law, the sectoral authorities also pay special attention to the risks that may derive from the situations described in paragraphs a) to c) of no. 1.

Article 16. Officer responsible for regulatory compliance 1 - Obliged entities designate a member of their top management or equivalent to ensure control of compliance with the regulatory framework on the prevention of money laundering and terrorist financing, whenever this is:

a) Adequate to the nature, size and complexity of the activity pursued by the obliged entities;

or

b) Required by law, regulation or determination of the competent sectoral authority.

2 - Without prejudice to the provisions of sectoral regulation, the person designated under the terms of the previous paragraph shall be exclusively responsible for:

a) Participating in the definition of and issuing a prior opinion on the policies and procedures and controls designed to prevent money laundering and terrorist financing;

b) Continuously monitoring the adequacy, sufficiency and up-to-dateness of the policies and procedures and controls in matters of prevention of money laundering and terrorist financing, proposing the necessary updates;

c) Participating in the definition, monitoring and evaluation of the internal training policy of the obliged entity;

d) Ensuring the centralization of all relevant information originating from the various business areas of the obliged entity;

e) Performing the role of interlocutor with judicial, police and supervisory and inspection authorities, in particular by complying with the duty of communication provided for in Article 43 and ensuring the exercise of the other communication and cooperation obligations.

3 - The obliged entities shall ensure that the person designated under the terms of paragraph 1:

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 20 / 122

a) Performs their duties independently, permanently, effectively and with the decision-making autonomy necessary for such exercise, whatever the nature of their relationship with the obliged entity;

b) Has the suitability, professional qualification and availability adequate for the exercise of the function;

c) Has adequate technical, material and human means and resources, including the staff necessary for the proper performance of the function;

d) Has unrestricted and timely access to all internal information relevant to the exercise of the function, in particular information concerning the implementation of the duty of identification and diligence and the records of transactions carried out;

e) Is not subject to potential functional conflicts, especially when the segregation of their functions is not verified.

4 - The exercise of the duty of communication provided for in Article 43 may not depend on a decision of the members of the management body, nor on the intervention of any third parties external to the function, whenever, in compliance with the preceding duty of examination, it is concluded that potential suspicions exist.

5 - It is up to the obliged entities to previously verify the fulfilment of the requirements of suitability, professional qualification and availability referred to in paragraph 3(b), and the results of that assessment shall be made available to the sectoral authorities, whenever requested.

6 - The obliged entities shall also ensure that all their staff, regardless of the nature of their relationship, are aware:

a) Of the identity and contact details of the person designated under the terms of paragraph 1;

b) Of the procedures for communicating to that person the suspicious conducts, activities or operations that they detect.

7 - When the designation referred to in paragraph 1 is not required, the obliged entities shall appoint a staff member to ensure the exercise of the functions provided for in paragraph 2(e).

8 - When this results from sectoral regulation or from a request by judicial, police or sectoral authorities, the obliged entities shall inform those authorities of the identity and other contact details of the persons designated under the terms provided for in paragraph 1 or paragraph 7, as well as of any subsequent changes.

9 - Without prejudice to the provisions of special legislation, the sectoral authorities may:

a) Subject the designation of the person referred to in paragraph 1 to prior authorization and establish the conditions that should determine its reassessment;

b) Assume the assessment of the suitability of the person designated under the terms of paragraph 1, based on:

i) Circumstances already verified at the time of their designation or others, if they consider that such circumstances were subject to a manifestly deficient assessment by the obliged entity;

ii) Any supervening circumstances that may justify the inadequacy for the exercise of the function;

c) Determine the measures necessary to ensure the effective management of money laundering and terrorist financing risks, including, whenever necessary, the temporary suspension of functions and the setting of a deadline for the replacement of the person designated under the terms of paragraph 1.

Article 17. Effectiveness assessment

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 21 / 122 1 - The obliged entities shall monitor, through periodic and independent assessments, the quality, adequacy and effectiveness of their policies and their procedures and controls in matters of prevention of money laundering and terrorist financing.

2 - The assessments referred to in the previous paragraph must have an extent proportional to the nature, size and complexity of the obliged entity, as well as to the risks associated with each of its business areas, and:

a) Be conducted with unrestricted and timely access to all internal information relevant to the performance of the assessments, including any documents prepared in compliance with this law or the regulation that implements it;

b) Be ensured independently by the internal audit function, by external auditors or by a duly qualified third party, to the extent that this is:

i) Adequate to the nature, size and complexity of the activity pursued by the obliged entities;

or

ii) Required by law, regulation or determination of the competent sectoral authority;

c) Be carried out with a frequency adequate to the risk associated with each of the business areas of the obliged entity or another frequency determined by regulation;

d) Allow the detection of any deficiencies affecting the quality, adequacy and effectiveness of the policies and procedures and controls adopted;

e) Cover at least:

i) The risk management model of the obliged entity and other policies, procedures and controls designed to comply with the provisions of this section;

ii) The quality of the communications and other information provided to the sectoral authorities;

iii) The state of implementation of the corrective measures previously adopted.

3 - Whenever obliged entities detect any deficiencies under the provisions of paragraph

d) of the previous number, they must strengthen the policies and procedures and controls adopted in the field of prevention of money laundering and terrorist financing, through the adoption of the corrective measures necessary to remove the deficiencies.

4 - The results of the assessments referred to in paragraphs 1 and 2 shall be put in writing, kept in accordance with the provisions of Article 51 and made permanently available to the sectoral authorities.

Article 18. Procedures and information systems in general 1 - Obliged entities shall apply the tools or information systems necessary for the effective management of the risk of money laundering and terrorist financing and for compliance with the applicable regulatory framework in that field.

2 - Without prejudice to the provisions of sectoral regulations, the tools and systems referred to in the previous number shall allow:

a) The recording of identification data and other elements relating to customers, their representatives and beneficial owners, as well as their updates;

b) The detection of circumstances susceptible to parameterization that should justify the updating of such identification data and elements;

c) The definition and updating of the risk profile associated with customers, business relationships, occasional transactions and operations in general;

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 22 / 122

d) The monitoring of customers and operations in view of the identified risks, including the timely detection:

i) Of relevant changes to the operational pattern of a given customer or group of interrelated customers;

ii) Of operations or set of operations that show elements characteristic of suspicion, namely those referred to in paragraph 2 of Article 52;

iii) Of other risk events or elements characteristic of suspicion upon whose detection compliance with the applicable regulatory framework depends, namely in terms of strengthening the duty of identification and diligence or compliance with the duty of examination;

e) The detection of the acquisition of the status of politically exposed person or holder of another political or public office, as well as any other specific status that should motivate the intervention of a member of top management or another element of higher hierarchical level;

f) The detection of persons or entities identified in any determinations issued by the sectoral authorities, namely in the context of the enhanced measures referred to in Article 36;

g) The detection of any persons or entities identified in restrictive measures, namely those arising from a resolution of the United Nations Security Council or a regulation of the European Union;

h) The blocking or suspension of the establishment or continuation of a business relationship, as well as of the carrying out of an occasional transaction or operation in general, whenever they depend on the intervention of a member of top management or another element of higher hierarchical level;

i) The blocking or suspension of the carrying out of operations or set of operations, namely when:

i) The obliged entity must refrain from carrying out a given operation or set of operations, in view of the existence of potential suspicions;

ii) The obliged entity must comply with the freezing obligations arising from the financial sanctions referred to in paragraph g);

j) The timely extraction of reliable and understandable information that supports the analysis and decision-making by the relevant internal structures, as well as the exercise of the duties of communication and collaboration legally provided for.

3 - The procedures and information systems referred to in the previous numbers, in particular with regard to their level of computerization and parameterization, must be proportionate to the nature, size and complexity of the activity of the obliged entity, as well as to the risks associated with each of their respective business areas, without prejudice to the provisions of sectoral regulations.

Article 19. Specific procedures and information systems 1 - Obliged entities shall apply adequate and risk-based procedures or information systems that allow assessing or detecting the statuses of 'politically exposed person', 'close family member' and 'person known to be closely associated':

a) Before the establishment of the business relationship or the carrying out of the occasional transaction;

b) During the business relationship, when any of the said statuses is subsequently acquired.

2 - In defining the procedures or systems referred to in the previous number, obliged entities:

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 23 / 122

a) Take into account at least the aspects of their activity referred to in paragraph a) of number 2 of Article 14;

b) Use sources of information that, taken together and in view of their specific concrete operational reality, allow permanently assessing the existence or subsequent acquisition of any of the statuses mentioned therein.

3 - Obliged entities shall also adopt reasonable procedures that allow:

a) Assessing the status of 'holder of another political or public office' before the establishment of the business relationship or the carrying out of the occasional transaction, as well as the subsequent acquisition of that status during the business relationship;

b) Permanently identify the degree of risk associated with business relationships and occasional transactions, as well as changes to that degree of risk during the course of the business relationship.

4 - After the cessation of any of the capacities referred to in the preceding paragraphs, obliged entities shall adopt procedures with the aim of assessing whether their customers continue to represent an increased risk of money laundering or terrorist financing, based on their respective profile and the nature of the operations carried out before and after the said cessation.

5 - The frequency of the procedures referred to in the preceding paragraph must be appropriate to the specific risk identified and, in the case of business relationships, may not exceed one year.

6 - The provisions of this article apply to business relationships and occasional transactions in which the capacities of "politically exposed person", "close family member", "person known to be closely associated" or "holder of another political or public office" are verified in relation to any:

a) Customer;

b) Customer's representative;

c) Customer's beneficial owner;

d) Beneficiary of a life insurance contract; or

e) Beneficial owner of the beneficiary of the contract referred to in the preceding subparagraph, where applicable.

Article 20.º Reporting of irregularities 1 - Obliged entities shall create specific, independent and anonymous channels that internally ensure, in an adequate manner, the receipt, processing and filing of reports of irregularities related to possible violations of this law, the regulations implementing it and the policies, procedures and controls internally defined in matters of prevention of money laundering and terrorist financing.

2 - The channels referred to in the preceding paragraph must:

a) Be proportionate to the nature, size and complexity of the obliged entity's activity;

b) Guarantee the confidentiality of the reports received and the protection of the personal data of the whistleblower and of the suspect of the commission of the infringement, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, and other data protection legislation.

3 - Persons who, by virtue of the functions they perform in the obliged entity, namely under Article 16.º, become aware of any serious fact that constitutes the irregularities referred to in paragraph 1 of this article, have the duty to report them to the supervisory body, under the terms and with the safeguards established in this article.

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 24 / 122 4 - When no supervisory body is appointed, the reports referred to in the preceding paragraph shall be addressed to the management body of the obliged entity.

5 - The reports made under this article, as well as the reports to which they give rise, shall be kept in accordance with the provisions of Article 51.º and placed, permanently, at the disposal of the sectoral authorities.

6 - Obliged entities shall refrain from any threats or hostile acts and, in particular, from any unfavorable or discriminatory employment practices against those who make reports under this article, and such reports may not, by themselves, serve as a basis for the obliged entity to initiate any disciplinary, civil or criminal proceedings against the author of the report, except if they are deliberately and manifestly unfounded.

7 - The sectoral authorities may require the respective obliged entities to submit a report, under the terms and with the frequency to be defined by those authorities, containing a description of the channels referred to in paragraph 1 and a summary indication of the reports received and their processing.

Article 21.º Restrictive measures 1 - Obliged entities shall adopt the means and mechanisms necessary to ensure compliance with the restrictive measures adopted by the United Nations Security Council or adopted by the European Union for the freezing of assets and economic resources related to terrorism, the proliferation of weapons of mass destruction, and their financing, against a designated person or entity.

2 - In order to comply with the provisions of the preceding paragraph, obliged entities shall adopt, in particular:

a) The appropriate means to ensure the immediate and full understanding of the content of the restrictive measures referred to in the preceding paragraph, in particular and where applicable, of the lists of persons and entities issued or updated under those measures, even if not available in Portuguese;

b) The consultation mechanisms necessary for the immediate application of those measures, including the electronic subscription to any content that, in this context, is available.

SUBSECTION III Group policies

Article 22.º Group relationships and establishments abroad 1 - Obliged entities that are part of a group shall promote:

a) The application at group level of the policies, procedures and controls defined and adopted in compliance with the provisions of this section;

b) The definition and adoption of information-sharing procedures within the group for the purposes of preventing and combating money laundering and terrorist financing, namely with a view to:

i) The management of money laundering and terrorist financing risks at group level, as well as the risks deriving from direct or indirect exposure to other entities and branches that are part of the same group;

ii) The exercise of the identification and due diligence duty provided for in this law, by all entities and branches that, being part of the same group, establish business relationships, carry out occasional transactions or execute operations that would be subject to the application of this law and the regulations implementing it.

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 25 / 122 2 - For the purposes of the provisions of paragraph b) of the previous number, entities that are part of the same group shall share any relevant information for the purposes of preventing and combating money laundering and terrorist financing, including the provision of information on:

a) Clients, accounts and specific operations, namely to the elements that, at group level, perform functions related to compliance control and auditing and, in general, to the prevention and combating of money laundering and terrorist financing;

b) Suspicions that certain funds or other assets come from criminal activities or are related to terrorist financing, provided that no opposition is raised by any relevant financial intelligence unit.

3 - The sharing of information under the previous number must be able to occur between any entities and branches that are part of the same group, even when the recipient of the shared information is not the parent company of the group.

4 - The obliged entities shall ensure that the policies and procedures and controls referred to in paragraph 1, as well as the information-sharing obligations provided for in paragraph 2, are adopted effectively and on a permanent basis:

a) In their branches, even if outside the framework of a group relationship;

b) In their majority-owned subsidiaries;

c) In other entities under their control, namely through the verification of one or more control indicators, as to be established by sectoral regulation.

5 - Obliged entities that operate establishments in another Member State of the European Union, including their branches, agents and distributors operating there, shall adopt and implement the necessary procedures to ensure that those establishments comply with the laws, regulations and other local provisions on the prevention and combating of money laundering and terrorist financing.

6 - Whenever they operate in a given host country in the manner provided for in paragraphs a) to c) of paragraph 4 and the minimum requirements applicable there in the field of prevention and combating of money laundering and terrorist financing prove to be less stringent, the obliged entities shall ensure the application of national laws, regulations and provisions in that field, including with regard to the protection of personal data, to the extent that the law of the host country permits.

7 - For the purposes of this article, obliged entities shall take into account all prohibitions, restrictions or other conditions imposed by the law of the host country that may prevent or limit the application of the provisions of paragraphs 4 and 6, including those relating to secrecy, protection of personal data and other restrictions on the sharing of information.

8 - If the law of the host country does not permit the application of the provisions of paragraphs 4 and 6, the obliged entities:

a) Ensure that their branches and majority-owned subsidiaries in that country, as well as other entities under their control as to be established by sectoral regulation, apply additional measures to effectively control the risk of money laundering and terrorist financing;

b) Immediately inform the sectoral authorities of the impediments identified and the additional measures adopted.

9 - When the additional measures referred to in the previous number prove insufficient to effectively control the risk of money laundering and terrorist financing, the sectoral authorities shall adopt the additional measures necessary to mitigate the identified risk, which may include the following control actions on the group:

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 26 / 122

a) Prohibition of establishing new business relationships or requirement to terminate existing business relationships;

b) Prohibition or limitation of the execution of operations;

c) Where necessary, cessation of activity in the host country;

d) Any other measures, among those provided for in section II of chapter VII, that prove adequate for mitigating the identified risks.

SECTION III Identification and diligence duty SUBSECTION I Identification and normal diligence DIVISION I General provisions

Article 23 Identification and diligence duty 1 - Obliged entities shall observe the identification and diligence procedures provided for in this section when:

a) They establish business relationships;

b) They carry out occasional transactions, regardless of whether the transaction is carried out through a single operation or several operations that appear to be related to each other:

i) Of an amount equal to or greater than €15,000; or

ii) That constitute a transfer of funds or a transaction executed within the scope of activity with virtual assets, whenever the amount thereof exceeds €1000;

c) There is a suspicion that the operations, regardless of their value and of any exception or threshold, may be related to money laundering or terrorist financing;

d) There are doubts about the veracity or adequacy of the identification data of clients previously obtained.

2 - The gaming service providers referred to in paragraphs a) to c) of paragraph 1 of article 4 shall observe the identification and diligence procedures provided for in this section when they carry out transactions of an amount equal to or greater than €2000, regardless of whether the transaction is carried out through a single operation or several operations that appear to be related to each other.

3 - As soon as possible, and based on criteria of materiality and risk, obliged entities shall apply the identification and diligence procedures to existing clients in accordance with this section.

4 - When complying with the provisions of the previous paragraph, the obliged entities shall take into account the identification and due diligence procedures previously adopted, the time at which they were applied and the adequacy of the elements obtained.

Article 24. Identification elements 1 - The identification of clients and their representatives shall be carried out:

a) In the case of natural persons, by collecting and recording the following identification elements:

i) Photograph

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 27 / 122

ii) Full name;

iii) Signature;

iv) Date of birth;

v) Nationality as stated in the identification document;

vi) Type, number, expiry date and issuing entity of the identification document;

vii) Tax identification number or, where there is no tax identification number, the equivalent number issued by a competent foreign authority;

viii) Profession and employer, where they exist;

ix) Full address of the permanent residence and, where different, of the tax domicile;

x) Place of birth;

xi) Other nationalities not stated in the identification document;

b) In the case of legal persons or centres of collective interests without legal personality, by collecting and recording the following identification elements:

i) Name;

ii) Object;

iii) Full address of the registered office and, where applicable, of the branch or permanent establishment, as well as, where different, any other address of the main places where the activity is carried out;

iv) Legal person identification number or, where none exists, equivalent number issued by a competent foreign authority;

v) Identity of the holders of shareholdings in the capital and voting rights of a value equal to or greater than 5%;

vi) Identity of the holders of the management body or equivalent body, as well as of other relevant senior officers with management powers;

vii) Country of incorporation;

viii) CAE code (Classification of Economic Activities), institutional sector code or other code of a similar nature, where it exists.

2 - In the case of clients' representatives, the obliged entities shall also verify the document that authorises such persons to act as their representatives.

Article 25. Means of proof of identification elements 1 - For the purposes of verifying the identification of natural persons, the obliged entities shall always require the presentation of valid identification documents, containing the identification elements provided for in subparagraphs i) to vi) of paragraph a) of no. 1 of the previous article.

2 - The proof of the data referred to in the previous paragraph shall be carried out by the following means, whenever the clients and their representatives have the necessary elements for this purpose and express to the obliged entity their intention to use them:

a) Through the electronic identification means, qualified electronic signature and secure authentication of the State available through the website autenticacao.gov.pt;

b) (Repealed.)

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 28 / 122

c) Using interoperability platforms between information systems issued by public services, under the terms of Regulation (EU) No. 910/2014 of the European Parliament and of the Council, of 23 July 2014;

d) Through the authorisation of the data subject for its transmission, under the terms of paragraphs 1 and 4 of

article 4-A of Law No. 37/2014, of 26 June.

3 - For the purposes of the provisions of the previous paragraph, the obliged entities shall make available the necessary technological means and services.

4 - Outside the cases provided for in no. 2, the proof of the documents referred to in no. 1 shall be carried out by:

a) Reproduction of the original of the identification documents, in physical or electronic form;

b) Certified copy thereof;

c) Access to the respective electronic information with equivalent value, namely through:

i) The use of secure devices, recognised, approved or accepted by the competent authorities, which confer qualified certification, under the terms to be defined by regulation;

ii) The collection and verification, with prior consent, of the electronic data from the competent entities responsible for their management;

iii) The authorisation for the transmission of data under the terms of paragraphs 1 and 4 of article 4-A of Law No. 37/2014, of 26 June;

iv) The use of qualified trust service providers, under the terms provided for in Regulation (EU) No. 910/2014 of the European Parliament and of the Council, of 23 July 2014.

5 - For the purposes of verifying the identification of legal persons or a centre of collective interests without legal personality, the obliged entities shall always require the presentation of the legal person identification card, the commercial register certificate or, in the case of an entity with a registered office located outside the national territory, an equivalent document issued by an independent and credible source, which prove the identification elements provided for in subparagraphs i) to iv) of paragraph b) of no. 1 of article 24. 6 - The proof of the data referred to in the previous paragraph shall be carried out through the use of interoperability platforms between information systems issued by public services or through any of the means of proof provided for in this article.

7 - Whenever the means of proof used do not cover some of the identification elements provided for in article 24, the obliged entities shall collect them through other admissible complementary means.

8 - Whenever the supporting documents, referring to any identification elements, presented to the obliged entities raise doubts as to their content or their suitability, authenticity, timeliness, accuracy or sufficiency, those entities shall take the appropriate steps for the full proof of the identification elements in question.

Article 26.º Timing of identity verification 1 - Without prejudice to the provisions of paragraph 3, the identity of the customer and their representatives is verified before the establishment of the business relationship or the carrying out of any occasional transaction.

2 - In the case of occasional transactions, the obliged entities verify the currency of the identification elements presented, regardless of whether they have already collected information elements about the customer during the carrying out of a previous occasional transaction.

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 29 / 122 3 - The identity verification provided for in paragraph 1 may be completed after the start of the business relationship, provided that the following conditions are cumulatively met:

a) If this is necessary in order not to interrupt the normal course of business;

b) The contrary does not result from a legal or regulatory provision applicable to the activity of the obliged entity;

c) The situation in question presents a low risk of money laundering and terrorist financing, expressly identified as such by the obliged entities;

d) The obliged entities implement appropriate measures to manage the risk associated with that situation, in particular by limiting the number, type or amount of operations that may be carried out.

4 - Whenever they make use of the power conferred by the previous paragraph, the obliged entities complete the identity verification procedures as soon as possible.

Article 27.º Complementary due diligence procedures In addition to the identification procedures provided for in Articles 24.º and 25.º, the obliged entities also proceed:

a) To obtain information on the intended purpose and nature of the business relationship;

b) To obtain information on the origin and destination of the funds moved within the scope of a business relationship or in the carrying out of an occasional transaction, when the customer's risk profile or the characteristics of the operation justify it;

c) To maintain continuous monitoring of the business relationship, in order to ensure that the operations carried out during that relationship are consistent with the entity's knowledge of the customer's activities and risk profile and, whenever necessary, of the origin and destination of the funds moved.

Article 28.º Adequacy to the degree of risk 1 - The obliged entities may adapt the nature and extent of the identity verification and due diligence procedures, depending on the risks associated with the business relationship or the occasional transaction, taking into account, in particular, the origin or destination of the funds and the other aspects referred to in paragraph 2 of Article 14.º 2 - For the purposes of the previous paragraph, the obliged entities consider at least the following factors:

a) The purpose of the business relationship;

b) The level of assets deposited per customer or the volume of operations carried out;

c) The regularity or duration of the business relationship.

3 - The obliged entities ensure that they meet the necessary conditions to demonstrate the adequacy of the procedures adopted under the previous paragraph whenever requested to do so by their respective sectoral authorities.

DIVISION II Beneficial owners

Article 29.º Knowledge of beneficial owners

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 30 / 122 1 - When the customer is a legal person or a centre of collective interests without legal personality, the obliged entities obtain satisfactory knowledge about the customer's beneficial owners, depending on the concrete risk of money laundering and terrorist financing.

2 - Before establishing a business relationship or carrying out an occasional transaction, the obliged entities proceed, in particular:

a) To adopt all necessary measures to assess the status of beneficial owner;

b) To obtain information on the identity of the customer's beneficial owners;

c) To adopt reasonable measures to verify the identity of the beneficial owners.

3 - The obliged entities also comply, with the necessary adaptations, with the provisions of this division, whenever the customer is a natural person who may not be acting on their own behalf.

4 - The obliged entities keep a written record of all actions aimed at complying with the provisions of this division, including any means used to assess the status of beneficial owner, in accordance with the assessment criteria set out in the following article, as well as any difficulties eventually encountered during the process of verifying the identity of the beneficial owners.

5 - The record referred to in the previous paragraph is kept in accordance with the provisions of Article 51.º and made permanently available to the sectoral authorities.

6 - During the continuous monitoring of the business relationship and, in particular, the exercise of the updating due diligence referred to in Article 40.º, the obliged entities expand their knowledge of the customer's beneficial owner and repeat the procedures provided for in this division whenever they suspect any relevant change regarding the customer's beneficial owners or the customer's ownership and control structure.

Article 30.º Criteria 1 - The following persons are considered beneficial owners of a collective investment undertaking and of corporate entities, when they are not companies with shares admitted to trading on a regulated market subject to information disclosure requirements consistent with European Union law or subject to equivalent international standards that ensure sufficient transparency of information relating to ownership:

a) The natural person or persons who, ultimately:

i) They hold ownership or control, direct or indirect, of a sufficient percentage of units of participation or securitisation in circulation in that collective investment undertaking;

ii) They hold ownership or control, direct or indirect, of a sufficient percentage of shares or voting rights or participation in the capital of that entity;

b) The natural person or persons who exercise control by other means over that collective investment undertaking or over that entity;

c) The natural person or persons who hold top-level management, if, after all possible means have been exhausted and provided there are no grounds for suspicion:

i) No person has been identified under the preceding subparagraphs; or

ii) Doubts remain that the person or persons identified are the beneficial owners.

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 31 / 122 2 - For the purposes of assessing the status of beneficial owner, where the client is a corporate entity or a collective investment undertaking referred to in the preceding paragraph, obliged entities:

a) Consider as an indication of direct ownership the holding, by a natural person, of participations representing more than 25 % of the share capital or of units of participation or securitisation in circulation of the client;

b) Consider as an indication of indirect ownership the holding of participations representing more than 25 % of the share capital or of units of participation or securitisation in circulation of the client by:

i) A corporate entity that is under the control of one or several natural persons; or

ii) Several corporate entities that are under the control of the same person or the same natural persons;

c) Verify the existence of any other indicators of control and of the other circumstances that may indicate control by other means.

3 - The following are considered beneficial owners of trusts:

a) The settlor or settlors;

b) The trustee or trustees of trusts;

c) The protector or protectors, if applicable;

d) The beneficiaries or, if they have not yet been determined, the category of persons in whose main interest the trust was constituted or carries on its activity;

e) Any other natural person who holds ultimate control of the trust through direct or indirect participation or through other means.

4 - In the case of legal persons of a non-corporate nature, such as foundations, or of centres of collective interests without legal personality of a nature analogous to trusts, the beneficial owners are considered to be the natural person or persons with positions equivalent or similar to those mentioned in the preceding paragraph.

5 - Without prejudice to the provisions of subparagraph k) of paragraph 1 of Article 2, pension funds are subject to the rules on beneficial owners in the event that they finance, exclusively or not, pension plans whose participants or beneficiaries are members of the management bodies of their respective associates, and in such cases their beneficial owners are considered to be those participants and beneficiaries.

6 - The provisions of the preceding paragraph apply only where at least 2 % of the value of the pension fund is allocated to financing the past liabilities of the participants and beneficiaries referred to therein or to the value of their individual accounts.

7 - The provisions of paragraph 5 also apply to contracts of collective adhesion to open pension funds, in cases where the value of the adhesion allocated to financing the respective past liabilities, or to the value of their individual accounts, represents at least 5 % of the value of the units of participation of the fund.

8 - Any participants and beneficiaries of individual adhesions to an open pension fund who individually hold at least 5 % of the value of the units of participation of that fund are also considered beneficial owners.

9 - In the cases provided for in the preceding paragraph, it is for the management entity of the pension fund to comply with the duties of providing information to obliged entities regarding the beneficial owner, and it is for the associate, in the cases provided for in paragraphs 5 to 7, to make available to the management entity of the fund the elements necessary for that purpose, having as reference the elements of the last approved financial year.

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 32 / 122

Article 31 Assessment of the status of beneficial owner and understanding of the ownership and control structure 1 - Obliged entities assess the status of beneficial owner through any document, measure or step considered suitable and sufficient, depending on the specific risk identified.

2 - In the case of trusts or other centres of collective interests without legal personality of an analogous nature, whose beneficiaries are defined on the basis of specific characteristics or categories, obliged entities obtain sufficient information on those beneficiaries, so as to ensure that they are in a position to fully comply with the provisions of this division in respect of them, at the time of payment or of the exercise of their acquired rights.

3 - The provisions of the preceding paragraph do not dispense with the immediate observance of the procedures provided for in this division, in respect of the other persons who may have the status of beneficial owner, under the terms of paragraphs 3 and 4 of the preceding article.

4 - In the context of assessing the status of beneficial owner, obliged entities adopt reasonable and risk-based measures to understand the ownership and control structure of the client, including the collection of reliable documents, data or information on the chain of participations or control.

Article 32 Identification of beneficial owners 1 - The obliged entities shall collect at least the identifying elements provided for in paragraph 1 of

Article 24, in respect of the client's beneficial owners.

2 - The verification of the identifying elements of the beneficial owners shall be carried out on the basis of documents, data or information from an independent and credible source, without prejudice to the provisions of paragraphs 3 and 4 below.

3 - In cases where a low risk of money laundering and terrorist financing is demonstrably verified, the sectoral authorities may allow, under the terms to be defined in regulations, the verification of the identifying elements of the beneficial owners on the basis of a declaration issued by the client or by those legally representing the client.

4 - The verification of the identifying elements of the client's beneficial owners shall be carried out in accordance with the provisions of Article 25, whenever:

a) The client, its beneficial owners, the business relationship or transaction represent an increased risk of money laundering or terrorist financing;

b) The status of beneficial owner or owners results from the provisions of subparagraph c) of paragraph 1 of Article 30;

c) The situations described in paragraph 2 of the following article are verified; or

d) This is determined by sectoral regulations or by a decision of the competent sectoral authorities.

5 - Without prejudice to the provisions of paragraph 2 of the previous article, the provisions of Article 26 shall apply, with the necessary adaptations, at the time of verification of the identity of the beneficial owner.

Article 33 Provision of information on beneficial owners to obliged entities 1 - Legal persons that establish or maintain business relationships with obliged entities or carry out occasional transactions with them shall make available to them in a timely manner, under penalty of the exercise of the duty of refusal provided for in Article 50:

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 33 / 122

a) Information on their legal owners or formal holders, in the case of a legal person;

b) Sufficient, accurate and up-to-date information on their beneficial owners;

c) Detailed data on the nature of the control exercised by the beneficial owner and the underlying economic interests; and

d) The other documents, data and information necessary for the compliance, by the obliged entities, with the provisions of this division.

2 - Those who, before the obliged entities, act as trustees or exercise a similar function in express trusts or in collective investment centres without legal personality with a similar structure or functions, shall disclose their status to the obliged entities and make available to them in a timely manner the following elements, in respect of the trust or the collective investment centre without legal personality:

a) The elements provided for in subparagraphs b) to d) of the previous paragraph;

b) Proof of the information contained in the central register of beneficial owners or another equivalent mechanism, in the situations provided for in paragraph 3 of the following article.

Article 34 Consultation of the central register of beneficial owners 1 - The information on beneficial owners shall be registered in the central register of beneficial owners, which is regulated by specific legislation.

2 - The obliged entities:

a) Consult the information contained in the central register of beneficial owners provided for in the previous paragraph, whenever the client, under the terms of the said specific legislation, is obliged to register its beneficial owners in national territory;

b) Carry out the said consultations with a frequency appropriate to the concrete risks identified and, at least, whenever they carry out, update or repeat the identification and due diligence procedures provided for in this law;

c) Collect proof of the information contained in the central register of beneficial owners or an extract of the register;

d) Make the establishment or continuation of the business relationship, or the carrying out of the occasional transaction, dependent on the verification of compliance with the registration obligation, by consulting the central register of beneficial owners, when the registration obligation is due under the terms of the special legislation referred to in the previous paragraph;

e) Immediately communicate to the Instituto de Registos e Notariado, I. P., under the terms to be established by this Institute, any discrepancies between the information contained in the register and that resulting from compliance with the duties provided for in this law, as well as any other omissions, inaccuracies or outdated information that they verify in that register.

3 - In the case of clients that are collective investment centres without legal personality or entities whose beneficial owners, in accordance with the special legislation referred to in paragraph 1, are not subject to registration in national territory, the obliged entities shall obtain from the client a written declaration indicating the legal justification for non-subjection to registration or, whenever applicable, the information contained in the central register of beneficial owners or an equivalent mechanism established in other jurisdictions, when access by the obliged entities to such mechanisms is not possible or cannot be carried out in a timely manner.

4 - Compliance with the provisions of this article does not exempt the observance of the other identification and due diligence procedures defined in this law.

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 34 / 122 SUBSECTION II Simplified measures

Artigo 35.º Simplified measures 1 - Obligated entities may simplify the measures adopted under the identification and due diligence duty when they identify a demonstrably reduced risk of money laundering and terrorist financing in business relationships, occasional transactions or operations they carry out.

2 - The adoption of simplified measures is only admissible following an adequate risk assessment by the obligated entities themselves or by the respective sectoral authorities and can never take place in any of the following situations:

a) When there are suspicions of money laundering or terrorist financing;

b) When enhanced identification or due diligence measures should be adopted;

c) Whenever so determined by the competent sectoral authorities.

3 - In the analysis of money laundering and terrorist financing risks that may give rise to the adoption of simplified measures, the obligated entities and the sectoral authorities take into account:

a) The situations indicative of potentially lower risk listed in Annex II to this law, of which it forms an integral part;

b) In the case of obligated entities, other situations indicative of potentially lower risk that may be identified by the respective sectoral authorities.

4 - The following are considered examples of simplified measures, without prejudice to others that prove more adequate to the specific risks identified:

a) Verification of the identification of the client and the beneficial owner after the establishment of the business relationship;

b) Reducing the frequency of updates of the data collected in compliance with the identification and due diligence duty;

c) Reducing the intensity of ongoing monitoring and the depth of the analysis of operations, when the amounts involved are of low value;

d) The absence of collecting specific information and the non-execution of specific measures that allow understanding the object and nature of the business relationship, when it is reasonable to infer the object and nature of the type of transaction carried out or business relationship established.

5 - The simplified measures to be applied by the obligated entity must be proportional to the identified reduced risk factors.

6 - The sectoral authorities may also define the specific content of the simplified measures that prove adequate to address certain identified reduced risks of money laundering and terrorist financing.

7 - The application of simplified measures does not exempt obligated entities from monitoring operations and business relationships in order to allow the detection of unusual or suspicious operations.

SUBSECTION III Enhanced measures

Artigo 36.º Enhanced measures

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 35 / 122 1 - In addition to the normal identification and due diligence procedures, obligated entities reinforce the measures adopted under the identification and due diligence duty when an increased risk of money laundering or terrorist financing in business relationships, occasional transactions or operations they carry out is identified by the obligated entities themselves or by the respective sectoral authorities.

2 - Enhanced measures are always applicable to the situations provided for in Articles 37.º to 39.º and 69.º to 71.º, as well as in any other situations that, for this purpose, may be designated by the competent sectoral authorities, including through the identification of natural or legal persons or collective interest centres without legal personality that should give rise to the adoption of such measures.

3 - The sectoral authorities may also define the specific content of the enhanced measures that prove adequate to address the identified increased risks of money laundering or terrorist financing.

4 - The adoption of the specific enhanced measures referred to in paragraphs 2 and 3 does not prejudice the adoption of others that equally prove necessary to address the specific identified risk.

5 - In the analysis of money laundering or terrorist financing risks that should give rise to the adoption of enhanced measures, the obligated entities and the sectoral authorities give particular consideration to:

a) The situations indicative of potentially higher risk listed in Annex III to this law, of which it forms an integral part;

b) In the case of obligated entities, other situations indicative of potentially higher risk that may be identified by the competent sectoral authorities.

6 - The following are considered examples of enhanced measures, without prejudice to others that prove more adequate to the specific risks identified:

a) Obtaining additional information about clients, their representatives or beneficial owners, as well as about planned or completed operations;

b) Carrying out additional due diligence to verify the information obtained;

c) The involvement of higher hierarchical levels for the authorisation of the establishment of business relationships, the execution of occasional transactions or the carrying out of operations in general;

d) Intensifying the depth or frequency of monitoring procedures for the business relationship or certain operations or sets of operations, with a view to detecting potential indicators of suspicion and the subsequent compliance with the reporting duty provided for in

Article 43.º;

e) Reducing the time intervals for updating the information and other elements collected in the exercise of the identification and due diligence duty;

f) Monitoring the oversight of the business relationship by the compliance officer referred to in Article 16.º or by another employee of the obligated entity who is not directly involved in the commercial relationship with the client;

g) The enforceability of making the first payment relating to a given transaction through a traceable means originating from a payment account opened by the client with a financial institution or another legally authorised entity which, not being located in a high-risk third country, demonstrably applies equivalent identification and due diligence measures.

Article 37 High-risk third countries

Directorate of Communication and Taxpayer Support DocBaseV/2017 36 / 122 1 - Obliged entities adopt effective enhanced measures proportionate to the existing risks whenever they establish business relationships, carry out occasional transactions, carry out operations or otherwise relate to high-risk third countries.

2 - For the purposes of the provisions of the preceding number, obliged entities adopt, at least, the measures listed in paragraphs a) to f) of paragraph 6 of the preceding article and, whenever the specific risk identified justifies it, the measure provided for in paragraph g) of the same number.

3 - The provisions of paragraph 1:

a) Are not automatically invoked in the case of branches and subsidiaries majority-held by obliged entities of the European Union which, being located in high-risk third countries, fully comply with the policies and procedures at group level provided for in Article 22;

b) Do not prejudice the determination, by the respective sectoral authorities, of the adoption of enhanced measures in the context of business relationships, occasional transactions or operations with natural or legal persons or centres of collective interests without legal personality established in other jurisdictions that may be identified by those authorities, based on the disclosures made by the Financial Action Task Force (FATF) or other credible sources;

c) Do not prejudice the adoption of those enhanced measures in any other situations in which obliged entities, in the light of a risk-based approach, identify an increased geographical risk, based on the said FATF disclosures and other credible sources, or on other information made available to them by the sectoral authorities.

4 - Obliged entities treat the situations provided for in paragraph a) of the preceding number in accordance with a risk-based approach.

Article 38 Distance contracting 1 - In cases where the establishment of the business relationship or the carrying out of the occasional transaction takes place without the client or their representative being physically present, the verification of the documents referred to in paragraphs 1 and 5 of Article 25 is carried out through the following means:

a) In the case of natural persons, under the terms provided for in paragraphs 2 to 4 of the said Article 25;

b) In the case of legal persons or centres of collective interests without legal personality, under the terms provided for in paragraph 6 of the same article.

2 - In addition to the provisions of the preceding paragraph, obligated entities shall adopt the other enhanced measures that are also necessary to address the specific risk identified, namely those provided for in subparagraphs b) or g) of paragraph 6 of Article 36.

Article 39. Politically exposed persons and holders of other political or public positions 1 - In the context of business relationships or occasional transactions with clients, their representatives or beneficial owners who are politically exposed persons, obligated entities, in addition to the normal identification and due diligence procedures:

a) Detect the status of «politically exposed person», acquired at a time prior or subsequent to the establishment of the business relationship or the carrying out of the occasional transaction, based on the procedures or information systems provided for in Article 19;

b) Ensure the involvement of a member of top management for approval:

i) Of the establishment of business relationships or the execution of occasional transactions;

ii) Of the continuity of business relationships in which the acquisition of the status of «politically exposed person» occurs after the establishment of the business relationship;

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 37 / 122

c) Adopt the necessary measures to know and verify the origin of the assets and funds involved in business relationships, occasional transactions or operations in general, for this purpose meaning:

i) «Assets», the totality of assets that make up the sources of wealth of the politically exposed person;

ii) «Funds», the amounts or assets specifically allocated to the established business relationship, the occasional transaction or the operation carried out with the politically exposed person;

d) Monitor on a permanent and enhanced basis the business relationships, with a particular view to identifying any operations that should be subject to reporting under the terms provided for in

Article 43. 2 - The provisions of the preceding paragraph do not prejudice the adoption of other enhanced measures or the intensification of the measures referred to in subparagraphs b) to d) of the same paragraph, whenever the specific increased risk of the business relationship or the occasional transaction proves to be particularly high.

3 - The provisions of the preceding paragraphs shall continue to apply to those who, having ceased to hold the status of politically exposed person, continue to represent, in accordance with the procedures provided for in Article 14 and paragraphs 4 and 5 of Article 19, an increased risk of money laundering or terrorist financing, due to their profile or the nature of the operations carried out.

4 - The regime set out in the preceding paragraphs applies to business relationships or occasional transactions with clients, their representatives or beneficial owners who are:

a) Close family members and persons recognised as closely associated;

b) Holders of other political or public positions, with the specificity given by the following paragraph.

5 - Compliance with the provisions of paragraphs b) to d) of no. 1 is only required in business relationships and occasional transactions with holders of other political or public positions in which an increased risk of money laundering or terrorist financing is identified.

SUBSECTION IV Updating obligation

Article 40. Updating procedures 1 - Obligated entities shall carry out periodic due diligence and procedures with the aim of ensuring the currency, accuracy and completeness of the information they already have, or should have, regarding:

a) The identifying elements of clients, representatives and beneficial owners and all other documents, data and information obtained in the exercise of the identification and due diligence duty;

b) Other elements of information provided for in this law;

c) The means of proof of the elements referred to in the previous paragraphs.

2 - The frequency of updating the information referred to in the previous paragraph is defined according to the degree of risk associated with each client by the obligated entity, with the time intervals varying in inverse order to the degree of risk identified, and the frequency of updating information relating to low-risk clients should not exceed five years.

3 - Without prejudice to the provisions of no. 5 and when the contrary does not result from the enhanced identification or due diligence measures provided for in this law and the regulations implementing it, obligated entities may also adapt the nature and extent of the obligations to update previously obtained means of proof and due diligence procedures, according to the risks of

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 38 / 122 money laundering or terrorist financing existing at the date of updating, and the provisions of Article 28 shall apply, with the necessary adaptations. 4 - Obligated entities shall immediately carry out the necessary updating of data whenever:

a) They have reasons to doubt its truthfulness, accuracy or currency;

b) They have suspicions of practices related to money laundering or terrorist financing; or

c) A legal obligation is imposed on them requiring them to carry out such updating.

5 - Documentary proof of the information to be updated may be made by simple copy, but obligated entities must request the presentation of original documents, in physical or electronic form, or certified copies thereof, or, alternatively, obtain electronic information with equivalent value, whenever:

a) The information in question has never been subject to any prior proof, under the terms provided for in Article 25;

b) The elements provided by the client for updating the data raise doubts;

c) The updating procedures are triggered by suspicions of money laundering or terrorist financing;

d) This results from the specific risk identified or from another circumstance considered relevant by the obligated entity or its sectoral authority.

SUBSECTION V Execution by third parties

Article 41. Execution of the identification and due diligence duty by third entities 1 - Obligated entities may use a third entity to execute the identification and due diligence procedures provided for in subsection I of this section, with the exception of the procedures referred to in paragraphs b) and c) of Article 27. 2 - For the purposes of the provisions of the previous paragraph, third entities are considered to be obligated entities, or others of equivalent nature headquartered abroad, that apply identification, due diligence and record-keeping procedures compatible with those provided for in this law and that are subject to supervision compatible with the provisions of Chapter VII, with respect to the requirements provided for in this law or equivalent regulations.

3 - Sectoral authorities may, through sectoral regulations, and in accordance with a risk-based approach, restrict:

a) The list of obligated entities that may use third entities;

b) The nature or the list of entities that may be considered third entities;

c) The list of procedures that may be executed by third entities.

4 - Obligated entities are prohibited from using third entities established in high-risk third countries, with the exception of branches or subsidiaries majority-owned by obligated entities, or others of equivalent nature, established in the European Union, if these branches or subsidiaries fully comply with the group-level policies and procedures, under the terms of Article 22. 5 - Whenever they use the execution of identification and due diligence procedures by third entities, obligated entities:

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 39 / 122

a) Ensure that such entities are qualified to execute the identification and due diligence procedures as their third entities;

b) Assess, based on public domain information, the reputation and suitability of the third entities;

c) Complete the information collected by the third entities or carry out a new identification, in the case of insufficient information or when the associated risk justifies it;

d) Comply with all document retention requirements provided for in Article 51, as if they had themselves carried out the identification and due diligence procedures executed by the third entities.

6 - Without prejudice to the provisions of sectoral regulations, obligated entities ensure that the third entities they use are in a position to:

a) Gather all information and comply with all identification, due diligence and document retention procedures that the obligated entities themselves must observe;

b) When requested, immediately transmit a copy of the identification and identity verification data and other relevant documentation on the client, their representatives or beneficial owners who were subject to the identification and due diligence procedures.

7 - The performance of identification and due diligence procedures by third parties must be provided for in contractual clauses governing the relationships between the obliged entity and the third party.

8 - Agency, representation or subcontracting relationships do not constitute performance by third parties as provided for in this article.

9 - The following may not establish agency, representation or subcontracting relationships, for the purposes of paragraph 1:

a) Third parties;

b) Obliged entities, or others of an equivalent nature headquartered abroad, that cannot benefit from third-party status, under the provisions of paragraph 2 or sectoral regulations.

10 - Without prejudice to the liability of third parties in performing the duties set out in this law, obliged entities remain liable for the exact compliance with the identification and due diligence procedures performed by third parties, as if they were their direct performers.

Article 42. Group relationships The requirements imposed by the previous article are considered fulfilled by obliged entities if, through a group program, the following conditions are cumulatively met:

a) The obliged entity relies on information provided by a third party within the same group, under the provisions of Article 22;

b) That group applies identification and due diligence procedures, document retention rules and programs to combat money laundering and terrorist financing under the terms of this law or equivalent rules;

c) The effective implementation of the requirements referred to in the previous subparagraph is subject to group-level supervision by a competent authority of the Member State of origin or the third country.

SECTION IV Duty to report

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 40 / 122 SUBSECTION I Reporting of suspicious transactions

Article 43. Reporting of suspicious transactions 1 - Obliged entities, on their own initiative, shall immediately inform the Central Department of Investigation and Criminal Action of the Attorney General's Office (DCIAP) and the Financial Intelligence Unit whenever they know, suspect or have sufficient reasons to suspect that certain funds or other assets, regardless of the amount or value involved, come from criminal activities or are related to terrorist financing.

2 - For the purposes of the previous paragraph, obliged entities shall report all transactions proposed to them, as well as any attempted transactions, that are ongoing or have been executed.

3 - Obliged entities shall keep, under the terms of Article 51, copies of the reports made under this article and make them permanently available to sectoral authorities.

Article 44. Terms of reporting 1 - The reports of suspicious transactions provided for in the previous article:

a) Are made through the external communication channels defined by the authorities receiving the information and under the terms established by them;

b) Are made as soon as the obliged entity concludes that the transaction is suspicious, preferably as soon as such transactions are proposed to them;

c) Include, at least:

i) The identification of natural and legal persons directly or indirectly involved and known to the obliged entity, as well as known information about their activity;

ii) The investigation and analysis procedures undertaken by the obliged entity in the specific case;

iii) The characterizing and descriptive elements of the transactions;

iv) The suspicion factors concretely identified by the obliged entity;

v) A copy of the documentation supporting the investigation and analysis undertaken by the obliged entity.

2 - In order to facilitate the speed of analysis and reporting of suspicious transactions, obliged entities shall ensure that the circulation of information related to suspicious transactions is processed in a simple and agile manner, reducing to a minimum the number of participants in the transmission circuit.

3 - The undertaking by obliged entities of more complex or in-depth examination procedures of transactions considered suspicious shall not hinder the reporting of such transactions in a timely manner.

SUBSECTION II Other reports

Article 45. Systematic reporting of transactions 1 - With the exception of lawyers and solicitors, obliged entities shall also report, on a systematic basis, to DCIAP and the Financial Intelligence Unit any typologies of transactions that

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 41 / 122 may be defined by order of the member of the Government responsible for the area of justice, which also defines the form, deadline, content and other terms of the reports.

2 - Obliged entities shall keep, under the terms of Article 51, copies of the reports made under this article and make them permanently available to sectoral authorities.

3 - The provisions of this article do not prejudice the provision of any other information on a periodic or systematic basis, based on the provisions of Article 53.

Article 46. Reporting of real estate activities 1 - Obliged entities engaged in real estate activities shall report to IMPIC, I. P.:

a) The start date of their activity, accompanied by the access code to the permanent commercial registry certificate, within a maximum period of 60 days from that date;

b) On a quarterly basis, the following elements on each real estate transaction and lease agreement carried out:

i) Clear identification of the parties involved;

ii) Total amount of the legal transaction and the value of each property transacted;

iii) Mention of the respective title documents;

iv) Clear identification of the means of payment used, indicating, whenever applicable, the numbers of the payment accounts used;

v) Identification of the property;

vi) Duration of the lease agreement, when applicable.

2 - The communication referred to in subparagraph a) of the previous paragraph:

a) Is only applicable to the entities referred to in subparagraph d) of paragraph 1 of Article 4;

b) Is accompanied by a certificate of commercial registration, if the reporting entity does not have the permanent certificate mentioned in subparagraph a).

3 - For the purposes of the provisions of subparagraph b) of paragraph 1, only lease agreements for real estate whose rent amount is equal to or greater than €2500 per month are communicated.

4 - The provisions of this article are subject to regulation by IMPIC, I. P., particularly regarding the form and deadlines for the required communications.

5 - The Tax and Customs Authority makes available to IMPIC, I. P., the elements at its disposal regarding the obligations provided for in subparagraphs a) and b) of paragraph 1 in relation to obliged entities that carry out real estate activities.

SECTION V Duty of abstention and suspension decisions

Article 47 Duty of abstention 1 - Obliged entities shall abstain from carrying out any operation or set of operations, present or future, that they know or suspect may be associated with funds or other assets originating from or related to the practice of criminal activities or with the financing of terrorism.

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 42 / 122 2 - The obliged entity shall immediately proceed with the respective communication under the terms of Articles 43 and 44, additionally informing the DCIAP and the Financial Information Unit that it has abstained from carrying out an operation or set of operations under the previous paragraph.

3 - If the obliged entity considers that the abstention referred to in paragraph 1 is not possible or that, after consultation with the DCIAP and the Financial Information Unit, it is likely to prejudice the prevention or future investigation of criminal activities from which funds or other assets, money laundering or terrorist financing originate, the operations may be carried out, with the obliged entity immediately communicating to the DCIAP and the Financial Information Unit the information concerning the operations.

4 - The Financial Information Unit, within three business days from receipt of the communications provided for in paragraphs 2 and 3, shall rule on them, forwarding the gathered information to the DCIAP.

5 - The obliged entity may carry out the operations in respect of which it has exercised the duty of abstention, in the following cases:

a) When it is not notified, within seven business days from the communication referred to in paragraph 2, of the temporary suspension decision provided for in the following article;

b) When it is notified, within the period referred to in the previous subparagraph, of the DCIAP's decision not to order the temporary suspension provided for in the following article, and they may be carried out immediately.

6 - For the purposes of the provisions of paragraph 3, obliged entities shall include in a document or record:

a) The reasons for the impossibility of exercising the duty of abstention;

b) References to the consultations made to the DCIAP and the Financial Information Unit, indicating the dates of contact and the means used.

7 - The documents or records prepared under the previous paragraph shall be kept in accordance with

Article 51 and placed, permanently, at the disposal of the sectoral authorities.

Article 48 Temporary suspension 1 - Within four business days following the submission of the information referred to in paragraph 4 of the previous article, the DCIAP may order the temporary suspension of the execution of the operations in respect of which the duty of abstention has been or should be exercised, notifying the obliged entity to that effect.

2 - Outside the cases provided for in the previous paragraph, temporary suspension may also be ordered in the following situations:

a) When the obliged entities have not complied with the duty to communicate suspicious operations provided for in Article 43 or with the obligations of abstention or information provided for in the previous article, where they are due;

b) Based on other information that is within the DCIAP's own knowledge, within the scope of the competences it exercises in matters of prevention of criminal activities from which funds or other assets, money laundering or terrorist financing originate;

c) Upon a proposal from the Financial Information Unit based on the analysis of pre-existing suspicious operation communications.

3 - The temporary suspension decision:

a) May cover present or future operations, including those relating to the same account or to other accounts or business relationships identified from a suspicious operation communication or from other

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 43 / 122 additional information that is within the DCIAP's own knowledge, regardless of the ownership of those accounts or business relationships;

b) Must identify the elements that are the object of the measure, specifying the persons and entities covered and, depending on the case, the following elements:

i) The type of operations or occasional transactions;

ii) The accounts or other business relationships;

iii) The specific powers and distribution channels.

Article 49 Confirmation of suspension 1 - The temporary suspension decision provided for in the previous article shall expire if it is not judicially confirmed, in the context of a criminal investigation, within two business days after its issuance.

2 - It is incumbent upon the examining judge to confirm the temporary suspension decreed for a period not exceeding three months, renewable within the term of the inquiry, as well as to specify the elements provided for in subparagraph b) of paragraph 3 of the previous article.

3 - At the request of the Public Prosecutor's Office, the notification of the persons and entities covered, in the reasoned decision of the examining judge that, for the first time, confirms the temporary suspension, may be deferred for a maximum period of 30 days, if it is understood that such notification is likely to compromise the result of investigation steps to be carried out immediately.

4 - The provisions of the previous paragraph do not prejudice the right of the persons and entities covered by the decision to, at any time and after being notified of the same or its renewals, request the review and amendment of the measure, with such notifications being made to the address of the person or entity indicated by the obliged entity, if no other exists.

5 - During the term of the suspension measure, the persons and entities covered by it may, through a reasoned request, seek authorization to carry out a one-off operation within the scope of the applied measure, which is decided by the examining judge, after hearing the Public Prosecutor's Office and weighing the interests at stake.

6 - At the request of the Public Prosecutor's Office, the examining judge may order the freezing of the funds, values or assets subject to the applied suspension measure, if it is shown that they are likely derived from or related to the practice of criminal activities or the financing of terrorism and if there is a danger of them being dispersed into the legitimate economy.

7 - In all matters not specifically provided for in this article, the provisions of the criminal procedure legislation shall apply subsidiarily.

SECTION VI Other duties

Article 50. Duty to refuse 1 - Obliged entities shall refuse to initiate business relationships, carry out occasional transactions or perform other operations when they do not obtain:

a) The identifying elements and the respective supporting means provided for the identification and verification of the identity of the client, their representative and the beneficial owner, including the information to assess the status of beneficial owner and the ownership and control structure of the client; or

b) The information provided for in Article 27 on the nature, object and purpose of the business relationship.

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 44 / 122 2 - In the situations provided for in the previous paragraph, the obliged entities shall terminate the business relationship, analyse the possible reasons for not obtaining the elements, means or information and, whenever the respective conditions are met, make the communication provided for in Article 43. 3 - In addition to the situations provided for in paragraph 1, when they cannot comply with the other identification and due diligence procedures provided for in this law, including the updating procedures provided for in Article 40, the obliged entities:

a) Refuse to initiate business relationships, carry out occasional transactions or perform other operations;

b) Terminate business relationships already established, when the specifically identified risk of money laundering and terrorist financing cannot be managed otherwise;

c) Analyse the possible reasons for the impossibility of complying with such procedures and, whenever the respective conditions are met, make the communication provided for in Article 43;

d) Act, whenever possible, in coordination with the competent judicial or police authorities, consulting them beforehand, whenever they have reasons to consider that the termination of the business relationship provided for in subparagraph b) is likely to harm an investigation.

4 - Obliged entities shall record in a document or written record:

a) The conclusions supporting the analyses referred to in paragraph 2 and in subparagraph c) of the previous paragraph;

b) The conclusions justifying the decision to terminate the business relationship provided for in subparagraph b) of the previous paragraph;

c) The reference to the carrying out of consultations with the authorities referred to in subparagraph d) of the previous paragraph, indicating the respective dates and means of communication used.

5 - Obliged entities shall keep, under the terms provided for in Article 51, the documents or records referred to in the previous paragraph and make them permanently available to the sectoral authorities.

6 - The sectoral authorities shall define the terms under which the return of funds or other assets entrusted to the obliged entities at the date of termination of the business relationship referred to in paragraph 2 and subparagraph b) of paragraph 3 shall take place, whenever such return is not prevented by a judicial or other legally provided measure.

7 - The exercise of the duty to refuse or the termination of the business relationship under this article shall not give rise to any liability for the obliged entity acting in good faith.

Article 51. Duty to keep records 1 - Obliged entities shall keep, for a period of seven years after the moment when the client identification was processed or, in the case of business relationships, after their termination:

a) The copies, records or electronic data extracted from all documents that they obtain or that are made available to them by their clients or any other persons, within the scope of the identification and due diligence procedures provided for in this law;

b) The documentation forming part of the processes or files relating to clients and their accounts, including commercial correspondence sent;

c) Any documents, records and analyses, internal or external, that formalise compliance with the provisions of this law.

2 - The originals, copies, references or any other durable media, with identical probative value, of the supporting documents and records of operations are always kept, in such a way as to allow the reconstruction of operations, for a period of seven years from their execution, even if, in the case of being part of a business relationship, the latter has already ended.

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 45 / 122 3 - For the purposes of complying with the provisions of the preceding paragraphs, the elements referred to therein are:

a) Kept on durable media, with a preference for electronic media;

b) Archived under conditions that allow their proper preservation and easy location, as well as immediate access to them, whenever requested by the Unidade de Informação Financeira and by the judicial, police and sectoral authorities and by the Autoridade Tributária e Aduaneira.

4 - The provisions of this article do not prejudice nor are they prejudiced by other retention obligations that do not arise from this law, particularly in matters of evidence applicable to criminal investigations and inquiries or to pending judicial and administrative proceedings.

5 - Without prejudice to the provisions of the preceding paragraph, the information elements communicated under

article 81-A of the Regime Geral das Instituições de Crédito e Sociedades Financeiras, approved by Decreto-Lei n.º 298/92, of 31 December, are kept by financial entities, for the purposes of this law, for a period of seven years after the end of the business relationship with the account holders or, as the case may be, with the lessee of a safe deposit box not linked to an account.

Artigo 52.º Duty of examination 1 - Whenever they detect the existence of any conduct, activity or operation whose characteristic elements make it susceptible to being related to funds or other assets from terrorist financing or other criminal activities, the obliged entities examine them with special care and attention, intensifying the degree and nature of their monitoring.

2 - For the purposes of the provisions of the preceding paragraph, the following characteristic elements are considered, whenever applicable, without prejudice to others that may occur in the specific case:

a) The nature, purpose, frequency, complexity, unusualness and atypicality of the conduct, activity or operations;

b) The apparent absence of an economic objective or lawful purpose associated with the conduct, activity or operations;

c) The amounts, origin and destination of the funds moved;

d) The place of origin and destination of the operations;

e) The means of payment used;

f) The nature, activity, operating pattern, economic and financial situation and profile of the intervening parties;

g) The type of transaction, product, corporate structure or centre of collective interests without legal personality that may particularly favour anonymity.

3 - The assessment of the degree of suspicion of a conduct, activity or operation does not presuppose the existence of any type of documentation confirming the suspicion, but rather results from the assessment of the concrete circumstances, in light of the diligence criteria required of a professional, in analysing the situation.

4 - Whenever, as a result of exercising the duty of examination, the obliged entities decide not to proceed with the communication provided for in article 43, they shall record in a document or register:

a) The grounds for the decision not to communicate, including the reasons supporting the absence of concrete factors of suspicion;

b) The reference to any eventual informal contacts that, in the course of that examination, were established with the Unidade de Informação Financeira and with the judicial and police authorities, indicating the respective dates and means of communication used.

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 46 / 122 5 - The results of the duty of examination, including the documents or records referred to in the preceding paragraph, are reduced to writing, kept in accordance with the provisions of the preceding article and placed, permanently, at the disposal of the sectoral authorities.

Artigo 53.º Duty of cooperation 1 - The obliged entities shall provide, promptly and fully, the cooperation requested of them by the DCIAP and by the Unidade de Informação Financeira, as well as by the other judicial and police authorities, by the sectoral authorities and by the Autoridade Tributária e Aduaneira.

2 - In compliance with the provisions of the preceding paragraph, the obliged entities are responsible, in particular, for:

a) Responding, completely, within the established deadline and through a secure channel that guarantees the full confidentiality of the elements provided, to requests for information intended to determine whether they maintain or have maintained, in the last seven years, business relationships with a given natural or legal person or centre of collective interests without legal personality, and the nature of those relationships;

b) Making available, completely and within the established deadline, all information, clarifications, documents and elements requested of them;

c) Granting, whenever requested and within the deadline set for that purpose, remote access to that information, documents and elements;

d) Complying, under the terms and deadlines set, with any periodic communication duties established in sectoral regulations;

e) Sending, completely and within the established deadlines, any other information requested on a periodic or systematic basis, regardless of the existence of a communication duty;

f) Cooperating fully and promptly with the sectoral authorities in the exercise of their inspection activity, in particular:

i) Refraining from any illegitimate refusal or obstructive conduct;

ii) Allowing the inspection of any facilities used, even if by third parties, for the exercise of their activity and related services;

iii) Guaranteeing direct access and providing for the examination of information elements on site, regardless of their medium;

iv) Providing copies, extracts or certified copies of all requested documentation;

v) Ensuring the attendance and full cooperation of any representative or employee who must be heard by the inspection authority, whatever the nature of their employment relationship;

g) Fully comply, and within the established deadline, with the determinations, orders or instructions addressed to them under the provisions of this law;

h) Report on the state of implementation of the recommendations addressed to them under Article 98. 3 - The DCIAP or the Financial Information Unit may, in particular, require obliged entities to inform them, immediately or within another deadline that they define for this purpose, of proposed, attempted, initiated or carried out operations within the scope of previously identified accounts or other business relationships, even if such operations are subject to a suspension measure adopted under Articles 48 and 49. 4 - The provisions of the preceding paragraphs in no case presuppose the prior exercise of the duty to report referred to in Article 43, without prejudice to the request for any information

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 47 / 122 complementary to the exercise of that duty to report by the DCIAP and the Financial Information Unit, under the provisions of the preceding paragraphs.

Article 54. Duty of non-disclosure 1 - Obliged entities, as well as the members of their management bodies, those exercising management, executive or supervisory functions therein, their employees, agents and other persons providing services to them on a permanent, temporary or occasional basis, may not reveal to the client or to third parties:

a) That the legally required communications have been, are being or will be transmitted, under the provisions of Articles 43, 45, 47 and 53;

b) Any information related to those communications, regardless of whether they arise from internal analyses of the obliged entity or from requests made by judicial, police or sectoral authorities;

c) That a criminal investigation or inquiry is or may be underway, as well as any other investigations, inquiries, verifications, analyses or legal proceedings to be conducted by the authorities referred to in the preceding subparagraph;

d) Any other information or analyses, whether internal or external, whenever the following depends on it:

i) The full exercise of the functions conferred by this law on obliged entities and on judicial, police and sectoral authorities;

ii) The preservation of any investigations, inquiries, verifications, analyses or legal proceedings and, in general, the prevention, investigation and detection of money laundering and terrorist financing.

2 - The disclosure of information does not constitute a violation of the duty provided for in the preceding paragraph:

a) To sectoral authorities, within the scope of their respective legal attributions;

b) To judicial and police authorities, within the scope of criminal proceedings or any other legal competences;

c) To the Tax and Customs Authority, within the scope of tax and customs inspection procedures.

3 - The provisions of paragraph 1 do not prevent the disclosure of information and other elements provided for therein:

a) Between financial entities and between these and other entities of an equivalent nature located in a Member State, provided they belong to the same group;

b) Between financial entities and their branches and majority-owned subsidiaries located in third countries, provided those branches and subsidiaries fully comply with the provisions of paragraph 4 of Article 22;

c) Between the persons referred to in subparagraphs e) and f) of paragraph 1 of Article 4, who are established in a Member State or in a third country that imposes requirements equivalent to those established in this law and the regulations implementing it, when they carry out their professional activity, as employed or self-employed workers, within the same legal person or a broader structure to which the person belongs and which shares the same ownership, management or regulatory compliance control;

d) Between financial entities, other entities of an equivalent nature and the persons referred to in subparagraphs e) and f) of paragraph 1 of Article 4, when they exchange information among themselves concerning a common client or transaction and provided that the entities or persons concerned:

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 48 / 122

i) Are located or established in a Member State or in a third country that imposes requirements equivalent to those established in this law and the regulations implementing it;

ii) Belong to the same professional category, it being understood, for this purpose, that financial entities covered by this law and entities of an equivalent nature belong to the same professional category; and

iii) Are subject to equivalent obligations with regard to professional secrecy and the protection of personal data.

4 - The provisions of paragraph 1 do not prejudice the information-sharing obligations provided for in Article 22. 5 - Obliged entities act with the necessary prudence towards clients in connection with the execution of potentially suspicious operations, avoiding any steps that, for any reason, may give rise to suspicion that any procedures are underway aimed at investigating suspicions of practices related to money laundering or terrorist financing.

6 - Whenever, under the provisions of the preceding paragraph, obliged entities must refrain from carrying out further steps with their clients, they shall immediately exercise the duty to report provided for in Article 43, with the information available to them at the time.

Article 55 Duty to provide training 1 - The obliged entities shall adopt measures proportionate to their respective risks and to the nature and size of their activity so that their managers, employees and other collaborators whose functions are relevant for the purposes of preventing money laundering and terrorist financing have adequate knowledge of the obligations arising from this law and the regulations implementing it, including in matters of personal data protection.

2 - The obliged entities shall ensure that the persons referred to in the previous paragraph are provided with specific and regular training actions appropriate to each sector of activity, enabling them to recognise operations that may be related to money laundering and terrorist financing and to act in such cases in accordance with the provisions of this law and the regulatory rules implementing it.

3 - In the case of newly hired collaborators whose functions are directly relevant in the scope of preventing money laundering and terrorist financing, the obliged entities shall, immediately after their hiring, provide them with adequate training on the policies, procedures and controls internally defined in matters of preventing money laundering and terrorist financing.

4 - The training actions, of an internal or external nature, intended to comply with the provisions of this article are:

a) Ensured by persons or entities with recognised competence and experience in the field of preventing and combating money laundering and terrorist financing;

b) Preceded by a favourable opinion of the compliance officer designated under the terms of paragraph 1 of Article 16, where such designation has taken place.

5 - The obliged entities shall keep updated and complete records of the internal or external training actions carried out, preserving them under the terms provided for in Article 51 and making them permanently available to the sectoral authorities.

Article 56 Derogation from the duty of secrecy and protection in the provision of information

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 49 / 122 1 - The obliged entities shall make available all information, all documents and other elements necessary for the full compliance with the duties listed in Articles 43, 45, 47 and 53, even if subject to any duty of secrecy imposed by legislative, regulatory or contractual means.

2 - The provision in good faith, by the obliged entities, of the information, documents and other elements referred to in the previous paragraph does not constitute a violation of any duty of secrecy imposed by legislative, regulatory or contractual means, nor does it entail liability of any kind, even when there is a lack of knowledge of the specific criminal activity or it has not effectively occurred.

3 - The obliged entities shall refrain from any threats, retaliatory or hostile acts and, in particular, from unfavourable or discriminatory labour practices against those who, in good faith, provide the information, documents and other elements referred to in paragraph 1.

4 - The provision of the information, documents and other elements referred to in paragraph 1 cannot, by itself, serve as a basis for the obliged entity to initiate disciplinary, civil or criminal proceedings against those who provide them, except if the said provision is deliberate and manifestly unfounded.

5 - The safeguards provided for in the previous paragraphs are applicable to the collaborators of the obliged entities who internally provide the information, documents and other elements referred to in paragraph 1.

6 - The obliged entities shall ensure the confidentiality of the identity of the collaborators referred to in the previous paragraph before any third parties, namely before clients and other collaborators who do not intervene in the exercise of the duties referred to in paragraph 1.

7 - The elements provided by the entities subject to paragraph 1 may be used in criminal proceedings, in inquiries that originated from suspicious transaction reports, as well as in any other inquiries, investigations or legal proceedings conducted by judicial, police or sectoral authorities, within the scope of their respective legal attributions and to the extent that the provided elements prove relevant for evidentiary purposes.

8 - Collaborators who are subject to the circumstances and practices referred to in paragraph 3 for reporting suspicions of money laundering or terrorist financing, either internally or to the Financial Intelligence Unit, may:

a) File a complaint with the competent authorities, under the terms provided for in criminal and criminal procedure legislation;

b) Bring a civil action, under the terms provided for in civil and civil procedure legislation, without prejudice to the confidentiality of the information collected by the Financial Intelligence Unit.

SECTION VII Protection and processing of data by obliged entities

Article 57 Object and purpose 1 - The obliged entities are authorised, under the terms provided for in this section, to carry out the processing of personal data necessary for the compliance with the preventive duties provided for in this law.

2 - The processing of personal data carried out by the obliged entities under the previous paragraph has as its exclusive purpose the prevention of money laundering and terrorist financing, and such data may not subsequently be processed, on the basis of this law, for any other purposes, including commercial purposes.

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 50 / 122 3 - The prevention and combating of money laundering and terrorist financing are expressly recognised as an area of protection of an important public interest, including with regard to the processing of personal data carried out on the basis of this law.

4 - The provisions of paragraph 2 do not affect the processing of the personal data referred to therein on the basis of other legal provisions, namely those set out in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, and other data protection legislation.

Article 58 Categories of personal data 1 - In order to comply with the provisions of this law, obliged entities are authorised to process the following categories of personal data:

a) Identification and contact data, as well as tax and professional data and the qualifications of the respective data subject, including the following elements:

i) Elements provided for in Article 24;

ii) Elements characterising the activities pursued;

iii) Elements relating to political or public offices that are or have been held;

iv) Elements relating to kinship and affinity relationships, as well as relevant corporate, commercial, professional or social relationships;

b) Financial and banking data, including those relating to:

i) The credit and solvency of the respective data subjects;

ii) The income or other assets related to the data subjects;

c) Information on the purpose and nature of the business relationship;

d) Information on the origin and destination of funds or other assets moved within the scope of a business relationship or the carrying out of an occasional transaction;

e) Information on the other elements characterising all operations carried out in the course of a business relationship or in the context of an occasional transaction;

f) Information on suspicions of criminal offences, the commission of administrative offences or other unlawful activities, including the following:

i) Information on reports of suspicious transactions made by the obliged entity itself or by other reporting entities;

ii) Information on other reports made to the competent authorities;

iii) Information provided by the competent authorities;

g) Information on decisions applying penalties, security measures, fines, ancillary sanctions or other sanctions for the commission of the acts referred to in the previous subparagraph.

2 - Obliged entities may also process any evidentiary means necessary for the verification of the data provided for in the previous paragraph.

3 - In addition to the data provided for in paragraph 1, obliged entities shall process the other personal data on which compliance with the preventive duties provided for in this law depends, and must, for this purpose, activate the appropriate procedures in accordance with the provisions of Regulation

(EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, and other data protection legislation.

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 51 / 122

Article 59 Data controllers 1 - Obliged entities are controllers of the personal data processing that they carry out under this law, and it is incumbent upon them to adopt the physical and logical security measures necessary to ensure the effective protection of the information and personal data processed, in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, and other data protection legislation.

2 - Obliged entities shall provide new customers with the information required under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, and other data protection legislation, including, in particular, a general notice on the legal obligations of obliged entities regarding the processing of personal data for the purposes of preventing money laundering and terrorist financing.

3 - Obliged entities, as controllers of the personal data processing that they carry out under this law, shall ensure the erasure of such data as soon as the retention periods referred to in Article 51 have elapsed, without prejudice to the provisions of paragraph 4 of that article and where the contrary does not result from other legal provisions.

Article 60 Right of access and rectification 1 - The rights of access and rectification conferred by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, and its implementing measures shall be exercised by the data subject through the Comissão Nacional de Proteção de Dados.

2 - The right of access to personal data by the respective data subject shall be denied in the situations provided for in paragraph 1 of Article 54 of this law.

3 - The provisions of the previous paragraph do not affect:

a) The right of the data subject to lodge a complaint or claim with the Comissão Nacional de Proteção de Dados, nor the recourse to the means of redress conferred in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, and other data protection legislation;

b) The verification by the Comissão Nacional de Proteção de Dados, on its own initiative or at the request of the data subject, of the lawfulness of the data processing, as well as the information to that data subject that all necessary verifications have been carried out and that the data processing in question is lawful or unlawful.

Article 61 Communication, transmission and interconnection of data 1 - The recognition provided for in paragraph 3 of Article 57 is, in particular, applicable for the purposes provided for in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, and other data protection legislation.

2 - Personal data processed on the basis of this law may be communicated or transferred:

a) To the DCIAP, the Financial Information Unit, the Tax and Customs Authority and the other judicial, police and sectoral authorities, under the terms provided for in this law;

b) To the persons or entities that, under the terms of paragraph 3 of Article 54, may appear as recipients of such data, even if located or established in third countries;

c) To the entities that are part of the same group, for the purposes provided for in Article 22, even if located or established in third countries.

3 - With regard to personal data processed on the basis of this law, the obliged entities may also establish data interconnection mechanisms with any of the authorities,

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 52 / 122 persons or entities to whom, under the provisions of the previous paragraph, they may communicate or transfer the same.

CHAPTER V Specific duties of financial entities

SECTION I General provisions

Article 62 Duties of financial entities Financial entities are subject to the general duties provided for in Chapter IV, with the specifications provided for in this chapter and in the sectoral regulatory rules issued under the terms of this law and the legislation governing their respective activity.

Article 62-A Branches and subsidiaries in third countries 1 - In compliance with the provisions of paragraph 4 of Article 22 of this law, financial entities also ensure the adoption of the procedures provided for in Article 2 of Commission Delegated Regulation

(EU) 2019/758 of 31 January 2019, supplementing Directive (EU) 2015/849 of the European Parliament and of the Council as regards regulatory technical standards for the minimum measures and the type of additional measures that credit and financial institutions must take to mitigate the risk of money laundering and terrorist financing in certain third countries.

2 - In compliance with the provisions of paragraph 7 of Article 22 of this law, financial entities ensure that the additional measures to be adopted and the communications to be addressed to the sectoral authorities observe the provisions of Articles 3 to 8 of Commission Delegated Regulation (EU) 2019/758 of 31 January 2019, without prejudice to the adoption of other supplementary measures appropriate to the specific risks identified and to the provisions of sectoral regulations.

Article 63 Own operations 1 - Financial entities also comply, under the terms and to the extent to be defined by sectoral regulations, with the preventive duties provided for in this law in relation to operations, and their respective counterparties, that they carry out:

a) On their own account;

b) On behalf of third parties that do not have the status of client.

2 - Included in the provisions of the previous paragraph are any operations, on their own account or not, between the financial entity and any other entities that are part of the same group, outside the scope of a client relationship.

Article 64 Prohibition of anonymity 1 - The opening, maintenance or existence of anonymous passbooks, safes or accounts, of any nature whatsoever, as well as the use of fictitious denominations or names, is prohibited.

2 - The issuance, use or acceptance of payments in anonymous electronic currency, including through the use of anonymous prepaid instruments, is likewise prohibited, except to the extent that sectoral regulation provides otherwise.

Article 65.º Time of identity verification

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 53 / 122 In the case of opening an account, financial entities may not, in the exercise of the powers conferred by paragraph 3 of Article 26.º and paragraph 5 of Article 32.º, allow the client or a person acting on the client's behalf to carry out transactions, make payment instruments available on the account or make changes to its ownership, until the identity of the client and the beneficial owner has been verified in accordance with the applicable legal or regulatory provisions.

Article 66.º Shell banks 1 - Financial entities are prohibited from establishing or maintaining correspondent relationships with shell banks.

2 - Financial entities shall also endeavor not to establish or maintain correspondent relationships with other financial entities that knowingly allow their accounts to be used by shell banks.

3 - As soon as they become aware that they maintain a correspondent relationship with shell banks or with other financial entities that knowingly allow their accounts to be used by shell banks, financial entities shall terminate such relationship and immediately inform the respective sectoral authority.

SECTION II Integrated System of Mutual Agricultural Credit

Article 67.º Compliance with preventive duties 1 - By virtue of the functions conferred on the Central Fund of Mutual Agricultural Credit by the provisions of Article 65.º of the Legal Regime for Mutual Agricultural Credit and Mutual Agricultural Credit Cooperatives, approved by Decree-Law No. 24/91, of 11 January, amended and republished by Decree-Law No. 142/2009, of 16 June:

a) The set of policies, procedures and controls of the mutual agricultural credit funds (CCAM)

that are part of the Integrated System of Mutual Agricultural Credit (SICAM), in matters of the prevention of money laundering and terrorist financing, must be designed and organized in coordination with the Central Fund of Mutual Agricultural Credit (Central Fund);

b) Compliance with the preventive duties provided for in this Law by the CCAM that are part of the SICAM may be ensured, in whole or in part, by the Central Fund, under the terms to be established in sectoral regulation.

2 - The CCAM that are part of the SICAM shall provide the Central Fund with all the elements necessary to comply with the provisions of the preceding paragraph, even if subject to a duty of confidentiality.

3 - In situations where, pursuant to the provisions of item b) of paragraph 1, the Central Fund ensures, on behalf of the CCAM that are part of the SICAM, the exercise of the preventive duties provided for in this Law, the Central Fund shall be liable for any non-compliance with those duties, either exclusively or jointly with the CCAM, depending on the allocation of the exercise of the duties determined in sectoral regulation.

SECTION III Specific duty of identification and diligence SUBSECTION I Life insurance contracts

Article 68.º Supplementary standard measures

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 54 / 122 1 - In addition to the other standard identification and diligence procedures provided for in this Law, financial entities, with regard to beneficiaries of life insurance contracts, as soon as they are identified or designated:

a) Collect the name or designation of the beneficiaries, when expressly identified as natural or legal persons or as centers of collective interests without legal personality;

b) Obtain sufficient information about the beneficiaries, when designated by characteristics, categories or other means, in order to ensure the conditions necessary for establishing their identity at the time of payment of the benefit.

2 - Verification of the identity of beneficiaries falling within the situations provided for in items

a) and b) of the preceding paragraph shall be carried out up to the time of payment of the benefit.

3 - In the event of a total or partial assignment to third parties of a life insurance contract, the obliged entities that become aware of it shall identify and verify the identity of the beneficial owners, under the terms provided for in Articles 29.º to 34.º, at the time the contract is assigned to the assignee who receives, for its own benefit, the value of the assigned contract.

Article 69.º Enhanced measures In the course of their activity relating to life insurance contracts, financial entities, in addition to the provisions of the preceding Article and the other standard identification and diligence procedures provided for in this Law:

a) Consider the beneficiary of such contracts as a risk factor to be taken into account in the analysis of money laundering or terrorist financing risks that should lead to the adoption of enhanced measures within the scope of the duty of identification and diligence;

b) Whenever they detect an increased risk of money laundering or terrorist financing associated with a beneficiary of such contracts who is a legal person or a center of collective interests without legal personality, they shall necessarily apply those enhanced measures, including the adoption of reasonable measures to, up to the time of payment of the benefit, know and verify the identity of the beneficial owner of the beneficiary of such insurance, under the terms set out in Articles 29.º to 34.º, with the necessary adaptations;

c) Adopt, up to the time of payment of the benefit or of the total or partial assignment of the contracts, reasonable measures to determine whether the beneficiaries of such contracts and, where applicable, the beneficial owners of those beneficiaries have the status of politically exposed persons, based on the procedures or systems provided for in Article 19;

d) In cases where, upon verification of that status, higher risks are identified:

i) Inform senior management before making the payment of the contract capital;

ii) Carry out enhanced scrutiny of the entire business relationship with the policyholder, with particular regard to identifying any transactions that must be reported under the terms provided for in Article 43. SECTION II Correspondent Relations

Article 70. Enhanced measures incumbent on the correspondent 1 - Without prejudice to other measures determined in sectoral regulation, financial entities, when acting as correspondents within the framework of cross-border correspondent relations with respondents from third countries:

Directorate of Communication Services and Taxpayer Support DocBaseV/2017 55 / 122

a) Carry out the normal identification and due diligence procedures provided for in this law, including the identification, assessment and review of the risks of money laundering and terrorist financing specifically associated with the correspondent relationship;

b) Collect sufficient information about the respondent in order to:

i) Understand the nature of its activity and the risks of money laundering and terrorist financing associated with it;

ii) Assess, based on public domain information, its reputation and the quality of its supervision, including any background related to investigative or sanctioning proceedings in the field of money laundering or terrorist financing;

c) Critically assess the policies and internal controls defined and adopted by the respondent with a view to preventing money laundering and terrorist financing;

d) Obtain the approval of senior management before establishing new correspondent relations;

e) Set out in a written document the responsibilities of the parties involved in the correspondent relationship.

f) In the context of the provision of payable-through accounts, ensure that respondents:

i) Verify the identity of the clientele that has direct access to the accounts;

ii) Maintain continuous monitoring of the business relationships established;

iii) Whenever requested, be able to provide information regarding compliance with the identification and due diligence duty.

2 - The establishment of correspondent relations is always subject to a prior opinion setting out all the due diligence carried out under paragraphs a) to c) of the preceding number, to be issued by the person designated under paragraph 1 of Article 16 or, where no such designation is made, by a member of senior management with sufficient knowledge of the risks of money laundering and terrorist financing associated with the specific correspondent relationship.

3 - The information collected under the provisions of paragraphs a) to c) of paragraph 1 shall be updated according to the degree of risk associated with the established banking correspondent relationships, and the provisions of Article 40 shall apply, with the necessary adaptations. 4 - Without prejudice to existing obligations in the context of compliance with financial sanctions arising from resolutions of the United Nations Security Council or European Union regulations, as well as other additional countermeasures, financial entities acting as correspondents shall monitor permanently and in an enhanced manner the operations carried out within the scope of a correspondent relationship, in terms that allow assessing:

a) The consistency of those operations with the identified risks and with the purpose and nature of the services contracted within the scope of the correspondent relationship;

b) The existence of any operations that should be reported under the terms set out in

Article 43. 5 - When, in compliance with the provisions of the previous number, they detect the existence of elements that should trigger the exercise of the duty of examination provided for in Article 52, financial entities acting as correspondents:

a) Request from the respondent all additional information relevant to the exercise of that duty;

b) Apply, in the event of total or partial non-provision of information by the respondent, the measures provided for in Article 50, without prejudice to, where termination of the correspondent relationship is not required,

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 56 / 122 adopting other measures appropriate to manage the specific risk identified, including, if necessary, limiting the operations carried out or the products offered within the scope of the correspondent relationship.

6 - The provisions of this article apply to other cross-border correspondent relationships, whenever an increased risk of money laundering or terrorist financing is identified by the financial entities acting as correspondents or by their respective sectoral authorities.

Article 71. Enhanced measures incumbent on the respondent 1 - In the context of executing transfers of funds that they identify as being of high risk, financial entities acting as respondents in the context of any cross-border correspondent relationships must, under the terms to be defined by sectoral regulation:

a) Know the entire chain of funds entrusted to their correspondents, from the moment they are delivered to them by the originators of the operations until the moment they are made available, in the destination country or jurisdiction, to the respective final beneficiaries;

b) Know all parties involved in that chain, ensuring that only entities or persons duly authorized to process transfers of funds by the competent authorities of the countries or jurisdictions involved participate in it, on any basis;

c) Obtain and keep permanently updated documentation attesting compliance with the provisions of the previous paragraphs, which must be made permanently available to the sectoral authorities.

2 - Sectoral authorities, based on a specific risk analysis, may define by sectoral regulation:

a) Typologies of high-risk operations that must comply with the provisions of the previous number;

b) Additional obligations for financial entities acting as respondents within the framework of a correspondent relationship.

SECTION IV Activity in Portugal of financial entities headquartered abroad

Article 72. Agents and distributors of payment institutions and electronic money institutions 1 - The preventive duties for money laundering and terrorist financing provided for in this law are fully complied with by natural and legal persons acting in Portugal as agents or distributors of payment institutions or electronic money institutions headquartered in another Member State of the European Union.

2 - The payment institutions or electronic money institutions referred to in the previous number are responsible for:

a) Ensuring full compliance with the provisions of the previous number by their agents and distributors, under the terms to be defined by regulation to be issued by Banco de Portugal;

b) Carrying out the necessary due diligence to verify the suitability and good commercial and financial reputation of agents and distributors;

c) Providing agents and distributors with specific training in the field of prevention of money laundering and terrorist financing, under the terms to be defined by regulation to be issued by Banco de Portugal;

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 57 / 122

d) Appointing a central contact point in national territory and ensuring the exercise of its functions, under the terms provided for in the following numbers;

e) Maintaining an updated list of their agents and distributors in national territory, which must be immediately made available to Banco de Portugal and to judicial and police authorities, whenever requested.

3 - The payment institutions and electronic money institutions referred to in paragraph 1 shall immediately appoint the central contact point referred to in paragraph d) of the previous number, whenever any of the following circumstances occurs:

a) Fulfilment of the quantitative criteria set out in points (a) or (b) of paragraph 1 of Article 3 of Commission Delegated Regulation (EU) 2018/1108 of 7 May 2018 supplementing Directive (EU) 2015/849 of the European Parliament and of the Council with regulatory technical standards on the criteria for the appointment of central contact points for electronic money issuers and payment service providers and with rules on their functions;

b) Banco de Portugal notifies the institution that it does not have information to determine whether the criteria referred to in the previous point are fulfilled, under the terms and for the purposes set out in point

c) of paragraph 1 of Article 3 of Delegated Regulation (EU) 2018/1108;

c) Banco de Portugal, following a prior risk assessment concluding that any of the situations set out in paragraphs 2 to 4 of Article 3 of Delegated Regulation (EU) 2018/1108 is fulfilled, notifies the institution or group of institutions of the need to appoint a central contact point, irrespective of whether the criteria referred to in the previous points are met.

4 - The payment institutions and electronic money institutions referred to in paragraph 1 shall notify Banco de Portugal of the full identification, address and contact details of the central contact point within 30 days of the verification of the obligation to appoint provided for in the previous paragraph.

5 - Payment institutions and electronic money institutions required to appoint a central contact point on the basis of fulfilment of the criteria set out in point (a) of paragraph 3 shall inform Banco de Portugal of the cessation of such fulfilment, and Banco de Portugal may object, within 30 days, to the dismissal of the central contact point if it considers that the criteria underlying its appointment continue to be fulfilled or concludes that the situations specified in points (b) or (c) of the same paragraph are met.

6 - Central contact points shall, from their appointment, perform the mandatory functions specified in Articles 4 and 5 of Delegated Regulation (EU) 2018/1108, with a view to:

a) Ensuring compliance, on behalf of the institution making the appointment, with the applicable rules on the prevention of money laundering and terrorist financing, in particular as regards compliance with the control and training duties by establishments, other than a branch, operating in national territory;

b) Facilitating the exercise of supervision by Banco de Portugal, in particular by ensuring compliance with the duty of cooperation in relation to the activity of such establishments.

7 - Banco de Portugal may also, following a prior risk assessment, determine that central contact points perform one or more additional functions specified in Article 6 of Delegated Regulation (EU) 2018/1108, including the performance of the reporting duty provided for in

Article 43 on behalf of establishments, other than a branch, operating in national territory.

8 - Banco de Portugal shall notify payment institutions and electronic money institutions that appoint a central contact point of any functional extension under the previous paragraph, setting in the notification the deadline from which the additional functions are performed.

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 58 / 122 9 - Banco de Portugal acts as competent authority under Delegated Regulation

(EU) 2018/1108, exercising for that purpose the powers conferred on it by this law.

10 - In the risk assessments referred to in point (c) of paragraph 3 and paragraph 7, Banco de Portugal shall consider at least the aspects referred to in Delegated Regulation (EU) 2018/1108, including the reports of the national risk assessment and respective updates, as well as the elements referred to in paragraph 4 of

Article 8 of this law.

11 - Banco de Portugal shall define, through regulation, other requirements not provided for in Delegated Regulation (EU) 2018/1108 and its implementing measures, and which are relevant to the pursuit of the objectives underlying the appointment of a central contact point.

Article 73 Free provision of services 1 - In order to clearly understand the money laundering and terrorist financing risks existing in their sector, the sectoral authorities:

a) Cooperate and exchange information with the competent authorities of the European Union Member State where financial entities authorised to operate in Portugal under the free provision of services regime have their head office;

b) May request from those financial entities information related to the performance of their activity in national territory, namely on:

i) The volume and amounts of transactions carried out in Portugal;

ii) The jurisdictions of origin or destination of transactions carried out in Portugal;

iii) The products and services made available in Portugal, as well as their respective distribution channels.

2 - When, in view of the information provided or the absence or clear insufficiency of the elements supplied under the previous paragraph, the sectoral authorities detect relevant money laundering or terrorist financing risks, they may subject the financial entities authorised to operate in Portugal under the free provision of services regime to compliance with the preventive duties provided for in this law, under the terms and to the extent to be defined, as the case may be, by sectoral regulation or decision of the competent sectoral authority.

3 - The sectoral authorities shall communicate the measures adopted under the previous paragraph to the competent authorities of the European Union Member State where the financial entities referred to in that paragraph have their head office.

CHAPTER VI Specific duties of non-financial entities

SECTION I General provisions

Article 74 Duties of non-financial entities Non-financial entities are subject to the general duties provided for in Chapter IV, with the specifications provided for in this chapter and in the sectoral regulatory standards issued under the terms of this law and the legislation regulating their respective activity.

Article 75 Specific training duty If the obliged non-financial entity is a natural person who carries out their professional activity as an employee of a legal person, the training duty provided for in Article 55 falls on the legal person.

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 59 / 122

SECTION II Specific provisions SUBSECTION I Games

Article 76 Casinos and bingo halls 1 - The concessionaires for the operation of games in casinos, referred to in paragraph (a) of no. 1 of Article 4, identify and verify the identity of patrons and, where applicable, their beneficial owners, at the time the patrons enter the gaming room or when they purchase or exchange gaming chips or conventional symbols usable for playing.

2 - The provisions of the previous paragraph do not exempt casino gaming concessionaires from complying with the other procedures provided for in Section III of Chapter IV, and they must be aware of the operations carried out by the patron in the gaming room and, based on them, define the nature and extent of those procedures.

3 - Casino gaming concessionaires are also subject to the following specific duties:

a) To issue, in gaming rooms, their own cheques in exchange for chips or conventional symbols only to the order of identified patrons who have acquired them by bank card or unused cheque and in an amount not exceeding the sum of those acquisitions;

b) To issue, in gaming and automatic machine rooms, their own cheques for payment of prizes only to the order of previously identified prize-winning patrons and resulting from the combinations of the machines' payout plan or accumulated prize systems.

4 - The cheques referred to in the previous paragraph are mandatorily made out to a named payee and crossed, with a clause prohibiting endorsement.

5 - The concessionaires for the operation of bingo halls referred to in paragraph (a) of no. 1 of Article 4 identify and verify the identity of players and, where applicable, their beneficial owners, at least at one of the following times:

a) At the time players enter the gaming room;

b) At the time of purchasing the gaming cards;

c) At the time of delivery of the prize.

6 - The provisions of no. 2 also apply to concessionaires for the operation of bingo halls, in relation to operations carried out by the player in the gaming room.

7 - Without prejudice to the other regulatory powers conferred by this law, the Gaming Regulation and Inspection Service of Turismo de Portugal, I. P., may approve or have approved specific regulations aimed at implementing the obligations provided for in this article, particularly with regard to determining the time of identification and verification of the identity of the patron or player.

Article 77 Games and betting provided for in the Legal Regime of Online Gaming The entities referred to in paragraph (c) of no. 1 of Article 4 verify the identity of players under the terms provided for in the RJO and its regulations.

Article 78 Betting and lotteries

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 60 / 122 1 - The entities paying prizes for betting and lotteries, referred to in paragraph (b) of no. 1 of

Article 4, comply with the identification and due diligence duty provided for in Section III of Chapter IV, in relation to the beneficiaries of betting or lottery prizes, when they make payments of prizes in an amount equal to or greater than €2000, regardless of whether the transaction is carried out through a single operation or several apparently related operations.

2 - For the purposes of the provisions of the previous paragraph, all prize payment operations that are based on the same gaming title are considered related to each other.

3 - The mediators of State social games may carry out the identification and due diligence procedures in relation to the beneficiaries of betting and lottery prizes in an amount less than €5000.

4 - The identification of the beneficiaries of betting or lottery prizes in an amount equal to or greater than €2000 is carried out by collecting and recording the full name, date of birth, type, number, date of validity and issuing entity of the identification document and tax identification number or, where none exists, an equivalent number issued by a competent foreign authority.

SUBSECTION II Legal professions

Article 79 Information relating to suspicious operations 1 - Whenever they act in the course of assessing a client's legal situation, within the scope of legal consultation or in the exercise of the defence or representation of that client in judicial proceedings or in relation to judicial proceedings, even when it concerns advice provided on how to institute or avoid such proceedings, regardless of whether this information is received or obtained before, during or after the proceedings, lawyers and solicitors are not obliged:

a) To carry out the communications provided for in Article 43 and in nos. 2 and 3 of Article 47;

b) To satisfy, within the scope of the duty of cooperation provided for in Article 53, requests related to those communications or to the facts that could have given rise to them.

2 - Outside the situations provided for in the previous paragraph, lawyers and solicitors:

a) Within the scope of the communications provided for in Article 43 and in paragraphs 2 and 3 of Article 47, they transmit the respective information to the president of their professional association, and the latter shall transmit the same, promptly and without filtering, to the DCIAP and the Financial Intelligence Unit;

b) Within the scope of the duty of cooperation provided for in Article 53, they communicate, within the established deadline, the information requested:

i) To the president of their professional association, when the requests are related to the communications referred to in the previous subparagraph, and that association shall transmit the information to the requesting entity, promptly and without filtering.

ii) Directly to the requesting entity, in all other cases.

3 - The obligations to communicate or provide information, promptly and without filtering, referred to in the previous paragraphs, do not preclude the verification, by the respective professional association, that the communications to be made or the information to be provided fall outside the situations provided for in paragraph 1 and fall within the operations set out in paragraph 2 of Article 4. SUBSECTION III Deterrence of the practice of illegal activity

Article 80 Deterrence of the practice of illegal activity

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 61 / 122 The attempt, by the persons referred to in subparagraphs e) and f) of paragraph 1 of Article 4, to dissuade a client from carrying out an act or an illegal activity does not constitute disclosure of information prohibited under paragraph 1 of Article 54

CHAPTER VII Competent authorities

SECTION I Competent authorities SUBSECTION I Judicial and police authorities

Article 81 Judicial and police authorities 1 - The criminal investigation judge and the Public Prosecution Service exercise the powers and benefit from the other prerogatives conferred by the specific provisions of this law.

2 - Without prejudice to the provisions of the previous paragraph, the DCIAP carries out prevention actions related to criminal activities from which funds or other assets are derived, to money laundering or to the financing of terrorism, within the scope of which it exercises the powers specifically conferred on it by this law.

3 - In carrying out the prevention actions referred to in the previous paragraph, the DCIAP has the powers conferred by the provisions of this law and of paragraph 3 of Article 1 of Law No. 36/94, of 29 September, amended by Laws No. 90/99, of 10 July, 101/2001, of 25 August, 5/2002, of 11 January, and 32/2010, of 2 September, with the necessary adaptations and may request, under the terms provided for in paragraph 4 of Article 95, any elements or information it considers relevant for the exercise of the functions conferred on it in this context.

4 - With a view to achieving the purposes of preventing money laundering and the financing of terrorism, the DCIAP has direct access, by means of an order, to all financial, tax, administrative, judicial and police information necessary for the preventive investigation procedures underlying money laundering and the financing of terrorism.

5 - The police authorities, in the exercise of their respective powers, benefit from the prerogatives conferred by this law, in particular the duty of cooperation provided for in Article 53 SUBSECTION II Financial Intelligence Unit

Article 82 Powers 1 - The Financial Intelligence Unit shall:

a) Receive, centralise, process and analyse the reports of suspicious operations made in the exercise of the duty of communication provided for in Article 43, as well as other systematic communications referred to in Article 45;

b) Collect, centralise, process and analyse information from other sources relating to the prevention and investigation of criminal activities from which funds or other assets are derived, of money laundering or of the financing of terrorism;

c) Disseminate, at national level, information related to the analyses carried out and their respective results, as well as any other relevant information;

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 62 / 122

d) Cooperate, at national level, with the other authorities that pursue functions relevant to the prevention and combating of money laundering and the financing of terrorism, under the terms provided for in this law;

e) Cooperate, at international level, with counterpart units, under the terms provided for in this law and in the applicable international cooperation instruments;

f) Exercise any other powers conferred by this law or by other legal provisions.

2 - In the exercise of its analysis powers, the Financial Intelligence Unit:

a) Carries out operational analyses focused on specific cases, activities or operations, on specific targets, or on other information appropriately selected, in accordance with the type and volume of the elements obtained and the expected usefulness of the information after its dissemination;

b) Carries out strategic analyses of trends, patterns and threats in the field of money laundering and the financing of terrorism.

3 - The Financial Intelligence Unit may request, under the terms provided for in paragraph 4 of Article 95, any elements or information it considers relevant for the exercise of the functions conferred on it by this law.

Article 83 Operational independence and autonomy 1 - The Financial Intelligence Unit has operational independence and autonomy and must be equipped with sufficient financial, human and technical resources for the full and independent performance of its functions.

2 - The Financial Intelligence Unit exercises its functions freely and with safeguarding against any political, administrative or private sector influence or interference likely to compromise its operational independence and autonomy.

3 - The Financial Intelligence Unit decides, in particular, autonomously on:

a) The analysis, request, transmission and dissemination of relevant information;

b) The conclusion of cooperation agreements and the exchange of information with other competent national authorities or with foreign counterpart units.

SUBSECTION III Sectoral authorities DIVISION I Financial sector

Article 84.º Supervisory authorities 1 - Without prejudice to the provisions of Article 91.º, the verification of compliance, by financial entities, with the duties and obligations provided for in this law and in the respective sectoral regulations shall be the responsibility, throughout the national territory, of:

a) The Insurance and Pension Funds Supervisory Authority, under the terms provided for in the following article;

b) Banco de Portugal and the CMVM, under the terms provided for in Articles 86.º to 88.º;

c) The General Inspectorate of Finance, in relation to the Treasury and Public Debt Management Agency - IGCP, E. P. E.

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 63 / 122 2 - The attributions of Banco de Portugal in matters of preventive supervision of money laundering and terrorist financing under this law shall not be prejudiced by the provisions of Council Regulation (EU) No. 1024/2013 of 15 October 2013, which confers specific tasks on the European Central Bank with regard to policies relating to the prudential supervision of credit institutions.

Article 85.º Exclusive competences of the Insurance and Pension Funds Supervisory Authority 1 - For the purposes of this law, the Insurance and Pension Funds Supervisory Authority shall be responsible for the supervision of the following financial entities:

a) Pension fund management companies;

b) Insurance undertakings, insurance intermediaries and ancillary insurance intermediaries, which carry out activities within the scope of the Life branch;

c) Branches located in Portuguese territory of the financial entities referred to in the preceding subparagraphs, or of other entities of an equivalent nature, which have their head office abroad;

d) Entities referred to in subparagraphs a) and b), or other entities of an equivalent nature, which operate in Portugal under the free provision of services regime, only under the terms provided for in Article 73.º 2 - The supervision of insurance distribution is an exclusive competence of the Insurance and Pension Funds Supervisory Authority, even if the insurance intermediary or ancillary insurance intermediary carries out other activities subject to the supervision or oversight of other authorities, under the terms of this law.

Article 86.º Exclusive competences of Banco de Portugal For the purposes of this law, Banco de Portugal shall be responsible for the supervision of the following financial entities:

a) Mortgage credit institutions;

b) Financial companies, with the exception of credit financial companies and investment companies regulated by Decree-Law No. 260/94 of 22 October, and the financial companies referred to in the following article;

c) Payment institutions with their head office in Portugal;

d) Electronic money institutions with their head office in Portugal;

e) Branches located in Portuguese territory of the financial entities referred to in the preceding subparagraphs, or of other entities of an equivalent nature, which have their head office abroad;

f) Payment institutions with their head office in another Member State of the European Union, when they operate in national territory through agents;

g) Electronic money institutions with their head office in another Member State of the European Union, when they operate in national territory through agents or distributors;

h) The entities referred to in points (a) to (d), or other entities of an equivalent nature, that operate in Portugal under the freedom to provide services regime, solely on the terms provided for in Article 73.º;

i) Entities that provide postal services, with regard to the financial products they make available on their own account.

Article 87.º Exclusive competences of the CMVM

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 64 / 122 For the purposes of this law, the CMVM is responsible for the supervision of the following financial entities:

a) Investment firms;

b) Management companies of collective investment undertakings and management companies of credit securitisation funds;

c) Self-managed collective investment societies;

d) Venture capital companies, venture capital investors, social entrepreneurship companies, venture capital fund management companies, self-managed venture capital investment companies and self-managed specialised alternative investment companies.

e) Credit securitisation companies;

f) Companies that market, to the public, contracts relating to investment in tangible assets;

g) Securities investment advisers;

h) Branches located in Portuguese territory of the financial entities referred to in the preceding points, or of other entities of an equivalent nature, that have their head office abroad;

i) The entities referred to in points (a) to (g), or other entities of an equivalent nature, that operate in Portugal under the freedom to provide services regime, solely on the terms provided for in Article 73.º;

j) Securities investment companies for the promotion of the economy;

k) Qualified venture capital fund managers;

l) Qualified social entrepreneurship fund managers;

m) Self-managed long-term European Union investment funds designated 'ELTIF';

n) Real Estate Investment and Management Companies in Portugal.

Article 88.º Shared competences between the Banco de Portugal and the CMVM The Banco de Portugal and the CMVM, within the scope of their respective attributions, are responsible for the supervision of financial entities for which they do not exercise exclusive competences under the provisions of the preceding articles, in particular the following entities:

a) Credit institutions that are not mortgage credit institutions;

b) Financial credit companies;

c) Investment companies regulated by Decree-Law n.º 260/94, of 22 October.

DIVISION II Non-financial sector

Article 89.º Competent entities 1 - Without prejudice to the provisions of Article 91.º, the verification of compliance by non-financial entities with the duties and obligations provided for in this law and in the respective regulatory instruments is the responsibility, throughout the national territory:

a) Of the Games Regulation and Inspection Service of Turismo de Portugal, I. P., with regard to the entities referred to in points (a) and (c) of paragraph 1 of Article 4.º;

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 65 / 122

b) Of the Inspectorate-General of the Ministry of Labour, Solidarity and Social Security, with regard to the entities referred to in point (b) of paragraph 1 of Article 4.º;

c) Of IMPIC, I. P., with regard to the entities referred to in point (d) of paragraph 1 of Article 4.º;

d) Of the CMVM, which exercises final supervision of compliance with the duties and obligations provided for in this law and in the respective regulatory instruments, with regard to auditors over whom the Order of Statutory Auditors also has attributions;

e) Of the Order of Certified Accountants, with regard to certified accountants;

f) Of the Bar Association, with regard to lawyers;

g) Of the Order of Solicitors and Enforcement Agents, with regard to solicitors;

h) Of the member of the Government responsible for the area of justice, assisted by the Institute of Registers and Notariado, I. P., in coordination with the Order of Notaries, with regard to notaries;

i) Of ASAE, with regard to the other persons or entities that, being covered by paragraph 1 of Article 4.º, are not subject to the supervision or inspection of another authority referred to in this

article;

j) Of the Banco de Portugal, with regard to the entities referred to in point (o) of paragraph 1 of Article 4.º 2 - The CMVM and the Order of Statutory Auditors incorporate the verification of compliance by auditors with the duties and obligations provided for in this law and in the respective regulatory instruments, in the supervision activities they carry out under the Legal Regime for Audit Supervision, approved by Law n.º 148/2015, of 9 September, and the Statute of the Order of Statutory Auditors, approved by Law n.º 140/2015, of 7 September.

3 - For the purposes of this law, it is the exclusive competence of the CMVM:

a) To supervise auditors of public interest entities, as such qualified in Article 3.º of the Legal Regime for Audit Supervision;

b) To investigate and decide on administrative offence proceedings relating to any auditors, including the application of sanctions of an administrative offence nature.

Article 90.º Professional orders 1 - Without prejudice to the provisions of the preceding article regarding the supervision of auditors, it is the responsibility of the professional orders to verify and adopt the measures necessary to ensure compliance by their respective members with the duties and obligations provided for in this law and in the respective regulatory instruments.

2 - Subject to the specificities of the sanctioning regime provided for in this law, the professional orders are equated to the sectoral authorities for the purposes provided for in this law, in particular with regard to the powers conferred on them and the need to equip themselves with adequate financial, human and technical resources for the performance of such functions.

3 - Without prejudice to the other duties provided for in this law, the professional orders:

a) Create, within their organizational structure, units specifically dedicated to ensuring compliance with this law and the implementing regulations;

b) Prepare and keep updated statistical data relating to the professions they regulate, in order to enable the identification, assessment and mitigation of the risks of money laundering and terrorist financing existing in the context of the same;

c) Ensure that the training actions necessary to guarantee compliance, by their respective members, with the duty provided for in Article 55.º are provided

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 66 / 122 4 - The professional orders draw up a detailed annual report of the activities carried out to ensure compliance with the obligations incumbent on them under this law, sending it, by 31 March of the following year, to the member of the Government who exercises the respective supervisory powers in accordance with Article 45.º of Law n.º 2/2013, of 10 January.

5 - In the annual report referred to in the preceding number, the following must be considered, in particular:

a) The sanctions applied for non-compliance with the obligations arising from this law;

b) The number of communications of irregularities received under item a) of Article 185.º;

c) The number of communications of suspicious transactions received;

d) The number of communications of suspicious transactions transmitted to the Financial Intelligence Unit;

e) Number and description of the measures undertaken to verify compliance, by the obliged entities, with the obligations incumbent on them under Articles 74.º and 79.º 6 - In the exercise of their supervisory functions, the members of the Government referred to in n.º 4 supervise compliance with the obligations incumbent on the professional orders under this law.

7 - The professional orders inform, through the Coordination Commission, the other competent entities for verifying compliance with this law of the annual report provided for in n.º 4.

DIVISION III Communication of real estate activities

Article 91.º Competence of IMPIC, I. P.

Verification of compliance with the provisions of Article 46.º and the implementing regulations shall always be the responsibility of IMPIC, I. P., whatever the nature of the obliged entities.

DIVISION IV Entities equated to obliged entities

Article 92.º Competent authorities Verification of compliance with the duties and obligations of the entities referred to in Article 5.º, provided for in this law and in the respective sectoral regulations, is the responsibility, throughout the national territory and to the extent that it is applicable:

a) Banco de Portugal, with regard to natural and legal persons acting in Portugal as agents or distributors of payment institutions or electronic money institutions;

b) Of the CMVM, in relation to management entities of crowdfunding platforms in the loan and equity modalities;

c) Of ASAE, in relation to the following entities:

i) Management entities of crowdfunding platforms in the donation and reward modalities; and

ii) Non-profit organizations.

SECTION II Powers of the sectoral authorities

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 67 / 122

Article 93.º General provision The sectoral authorities exercise the powers and faculties conferred by this section and by the other specific provisions set out in this law.

Article 94.º Regulatory powers 1 - Within the scope of their attributions, the sectoral authorities may draft, approve or have approved regulations, or other general rules, aimed at ensuring that the obligations set out in this law are complied with to an extent appropriate to the risks of money laundering and terrorist financing existing in each sector and to the size, nature and complexity of the obliged entities and of the activities pursued by them.

2 - The regulations or rules referred to in the previous paragraph may, in particular:

a) Define situations in which the reinforcement or simplification of the identification and due diligence measures set out in this law should take place, as well as define the specific content of those measures, without prejudice to the powers conferred on the obliged entities in this area and to the individual decisions adopted by the competent sectoral authorities;

b) Specify the other conditions for the exercise of the preventive duties set out in Chapters IV, V and VI;

c) Establish the procedures, instruments, mechanisms, application formalities, information reporting obligations and other aspects necessary to ensure compliance with those preventive duties and effective management of the risks of money laundering and terrorist financing, in accordance with the size, nature and complexity of the obliged entities and of the activities pursued by them;

d) Specify the scope and terms of compliance with the preventive duties set out in this law, by entities that carry out activities with virtual assets.

3 - The competent authorities may also:

a) Draft, approve or have approved regulations, or other general rules, aimed at regulating other situations specifically provided for in this law;

b) Issue, approve or have approved instructions or other specific rules on the prevention of money laundering and terrorist financing;

c) Propose and ratify codes of conduct and manuals of good practices on the prevention of money laundering and terrorist financing.

Article 95.º Powers to verify compliance 1 - Within the scope of their attributions, the sectoral authorities enforce the rules set out in this law and in the corresponding regulatory diplomas of sectoral application, adopting the supervision or inspection measures necessary to verify the respective compliance.

2 - For the purposes of the provisions of the previous paragraph, the sectoral authorities:

a) Carry out the periodic and ad hoc inspections necessary to verify the applicable regulatory framework;

b) Request, spontaneously, periodically or systematically, the provision of information and other elements necessary to verify the applicable regulatory framework;

c) Issue determinations, orders or instructions of a specific nature aimed at enforcing the applicable regulatory framework or preventing situations of non-compliance;

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 68 / 122

d) Initiate and conduct the respective administrative offence or disciplinary proceedings and, as the case may be, apply or propose the application of sanctions.

3 - In addition to the provisions of the previous paragraph, the sectoral authorities may exercise any other powers conferred by their respective organic laws and by the diplomas that regulate their respective activity, to the extent that they are relevant to ensuring compliance with the provisions of this law and the corresponding regulatory diplomas of sectoral application.

4 - The sectoral authorities shall also request from any person the information and elements they consider relevant for the exercise of their functions and, if necessary, summon and hear that person, or their representative, in order to obtain the information or elements considered relevant.

5 - Entities that hold qualifying holdings in the capital of obliged entities have a special duty to provide the competent sectoral authority with all elements or information that this authority considers relevant for the supervision or inspection of the entities in which they participate.

Article 96.º Inspection measures for verifying compliance In the exercise of the inspection powers referred to in subparagraph a) of paragraph 2 of the previous article, the sectoral authorities:

a) Have access to any establishments or facilities used, even by third parties, for the exercise of their respective activity and any related services;

b) Inspect and examine the information elements on site, regardless of their medium;

c) Obtain copies, extracts or transcripts of the documents they consider relevant, regardless of their medium;

d) They request from any legal representative or collaborator of the inspected entities, or from anyone who collaborates with them in any capacity, any clarifications regarding facts or documents related to the object and purpose of the inspection, and record the respective responses;

e) They request the assistance of security forces and services, when they deem it necessary for the proper performance of their duties.

Article 97. Corrective measures 1 - Sectoral authorities require that obliged entities that do not comply or are at risk of not complying with the obligations set out in this law and the corresponding regulatory diplomas of sectoral application adopt the necessary measures or actions to remedy or prevent such non-compliance.

2 - For this purpose, sectoral authorities may, among others, determine the following measures:

a) Require the strengthening of processes and mechanisms created to manage the risks of money laundering and terrorist financing;

b) Prohibit, limit or suspend activities or operations, in whole or in part;

c) Impose enhanced measures in relation to certain operations;

d) Impose the communication of additional information or intensify the frequency of existing communications, namely regarding operations carried out.

Article 98. Recommendations

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 69 / 122 1 - Sectoral authorities issue the generic recommendations and guidelines that favor compliance with the applicable regulatory framework and an effective management of the risks of money laundering and terrorist financing by obliged entities.

2 - Sectoral authorities may also address specific recommendations to a given obliged entity, whenever they consider it pertinent to ensure an effective management of the risks of money laundering and terrorist financing.

3 - Obliged entities must inform the competent sectoral authority, under the terms to be defined by it, of the state of implementation of the recommendations addressed to them, justifying in a reasoned manner any decision not to comply, in whole or in part, with those recommendations.

Article 99. Countermeasures 1 - Without prejudice to the enhanced measures specifically provided for in this law, sectoral authorities shall adopt, to the extent legally permissible, the necessary countermeasures to:

a) Comply with a resolution of the United Nations Security Council or a legal act of the European Union, as well as other legal acts approving restrictive measures of national or supranational scope;

b) Comply with public statements and other requests made by the FATF; or

c) Address the risks of money laundering and terrorist financing emerging from high-risk third countries and other risky jurisdictions.

2 - Countermeasures must be proportionate to the identified risks and cannot conflict with other countermeasures arising from the legal acts referred to in subparagraph a) of the previous paragraph, when they have a different basis from such acts.

3 - Examples of countermeasures, without prejudice to others that prove more adequate to the concrete identified risks, are:

a) Determine the application, by obliged entities, of enhanced identification and due diligence measures with added content compared to what is provided for in this law;

b) Determine the strengthening of existing mechanisms for communication or sending of information by obliged entities, namely through the request for additional information;

c) Determine, on a systematic basis, the communication of operations or the sending of information regarding the same by obliged entities, regardless of the provisions of Articles 45 and 46;

d) Refuse or condition upon compliance with additional requirements the establishment of subsidiaries, branches, representative offices or similar structures of the country in question;

e) Prohibit or condition upon compliance with additional requirements the establishment of subsidiaries, branches, representative offices or similar structures in the country in question;

f) Limit the business relationships or operations of an obliged entity with a given territory or with persons or entities of that territory;

g) Prohibit the use by the obliged entity of third parties located in a given territory, even when that territory is not qualified as a high-risk third country;

h) Oblige financial entities to analyze, change or, if necessary, terminate correspondent relationships with entities of a given territory;

i) Determine the strengthening of supervision procedures for branches and subsidiaries of entities headquartered in a given territory;

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 70 / 122

j) Determine the strengthening of group supervision procedures, in relation to its branches and subsidiaries located in a given territory;

k) Determine the strengthening of risk management and audit procedures of entities operating in a given territory.

4 - In the situations covered by Article 37 of this law where the application of countermeasures is justified, sectoral authorities shall determine the adoption of one or more of the measures set out in the previous paragraph, without prejudice to the adoption of complementary measures that prove proportionate to the identified risks.

5 - When applying countermeasures, sectoral authorities shall take into account the relevant assessments or reports prepared by international organizations and standardization bodies with competences in the field of preventing money laundering and terrorist financing regarding the risks that each third country represents.

6 - Sectoral authorities shall communicate the intention to adopt any countermeasure to the competent governmental body to transmit the information to the European Commission, informing the Coordination Commission of that fact.

Article 100 Entities equivalent to obliged entities The sectoral authorities shall exercise, in relation to the entities referred to in Article 5 and to the extent applicable, powers identical to those they have in relation to the respective obliged entities.

SECTION III Duties of the sectoral authorities

Article 101 General provision The sectoral authorities shall comply with the duties set out in this section and in the other specific provisions laid down in this law.

Article 102 Risk-based supervision or oversight 1 - The sectoral authorities shall supervise or oversee the provisions of this law and of the respective regulatory diplomas for sectoral application in accordance with the existing risks of money laundering and terrorist financing.

2 - In the exercise of their risk-based supervision or oversight activity, the sectoral authorities:

a) Obtain the information necessary to understand, clearly and on an ongoing basis, the risks of money laundering and terrorist financing existing at national and supranational level, considering at least the national assessments provided for in Article 8 and the sources referred to in paragraph 4 thereof;

b) Identify and assess, on an ongoing basis, the risks of money laundering and terrorist financing existing in the context of the sectors they supervise or oversee, and to that end shall carry out periodic assessment exercises;

c) Identify and assess, on an ongoing basis, the risks of money laundering and terrorist financing associated with the respective obliged entities or, where the specific risk does not justify an individualised analysis, with a given set of obliged entities.

3 - For the purposes of the provisions of subparagraph c) of the previous paragraph, the sectoral authorities:

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 71 / 122

a) Exercise the powers to verify compliance conferred on them by this law to guarantee access to all relevant information on the risks of money laundering and terrorist financing to which the respective obliged entities are exposed;

b) Identify the specific risks of money laundering and terrorist financing inherent in the specific operational reality of the obliged entities and, where applicable, of the group in which they are included, considering at least the aspects referred to in subparagraph a) of paragraph 2 of Article 14;

c) Define and categorise the money laundering and terrorist financing risk profile of the obliged entities, including the risks of non-compliance with this law and the respective regulatory diplomas for sectoral application;

d) Review, on the following terms, the identification and assessment exercises already carried out:

i) On a periodic basis, in accordance with the risks previously identified;

ii) Whenever events or developments occur in the management or activities of the obliged entities that justify an extraordinary review.

4 - The sectoral authorities shall determine the type, frequency and intensity of the supervision or oversight actions, as well as of the corresponding compliance verification measures, based on the risk profile of the respective obliged entities and on the relevant risks of money laundering and terrorist financing at sectoral, national or supranational level.

5 - The sectoral authorities, in conducting their risk-based supervision or oversight activity, shall act in accordance with the principle of proportionality and shall take into account the following aspects:

a) The size, nature, level and complexity of the obliged entities and of the activities pursued by them;

b) The degree of discretion attributed to the obliged entities in identifying and assessing the risks of money laundering and terrorist financing to which they are exposed;

c) The adequacy of the risk identification, assessment and mitigation exercises carried out by the obliged entities, including the relevance and level of effectiveness of their internal policies, controls and procedures regarding the prevention of money laundering and terrorist financing.

6 - The sectoral authorities shall approve, by their own regulations, the internal procedures necessary to comply with the provisions of this article, and shall inform the Coordination Commission thereof.

Article 103 Resources of the sectoral authorities 1 - The sectoral authorities must be equipped with adequate financial, human and technical resources for the full and independent performance of their functions.

2 - The sectoral authorities shall ensure that the staff assigned to the supervision or oversight of this law follow high professional standards, namely regarding confidentiality and respect for the protection of personal data, demonstrate the highest integrity and possess the skills appropriate to the exercise of the function.

3 - The sectoral authorities shall guarantee the application of the provisions of the previous paragraph in the process of hiring staff whose functions are relevant for the purposes of the supervision or oversight of this law.

4 - The sectoral authorities shall also ensure that the relevant staff are provided with the training necessary for the full performance of the supervision or oversight functions conferred by this law.

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 72 / 122

Article 104 Reporting duties 1 - Whenever the sectoral authorities, in the exercise of any functions, become aware of or suspect facts likely to be related to criminal activities from which funds or other assets derive or to the financing of terrorism, they must immediately report them to the DCIAP and to the Financial Information Unit, if the report has not yet been made.

2 - The duty of communication provided for in the previous paragraph is equally applicable:

a) To the authorities responsible for the supervision of management companies of securities markets, of management companies of clearing houses or that act as central counterparties, of management companies of settlement systems and of management companies of centralized securities systems;

b) To the Tax and Customs Authority, in the exercise of their respective functions.

3 - The information provided under the previous paragraphs is subject to the provisions of Article 56. 4 - Without prejudice to the duty of communication provided for in the preceding paragraphs, the Order of Certified Accountants communicates to the CMVM any complaints or other elements that may indicate non-compliance with the duties and obligations provided for in this law and its regulatory diplomas, within three days, counting from the receipt of the complaint or those elements.

Article 105. Duty of secrecy 1 - Persons who exercise or have exercised functions in the sectoral authorities, as well as those who provide or have provided services to them on a permanent or occasional basis, are subject to a duty of secrecy regarding facts of which they become aware exclusively through the exercise of those functions or the provision of those services and may not disclose or use the information obtained.

2 - The duty of secrecy remains after the cessation of functions or the provision of services by the persons subject to it.

3 - Without prejudice to the provisions of the following paragraph, the facts or elements subject to secrecy may only be revealed in the following situations:

a) Upon authorization of the interested party, transmitted to the sectoral authority;

b) In the context of compliance with the obligations and the performance of the functions conferred by this law, including for the purposes provided for in no. 7 of Article 56;

c) Within the framework of the cooperation regime set out in Chapter IX, under the terms specifically provided for therein.

4 - Outside the cases provided for in the previous paragraph, the sectoral authorities may exchange information subject to secrecy under the terms defined in the respective sectoral legislation.

5 - The disclosure of information that does not allow the individual identification of persons or institutions is also lawful, particularly in summary or aggregate form.

6 - The information received for compliance with this law by the supervisory authorities of financial entities, within the framework of the cooperation regime referred to in subparagraph c) of no. 3, may only be used:

a) In the exercise of the attributions conferred by this law, including the application of sanctions;

b) In the exercise of the attributions conferred by the other sectoral diplomas that regulate the respective activity, under the terms provided for therein;

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 73 / 122

c) In the context of judicial actions that have as their object decisions taken by the member of the Government responsible for the area of finance or by the supervisory authority of financial entities in the exercise of their functions.

Article 106. Protection and processing of personal data by competent authorities 1 - The provisions of this law do not prejudice nor are prejudiced by the provisions relating to the processing of personal data in the framework of police and judicial cooperation in criminal matters.

2 - Without prejudice to any other legitimate processing, the judicial, police and sectoral authorities are authorized to process, as controllers of such processing, the personal data and evidence referred to in Article 58 for the purposes of preventing and combating money laundering and terrorist financing, and the provisions of Article 60 shall apply, with the necessary adaptations. 3 - In addition to the data referred to in the previous paragraph and without prejudice to any other legitimate processing, the authorities referred to in that paragraph may also process other personal data that prove relevant for the prevention and combating of money laundering and terrorist financing, in accordance with the provisions of Law no. 59/2019, of 8 August.

4 - The provisions of no. 3 of Article 57 and no. 1 of Article 61 are equally applicable. 5 - The judicial, police and sectoral authorities may, in relation to personal data that may be processed under this law:

a) Communicate, transfer or establish mechanisms for the interconnection of such data with other authorities with responsibilities in the field of preventing and combating money laundering and terrorist financing, even if located in third countries, particularly within the scope of the national and international cooperation obligations provided for in Chapter IX;

b) Proceed with their disclosure to obliged entities, to the extent that this is relevant for the prevention and combating of money laundering and terrorist financing.

SECTION IV Supervision of payment institutions and electronic money institutions headquartered in another Member State of the European Union

Article 107. Payment institutions and electronic money institutions headquartered in another Member State of the European Union 1 - Banco de Portugal may carry out direct inspections at the premises of the central contact point provided for in Article 72, as well as at the premises of any agents or distributors of the institutions referred to in that article:

a) In order to verify compliance with the provisions of its nos. 1 and 2;

b) Whenever there are suspicions that the central contact point is not fulfilling the functions mentioned in its nos. 6 and 7;

c) When there are suspicions of involvement in any operations that may be related to criminal activities from which funds or other assets derive or to terrorist financing.

2 - When there is a serious or repeated breach, or risk of breach, of the duties set out in this law, Banco de Portugal, without prejudice to the sanctioning powers conferred by this law:

a) Issues a specific determination granting a time limit to the payment institution or electronic money institution concerned to remedy the irregularity detected or the respective risk of occurrence;

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 74 / 122

b) May, in view of the specific risk identified, determine the adoption of the measures provided for in Article 97, for the time necessary to remedy the irregularity or the respective risk of occurrence;

c) In addition to the provisions of the preceding subparagraphs, cooperates and exchanges information with the supervisory authorities and other relevant authorities of the European Union Member State where the payment institution or electronic money institution has its registered office, with a view to adopting measures aimed at mitigating the risks of money laundering and terrorist financing.

3 - Natural and legal persons acting in Portugal as agents or distributors of payment institutions or electronic money institutions with their registered office in another European Union Member State shall provide all necessary cooperation for the proper implementation of the supervisory actions and measures adopted under this article, and the provisions of Article 53 shall apply, with the necessary adaptations.

SECTION V Whistleblowing

Article 108 Whistleblowing 1 - Any person who becomes aware of violations or indications of violations of this law and its respective sectoral implementing regulations may file a report with the relevant sectoral authority.

2 - The protection of the personal data of the whistleblower and of the person concerned is guaranteed, in accordance with Regulation

(EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, and other data protection legislation.

3 - Confidentiality regarding the identity of the whistleblower is also guaranteed at all times or until such information is required to safeguard the rights of defence of those concerned by the report, within the scope of the investigations to which it gives rise or subsequent judicial proceedings.

4 - Obligated entities must refrain from any threats or hostile acts and, in particular, from any unfavourable or discriminatory employment practices against those who make reports to the competent sectoral authorities under this article.

5 - Reports made under this article may not, by themselves, serve as grounds for initiating any disciplinary, civil or criminal proceedings against the whistleblower, unless they are deliberately and manifestly unfounded.

6 - Sectoral authorities must:

a) Create specific, independent and anonymous channels that internally ensure, in an adequate manner, the receipt, processing and filing of reports made under this article;

b) Ensure adequate protection for the person concerned.

7 - Sectoral authorities may approve, through their own regulations, the specific procedures necessary to ensure the guarantees provided for in the preceding paragraphs.

SECTION VI Authorisations and assessment of the fitness and propriety of management bodies

Article 109 Powers regarding authorisation 1 - The competent authorities for granting authorisation or other permission on which the exercise of a profession or activity covered by this law depends must, to the extent legally permissible, consider the existing risks of money laundering and terrorist financing

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 75 / 122 terrorism when defining the procedures they establish for granting and reassessing the respective authorisation or permission.

2 - Where the authority competent for granting the authorisation or permission is different from the sectoral authority competent for the purposes of this law:

a) The authority granting the authorisation or permission shall previously consult the competent sectoral authority on any information relevant for the purposes of the preceding paragraph;

b) The competent sectoral authority shall, on its own initiative, communicate to the authority granting the authorisation or permission any facts or indications likely to determine its reassessment.

3 - The granting of authorisation or any other permission allowing the exercise of activity in national territory by shell banks is prohibited, on any grounds whatsoever.

Article 110 Revocation of authorisation 1 - The authorisation or other permission on which the exercise of a profession or activity covered by this law depends may be revoked, without prejudice to other legally provided grounds, in the event of a serious or repeated violation of the legal or regulatory provisions aimed at preventing money laundering and terrorist financing.

2 - The revocation of the authorisation or permission shall be the responsibility of the authority that granted it.

3 - The revocation decision must be reasoned, notified to the person concerned and, in the case of credit institutions and financial institutions, communicated to the respective European Supervisory Authorities and supervisory authorities of the European Union Member States where the institution has branches, subsidiaries or provides services.

4 - The competent authority shall give the revocation decision appropriate publicity and take the necessary steps for the immediate closure of all establishments.

Article 111 Assessment of fitness and propriety 1 - Persons who hold management positions in obligated entities, with the exception of those mentioned in subparagraphs j), m) and n) of paragraph 1 of Article 4, must be considered fit and proper by the competent authorities for their registration, licensing or authorisation.

2 - The provisions of this article apply to the extent that this does not arise from the sectoral legislation governing access to the activities covered by this law and does not conflict with the provisions of European Union legal acts governing those activities.

3 - In assessing competence, obliged entities must be asked to demonstrate that the person intending to hold the management position possesses the skills and qualifications necessary for its exercise, acquired through academic qualifications or training appropriate to the position to be held and through professional experience with duration and levels of responsibility that are consistent with the characteristics, complexity and size of the obliged entity, as well as with the risks associated with the activity it carries out.

4 - In assessing suitability, consideration must be given to how the person intending to hold the management position habitually manages business, professional or personal affairs, or practises the profession, in particular in aspects that reveal their ability to decide in a considered and judicious manner, taking into account all circumstances relevant to the activity carried out, in view of the characteristics, complexity and size of the obliged entity.

5 - The assessment of suitability must be carried out on the basis of objective criteria, and at least the following situations must be taken into account, depending on their seriousness:

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 76 / 122

a) Conviction, in Portugal or abroad, by a final judgment, for an offence punishable by a prison sentence of more than six months, considered relevant to the exercise of the functions, namely:

i) Money laundering offence;

ii) Offence of mismanagement or active corruption;

iii) Forgery offences;

iv) Offence of influence peddling;

b) Declaration of insolvency by judicial decision;

c) Refusal, revocation, cancellation or cessation of registration, authorisation, admission or licence to carry out a commercial, business or professional activity, by an authority, professional order or body with similar functions, or dismissal from a position by a public entity;

d) Prohibition, by a judicial authority, authority, professional order or body with similar functions, from acting as director or manager of a civil or commercial company or from performing duties therein.

6 - In their assessment, the competent entities must take into consideration, in addition to the situations set out in this article or others of a similar nature, any and all circumstances of which they may legally become aware and which, by reason of their seriousness, frequency or any other relevant characteristics, are relevant to assessing the suitability of the person concerned, in accordance with the characteristics, complexity and size of the obliged entity.

7 - The occurrence of any of the situations provided for in this article does not necessarily result in the loss of suitability to exercise functions in the obliged entity, and its relevance must be weighed by the competent authority, among other factors, according to the activity performed by the person and the risk that this represents for the entity and for the sector, in accordance with their respective characteristics, complexity and size.

8 - The competent entities shall apply the provisions of the preceding paragraphs, with the necessary adaptations, to the beneficial owners of the obliged entities that they supervise or monitor, and may determine the suspension of the exercise of voting rights or other available rights through which those beneficial owners exercise control over the obliged entity concerned, for the time necessary to remedy the missing requirements.

9 - For the purposes of the provisions of the preceding paragraph, the competent authorities shall consult the central register of beneficial owners provided for in Article 34. 10 - Whenever the competent authorities consider, on the basis of this article, that there is a situation of incompetence or unsuitability, they shall provide a reasoned justification of the factual and legal circumstances on which they base their assessment.

11 - If the requirements of competence and suitability of the persons referred to in paragraph 1 are no longer met, the competent entities may adopt one or more of the following measures:

a) Set a deadline for the adoption of appropriate measures to comply with the missing requirement;

b) Suspend the authorisation to exercise the functions concerned, for the period of time necessary to remedy the lack of the identified requirements;

c) Where applicable, set a deadline for changes in the distribution or composition of the governing body concerned;

d) Revoke the authorisation to exercise the functions concerned, when the necessary measures to ensure compliance with the missing requirement are not adopted within the set deadline.

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 77 / 122 12 - In the case of the beneficial owners referred to in paragraph 8, the subsequent lack of the requirements provided for in this article may determine the suspension of the exercise of voting rights or other available rights through which those beneficial owners exercise control over the obliged entity concerned, for the time necessary to remedy the missing requirements.

13 - The sectoral authorities may define, through regulation, the procedures necessary to ensure compliance with the provisions of this article, taking into account the characteristics, complexity and size of the obliged entities, as well as the information obtained in compliance with the sectoral legislation governing access to the respective activities, where they exist.

14 - The professional orders shall apply, with the necessary adaptations, the measures provided for in this

article to the members of their professional orders.

Article 112 Registration of providers of services to companies, to other legal persons or to centres of collective interests without legal personality 1 - Providers of services to companies, to other legal persons or to centres of collective interests without legal personality that fall within the situations provided for in paragraph 3 of Article 4 shall register with ASAE and keep all information contained in that register up to date.

2 - ASAE shall organise and keep up to date the register mentioned in the previous paragraph, defining by regulation the elements subject to it, the respective updating obligations and the other terms necessary for its operation.

Article 112-A Register of entities carrying out activities with virtual assets 1 - Activities with virtual assets may only be carried out by an entity that obtains its prior registration for that purpose with Banco de Portugal, even if the applicant carries out another profession or activity covered by this law, even if subject to authorisation or licensing.

2 - In order to verify compliance with the provisions of the previous paragraph, Banco de Portugal has the powers conferred in sectoral legislation to prevent the unauthorised exercise of other reserved activities subject to its supervision.

3 - Banco de Portugal shall assess competence and suitability under the terms provided for in

Article 111, as a condition for the granting and maintenance of the registration referred to in paragraph 1.

4 - The registration referred to in paragraph 1 shall cover the following elements:

a) Company name or designation and, where applicable, trademark or trade name;

b) Professional domicile or registered office and, where different, place of central administration, and respective contacts;

c) Corporate purpose;

d) Type of activities with virtual assets that the applicant proposes to carry out;

e) Jurisdictions in which each of the activities with virtual assets that the applicant proposes to carry out will be carried out;

f) Exercise of another profession or activity covered by this law;

g) Identification of the holders of shareholdings, including the beneficial owners;

h) Identification of the members of the management and supervisory bodies and of other persons holding top management positions;

i) Other elements specified in sectoral regulation;

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 78 / 122

j) Changes occurring in the elements set out in the previous subparagraphs.

5 - The application for the registration referred to in paragraph 1 shall be submitted by the applicant to Banco de Portugal, duly accompanied by the following elements:

a) Draft articles of association or amendment to the articles of association, containing an express reference to the activities with virtual assets that the applicant proposes to provide;

b) Address of the professional domicile or registered office and, where different, of the central administration, indicating the respective contacts;

c) Programme of activities and business plan, indicating at least:

i) The projected geographical implementation;

ii) The organisational structure and the human, technical and material resources allocated to the exercise of each of the activities with virtual assets, including a detailed description of the IT architecture associated with the development of such activities;

iii) A forecast of the total amount of operations associated with each of the activities with virtual assets, for the first three years of activity;

iv) The foreseeable date for the start of activity;

d) Description of the internal control mechanisms to comply with the legal or regulatory provisions intended to prevent money laundering and terrorist financing, including an assessment of the risks associated with its projected customer base, products and services, distribution channels to be used and planned geographical areas of operation, as well as measures to mitigate them;

e) Identity and respective supporting elements of the holders of shareholdings, of the beneficial owners and of the members of the management and supervisory bodies and of other persons holding top management positions;

f) Supporting elements of the suitability and competence of the persons subject to assessment, under the terms provided for in Article 111;

g) Proof of holding the share capital and of the origin of the funds used for its subscription;

h) Other elements specified in sectoral regulation.

6 - The application for registration of the changes referred to in subparagraph j) of paragraph 4 shall be submitted to Banco de Portugal within a maximum period of 30 days from the date on which the facts occurred, duly accompanied by the documents evidencing the fact to be registered.

7 - The submission of the elements referred to in paragraphs 4 and 5 may be dispensed with when Banco de Portugal is already aware of them.

8 - Banco de Portugal may request additional information from applicants and carry out the investigations it considers necessary.

9 - The decision on the initial registration application shall be notified to the applicant within three months from the date of receipt of the elements provided for in paragraph 5 or, if applicable, of receipt of the additional information requested by Banco de Portugal, but never after six months have elapsed from the date of the initial submission of the application.

10 - The decision on the application for registration of changes shall be notified to the applicant within a maximum period of 30 days from the date of receipt of the elements provided for in paragraph 5 or, if applicable, of receipt of the additional information requested by Banco de Portugal, but never after two months have elapsed from the date of submission of the amendment application.

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 79 / 122 11 - The lack of notification within the periods referred to in paragraphs 9 and 10 constitutes a presumption of tacit approval of the application.

Article 112-B Grounds for refusal, expiry or cancellation of the registration of entities carrying out activities with virtual assets 1 - Banco de Portugal shall refuse registration applications submitted under the previous article whenever:

a) The registration application is not accompanied by all the necessary elements and documents;

b) It is manifest that the fact to be registered is not evidenced in the documents submitted;

c) The processing of the application suffers from inaccuracies or falsehoods;

d) It verifies that any of the requirements on which access to activities with virtual assets depends is not met;

e) It verifies the existence of a risk of serious non-compliance with the laws and regulations aimed at preventing money laundering and terrorist financing.

2 - The registration provided for in the previous article shall expire if the entity carrying out activities with virtual assets enters into liquidation or does not commence activity within six months after the initial registration.

3 - The provisions of Article 110 shall apply to the cancellation of the registration provided for in the previous article, and the following situations shall also constitute grounds for cancellation:

a) The registration having been obtained by means of false or inaccurate declarations or other unlawful expedients, regardless of the sanctions applicable in the case;

b) Supervening lack of the requirements on which the granting of the registration depends;

c) The entity having ceased carrying out activities with virtual assets or having reduced or maintained them at an insignificant level for a period exceeding six months.

4 - The registration may be cancelled at the request of the entity carrying out activities with virtual assets, when it intends to suspend or cease carrying out such activities.

5 - For the purposes of subparagraph b) of paragraph 3, both facts occurring after registration and prior facts of which knowledge is only obtained after registration has been effected shall be considered supervening.

CHAPTER VIII Information and statistical data

SECTION I Information

Article 113 Access to information For the full performance of its duties of preventing and combating money laundering and terrorist financing, the DCIAP and the Financial Intelligence Unit shall have access, in a timely manner, to:

a) Any elements in the possession of the obliged entities that are relevant to their analyses, regardless of whether the duty to report provided for in Articles 43 or 45 has been exercised or not;

b) Any information of a financial, commercial, corporate, administrative, registry, judicial or police nature, regardless of its source and of who holds it;

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 80 / 122

c) Any information of a tax or customs nature.

Article 114 Feedback 1 - The Financial Intelligence Unit shall promote feedback to the obliged entities and sectoral authorities on the forwarding and the result of suspicious transaction reports made under Articles 43 and 104, in order to assist, as the case may be, in the application or supervision of measures to prevent money laundering and terrorist financing and, in particular, in the detection and reporting of suspicious transactions.

2 - The obliged entities shall, in turn, ensure feedback to the Financial Intelligence Unit regarding the results of the steps taken on the basis of information provided by that Unit.

Article 115 Protection of information 1 - In addition to the provisions of Article 106, the DCIAP and the Financial Intelligence Unit shall have rules for the protection of information processed under this law that ensure an adequate level of security and confidentiality.

2 - The rules referred to in the previous paragraph must, in particular, establish procedures for access, management, storage, dissemination and consultation of information.

SECTION II Collection, maintenance and publication

Article 116 Statistical data and other relevant information 1 - In order to contribute to the preparation of the national risk assessments provided for in Article 8, and to assess the effectiveness of the existing systems for preventing and combating money laundering and terrorist financing, at national level and at the level of the different sectors, the Financial Intelligence Unit and the judicial, police and sectoral authorities shall maintain complete statistical data on the prevention and combating of money laundering and terrorist financing.

2 - The statistical data mentioned in the previous paragraph shall include, as the case may be:

a) Data on the size and importance of the different sectors covered by the scope of application of this law, namely, the number of obliged persons or entities registered or authorised to operate in national territory and the economic importance of each sector;

b) Number of suspicious transactions reported to the Financial Intelligence Unit and data on the usefulness and follow-up given to such reports;

c) Number of cases investigated, of persons charged in judicial proceedings and of persons convicted of the crimes of money laundering or terrorist financing, data on the types of underlying offences and the value, in euros, of the assets subject to freezing, seizure, attachment or declaration of loss in favour of the State;

d) Number of requests for mutual legal assistance or other requests for international cooperation made and received and data relating to the follow-up they received.

3 - The Coordination Commission shall identify and contact other entities with responsibilities in the field of preventing and combating money laundering and terrorist financing that should maintain and communicate relevant statistical data.

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 81 / 122 4 - In order to ensure the strengthening of the quality, completeness, coherence and reliability of the relevant statistical data in the field of prevention and combating of money laundering and terrorist financing, the Coordination Commission:

a) Provides information on the same to the entities responsible for its collection and maintenance;

b) Periodically reviews the adequacy of the statistical data and, if necessary, defines the communication of new data.

5 - The Coordination Commission publishes on the portal provided for in Article 121, at least annually:

a) The statistical data communicated to it under the terms provided for in the following articles;

b) A consolidated analysis of the complete statistical data on the prevention and combating of money laundering and terrorist financing, which is subsequently communicated to the European Commission by the competent government bodies.

6 - The Coordination Commission prepares, keeps updated and publishes on the portal provided for in Article 121, whenever necessary, the list of prominent public functions at senior level that fall within the definition of 'politically exposed persons' provided for in point cc) of paragraph 1 of Article 2. 7 - For the purposes of the preceding paragraph, the Coordination Commission requests the international organisations accredited in national territory to prepare, keep updated and send to it the list of prominent public functions in those organisations.

8 - The Coordination Commission notifies the European Commission of the lists referred to in paragraphs 6 and 7.

Article 117 Financial Intelligence Unit 1 - The Financial Intelligence Unit is responsible for preparing and keeping updated statistical data relating to:

a) The number of suspicious transactions reported under the terms set out in Articles 43 and 104 and in point g) of paragraph 1 of Article 146 and the forwarding and outcome of such reports;

b) The number of cross-border information requests sent, received or refused by it and to which it responded totally or partially.

2 - The Financial Intelligence Unit is also responsible for preparing and keeping updated statistical data relating to the human resources assigned to the performance of the functions provided for in Articles 82 and 83. 3 - The Financial Intelligence Unit communicates, at least annually, the statistical data provided for in the preceding paragraphs to the Coordination Commission, for the purposes provided for in paragraph 5 of

Article 116

Article 118 Judicial and police authorities 1 - The judicial and police authorities shall collect statistical data relating to their activity in the field of prevention and combating of money laundering and terrorist financing, including the following:

a) The number of cases investigated;

b) The number of persons charged in judicial proceedings;

c) The number of persons convicted of money laundering or terrorist financing offences;

d) Data on the types of underlying offences;

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 82 / 122

e) The value, in euros, of the assets subject to freezing, seizure, attachment or declaration of forfeiture in favour of the State;

f) The number of requests for mutual legal assistance or other requests for international cooperation made and received and data relating to their follow-up.

2 - The judicial and police authorities shall send, annually, the data referred to in the preceding paragraph that relate to their activity:

a) To the Directorate-General for Justice Policy and to the Financial Intelligence Unit, in the case of the data referred to in points a) to d);

b) To the Attorney General's Office, in the case of the data referred to in points a) and f);

c) To the Asset Recovery Office, in the case of the data referred to in point e).

3 - The Directorate-General for Justice Policy, the Attorney General's Office and the Asset Recovery Office shall communicate, at least annually, the statistical data provided for in the preceding paragraph to the Coordination Commission, for the purposes provided for in paragraph 5 of Article 116.

Article 119 Sectoral authorities 1 - The sectoral authorities shall prepare and keep updated statistical data relating to their specific sectors of activity in the field of prevention of money laundering and terrorist financing, including the following:

a) Data on the size and economic importance of each sector;

b) Data on the number of obliged persons or entities registered or authorised to operate in national territory;

c) Data on:

i) The number of inspections, monitoring or remote analyses carried out;

ii) The number of on-site inspections, monitoring or analyses carried out;

iii) The number of legal or regulatory infringements detected;

iv) The number of sanctions or other administrative measures applied;

v) The amount of fines applied.

vi) The human resources assigned to the performance of the functions provided for in Articles 84 to 92. 2 - The sectoral authorities shall communicate, at least annually, the statistical data provided for in the preceding paragraphs to the Coordination Commission, for the purposes provided for in paragraph 5 of Article 116.

Article 120 Dissemination of information and statistical data 1 - It is incumbent upon the sectoral authorities, the Financial Intelligence Unit and the Coordination Commission, within the scope of their respective attributions, to issue alerts and disseminate updated information on:

a) Known risks, methods and trends of money laundering and terrorist financing;

b) Indications and elements characterising suspicion that allow the detection of transactions that should be reported under the terms of this law;

c) Relevant concerns regarding the weaknesses of the existing prevention and combating of money laundering and terrorist financing systems in other jurisdictions;

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 83 / 122

d) Other aspects that assist in complying with the provisions of this law and the regulations that implement it.

2 - The information provided for in the previous paragraph must be made available on the portal referred to in the following article, insofar as this does not prejudice the prevention or combating of money laundering and terrorist financing.

Article 121. Internet Portal 1 - The Coordination Commission is responsible for creating and maintaining on the Internet a portal for the prevention and combating of money laundering and terrorist financing.

2 - The information published on the portal must be understandable, consolidated, up-to-date, complete and structured, in terms that allow obliged entities to fully understand the obligations for the prevention of money laundering and terrorist financing and, as well, the best practices in each area of activity.

3 - The portal must contain the relevant links to the Internet pages of the Financial Information Unit and the sectoral authorities, as well as other national and international entities with responsibilities in the field of prevention and combating of money laundering and terrorist financing.

4 - The portal must provide for the possibility for obliged entities to register with it, in order to electronically subscribe to periodic information relevant to them in matters of prevention and combating of money laundering and terrorist financing, including the restrictive measures referred to in Article 21. 5 - The provisions of the previous paragraphs do not exempt the sectoral authorities and other entities with responsibilities in the field of prevention and combating of money laundering and terrorist financing from publishing on their Internet pages relevant information within the scope of their legal attributions and competences.

6 - The portal must also contain relevant information for the general public, namely the periodic analyses and reports in the field of prevention and combating of money laundering and terrorist financing that must be made public.

CHAPTER IX Cooperation

SECTION I National cooperation

Article 122. Coordination Commission 1 - In addition to the provisions of Articles 8, 9, 116, 120 and 121, and without prejudice to the competences and autonomy of the different authorities that comprise it, the Coordination Commission is also responsible for:

a) Evaluating and proposing, on a continuous basis, the adoption of the policies necessary for the pursuit of the national strategy for the prevention and combating of money laundering and terrorist financing, based on the identified risks;

b) Promoting and coordinating the exchange of information and the holding of reciprocal consultations between the entities that comprise the Coordination Commission and between these and other entities with responsibilities in the field of prevention and combating of money laundering and terrorist financing, defining appropriate and effective instruments, mechanisms and procedures for the exchange of information.

2 - The entities that comprise the Coordination Commission, as well as any other entities with responsibilities in the field of prevention and combating of money laundering and

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 84 / 122 terrorist financing, provide the collaboration and assistance requested by the Coordination Commission for the pursuit of its mission, attributions and competences.

3 - Persons who, on any grounds, exercise or have exercised functions in the Coordination Commission, in its bodies, working groups and specialised sections are subject to a duty of secrecy regarding facts of which they become aware exclusively through the exercise of those functions, without prejudice to the use of the information obtained for the pursuit of functions related to the prevention and combating of money laundering and terrorist financing that are assigned to the entities that comprise the Coordination Commission or that have legal responsibilities in that field.

Article 123. Policies for the prevention and combating of money laundering and terrorist financing 1 - The Coordination Commission annually submits to the Council of Ministers for approval an evaluation report and proposal of the policies necessary for the pursuit of the national strategy for the prevention and combating of money laundering and terrorist financing, based on the identified risks and on the continuous assessment of the effectiveness of such policies.

2 - The Financial Information Unit, the other judicial, police and sectoral authorities with competences under this law, the remaining entities that comprise the Coordination Commission, as well as any other political decision-makers or any other entities with responsibilities in the field of prevention and combating of money laundering and terrorist financing coordinate and cooperate at national level, with a view to:

a) The development and execution of the policies referred to in the previous paragraph, in terms that guarantee the technical conformity and effectiveness of the national system for the prevention and combating of money laundering and terrorist financing;

b) Understanding the risks of money laundering and terrorist financing that must inform those policies, namely in the context of the assessment and updating exercises referred to in Article 8. 3 - The Coordination Commission is responsible for effectively promoting the coordination and cooperation referred to in the previous paragraph, and is periodically communicated, by the entities that comprise the Commission and under the terms to be defined by it, with the elements of information relevant for an adequate perception:

a) Of the risks of money laundering and terrorist financing existing at national level and in each of the sectoral segments subject to the application of this law;

b) The effectiveness of the prevention and combating policies against money laundering and terrorist financing previously adopted.

4 - The elements to be communicated to the Coordinating Commission under the previous paragraph shall be transmitted to it on an annual basis or less frequently as may be defined by the Commission, and shall include at least the information and statistical data referred to in Articles 116 to 119. 5 - The Coordinating Commission may extend the periodic communication of information provided for in paragraphs 3 and 4 to other entities with responsibilities in the field of prevention and combating money laundering and terrorist financing.

6 - The Coordinating Commission shall also promote the establishment of coordination and cooperation mechanisms similar to those provided for in this Article in the field of combating the financing of the proliferation of weapons of mass destruction, involving for this purpose all entities with responsibilities in that field.

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 85 / 122

Article 124. Activities for the prevention and combating of money laundering and terrorist financing 1 - Entities with operational competences in the field of prevention and combating money laundering and terrorist financing shall cooperate and exchange among themselves all essential or relevant information in that field, on their own initiative or whenever requested to do so with justification, even if such information is subject to any duty of secrecy imposed by legislative, regulatory or contractual means, without prejudice to the provisions of paragraphs 2 to 4 and the legal regimes of judicial secrecy and State secrecy.

2 - If the cooperation provided for in the previous paragraph involves the sharing of information subject to the duty of secrecy of the sectoral authorities, these may proceed with the exchange of that information:

a) Whenever the knowledge of the information derives from the exercise of their respective functions in matters of prevention and combating money laundering or terrorist financing;

b) In the case of the supervisory authorities of financial entities, also in cases where it is relevant for the exercise of the other functions conferred by the legal instruments regulating their respective activity.

3 - Outside the cases provided for in the previous paragraph, whenever the information provided for in paragraph 1 is subject to the duty of secrecy of the sectoral authorities, these may proceed with the exchange of that information under the terms defined in their respective sectoral legislation.

4 - All authorities, bodies and persons participating in the exchanges of information referred to in paragraphs 2 and 3 shall be subject to the duty of secrecy of the transmitting sectoral authority.

5 - In order to comply with the provisions of this Article, the Coordinating Commission shall promote the conclusion of cooperation protocols between entities with operational competences in the field of prevention and combating money laundering and terrorist financing, which shall establish at least:

a) The type of information that should be subject to spontaneous sharing between those entities;

b) The terms under which such information is provided, including with regard to:

i) The mechanisms for the protection of information considered sensitive;

ii) The designation of the persons who, within each of the entities, assume responsibility for the communications made under this Article.

6 - Within the scope of the cooperation provided for in this Article, entities with operational competences shall provide:

a) Spontaneously, the information that, while not only relevant to the pursuit of their specific objectives, is necessary for the achievement of the purposes of the other entities with such operational competences;

b) Any other information that, under paragraph 1, is legally requested by other entities pursuing such operational competences.

7 - The provision of information under this Article shall be carried out as soon as possible and without any associated costs for the requesting entity or the recipient of the information.

8 - For the purposes of this Article, entities with operational competences in the field of prevention and combating money laundering or terrorist financing shall be considered:

a) The Financial Intelligence Unit and the judicial, police and sectoral authorities provided for in this law;

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 86 / 122

b) The Tax and Customs Authority;

c) The Foreigners and Borders Service;

d) The Security Intelligence Service and the Strategic Defense Intelligence Service of the Portuguese Republic Intelligence System.

Article 125. Cooperation with the Financial Intelligence Unit 1 - The Financial Intelligence Unit shall provide to the judicial, police and sectoral authorities provided for in this law, spontaneously or upon request, the results of analyses and other information that may be relevant for the full performance of the legal attributions conferred on those authorities, including the information referred to in Article 113. 2 - The provisions of the previous paragraph shall not apply when the provision of information may harm possible investigations, inquiries, analyses or other ongoing proceedings or, in exceptional circumstances, when:

a) It is clearly disproportionate in relation to the legitimate interests of a given natural or legal person;

b) It is irrelevant in relation to the purposes for which it was requested.

3 - The rules for the protection of information provided for in Article 115 shall apply to the dissemination of information carried out under paragraph 1.

4 - The judicial, police and sectoral authorities provided for in this law shall always ensure a timely return of information to the Financial Information Unit on the use and usefulness of the information provided under paragraph 1, particularly with regard to the results of investigations, inspections, inquiries or other steps carried out on the basis of the information provided.

5 - The provisions of paragraph 1 shall not affect the operational independence and autonomy of the Financial Information Unit, which is exclusively responsible for deciding to carry out analyses and disseminations based on the information provided.

Article 126 Cooperation between the Central Department of Investigation and Criminal Action and the Financial Information Unit The DCIAP and the Financial Information Unit shall cooperate in order to establish a single, secure and reliable channel through which obliged entities may carry out:

a) The communications provided for in Articles 43 and 45 and in paragraphs 2 and 3 of Article 47;

b) The provision of any other information simultaneously to the DCIAP and to the Financial Information Unit.

Article 127 Cooperation in matters of registries and databases 1 - Public entities responsible for the management of registries, central files or databases, including the central register of beneficial owners referred to in Article 34, shall grant access to or provide the information contained therein to judicial, police and sectoral authorities whenever necessary for the exercise of the attributions of these authorities in the context of the prevention of and fight against money laundering and terrorist financing.

2 - The Tax and Customs Authority may access the mechanisms, procedures, documents and information relating to the duties of identification, customer due diligence and record-keeping regarding beneficial owners provided for in this law, for the purposes of the application and control of compliance with the

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 87 / 122 obligations provided for in Decree-Law No. 61/2013 of 10 May, and to ensure administrative cooperation in the field of taxation.

3 - The provision of access or information under the preceding paragraphs shall be carried out without any associated costs.

4 - The provisions of this article shall not affect the obtaining, by the competent authorities under this law, of other information, directly or through obliged entities, on legal persons, centres of collective interests without legal personality, their formal holders, beneficial owners, members of corporate bodies, trustees and other persons occupying similar positions.

SECTION II International cooperation SUBSECTION I Cooperation between sectoral authorities DIVISION I General provisions

Article 128 Object, scope and principle of reciprocity 1 - The forms of international cooperation between sectoral authorities in the field of prevention of money laundering and terrorist financing shall be governed:

a) By the treaties, conventions, international agreements and specific provisions on cooperation that bind the sectoral authorities;

b) In the absence thereof, by the provisions of this division.

2 - The Tax and Customs Authority shall be treated as a sectoral authority for the purposes of the provisions of this division.

3 - The international cooperation regulated by the provisions of this division shall be subject to the principle of reciprocity, and the necessary guarantees may be requested or provided if circumstances so require.

4 - Sectoral authorities may satisfy requests for cooperation from an authority that does not ensure the reciprocity provided for in the preceding paragraph, to the strict extent that the requested authority considers it necessary to prevent money laundering or terrorist financing and the information communicated remains subject to the duty of secrecy of the transmitting sectoral authority.

5 - For the purpose of assessing the principle of reciprocity in satisfying requests for international cooperation that involve obtaining or accessing information on legal owners, formal holders or beneficial owners of legal persons or centres of collective interests without legal personality, the sectoral authorities shall verify the quality of the information provided by foreign authorities in that context, in particular information relating to the identification or location of:

a) Beneficial owners of legal persons or centres of collective interests without legal personality under foreign law;

b) Beneficial owners resident abroad.

Article 129 General duty of cooperation

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 88 / 122 1 - Sectoral authorities shall provide any information, assistance or other form of cooperation requested of them by a foreign authority, or that proves necessary for the achievement of the purposes pursued by that authority.

2 - The cooperation provided for in the preceding paragraph includes the carrying out of investigations, inspections, inquiries or other steps admissible on behalf of foreign authorities, and the sectoral authorities shall provide them with all information they may obtain under the powers conferred by national law, with respect for the safeguards provided for in Article 134. 3 - The cooperation provided for in the preceding paragraphs shall be provided:

a) Spontaneously or at the request of the requesting authority, as the case may be;

b) Within the shortest possible time and by the most expeditious and effective means;

c) Regardless of the status or nature of the foreign authority.

4 - The sectoral authorities shall internally define reliable, secure and effective channels and procedures that ensure the timely receipt, execution, transmission and prioritisation of cooperation requests, in compliance with the safeguards referred to in Article 134. 5 - The sectoral authorities shall also, upon request by a foreign authority to which they provide cooperation and whenever possible, ensure timely feedback to those authorities on the use and usefulness of the cooperation provided, particularly with regard to the results of analyses or other steps taken on the basis of the information provided.

Article 130. Special duties of cooperation 1 - The sectoral authorities and the professional associations shall cooperate in particular, within the scope of their respective powers, with the counterpart authorities of the other Member States listed in a public register maintained by the European Commission.

2 - Where an obliged entity established in Portugal does not have its head office in the national territory, the sectoral authorities shall cooperate in particular with the competent authorities of the European Union Member State in which the obliged entity has its head office, with a view to ensuring effective supervision of compliance with the requirements of this law and the equivalent rules of the Member State of origin.

3 - In exercising their sanctioning powers, the competent authorities shall cooperate closely to ensure that the sanctions and measures applied produce the desired effects and shall coordinate their action where cross-border infringements are at stake.

Article 131. Cooperation instruments 1 - The sectoral authorities shall enter into protocols or memoranda of understanding, of a bilateral or multilateral nature, that prove necessary to overcome any constraints and restrictive conditions, such as those provided for in Article 133, which prevent the full performance of the duty of collaboration on a reciprocal basis.

2 - The Coordination Committee shall assist the sectoral authorities:

a) In identifying the foreign authorities with which cooperation protocols should be entered into;

b) At the request of the latter, in establishing the contacts necessary for the negotiation and conclusion of such protocols in good time.

Article 132. Cooperation between non-homologous authorities

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 89 / 122 1 - The sectoral authorities may satisfy requests for cooperation coming from foreign authorities that are not their homologues, provided that:

a) The contrary does not result from the treaties, conventions, agreements and specific cooperation regimes applicable;

b) The requesting foreign authority, as well as the purpose and grounds of the request for cooperation, are clearly identifiable;

c) The national authority that is the homologue of the requesting foreign authority is aware of the request and does not express its opposition;

d) The provisions of this Division are observed, in particular the guarantees of reciprocity and the safeguards provided for herein.

2 - The information subject to the requests for cooperation referred to in the preceding number may, depending on what proves most appropriate:

a) Be provided directly to the requesting foreign authority;

b) Be forwarded to the foreign authority that is the homologue of the requested authority, for subsequent transmission to the requesting authority;

c) Be forwarded to the national authority that is the homologue of the requesting foreign authority, which shall then be responsible for transmitting the information.

3 - The use of the information transmission channels provided for in items a) and b) of the preceding number is subject to the non-opposition of the homologous authorities:

a) Of the requesting foreign authority, in any case;

b) Of the requested authority, in the situation provided for in item b) of the preceding number.

Article 133. Prohibition of imposing excessively restrictive conditions 1 - Without prejudice to the provisions of the following article, the sectoral authorities shall refrain from imposing any excessively restrictive conditions on the full satisfaction of a request for cooperation or on the provision of information from a foreign authority, whatever its nature or status.

2 - For the purposes of the provisions of the preceding number, the following are considered, in particular, to be excessively restrictive conditions the refusal to satisfy a request for cooperation or to provide information on the following grounds:

a) The allegation that the request covers facts of tax or customs relevance, even if subject to secrecy and even when they constitute the commission of crimes of that nature, regardless of differences in the definition of those criminal offences compared to other legal systems;

b) The invocation of a duty of secrecy imposed by legislative, regulatory or contractual means that binds the obliged entities;

c) The allegation that an investigation, a criminal inquiry or other legal proceeding is underway or may be underway, except where satisfying the request for cooperation may prejudice that investigation, inquiry or proceeding;

d) The invocation that the nature or status of the requesting authority is different from the nature or status of the requested authority.

Article 134. Safeguards

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 90 / 122 1 - The sectoral authorities shall ensure that the requests for cooperation processed under this Division relate to the prevention of criminal activities from which funds or other assets originate, money laundering or terrorist financing.

2 - Without prejudice to the provisions of the following number, the sectoral authorities:

a) Use the information they receive from the transmitting authority, in satisfaction of a request for international cooperation, exclusively for the purposes for which such information was requested or provided;

b) Adopt the safeguards necessary to ensure that the information is used only for the authorised purposes.

3 - Any disclosure of the information received under the preceding number to any other authority or to any other third parties, as well as any use for purposes exceeding those initially approved, is subject to prior consent from the transmitting authority.

4 - In executing a request for international cooperation, or when processing information received under a request for international cooperation, the sectoral authorities:

a) Ensure an adequate level of confidentiality of the information, so as to protect the integrity of any inquiries, investigations, verifications or other proceedings that gave rise to the request for cooperation;

b) Ensure that the exchange of information subject to the request for cooperation is carried out through secure and reliable channels;

c) They shall in particular observe the applicable provisions on the protection of personal data, professional secrecy, judicial secrecy, State secrecy and in all other cases in which secrecy is protected, with the exception of the situation provided for in item a) of paragraph 2 of the preceding article;

d) They shall generally ensure that the execution of the request for cooperation, or the processing of the information received thereunder, is carried out in compliance with Portuguese law, except when, at the request of the foreign authority or as a result of an agreement, the law of the foreign State should be followed, to the extent that this does not contravene the fundamental principles of Portuguese law and does not result in discriminatory treatment of those principles.

5 - Sectoral authorities may refuse to provide information to the requesting authority if it is not in a position to ensure the verification of the safeguards referred to in the preceding paragraph.

DIVISION II Cooperation between financial sector supervisory authorities

Article 135. Duty of cooperation between financial sector supervisory authorities 1 - The supervisory authorities of financial entities shall cooperate with foreign authorities that, irrespective of their nature or organisational status, perform functions analogous to those provided for in this law or in other legal instruments regulating the supervision of the activity carried out by financial entities.

2 - Without prejudice to the provisions of paragraph 4, the supervisory authorities of financial entities shall exchange, spontaneously or upon request, all information relevant to supervisory activity of which they may have knowledge under this law and the other legal instruments governing their respective activity, in accordance with applicable international standards and in proportion to their respective needs, including:

a) Information in the possession of or relating to financial entities, including information on:

i) The policies and the procedures and controls referred to in Article 12;

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 91 / 122

ii) Specific clients, accounts and transactions;

b) Information obtained in the course of supervision, including information on:

i) The activities and business areas pursued by financial entities;

ii) The beneficial owners of financial entities and other persons holding qualifying holdings in them;

iii) The management and supervision of financial entities, in particular information on the identity, competence and suitability of the holders of management, supervisory and other essential functions;

c) Information on any breaches or on the risk of their occurrence;

d) Information on applicable local rules and other information of general interest on the supervised sectors.

3 - The supervisory authorities of financial entities may exchange the information referred to in the previous paragraphs with authorities that pursue analogous functions in other Member States, even if such information is subject to any duty of secrecy, imposed by legislative, regulatory or contractual means, that applies to financial entities or to supervisory authorities.

4 - The supervisory authorities of financial entities may, within the scope of cooperation agreements they have entered into and for the exercise of supervisory functions, exchange information subject to secrecy with authorities that pursue analogous functions in States that are not members of the European Union, on a reciprocal basis and upon demonstration of equivalent requirements in matters of professional secrecy, provided that the agreements comply with the provisions of Article 46.º of Regulation

(EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016.

5 - All authorities, bodies and persons that participate in the exchanges of information referred to in the previous paragraphs are subject to the duty of secrecy of the transmitting supervisory authority.

6 - Without prejudice to the provisions of paragraph 4, in addition to carrying out inspections, verifications or any other steps on behalf of foreign authorities, the supervisory authorities of financial entities, provided they are previously informed, allow them to carry out verifications or inspections in Portuguese territory.

7 - The supervisory authorities of financial entities comply with the provisions of paragraph 3 of

the previous article to the extent that the contrary does not result from applicable legal obligations, and the supervisory authorities must immediately inform the foreign authority that provides them with information of any legal obligations that prevent or have prevented obtaining prior consent for the disclosure to third parties of the information provided.

8 - The supervisory authorities of financial entities may only communicate information originating from another Member State with the express consent of the transmitting authority and, if applicable, exclusively for the authorized purposes.

9 - In the case of financial entities that are part of a group, the supervisory authorities shall cooperate in particular:

a) With the competent authorities of the Member State in which the parent company is established, when it is located outside national territory;

b) With the competent authorities of the European Union Member States in which the group is established, when the parent company is located in national territory.

SUBSECTION II Cooperation between Financial Intelligence Units

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 92 / 122

Article 136 General principles 1 - The Financial Intelligence Unit shall cooperate to the maximum extent possible with its counterparts, regardless of their nature and organizational status.

2 - When developing its cooperation activities, the Financial Intelligence Unit shall observe, in particular:

a) The Egmont Group Charter and principles;

b) The memoranda of understanding established in accordance with those principles;

c) The European Union instruments regarding the exchange of information.

3 - The provisions of this subsection shall apply to cooperation between the Financial Intelligence Unit and its counterparts of:

a) Other European Union Member States;

b) Third countries, without prejudice to the provisions of Article 139 and when they ensure reciprocal treatment and offer identical guarantees, namely by virtue of adherence to the charter, principles or memoranda of understanding referred to in the previous paragraph.

4 - The provisions of paragraph 5 of Article 128 shall apply, with the necessary adaptations.

Article 137 Duty of cooperation between Financial Intelligence Units 1 - The Financial Intelligence Unit shall exchange, spontaneously or upon request from its counterparts, all information that may be relevant for the processing or analysis of information concerning:

a) Practices related to criminal activities from which funds or other assets derive, to money laundering or to terrorist financing;

b) Natural or legal persons or centers of collective interests without legal personality that may be involved in the practices referred to in the previous subparagraph.

2 - The exchange of information under the previous paragraph shall not depend on the identification, at the time of exchange, of the specific criminal activity.

3 - The Financial Intelligence Unit shall include in the requests for information it addresses to its counterparts, as well as require from them in the requests it receives, all relevant facts, the background, the reasons justifying the request, the links with the country of the requested Unit and the indication of how the requested information is used.

4 - The Financial Intelligence Unit shall address and receive requests for information through the protected communication means it has agreed with its counterparts, privileging the use of the FIU.net network, or a mechanism that succeeds it, or other especially secure and reliable channels.

5 - The Financial Intelligence Unit, in response to a request for cooperation addressed to it by one of its counterparts, shall access and make available in a timely manner all information it may have under this law, namely by virtue of the provisions of Article 113 6 - The Financial Intelligence Unit shall cooperate with its counterparts in the application of cutting-edge technologies, under the terms permitted by national law.

7 - The technologies referred to in the previous paragraph must allow the Financial Intelligence Units to compare their data with the data of other Units anonymously, ensuring full protection of personal data, with the aim of detecting individuals or entities that may be of interest to the Financial Intelligence Units of other jurisdictions.

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 93 / 122

Article 138 Cooperation in the context of communication and suspension of execution of suspicious operations 1 - Whenever it receives a communication made under Article 43 that concerns another jurisdiction, the Financial Intelligence Unit shall transmit it immediately to its counterpart.

2 - Whenever it receives from one of its counterparts a request for suspension of an operation that meets the requirements of this law, the Financial Intelligence Unit shall immediately initiate the procedures provided for its suspension, without prejudice to situations in which its execution is justified, under the provisions of paragraph 3 of Article 47

Article 139 Specific duty of cooperation between Financial Intelligence Units of the European Union 1 - Without prejudice to the provisions of Article 73 and paragraph 3 of Article 82, the Financial Intelligence Unit:

a) Requests any counterpart from another European Union Member State to obtain relevant information from a person or entity established there that, although corresponding to any of the categories provided for in Articles 3 to 5, carries out activity in national territory through a form of action not covered by this law;

b) Promptly obtains, from obliged entities established in national territory, any information requested by a counterpart from another European Union Member State in which such entities operate outside the scope of freedom of establishment, also ensuring the immediate transmission of the information obtained;

c) Designates a contact point responsible for receiving requests for information from counterparts of other Member States.

2 - Differences between definitions of national law of underlying offences shall not prevent the Financial Intelligence Unit from providing assistance to another Financial Intelligence Unit of the European Union.

Article 140. Refusal and restrictions on the provision of information 1 - The Financial Information Unit promotes the free exchange of information for analysis purposes and refrains from any illegitimate or undue refusal to provide information, as well as from imposing any excessively restrictive condition, within the meaning of Article 133. 2 - The information exchanged between the Financial Information Unit and its counterparts is used for the pursuit of the functions assigned to it by this law and by analogous foreign legislation, and the Financial Information Unit shall:

a) The possibility of imposing restrictions and conditions on the use of the information it provides;

b) The obligation to observe the restrictions and conditions imposed by its counterparts regarding the information provided by them.

3 - In any case, the provisions of paragraphs 2 and 3 of Article 134 shall apply, with the necessary adaptations, to the use and subsequent disclosure of information exchanged between the Financial Information Unit and its counterparts.

4 - The Financial Information Unit shall observe the safeguards provided for in paragraph 4 of Article 134 and may only refuse to provide information on the grounds that its counterparts are unable to observe them, with the exception of the safeguard mentioned in subparagraph c) of the said paragraph 4, whose non-observance constitutes grounds for refusal only in the part concerning judicial and State secrets.

5 - Outside the cases provided for in the previous paragraph, the Financial Information Unit shall grant the prior consent referred to in paragraph 3 of Article 134 immediately and to the fullest extent possible,

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 94 / 122 regardless of the specific criminal activity, limiting the refusal to situations in which the respective granting:

a) Exceeds its legal attributions in matters of prevention and combating money laundering and terrorist financing;

b) (Revoked.)

c) Is likely to prejudice an investigation;

d) Is not consistent with the fundamental principles of national law.

6 - The grounds for refusal referred to in paragraphs 4 and 5 shall be duly substantiated, documented and, whenever possible, made known to the counterpart Unit.

SUBSECTION III Cooperation with the European Supervisory Authorities and with the European Central Bank

Article 141. Cooperation with the European Supervisory Authorities The supervisory authorities of financial entities shall cooperate with the European Supervisory Authorities, in particular by providing them with all information necessary for the fulfilment of the obligations incumbent upon them, under the terms set out in Directive 2015/849/EU of the European Parliament and of the Council of 20 May 2015, and in the regulations establishing them.

Article 142. Cooperation with the European Central Bank 1 - The supervisory authorities of financial entities shall provide the European Central Bank with the information at their disposal in compliance with this law, strictly to the extent that such information is relevant for the exercise of the functions conferred by Council Regulation (EU) No. 1024/2013 of 15 October 2013.

2 - The supervisory authorities of financial entities shall provide the information referred to in the previous paragraph even if it is subject to any duty of secrecy, imposed by legislative, regulatory or contractual means, that weighs upon the financial entities or their respective supervisory authorities.

3 - For the purposes provided for in the previous paragraphs, the supervisory authorities of financial entities shall exchange information with the European Central Bank in accordance with the agreement on the practical modalities for the exchange of information concluded under the terms provided for in paragraph 2 of Article 57-A of Directive 2015/849/EC of the European Parliament and of the Council of 20 May 2015.

4 - The provisions of this article shall not prejudice the attributions and competences of the supervisory authorities of financial entities in matters of prevention of money laundering and terrorist financing, which shall remain even when the financial entities referred to in Article 3 are subject to the prudential supervision of the European Central Bank, under the provisions of Council Regulation (EU) No. 1024/2013 of 15 October 2013.

SUBSECTION IV Cooperation between the Financial Information Unit and the European Commission

Article 143. Cooperation with the European Commission The Financial Information Unit shall provide the European Commission with the collaboration necessary for the pursuit of the functions incumbent upon it by virtue of Directive 2015/849/EU of the European Parliament and of the Council of 20 May 2015.

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 95 / 122

CHAPTER X Entities equated to obliged entities

SECTION I Crowdfunding platform management entities

Article 144. Special duties 1 - Crowdfunding platform management entities for lending and capital must ensure, in relation to each project, the recording of the following information elements:

a) Full identification of investors and beneficiaries;

b) Amounts invested, individualized by investor and by operation;

c) Dates of the investments, including dates of total or partial amortization;

d) Full identification of the persons who proceed with the total or partial amortization of the amounts invested whenever such operation is not carried out by the beneficiary;

e) Value of the remuneration received or of the shareholdings or dividends and shared profits, individualized by investor.

2 - Crowdfunding platform management entities for donation or reward must ensure, in relation to each project, the recording of the following information elements:

a) Full identification of beneficiaries and supporters;

b) Amounts of the support granted, individualized by supporter and by operation.

3 - The management entities of crowdfunding platforms must keep in durable medium the information elements referred to in the preceding paragraphs, as well as the supporting evidence thereof, for a period of seven years.

4 - The management entities of crowdfunding platforms shall immediately inform the DCIAP and the Financial Information Unit of any suspicions that certain funds may be related to the financing of terrorism or originate from other criminal activities, keeping secret the communications made and the identity of those who made them.

SECTION II Non-profit organizations

Article 145.º Risk assessment 1 - The Coordination Commission, through periodic exercises, promotes the identification and assessment of the risks of money laundering and financing of terrorism specifically associated with non-profit organizations.

2 - Within the scope of the exercises referred to in the preceding paragraph, the Coordination Commission promotes the preparation and updating of a list of persons, entities or organizations that fall within the definition of non-profit organization provided for in this law.

3 - For the purposes of the provisions of paragraph 1, the Coordination Commission shall also:

a) Identify the types of non-profit organizations that, by virtue of their activities or characteristics, represent an increased risk;

b) Review the adequacy of the legal and regulatory obligations applicable to non-profit organizations, in view of the existing risks;

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 96 / 122

c) Identify the best practices followed by non-profit organizations.

4 - The authorities and other public bodies with competences in the field of non-profit organizations shall provide the Coordination Commission with all information, including that available in databases or registries, relevant for compliance with the provisions of this article.

5 - The Coordination Commission shall provide ASAE with all information prepared under this

article, with a view to facilitating the verification of compliance with the obligations provided for in the following article and in the regulations to which it refers.

Article 146.º Duties of non-profit organizations 1 - Non-profit organizations:

a) Maintain information on:

i) The object and purpose of their activities;

ii) The identity of their beneficial owners and of the other persons who control or direct such activities, including their governing bodies and the other persons responsible for management;

b) Promote adequate procedures to ensure the suitability of their governing bodies and of the other persons responsible for their management;

c) Record the national and international transactions carried out by them;

d) Adopt risk-based procedures to ensure that the activities actually carried out and the manner in which funds are used fall within the object and purpose of the organization;

e) Obtain and evidence information on the identity of the persons or entities that provide them with or receive from them funds free of charge, whenever the donations are of a value equal to or greater than € 100;

f) Adopt procedures to ensure knowledge of their counterparties, namely with regard to the identity, professional experience and reputation of those responsible for their management;

g) Immediately inform the DCIAP and the Financial Information Unit of any suspicions that certain funds may originate from criminal activities or be related to the financing of terrorism, keeping secret the communications made and the identity of those who made them;

h) Keep, for a period of seven years, the elements that evidence compliance with the provisions of this article and the regulations to which it refers;

i) Provide the collaboration requested of them by the DCIAP and the Financial Information Unit, as well as by the other judicial and police authorities and by ASAE, including the provision of the elements relevant to assess compliance with the provisions of this article and the regulations to which it refers.

2 - ASAE:

a) Adopts the regulations necessary to ensure compliance with the provisions of the preceding paragraph;

b) May determine, taking into account the existing risks and under the terms to be defined in regulations, the application to non-profit organizations of the other pertinent provisions provided for in this law;

c) May ex officio consider the duties provided for in this article or in the regulations to which it refers as fulfilled, when the information provided to other authorities or public bodies with competences in the field of non-profit organizations, even for other purposes, is sufficient for that purpose;

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 97 / 122

d) Access all information necessary for verifying compliance with this article and the regulations to which it refers, namely information of a fiscal nature, even if held by other authorities or public bodies with competences in the field of non-profit organizations and even if such information is subject to any duty of secrecy, imposed by legislative, regulatory or contractual means.

CHAPTER XI Measures for the implementation of Regulation (EU) 2015/847

Article 147.º Verification of the accuracy of information relating to the payer or the payee 1 - For the purposes of the provisions of paragraph 5 of Article 4 of Regulation (EU) 2015/847, the verification provided for in paragraph 4 of that article shall be considered to have been carried out if:

a) The identity of the payer has been verified or updated in accordance with subsections I and IV of

section III of chapter IV of this law;

b) The information obtained is subject to conservation in accordance with the provisions of Article 51 of this law.

2 - For the purposes of the provisions of paragraph 5 of Article 7 of Regulation (EU) 2015/847, the verification provided for in paragraphs 3 and 4 of that Article shall be considered to have been carried out if:

a) The identity of the beneficiary has been verified or updated in accordance with subsections I and IV of

section III of chapter IV of this law;

b) The information obtained is subject to retention in accordance with the provisions of Article 51 of this law.

Article 148. Risk-based procedures The beneficiary's payment service providers, when applying the risk-based procedures referred to in the first part of paragraph 1 of Article 8 of Regulation (EU) 2015/847, shall take into account the procedures adopted in compliance with the provisions of Article 28 of this law.

Article 149. Communications on omission of information and adoption of measures Without prejudice to the provisions of the following Article, the communications provided for in the second part of paragraph 2 of Articles 8 and 12 of Regulation (EU) 2015/847 shall be addressed to Banco de Portugal and, if any, to other authorities with competence to supervise compliance with the provisions on combating money laundering and terrorist financing by the payment service providers concerned.

Article 150. Suspicious operations For the purposes of the provisions of Articles 9 and 13 of Regulation (EU) 2015/847:

a) The omission or incompleteness of the required information shall be considered as a factor to be taken into account for strengthening the measures adopted under the duty of identification and diligence provided for in this law;

b) The assessment of the possibly suspicious nature of the transfer of funds, or of any related operation, shall take place within the framework of the duty of examination provided for in Article 52 of this law;

c) Communications of potentially suspicious operations shall be made in accordance with the provisions of Articles 43 and 44 of this law.

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 98 / 122

Article 151. Provision of information 1 - In the context of the provision of information and any other elements under Article 14 of Regulation (EU) 2015/847, payment service providers shall be subject:

a) To the provisions on the duty of cooperation set out in Article 53 of this law;

b) To the provisions on the duty of non-disclosure set out in Article 54 of this law.

2 - In circumstances where the appointment of a central contact point is required, in accordance with the provisions of Article 72 of this law, the provision of information and any other elements under Article 14 of Regulation (EU) 2015/847 and of the preceding paragraph shall be made through that contact point.

Article 152. Data protection For the purposes of Article 15 of Regulation (EU) 2015/847, the provisions of section VII of chapter IV of this law shall be observed, with the necessary adaptations, and payment service providers shall be authorised to process the information elements obtained in compliance with that Regulation.

Article 153. Retention of information For the purposes of Article 16 of Regulation (EU) 2015/847, payment service providers shall retain the records of the information referred to in Articles 4 to 7 of the Regulation in accordance with the provisions of Article 51 of this law.

Article 154. Competent sectoral authority 1 - Banco de Portugal shall be responsible for verifying compliance with the rules set out in Regulation

(EU) 2015/847 by payment service providers established in Portugal.

2 - In the exercise of the functions referred to in the preceding paragraph, Banco de Portugal:

a) Shall have the powers conferred by sections II and IV of chapter VII of this law, with the necessary adaptations;

b) Shall comply, with the necessary adaptations, with the duties provided for in section III of the same

chapter VII, and shall be authorised, under the provisions of Article 106 of this law, to process the information elements relating to the implementation of Regulation (EU) 2015/847;

c) In the event of a serious or repeated violation of the rules set out in Regulation (EU) 2015/847:

i) May proceed with the revocation of the authorisation or other authorisation on which the exercise of the activity of the payment service provider concerned depends, under the provisions of Article 110 of this law or of the applicable sectoral legislation;

ii) Shall communicate any facts or indications likely to determine the reassessment of that authorisation or authorisation, whenever it is not responsible for granting it.

3 - In compliance with the provisions of paragraph a) of the preceding paragraph, Banco de Portugal may issue regulations on the measures to be adopted under Regulation (EU) 2015/847, including with regard to the implementation of Articles 7, 8, 11 and 12

Article 155. Cooperation

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 99 / 122 1 - Banco de Portugal shall provide to the other entities with operational competences in the field of prevention and combating of money laundering and terrorist financing, in accordance with the provisions of Article 124 of this law, all information relating to the implementation of Regulation

(EU) 2015/847.

2 - The international cooperation regime provided for in section II of chapter IX of this law shall also apply to the exchange of all information relating to the implementation of Regulation

(EU) 2015/847.

Article 156. Reporting of irregularities For the purposes of paragraphs 1 and 2 of Article 21 of Regulation (EU) 2015/847, the provisions set out in Articles 108 and 20 of this law shall apply, respectively, with the necessary adaptations.

CHAPTER XII Sanctioning regime

SECTION I Criminal offences

Article 157. Unlawful disclosure of information 1 - The unlawful disclosure, to clients or third parties, of the information, communications, analyses or any other elements provided for in paragraphs a) to d) of paragraph 1 of Article 54 of this law and in the

Article 14 of Regulation (EU) 2015/847, is punished:

a) In the case of natural persons, with a penalty of imprisonment of up to three years or with a fine, under the general terms;

b) In the case of legal persons or entities equivalent to legal persons, with a fine with a minimum limit of not less than 50 days.

2 - In case of mere negligence, the penalty provided for in subparagraph a) of the previous paragraph is reduced to 1/3 at its maximum limit.

Article 158. Disclosure and favoring the discovery of identity 1 - The disclosure or favoring the discovery of the identity of anyone who provided information, documents or elements under Articles 43 to 45, 47 and 53 of this law or Regulation (EU) 2015/847, is punished:

a) In the case of natural persons, with a penalty of imprisonment of up to three years or with a fine, under the general terms;

b) In the case of legal persons or entities equivalent to legal persons, with a fine with a minimum limit of not less than 50 days.

2 - In case of mere negligence, the penalty provided for in subparagraph a) of the previous paragraph is reduced to 1/3 at its maximum limit.

Article 159. Disobedience 1 - Anyone who refuses to comply with the legitimate orders or mandates of the competent authorities, issued within the scope of their functions, or creates any obstacles to their execution, incurs the penalty provided for the crime of qualified disobedience, if the competent authorities have given the warning of that penalty.

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 100 / 122 2 - The same penalty is incurred by anyone who fails to comply with, hinders or defrauds the execution of ancillary sanctions or precautionary measures applied in proceedings initiated for violation of the provisions of this law or their respective regulatory diplomas.

Article 159-A Responsibility and punishment of legal persons and equivalent entities Legal persons and equivalent entities are responsible, under the general terms, for the crimes provided for in this section, without prejudice to the specific limits provided for in Articles 157 and 158

SECTION II Administrative offenses SUBSECTION I General provisions

Article 160. Application in space The provisions of this section are applicable, regardless of the nationality of the agent, to the following facts that constitute an offense against Portuguese law:

a) Facts practiced in Portuguese territory;

b) Facts committed outside national territory for which the entities referred to in Articles 3, 4 and 6 are responsible, acting through branches, agents or distributors or under a service provision arrangement, as well as persons who, in relation to such entities, are in any of the situations provided for in paragraph 1 of Article 163;

c) Facts committed on board Portuguese ships or aircraft, unless a treaty or convention provides otherwise.

Article 161 Responsibility 1 - For the commission of the administrative offences provided for in this section, natural persons, legal persons, even if irregularly constituted, and associations without legal personality may be held liable, jointly or not.

2 - Any person who, by act or omission, causally contributes to the commission of the administrative offences provided for in this law shall be liable as the perpetrator.

Article 162 Liability of legal persons and equivalent entities 1 - Legal persons and entities equivalent to legal persons shall be liable for the administrative offences committed by natural persons who hold positions of administration, management, direction, supervision or inspection, representatives, workers or other collaborators, permanent or occasional, when they act in the exercise of their functions or in the name and in the interest of the collective entity.

2 - The liability of the legal person or entity equivalent to a legal person is excluded only when the agent acts against express orders or instructions of that entity.

3 - The legal invalidity and ineffectiveness of the acts on which the relationship between the individual agent and the legal person or entity equivalent to a legal person is based shall not prevent the liability of either of them.

Article 163 Liability of natural persons

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 101 / 122 1 - The liability of legal persons and entities equivalent to legal persons does not exclude the individual liability of natural persons who hold positions of administration, management, direction, supervision or inspection, representatives, workers or other collaborators, permanent or occasional.

2 - The fact that the unlawfulness or the degree of unlawfulness depends on certain qualities or special relationships of the agent and these are verified only in the person of the represented party, or that the agent is required to perform the act in his or her own interest, with the representative having acted in the interest of the represented party, shall not prevent the liability of the individual agents who represent another.

3 - Natural persons who are members of the bodies of administration, direction or supervision of the legal person or entity equivalent to a legal person shall incur the penalty provided for the perpetrator, specially mitigated, when, cumulatively, they are not directly responsible for the department or area where the infringement was committed and their liability is based solely on the fact that, knowing or being required to know of the commission of the infringement, they did not immediately adopt the appropriate measures to bring it to an end, unless a more serious penalty is applicable to them by virtue of another legal provision.

Article 164 Attempt and negligence 1 - Attempt and negligence are always punishable.

2 - In the case of a negligent infringement, the maximum limit of the fine provided for the infringement is reduced by half.

3 - In the case of an attempt, the applicable fine is that provided for the completed offence, specially mitigated.

Article 165. Concurrent offences 1 - Save as provided in the following paragraph, if the same fact simultaneously constitutes a crime and an administrative offence, the agents are held liable for both offences, and separate proceedings are initiated for that purpose, which are decided by the respectively competent entities.

2 - Without prejudice to liability for both offences, criminal proceedings alone are brought when the crime and the administrative offence have been committed by the same defendant, through the same fact, violating identical legal interests, and the criminal judge may apply the sanctions, including ancillary sanctions, provided for the administrative offence in question.

3 - In the cases provided for in the previous paragraph, the respective sectoral authority must be notified of the decision that ends the proceedings.

Article 166. Limitation 1 - The proceedings relating to the administrative offences provided for in this law are time-barred after five years.

2 - In cases where the facts that are the subject of the administrative offence proceedings have been concealed, the limitation period is suspended until those facts become known to the entity with competence to conduct the administrative offence proceedings.

3 - Without prejudice to the other grounds for suspension and interruption of the limitation period provided for by law, the limitation period for administrative offence proceedings is also suspended from the notification of the order that proceeds to the preliminary examination of the appeal against the decision applying a sanction until the notification of the final decision on the appeal.

4 - The suspension provided for in the previous paragraphs may not exceed:

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 102 / 122

a) 30 months, where the offences are punishable with a fine of up to 1 000 000 €;

b) Five years, where the offences are punishable with a fine of more than 1 000 000 €.

5 - The period referred to in the previous paragraph is doubled if there has been an appeal to the Constitutional Court.

6 - The limitation period for fines and ancillary sanctions is five years, counting from the day on which the administrative decision becomes final or from the day on which the judicial decision becomes final.

Article 167. Graduation of the sanction 1 - The determination of the amount of the fine and of the ancillary sanctions is made according to the concrete unlawfulness of the fact, the fault of the agent and the requirements of prevention, also taking into account the individual or collective nature of the agent.

2 - In determining the concrete unlawfulness of the fact, the fault of the agent and the requirements of prevention, the following circumstances, among others, are taken into account:

a) Duration of the offence;

b) Degree of participation of the defendant in the commission of the offence;

c) Existence of a benefit, or intention to obtain it, for oneself or for another;

d) Existence of damages caused to a third party by the offence and their importance when determinable;

e) Danger or damage caused to the financial system or the national economy;

f) Occasional or repeated nature of the offence;

g) Intensity of intent or negligence;

h) If the administrative offence consists in the omission of the performance of a duty, the time elapsed since the date on which the act should have been performed;

i) Level of responsibilities of the natural person, scope of their functions and respective sphere of action in the legal person or equivalent entity in question;

j) Special duty of the natural person not to commit the offence.

3 - In determining the applicable sanction, the following are also taken into account:

a) The economic situation of the defendant;

b) The previous conduct of the defendant;

c) The existence of acts of concealment aimed at making it difficult to discover the offence;

d) The existence of acts by the agent intended, on their own initiative, to repair the damages or obviate the dangers caused by the offence;

e) The level of collaboration of the defendant with the entity with competence to conduct the administrative offence proceedings.

4 - The fine must, whenever possible, exceed the economic benefit that the defendant or the person whom they intended to benefit have obtained from the commission of the offence.

Article 168. Injunctions and compliance with the violated duty

1 - Whenever the infringement results from the breach of a duty, the application of the sanction and the payment of the fine do not exempt the offender from complying with the duty, if this is still possible.

2 - The competent sectoral authority or the court may subject the offender to an injunction to comply with the duty in question, to cease the unlawful conduct and to prevent its consequences.

3 - If the injunctions referred to in the preceding paragraphs are not complied with within the time limit set by the competent sectoral authority or by the court, the offender incurs the sanction provided for in respect of administrative offences under Article 170. SUBSECTION II Special Offences

Article 169. Administrative Offences The following typical unlawful facts constitute administrative offences:

a) The failure to draw up a document or written record evidencing money laundering and terrorist financing risk management practices, as well as risk analyses of new products, practices or technologies, in breach of Article 14(3)(c) and Article 15(3);

b) The failure to create specific, independent and anonymous channels that internally ensure, in an appropriate manner, the receipt, processing and filing of communications of irregularities, as well as the absence of internal communication of irregularities or the failure to submit a report to the sectoral authorities, in breach of Article 20(1) to (4) and (7);

c) The failure to communicate, on a systematic basis, to the DCIAP and the Financial Intelligence Unit, any typologies of transactions, in breach of Article 45(1);

d) Non-compliance with the rules relating to the communication of real estate activities provided for in Article 46 and in the corresponding regulatory provisions;

e) The failure to draw up the documents or records provided for in Article 47(6) and Article 52(4);

f) The processing of personal data for purposes other than the prevention of money laundering or terrorist financing, in breach of Article 57(2);

g) The failure to adopt the security measures necessary to ensure the effective protection of the information and personal data processed, the failure to provide new customers with information on the processing of personal data, as well as the failure to delete processed personal data, in breach of Article 59;

h) Non-compliance with the duty to provide feedback to the Financial Intelligence Unit provided for in Article 114(2);

i) The failure by payment service providers to retain information on payers and payees together with the transfers, in breach of Article 10 of Regulation (EU) 2015/847;

j) Non-compliance by payment service providers with the obligations on the protection of personal data provided for in Article 15 of Regulation (EU) 2015/847, with the specifications set out in

Article 152 of this Law;

k) The failure by payment service providers to establish adequate internal procedures that allow employees or persons in a comparable position to report infringements committed internally, in breach of Article 21(2) of Regulation (EU) 2015/847, with the specifications set out in Article 156 of this Law;

Directorate of Communication Services and Taxpayer Support DocBaseV/2017 104 / 122

l) Violations of the mandatory provisions of this Law and of the specific legislation, including that of the European Union, governing preventive and repressive measures to combat money laundering and terrorist financing, not provided for in the preceding items and in the following Article, as well as of the regulations issued in compliance with or for the implementation of those provisions;

m) (Repealed.)

n) (Repealed.)

o) (Repealed.)

p) (Repealed.)

q) (Repealed.)

r) (Repealed.)

s) (Repealed.)

t) (Repealed.)

u) (Repealed.)

v) (Repealed.)

w) (Repealed.)

x) (Repealed.)

y) (Repealed.)

z) (Repealed.)

aa) (Repealed.)

bb) (Repealed.)

cc) (Repealed.)

dd) (Repealed.)

ee) (Repealed.)

ff) (Repealed.)

gg) (Repealed.)

hh) (Repealed.)

ii) (Repealed.)

jj) (Repealed.)

kk) (Repealed.)

ll) (Repealed.)

mm) (Repealed.)

nn) (Repealed.)

oo) (Repealed.)

pp) (Repealed.)

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 105 / 122

qq) (Repealed.)

rr) (Repealed.)

ss) (Repealed.)

tt) (Repealed.)

uu) (Repealed.)

vv) (Repealed.)

ww) (Repealed.)

xx) (Repealed.)

yy) (Repealed.)

zz) (Repealed.)

aaa) (Repealed.)

bbb) (Repealed.)

ccc) (Repealed.)

ddd) (Repealed.)

eee) (Repealed.)

fff) (Repealed.)

ggg) (Repealed.)

hhh) (Repealed.)

iii) (Repealed.)

jjj) (Repealed.)

kkk) (Repealed.)

lll) (Repealed.)

mmm) (Repealed.)

nnn) (Repealed.)

ooo) (Repealed.)

ppp) (Repealed.)

qqq) (Repealed.)

rrr) (Repealed.)

sss) (Repealed.)

ttt) (Repealed.)

uuu) (Repealed.)

vvv) (Repealed.)

www) (Repealed.)

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 106 / 122

xxx) (Repealed.)

yyy) (Repealed.)

zzz) (Repealed.)

aaaa) (Repealed.)

bbbb) (Repealed.)

cccc) (Repealed.)

dddd) (Repealed.)

eeee) (Repealed.)

ffff) (Repealed.)

gggg) (Repealed.)

hhhh) (Repealed.)

iiii) (Repealed.)

jjjj) (Repealed.)

kkkk) (Repealed.)

llll) (Repealed.)

mmmm) (Repealed.)

nnnn) (Repealed.)

oooo) (Repealed.)

pppp) (Repealed.)

qqqq) (Repealed.)

rrrr) (Repealed.)

Article 169.º-A Especially serious administrative offences The following typical unlawful acts constitute especially serious administrative offences:

a) The entering into or participation in any transactions resulting in non-compliance with the limits on the use of cash, in breach of the provisions of Article 10.º and the corresponding regulatory provisions;

b) The commission of acts that may result in the involvement of the obligated entities in any money laundering or terrorist financing operation, as well as the failure to adopt all appropriate measures to prevent such involvement, in breach of the provisions of paragraph 3 of Article 11.º and the corresponding regulatory provisions;

c) The breach of the internal control system rules provided for in Article 12.º and the corresponding regulatory provisions;

d) Non-compliance with the duties of the management body provided for in paragraphs 2 and 3 of Article 13.º and the corresponding regulatory provisions;

e) The breach of the risk management rules provided for in paragraphs 1 and 2 and in items a) and b) of paragraph 3 of Article 14.º and the corresponding regulatory provisions;

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 107 / 122

f) Non-compliance with the duties relating to the launch of new products, practices or technologies provided for in paragraph 2 of Article 15.º and the corresponding regulatory provisions;

g) Failure to appoint a compliance officer, as provided for in paragraphs 1 and 7 of Article 16.º and the corresponding regulatory provisions;

h) Non-compliance with the provisions set out in paragraphs 2 to 6 and 8 of Article 16.º and the corresponding regulatory provisions;

i) Non-compliance with the rules relating to effectiveness assessment provided for in paragraphs 1 to 3 of Article 17.º and the corresponding regulatory provisions;

j) Non-compliance with the rules relating to general procedures and information systems provided for in Article 18.º and the corresponding regulatory provisions;

k) Non-compliance with the rules relating to specific procedures and information systems provided for in Article 19.º and the corresponding regulatory provisions;

l) Acting in breach of the provisions of paragraph 6 of Article 20.º and the corresponding regulatory provisions;

m) Non-compliance with the rules relating to the adoption of the means and mechanisms necessary to ensure compliance with restrictive measures as provided for in Article 21.º and the corresponding regulatory provisions;

n) Non-compliance with the rules relating to group relationships and establishments abroad provided for in paragraphs 1 to 6 and 8 of Article 22.º, in Article 62.º-A and the corresponding regulatory provisions;

o) Non-compliance with the identification and due diligence procedures provided for in Articles 23.º to 27.º, 76.º and 77.º and in the corresponding regulatory provisions;

p) Non-observance of the rules relating to the proportionality to the degree of risk provided for in Article 28.º and in the corresponding regulatory provisions;

q) Non-compliance with the duties relating to knowledge, assessment of quality and identification of beneficial owners, understanding of their respective ownership and control structure, as well as consultation of the central register of beneficial owners, provided for in paragraphs 1 to 4 and 6 of Article 29.º, in Articles 31.º and 32.º and in paragraphs 2 and 3 of Article 34.º and in the corresponding regulatory provisions;

r) Adoption of simplified identification and due diligence measures, in breach of the provisions of Article 35.º and of the corresponding regulatory provisions;

s) The non-compliance with the rules relating to the adoption of enhanced identification and due diligence measures provided for in Articles 36 to 39 and the corresponding regulatory provisions;

t) The failure to comply with the updating procedures provided for in Article 40 and the corresponding regulatory provisions;

u) The failure to comply with the rules relating to the performance of the identification and due diligence duty by third parties provided for in Articles 41 and 42 and the corresponding regulatory provisions;

v) The failure to comply with the rules relating to the reporting of suspicious transactions provided for in paragraphs 1 and 2 of Article 43, in Article 44 and the corresponding regulatory provisions;

w) The failure to comply with the duty of abstention provided for in paragraph 1 of Article 47 and the corresponding regulatory provisions;

x) The breach of the rules relating to the communication of transactions provided for in paragraphs 2 and 3 of Article 47 and in the corresponding regulatory provisions;

y) The execution of transactions in respect of which the duty to abstain has been exercised in breach of the provisions of paragraph 5 of Article 47 and in the corresponding regulatory provisions;

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 108 / 122

z) The failure to temporarily suspend transactions determined or confirmed under Articles 48 and 49 and in the corresponding regulatory provisions;

aa) The breach of the refusal duties provided for in paragraphs 1 to 3 of Article 50 and in the corresponding regulatory provisions;

bb) The failure to draw up a written document or record, under the terms provided for in paragraph 4 of Article 50 and in the corresponding regulatory provisions;

cc) The return of funds or other assets entrusted to obliged entities, outside the terms defined by the sectoral authorities, in breach of the provisions of paragraph 6 of Article 50 and in the corresponding regulatory provisions;

dd) The breach of the duty of safekeeping provided for in paragraphs 1 to 3 and 5 of Article 51 and in the corresponding regulatory provisions;

ee) The breach of the duty to examine with special care and attention any conduct, activity or transaction whose characteristic elements make it susceptible of being related to funds or other assets from terrorist financing or other criminal activities, intensifying the degree and nature of its monitoring, provided for in paragraph 1 of Article 52 and in the corresponding regulatory provisions;

ff) The breach of the duty of cooperation provided for in Article 53 and in the corresponding regulatory provisions;

gg) The breach of the duty of non-disclosure provided for in paragraph 1 of Article 54 and in the corresponding regulatory provisions;

hh) Acting without the necessary prudence towards clients related to the execution of potentially suspicious transactions, or carrying out any steps that may give rise to suspicion that investigation procedures related to money laundering or terrorist financing are underway, in breach of the provisions of paragraph 5 of Article 54 and in the corresponding regulatory provisions;

ii) The breach of the communication duty provided for in paragraph 6 of Article 54 and in the corresponding regulatory provisions;

jj) The breach of the training duty provided for in paragraphs 1 to 4 of Article 55, in Article 75 and in the corresponding regulatory provisions;

kk) The breach of the duties to reduce to writing, to keep and to make available to the sectoral authorities the elements provided for in paragraph 4 of Article 12, in paragraph 4 of Article 14, in paragraph 4 of

Article 17, in paragraph 5 of Article 20, in paragraph 5 of Article 29, in paragraph 3 of Article 43, in paragraph 2 of Article 45, in paragraph 7 of Article 47, in paragraph 5 of Article 50, in paragraph 5 of Article 52 and in paragraph 5 of Article 55 and in the corresponding regulatory provisions;

ll) Acting in breach of the provisions of paragraph 3 of Article 56 and in the corresponding regulatory provisions;

mm) The breach of confidentiality, in breach of the provisions of paragraph 6 of Article 56 and in the corresponding regulatory provisions;

nn) The breach of the preventive duties of money laundering and terrorist financing in relation to transactions and their counterparties that financial entities carry out on their own account and on behalf of third parties that do not have the status of client and, on their own account or not, between the financial entity and any other entities that are part of the same group, outside the scope of a client relationship, provided for in Article 63 and in the corresponding regulatory provisions;

oo) The opening, maintenance or existence of passbooks, safes or anonymous accounts, whatever their nature, as well as the use of fictitious denominations or names, or the issuance, use

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 109 / 122 or the acceptance of payments in anonymous electronic money, including using anonymous prepaid instruments, in breach of the provisions of Article 64 and in the corresponding regulatory provisions;

pp) The permission to carry out transactions on an account, by the client or on their behalf, the provision of payment instruments on the same or the carrying out of changes in its ownership, while the identity of the client and the beneficial owner has not been verified, in breach of the provisions of Article 65 and in the corresponding regulatory provisions;

qq) The establishment or maintenance of correspondent relationships with shell banks or with financial entities that knowingly allow their accounts to be used by shell banks, in breach of the provisions of paragraphs 1 and 2 of Article 66 and in the corresponding regulatory provisions;

rr) The failure by financial entities to comply with the duty to terminate the correspondent relationship with shell banks or with financial entities that knowingly allow their accounts to be used by shell banks, as well as the failure to immediately communicate to the respective sectoral authority, in breach of the provisions of paragraph 3 of Article 66 and in the corresponding regulatory provisions;

ss) The failure to adopt normal complementary measures in the context of Life insurance contracts, in breach of the provisions of Article 68 and in the corresponding regulatory provisions;

tt) The absence, inadequacy or incompleteness of the application of enhanced measures in the context of Life insurance contracts, in breach of the provisions of Article 69 and in the corresponding regulatory provisions;

uu) The breach of the rules relating to enhanced measures when financial entities act as correspondents, within the framework of cross-border correspondent relationships with respondents from third countries, provided for in Article 70 and the corresponding regulatory provisions;

vv) The breach of the rules relating to enhanced measures when financial entities act as respondents, within the framework of any cross-border correspondent relationships, provided for in

Article 71 and the corresponding regulatory provisions;

ww) The breach of the duties provided for in paragraph 2 of Article 72 and the corresponding regulatory provisions, by payment institutions and electronic money institutions that operate in Portugal through agents or distributors;

xx) The breach of the duty to provide information by financial entities authorised to operate in Portugal under the free provision of services regime provided for in point b) of paragraph 1 of Article 73 and the corresponding regulatory provisions;

yy) The absence, inadequacy or incompleteness of the mechanisms necessary to verify the identity of players, in breach of the provisions of Article 78 and the corresponding regulatory provisions;

zz) The breach of the duty to provide collaboration by agents or distributors of payment institutions or electronic money institutions headquartered in another Member State provided for in paragraph 3 of Article 107 and the corresponding regulatory provisions;

aaa) Acting in breach of the provisions of paragraph 4 of Article 108 and the corresponding regulatory provisions;

bbb) The breach of the rules on the registration of providers of services to companies, to other legal persons or to centres of collective interests without legal personality, provided for in Article 112 and the corresponding regulatory provisions;

ccc) The breach of the rules relating to the registration of entities that carry out activities with virtual assets provided for in Article 112-A and the corresponding regulatory provisions;

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 110 / 122 ddd) The breach of the registration and record-keeping duties provided for in Article 144 and the corresponding regulatory provisions;

eee) The breach, by non-profit organisations, of the duties provided for in paragraph 1 of Article 146 and the corresponding regulatory provisions;

fff) The breach, by payment service providers, of the duties provided for in Articles 4, 5 and 6 of Regulation (EU) 2015/847, with the specifications set out in paragraph 1 of Article 147 of this law and the corresponding regulatory provisions;

ggg) The breach, by payment service providers, of the duties provided for in Article 7 of Regulation (EU) 2015/847, with the specifications set out in paragraph 2 of Article 147 of this law and the corresponding regulatory provisions;

hhh) The failure, by payment service providers, to apply risk-based procedures, in breach of the provisions of the first part of paragraph 1 of Article 8 of Regulation (EU) 2015/847, with the specifications set out in Article 148 of this law and the corresponding regulatory provisions;

iii) The failure to reject transfers or the failure to request information on the payer and the payee, by payment service providers, in breach of the provisions of the second part of paragraph 1 of Articles 8 and 12 of Regulation (EU) 2015/847 and the corresponding regulatory provisions;

jjj) The failure to adopt measures, by payment service providers, in cases of repeated failure to provide information on the payer or the payee, in breach of the provisions of the first part of paragraph 2 of Articles 8 and 12 of Regulation (EU) 2015/847 and the corresponding regulatory provisions;

kkk) The failure to report to the competent authority, by payment service providers, of omissions of information and the measures adopted, in breach of the provisions of the second part of paragraph 2 of Articles 8 and 12 of Regulation (EU) 2015/847, with the specifications set out in Article 149 of this law and the corresponding regulatory provisions;

lll) The failure, by payment service providers, to consider the omitted or incomplete nature of the information on the payers or the payees, in breach of the provisions of Articles 9 and 13 of Regulation (EU) 2015/847, with the specifications set out in points a) and b)

of Article 150 of this law and the corresponding regulatory provisions;

mmm) The failure to report, by payment service providers, of suspicious transactions, in breach of the provisions of Articles 9 and 13 of Regulation (EU) 2015/847, with the specifications set out in point c) of Article 150 of this law, and the corresponding regulatory provisions;

nnn) The failure, by payment service providers, to apply effective procedures for the analysis of the information fields on the payers and the payees and for the detection of the omission of information on them, in breach of the provisions of Article 11 of Regulation

(EU) 2015/847 and the corresponding regulatory provisions;

ooo) The failure, by payment service providers, to apply risk-based procedures, in breach of the provisions of the first part of paragraph 1 of Article 12 of Regulation (EU) 2015/847 and the corresponding regulatory provisions;

ppp) The absence, inadequacy or incompleteness of the provision of collaboration, by payment service providers, to the DCIAP, the Financial Information Unit, the other judicial and police authorities or the sectoral authorities, in breach of the provisions of Article 14 of Regulation

(EU) 2015/847, and with the specifications set out in point (a) of paragraph 1 and paragraph 2 of Article 151 of this law and in the corresponding regulatory provisions;

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 111 / 122 qqq) The failure, by payment service providers, to comply with the duties set out in Article 54 in conjunction with point (b) of paragraph 1 of Article 151, and in the corresponding regulatory provisions;

rrr) The failure, by payment service providers, to comply with the duties on the preservation of information, in breach of the provisions of Article 16 of Regulation (EU) 2015/847, with the specifications set out in Article 153 of this law and in the corresponding regulatory provisions;

sss) The commission or omission of acts likely to prevent or hinder the exercise of the inspection activity of the sectoral authorities;

ttt) The failure to provide information and the provision in incomplete form of other elements owed to the sectoral authorities, within the established time limits;

uuu) The provision to the sectoral authorities of false information or incomplete information likely to lead to erroneous conclusions with an effect identical or similar to that which false information on the same subject would have;

vvv) Unlawful disobedience to determinations of the sectoral authorities, specifically issued, under the terms of the law, for the individual case considered;

www) The failure to comply with countermeasures adopted by the sectoral authorities;

xxx) The failure to comply with decisions of the sectoral authorities ordering the closure of establishments, under the terms of this law.

Article 170 Fines 1 - The especially serious administrative offences provided for in Article 169-A are punishable as follows:

a) When the offence is committed in the course of the activity of a credit institution or financial institution:

i) With a fine of 50 000 € to 5 000 000 €, if the offender is a legal person or an entity equated to a legal person;

ii) With a fine of 25 000 € to 5 000 000 €, if the offender is a natural person;

b) When the offence is committed in the course of the activity of another financial entity:

i) With a fine of 25 000 € to 2 500 000 €, if the offender is a legal person or an entity equated to a legal person;

ii) With a fine of 12 500 € to 2 500 000 €, if the offender is a natural person;

c) When the offence is committed in the course of the activity of one of the non-financial entities referred to in points (a) to (c) of paragraph 1 of Article 4:

i) With a fine of 50 000 € to 1 000 000 €, if the offender is a legal person or an entity equated to a legal person;

ii) With a fine of 25 000 € to 1 000 000 €, if the offender is a natural person;

d) When the offence is committed in the course of the activity of another non-financial entity, with the exception of certified accountants, lawyers, solicitors and notaries:

i) With a fine of 5000 € to 1 000 000 €, if the offender is a legal person or an entity equated to a legal person;

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 112 / 122

ii) With a fine of 2500 € to 1 000 000 €, if the offender is a natural person;

e) When the offence is committed by a legal person, an entity equated to a legal person or a natural person that does not fall within the situations provided for in the preceding points:

i) With a fine of 3000 € to 1 000 000 €, if the offender is a legal person or an entity equated to a legal person;

ii) With a fine of 1000 € to 500 000 €, if the offender is a natural person.

2 - When the offence committed constitutes an administrative offence under Article 169, the amounts provided for in the preceding paragraph shall apply, with the maximum amounts reduced by half.

Article 171 Aggravation of the limits of fines 1 - Whenever the amount corresponding to twice the economic benefit resulting from the commission of an administrative offence provided for in this section is determinable and higher than the maximum limit of the applicable fine, this limit shall be raised to that amount.

2 - In the specific case of legal persons that are credit institutions or financial institutions or any of the non-financial entities referred to in points (a) to (c) of paragraph 1 of Article 4, the applicable maximum limits provided for in the preceding article shall be raised to the amount corresponding to 10% of the total annual turnover, in accordance with the latest available accounts approved by the management body, whenever this amount is higher than those limits.

3 - If the credit institution or financial institution is a parent company or a subsidiary of the parent company obliged to prepare consolidated financial accounts, the turnover to be considered for the purposes of the provisions of the preceding paragraph is the total annual turnover or the corresponding type of income, in accordance with the applicable accounting directives, under the terms of the latest available consolidated accounts approved by the management body of the ultimate parent company on which that company depends.

4 - When the maximum limits provided for in the preceding article are simultaneously liable to aggravation under the terms of paragraphs 1 and 2, the higher amount shall prevail as the maximum limit.

Article 172 Ancillary sanctions 1 - Together with the fines provided for in Article 170, the following ancillary sanctions may be applied:

a) Loss, in favour of the State, of the object of the offence and of the economic benefit obtained by the offender through its commission;

b) Closure, for a period of up to two years, of the establishment where the offender carries on the profession or activity to which the administrative offence relates;

c) Prohibition, for a period of up to three years, of the exercise of the profession or activity to which the administrative offence relates;

d) Prohibition, for a period of up to three years, from performing functions of administration, management, leadership, holding of corporate bodies, representation, mandate and supervision in entities subject to the supervision or oversight of the competent sectoral authority and in entities that are in a relationship of control or group with these;

e) Publication of the final or res judicata decision.

2 - The publication referred to in paragraph e) of the previous number is carried out, in full or by extract, at the expense of the offender, in a suitable place for the fulfillment of the purposes of general prevention of the

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 113 / 122 legal system, namely in a national, regional or local newspaper, whichever, in the case, appears more appropriate.

SUBSECTION III Procedural provisions

Article 173.º Competence 1 - Without prejudice to the provisions of the following number, the investigative and decision-making competences of the proceedings initiated for the practice of the administrative offenses provided for in this section belong:

a) To the Insurance and Pension Funds Supervisory Authority, the Bank of Portugal or the CMVM, in the case of administrative offenses practiced by the financial entities referred to in nos. 1 and 2 and in paragraph a)

of no. 3 of article 3.º, within the specific scope of the supervisory competences conferred on those authorities by articles 85.º to 88.º;

b) To the Bank of Portugal, in the case of administrative offenses practiced by the entities referred to in paragraph

o) of no. 1 of article 4.º, in paragraph a) of article 5.º and in article 6.º;

c) To the CMVM:

i) In the case of administrative offenses practiced by auditors, referred to in paragraph e) of no. 1 of article 4.º;

ii) In the case of administrative offenses practiced by the entities referred to in subparagraph i) of paragraph b) of

article 5.º;

d) To the Inspeção-Geral de Finanças, in the case of administrative offenses practiced by the financial entity referred to in paragraph b) of no. 3 of article 3.º;

e) To the Serviço de Regulação e Inspeção de Jogos do Turismo de Portugal, I. P., as regards the investigative competence, and to the Comissão de Jogos do Turismo de Portugal, I. P., as regards the decision-making competence, in the case of administrative offenses practiced by the non-financial entities referred to in paragraphs a) and c) of no. 1 of article 4.º;

f) To the Inspeção-Geral do Ministério do Trabalho, Solidariedade e da Segurança Social as regards the investigative competence, and to the member of the Government responsible for Labor, Solidarity and Social Security, as regards the decision-making competence, in the case of administrative offenses practiced by the non-financial entities referred to in paragraph b) of no. 1 of article 4.º;

g) To the IMPIC, I. P., in the case of administrative offenses practiced by the non-financial entities referred to in paragraph d) of no. 1 of article 4.º;

h) To the ASAE:

i) In the case of administrative offenses practiced by the other non-financial entities referred to in article 4.º, with the exception of certified accountants, lawyers, solicitors and notaries;

ii) In the case of administrative offenses practiced by the entities referred to in subparagraphs ii) and iii) of paragraph

b) of article 5.º 2 - The investigative and decision-making competences of the proceedings initiated for the practice of the administrative offense provided for in paragraph d) of article 169.º always belong to the IMPIC, I. P., whatever the nature of the offending entity.

3 - When the administrative offenses provided for in this section are practiced by a legal person, an entity equivalent to a legal person or a natural person of a nature different from the entities provided for in articles 3.º to 6.º, the investigative and decision-making competences belong to the sectoral authority before which the adoption of the behavior or cessation of the conduct is due.

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 114 / 122

Article 174.º Precautionary measures 1 - When it proves necessary to safeguard the effective investigation or instruction of the administrative offense proceedings, the financial system or the rights of interested parties, the entity with decision-making competence for the administrative offense proceedings may:

a) Determine the imposition of conditions on the exercise of the activity by the agent of the illicit practice, namely compliance with special information duties or certain technical rules;

b) Determine the requirement of a request for prior authorization from the competent sectoral authority for the practice of certain acts;

c) Determine the preventive suspension of the exercise of a certain activity, function or position by the agent of the illicit practice;

d) Determine the preventive closure, in whole or in part, of the establishment where the illicit practice takes place;

e) Determine the preventive suspension of the authorization granted for the exercise of the activity or profession to which the administrative offense relates;

f) Determine the seizure of objects that have served or were intended to serve for the practice of an offense.

2 - The adoption of any of the measures referred to in the previous number must respect the principles of necessity, adequacy and proportionality, and be preceded by a hearing of the agent of the illicit practice, except when the application of the precautionary measure proves urgent or when that diligence could compromise the execution or the usefulness of the decision.

3 - The measures provided for in no. 1 remain in force, depending on the cases:

a) For the period stipulated by the entity with decision-making competence for the administrative offense proceedings;

b) Until their revocation by the entity with decision-making competence for the administrative offense proceedings or by judicial decision;

c) Until the beginning of compliance with an ancillary sanction of equivalent effect.

4 - The measures provided for in paragraphs c) and d) of no. 1 may be subject to publication.

5 - When, under the terms of paragraph c) of no. 1, the total suspension of the activities or functions exercised by the agent of the unlawful practice is determined and the latter is subsequently convicted, in the same proceeding, of an ancillary sanction consisting of a prohibition or disqualification from exercising the same activities or functions, the duration of the preventive suspension shall be deducted from the enforcement of the ancillary sanction.

Article 175. Suspension of the enforcement of the sanction 1 - The sectoral authorities may suspend, in whole or in part, the enforcement of the sanctions they impose, whenever they conclude that, in that way, the purposes of prevention are still achieved in an adequate and sufficient manner.

2 - The suspension may be made subject to compliance with certain obligations, in particular those considered necessary for the regularization of unlawful situations, the reparation of damage or the prevention of dangers.

3 - The period of suspension shall be set between two and five years, counted from the date on which the conviction decision becomes final or res judicata.

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 115 / 122 4 - The suspension does not cover the costs.

5 - Once the period of suspension has elapsed without the agent having committed any criminal offence or administrative offence for the prosecution of which the same sectoral authority is competent, and without having breached the obligations imposed on him, the sanction whose enforcement had been suspended shall be deemed extinguished; otherwise, it shall be enforced, when it is shown that the purposes underlying the suspension could not be achieved through it.

Article 176. Destination of the fines and of the economic benefit Regardless of the stage at which the conviction decision becomes final or res judicata, the proceeds of the fines and of the economic benefit seized in administrative offence proceedings shall accrue:

a) Entirely to the Deposit Guarantee Fund, in the case of amounts related to administrative offence proceedings in which the entity with investigative competence is Banco de Portugal;

b) Entirely to the Investor Compensation System, in the case of amounts related to administrative offence proceedings in which the entity with investigative competence is the CMVM;

c) 60 % to the State and 40 % to the respective sectoral authority, in the case of amounts related to administrative offence proceedings in which the entity with investigative competence is the Serviço de Regulação e Inspeção de Jogos do Turismo de Portugal, I. P., the Inspeção-Geral do Ministério do Trabalho, Solidariedade e da Segurança Social, the IMPIC, I. P., or the ASAE;

d) Entirely to the respective sectoral authority, in all other cases.

Article 177. Liability for payment 1 - Where the infringements are also attributable to legal persons and entities equated to legal persons, the latter shall be jointly and severally liable for the payment of the fine and of the costs to which the respective holders of management, administration, direction, supervisory or inspection functions, as well as their representatives, employees or other permanent or occasional collaborators, are convicted for the commission of infringements punishable under this law.

2 - Where the infringements are also attributable to the holders of the management bodies of legal persons and entities equated to legal persons who, being able to do so, did not oppose their commission, those holders of management bodies shall be individually and subsidiarily liable for the payment of the fine and of the costs to which the respective legal persons and entities equated to legal persons are convicted, even if, at the date of conviction, they have been dissolved or have entered into liquidation.

Article 178. Disclosure of the decision 1 - Immediately after the expiry of the period for the respective judicial challenge, the conviction decision for the commission of administrative offences provided for in this section must be disclosed on the website of the competent sectoral authority on the Internet, even if such decision has been subject to challenge.

2 - The disclosure referred to in the previous paragraph may be made in full or by extract including at least the identity of the natural persons, legal persons or entities equated to legal persons convicted and information on the type and nature of the infringement.

3 - In cases where the conviction decision has been subject to judicial challenge, the competent sectoral authority must:

a) Expressly mention that fact in the disclosure of the decision;

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 116 / 122

b) Publish on its respective website any subsequent information on the outcome of the appeal lodged, including any decision that revokes the previous decision.

4 - Where, after a prior case-by-case assessment, it is concluded that the disclosure of the decision and the publication of personal data could be disproportionate in view of the seriousness of the infringement, jeopardise the stability of the financial markets, compromise an ongoing investigation or cause disproportionate damage to the institutions or natural persons concerned, the sectoral authority must:

a) Disclose the decision on an anonymous basis, completing the publication with the personal data only when the grounds for not disclosing them cease to exist;

b) Postpone the disclosure of the decision until the moment when the grounds for not disclosing it cease to exist;

c) Cancel the disclosure of the decision, when the solutions provided for in the previous paragraphs prove insufficient to guarantee the proportionality of the disclosure measure in view of the seriousness of the infringement, as well as the stability of the financial markets.

5 - Without prejudice to the possible application of a shorter period provided for in the personal data protection legislation, the information disclosed under the preceding paragraphs remains available on the website of the competent sectoral authority for five years, counted, as the case may be, from the date of publication or from the date on which the conviction decision becomes final or res judicata, and may not be indexed by Internet search engines.

SUBSECTION IV Appeal

Article 179. Competent court The Competition, Regulation and Supervision Court is the competent court to hear appeals, reviews and enforcement of decisions or any other measures legally subject to challenge taken in administrative offence proceedings brought under this law.

Article 180. Reformatio in pejus The principle prohibiting reformatio in pejus does not apply to administrative offence proceedings brought and decided under this law, and this information must be included in all final decisions that allow challenge or appeal.

SUBSECTION V Other provisions

Article 181. Communication of sanctions The Insurance and Pension Funds Supervisory Authority, the Bank of Portugal and the CMVM must communicate to the European Supervisory Authorities the sanctions applied to credit institutions and financial institutions for the commission of administrative offences provided for in this law, as well as any appeal filed against the decisions applying them and the respective outcome.

Article 182. Subsidiary law To the offences provided for in this section, in everything that does not contradict its provisions, the following apply subsidiarily:

a) In the case of administrative offence proceedings in which the investigative competence lies with the Insurance and Pension Funds Supervisory Authority, the provisions set out, depending on the matter in question:

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 117 / 122

i) Of Chapter II of Title VIII of the legal regime for access to and pursuit of the insurance and reinsurance activity, approved by Article 2 of Law No. 147/2015, of 9 September;

ii) Of Chapter VII of the legal regime for the distribution of insurance and reinsurance, approved by paragraph 2 of

Article 1 of Law No. 7/2019, of 16 January;

iii) Of Chapter II of Title IX of Decree-Law No. 12/2006, of 20 January, which regulates the incorporation and operation of pension funds and pension fund management entities;

iv) Of the procedural regime applicable to special crimes in the insurance and pension funds sector and to administrative offences whose processing is the responsibility of the Insurance and Pension Funds Supervisory Authority, approved by Article 3 of Law No. 147/2015, of 9 September;

b) In the case of administrative offence proceedings in which the investigative competence lies with the Bank of Portugal, the provisions set out in Title XI of the General Regime for Credit Institutions and Financial Companies, approved by Decree-Law No. 298/92, of 31 December;

c) In the case of administrative offence proceedings in which the investigative competence lies with the CMVM, the provisions set out in the Securities Code;

d) In the case of administrative offence proceedings in which the investigative competence lies with the Gaming Regulation and Inspection Service of Turismo de Portugal, I. P., the provisions set out, depending on the matter in question:

i) Of Chapter IX of Decree-Law No. 422/89, of 2 December;

ii) Of Chapter V of the Legal Regime for Online Games and Betting, approved by Decree-Law No. 66/2015, of 29 April;

iii) Of Chapters VIII and IX of Decree-Law No. 31/2011, of 4 March;

iv) Of the general regime for the offence of mere social ordering, set out in Decree-Law No. 433/82, of 27 October;

e) In the case of administrative offence proceedings in which the investigative competence lies with other sectoral authorities, the provisions set out in the general regime for the offence of mere social ordering, set out in Decree-Law No. 433/82, of 27 October.

SECTION III Disciplinary offences

Article 183. Disciplinary liability The violation, by a certified accountant, lawyer, solicitor or notary, of the duties provided for in this law or in the respective regulations constitutes an offence of a disciplinary nature, punishable in accordance with the statute of the respective professional association and other applicable legislation and regulations.

Article 184. Sanctions 1 - Where, under the statute, the offence is punishable by a fine, the maximum limit thereof is doubled, where the amount corresponding to the economic benefit resulting from the commission of the offence is determinable and greater than €500,000.

2 - In determining the measure of the sanctions, account must be taken of the degree of fault and the personality of the agent, the consequences of the offence and all other mitigating and aggravating circumstances provided for in the applicable legal framework.

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 118 / 122 3 - In the case of notaries, the disciplinary power lies with the Minister of Justice and the Order of Notaries, under the terms set out in paragraph 1 of Article 62 of the Notarial Statute, approved by Decree-Law No. 26/2004, of 4 February.

Article 185. Communication of irregularities and disclosure of conviction decisions The rules set out in the following apply, with the necessary adaptations:

a) Article 20 and Article 108, on the communication of irregularities;

b) Article 178, on the disclosure of conviction decisions.

CHAPTER XIII Legislative amendments

Article 186. Amendment to the Penal Code Article 368-A of the Penal Code, approved by Decree-Law No. 400/82, of 23 September, and amended by Law No. 6/84, of 11 May, by Decree-Laws Nos. 101-A/88, of 26 March, 132/93, of 23 April, and 48/95, of 15 March, by Laws Nos. 90/97, of 30 July, 65/98, of 2 September, 7/2000, of 27 May, 77/2001, of 13 July, 97/2001, 98/2001, 99/2001 and 100/2001, of 25 August, and 108/2001, of 28 November, by Decree-Laws Nos. 323/2001, of 17 December, and 38/2003, of 8 March, by Laws Nos. 52/2003, of 22 August, and 100/2003, of 15 November, by Decree-Law No. 53/2004, of 18 March, by Laws Nos. 11/2004, of 27 March, 31/2004, of 22 July, 5/2006, of 23 February, 16/2007, of 17 April, 59/2007, of 4 September, 61/2008, of 31 October, 32/2010, of 2 September, 40/2010, of 3 September, 4/2011, of 16 February, 56/2011, of 15 November, 19/2013, of 21 February, and 60/2013, of 23 August, by Organic Law No. 2/2014, of 6 August, by Laws Nos. 59/2014, of 26 August, 69/2014, of 29 August, and 82/2014, of 30 December, by Organic Law No. 1/2015, of 8 January, and by Laws Nos. 30/2015, of 22 April, 81/2015, of 3 August, 83/2015, of 5 August, 103/2015, of 24 August, 110/2015, of 26 August, 39/2016, of 19 December, and 8/2017, of 3 March, is hereby amended to read as follows:

"Article 368-A [...]

1 - For the purposes of the following paragraphs, advantages shall be considered to be the assets derived from the practice, in any form of participation, of the typical unlawful acts of pimping, sexual abuse of children or dependent minors, extortion, trafficking in narcotic drugs and psychotropic substances, arms trafficking, trafficking in human organs or tissues, trafficking in protected species, tax fraud, influence peddling, corruption and other offences referred to in paragraph 1 of Article 1 of Law No. 36/94, of 29 September, and in Article 324 of the Industrial Property Code, and of the typical unlawful acts punishable by a prison sentence of a minimum duration exceeding six months or a maximum duration exceeding five years, as well as the assets obtained with them.

2 - [...]

3 - [...]

4 - Punishment for the crimes provided for in paragraphs 2 and 3 shall take place even if the place where the act was committed or the identity of its perpetrators is unknown, or even if the acts constituting the underlying offence were committed outside national territory, unless they are lawful acts under the law of the place where they were committed and to which Portuguese law is not applicable under the terms of Article 5. 5 - The act is punishable even if the criminal proceedings relating to the typical unlawful acts from which the advantages derive depend on a complaint and it has not been filed.

6 - [...]

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 119 / 122 7 - [...]

8 - [...]

9 - [...]

10 - [...]"

Article 187. Amendment to the Industrial Property Code Article 324 of the Industrial Property Code, approved by Decree-Law No. 36/2003, of 5 March, and amended by Decree-Laws Nos. 318/2007, of 26 September, and 360/2007, of 2 November, by Law No. 16/2008, of 1 April, by Decree-Law No. 143/2008, of 25 July, and by Laws Nos. 52/2008, of 28 August, and 46/2011, of 24 June, is hereby amended to read as follows:

"Article 324 [...]

Anyone who sells, puts into circulation or conceals counterfeit products, in any of the ways and under the conditions referred to in Articles 321 to 323, with knowledge of that situation, shall be punished with a prison sentence of up to 18 months or a fine of up to 120 days."

CHAPTER XIV Transitional and final provisions

Article 188. Transitional provisions 1 - Tied insurance intermediaries are exempt from the obligations provided for in this law until the entry into force of the legal instrument that transposes into domestic law Directive

(EU) 2016/97 of the European Parliament and of the Council, of 20 January 2016.

2 - When related to the preservation of relevant elements in pending judicial and administrative proceedings concerning the prevention, detection, investigation or repression of suspicions of money laundering or terrorist financing, the time limits provided for in Article 51 are extended by the duration of the proceedings, with a deadline of 25 June 2025.

3 - The provisions of the previous paragraph shall not prejudice the legal rules applicable in matters of evidence relating to criminal investigations and pending judicial and administrative proceedings.

4 - The exemption provided for in Article 5 of Law No. 25/2008, of 5 June, shall persist until the approval of a regulatory rule to be issued by the Bank of Portugal, which defines the terms under which this law is applicable to the activities benefiting from that exemption.

5 - Obliged entities shall make available the means referred to in paragraph 3 of Article 25 of this law from 1 January 2019.

6 - Without prejudice to the provisions of the previous paragraph, until 1 January 2019 obliged entities, when proving the identifying elements of natural persons, may use the means provided for in paragraphs 2 and 4 of Article 25.

Article 189. References 1 - All references made by other legal instruments to the legal instruments repealed under the terms of the following article shall be considered, henceforth, to be made to this law.

2 - All references made by other legal instruments to Directive 2005/60/EC of the European Parliament and of the Council, of 26 October 2005, shall be considered, henceforth, to be made to Directive

(EU) 2015/849 of the European Parliament and of the Council, of 20 May 2015.

Direção de Serviços de Comunicação e Apoio ao Contribuinte DocBaseV/2017 120 / 122 3 - All references made by other legal instruments to Regulation (EC) No. 1781/2006 of the European Parliament and of the Council of 15 November 2006 shall be construed, from now on, as references to Regulation (EU) 2015/847 of the European Parliament and of the Council of 20 May 2015.

Article 190.º Repeal provision 1 - The following are repealed:

a) Law No. 25/2008 of 5 June, as amended by Decree-Law No. 317/2009 of 30 October, by Law No. 46/2011 of 24 June, by Decree-Laws Nos. 242/2012 of 7 November, 18/2013 of 6 February, and 157/2014 of 24 October, and by Laws Nos. 62/2015 of 24 June, and 118/2015 of 31 August;

b) Decree-Law No. 125/2008 of 21 July;

c) Order No. 150/2013 of 19 February, published in the Diário da República, 2nd series, No. 53, of 15 March 2013.

2 - The amendments introduced by Articles 61.º and 62.º of Law No. 25/2008 of 5 June to Law No. 52/2003 of 22 August are saved from the provisions of subparagraph a) of the preceding paragraph.

Article 191.º Entry into force This law shall enter into force within 30 days after its publication.

ANNEX I [referred to in subparagraph i) of subparagraph v) of paragraph 1 of Article 2.º]

List of operations

a) Operations specific to exchange offices;

b) Loans, namely consumer credit, mortgage credit, factoring with or without recourse, financing of commercial operations (including non-recourse discounting);

c) Financial leasing;

d) Payment services, within the meaning of paragraph 3 of Article 4.º of Directive 2015/2366/EU of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market;

e) Issuance and management of other means of payment (for example, travellers' cheques and letters of credit), to the extent that the activity is not covered by the preceding subparagraph;

f) Granting of guarantees and other commitments;

g) Transactions carried out on own account or on behalf of clients involving money market instruments (cheques, bills and promissory notes, certificates of deposit, among others), foreign exchange, financial futures and options, instruments on foreign exchange or on interest rates and transferable securities.

h) Participation in issues of securities and provision of services related to such issue;

i) Advice to undertakings on capital structure, industrial strategy and related matters, and advice and services relating to mergers and acquisitions of undertakings;

j) Intermediation in interbank markets;

k) Portfolio management or advice on portfolio management;

l) Safekeeping and administration of securities;

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 121 / 122

m) Renting of safes;

n) Issuance of electronic money.

ANNEX II [referred to in subparagraph a) of paragraph 3 of Article 35.º]

Non-exhaustive list of factors and indicative types of potentially lower risk 1 - Customer risk factors:

a) Companies with shares admitted to trading on a regulated market and subject, by virtue of the rules of that market, law or other binding instruments, to disclosure obligations that ensure adequate transparency regarding their beneficial owners;

b) Public administration or public companies;

c) Customers residing in lower-risk geographical areas, determined in accordance with paragraph 3 of this annex.

2 - Product, service, transaction or distribution channel risk factors:

a) Life insurance contracts and pension funds or savings products of a similar nature with low annual premium or contribution;

b) Insurance contracts linked to pension plans provided they do not contain a surrender clause and cannot be used as collateral for loans;

c) Pension schemes, supplementary pension plans or similar arrangements for the payment of retirement benefits to salaried workers, with contributions made by deduction from salaries and where the scheme prevents beneficiaries from transferring rights;

d) Limited and clearly defined financial products or services aimed at increasing the level of financial inclusion of certain types of customers;

e) Products where the risks of money laundering and terrorist financing are controlled by other factors, such as the imposition of loading limits or the transparency of their ownership, and may include certain types of electronic money.

3 - Geographical location risk factors - registration, establishment or residence in:

a) Member States of the European Union;

b) Third countries that have effective systems for the prevention and combating of money laundering and terrorist financing;

c) Countries or jurisdictions identified by credible sources as having a low level of corruption or other criminal activities;

d) Third countries that are subject, based on reliable sources, such as published mutual evaluation, detailed evaluation or follow-up reports, to obligations for the prevention and combating of money laundering and terrorist financing consistent with the revised FATF recommendations and that effectively implement those obligations.

ANNEX III [referred to in subparagraph a) of paragraph 5 of Article 36.º]

Non-exhaustive list of factors and indicative types of potentially higher risk, in addition to the situations specifically provided for in this law 1 - Customer risk factors:

a) Business relationships that take place in unusual circumstances;

Directorate of Communication and Taxpayer Support Services DocBaseV/2017 122 / 122

b) Customers residing or carrying out activity in higher geographical risk areas, determined in accordance with paragraph 3 of this annex;

c) Legal persons or centres of collective interests without legal personality that are structures for holding personal assets;

d) Companies with nominee shareholders or whose capital is represented by bearer shares;

e) Clients that carry on activities involving intensive cash operations;

f) Ownership or control structures of the client that appear unusual or excessively complex, taking into account the nature of the activity carried on by the client;

g) The client is a national of a third country who applies for residence or citizenship rights in Portugal in exchange for capital transfers, acquisition of assets or public debt securities or investment in corporate entities established in national territory.

2 - Risk factors inherent to the product, service, operation or distribution channel:

a) Private banking;

b) Products or operations likely to favour anonymity;

c) Payments received from third parties unknown or not associated with the client or with the activity carried on by the client;

d) New products and new business practices, including new distribution mechanisms and payment methods, as well as the use of new technologies or technologies under development, both for new products and for existing products;

e) Business relationships or operations without the physical presence of the client, without certain safeguards, such as electronic identification means, relevant trust services within the meaning of Regulation

(EU) No. 910/2014 of the European Parliament and of the Council, of 23 July 2014, or other secure, regulated, recognised, approved or accepted electronic or remote identification processes by the relevant national authorities;

f) Transactions related to oil, arms, precious stones and metals, tobacco products, cultural artefacts and other items of archaeological, historical, cultural and religious relevance or of rare scientific value, as well as ivory and protected species.

3 - Risk factors inherent to geographic location:

a) Countries or jurisdictions identified by reputable sources, such as published mutual evaluation, detailed assessment or follow-up reports, as not having effective systems for the prevention and combating of money laundering and terrorist financing, without prejudice to the provisions of this law regarding high-risk third countries;

b) Countries or jurisdictions identified by credible sources as having a significant level of corruption or other criminal activities;

c) Countries or jurisdictions subject to sanctions, embargoes, other restrictive measures or additional countermeasures imposed, in particular, by the United Nations and the European Union;

d) Countries or jurisdictions that provide financing or support to terrorist activities or acts, or in whose territory terrorist organisations operate.