Prudential expectations in relation to the de-risking phenomenon

NBB_2022_03 - 1 February 2022 Circular - Page 1/18 boulevard de Berlaimont 14 – BE-1000 Bruxelles tél. +32 2 221 30 17 numéro d’entreprise: 0203.201.340 RPM Bruxelles www.bnb.be Circular Brussels, 1 February 2022 Référence: NBB_2022_03 votre correspondant: Benoît Bienfait tél. +32 2 221 36 42 benoit.bienfait@nbb.be Prudential expectations on de-risking Scope

• credit institutions under Belgian law, including branches in Belgium of institutions governed by the law of another country of the European Economic Area (EEA) or of a third country;
• stockbroking firms under Belgian law, including branches in Belgium of undertakings governed by the law of another EEA country or a third country;
• insurance undertakings under Belgian law that are authorised to exercise life insurance activities, including branches in Belgium of undertakings governed by the law of another EEA country or of a third country;
• payment institutions and electronic money institutions under Belgian law, including branches in Belgium of institutions governed by the law of another EEA country or of a third country, as well as payment institutions and electronic money institutions authorised in another EEA country that are required to designate a central contact point in Belgium;
• central securities depositories as defined in Article 36/26/1 of the Law of 22 February 1998 laying down the Organic Statute of the National Bank of Belgium.

Circular - Page 2/18 NBB_2022_03 - 1 February 2022 Dear Sir or Madam, Since the entry into force of the Law of 18 September 2017 on the prevention of money laundering and terrorist financing and on the restriction of the use of cash (“the Anti-Money Laundering Law”), the National Bank of Belgium (“the Bank”) has noted an increase in the number of de-risking actions by financial institutions under its remit that allege reasons related primarily to combating money laundering and terrorist financing (“AML/CFT”). “De-risking” is defined here as the decision in principle, taken a priori by a financial institution, to refuse to enter into business relations with potential customers or to terminate existing business relations with current customers on the grounds that these potential or existing customers belong to a category of persons which the financial institution alleges is linked to excessive risks of money laundering or terrorist financing (“ML/FT”), inter alia in view of its risk appetite or the AML/CFT system it has put in place. The Bank notes that a significant number of undertakings and professionals from various sectors have been confronted with this phenomenon. At present, the Bank observes that de-risking is mainly practised by financial institutions from the banking sector, but it cannot be ruled out that this phenomenon may also spread within the other financial sectors covered by this circular. While decisions not to enter into or terminate a business relationship, or not to carry out a transaction, may be consistent with the requirements of the Anti-Money Laundering Law, de-risking entire categories of customers without due regard to individual customers’ risk profiles is a sign of ineffective management of money laundering and terrorist financing risks and can have a significant impact. In its capacity as the supervisory authority designated by Article 85, § 1, 3°, of the Anti-Money Laundering Law, the Bank is of the opinion that financial institutions under its supervision must effectively implement mechanisms to prevent and manage the risks of money laundering and terrorist financing. The Bank also recognises that the business relations between a financial institution and its customers are essentially governed by the principle of contractual freedom which, barring legal exceptions, does not allow a party (in this case, a financial institution) to be obliged to enter into a contractual relationship to which it has not freely consented. The Bank wishes to point out that the scope of this Circular is limited to such de￾risking as results from inadequate implementation by financial institutions of their obligations under the applicable legal and regulatory provisions on AML/CFT. Entities under the Bank’s supervision are reminded that effective application of the anti-money laundering law and regulations does not exempt them from complying fully and simultaneously with other mandatory or public-order legislation that is also binding on them (see the page “Due diligence obligations and compliance with other legislation” on the Bank's website). This is the case e.g. with the legislation on combating discrimination, Article VII 55/12 of the Code of Economic Law, which grants payment institutions objective, non-discriminatory and proportionate access to the payment account services of credit institutions, as well as the provisions of Book VII, Title 3, Chapter 8, of the Code of Economic Law on access to payment accounts and the basic banking service. It also stresses that financial institutions are expected to assume their specific responsibility for the economic development of society as effectively as possible, without prejudice to the legal and regulatory provisions applicable to them. Although some financial institutions may have tried to justify their restrictive and defensive behaviour in the context of implementing their procedure for accepting new customers or breaking off existing business relationships by their desire to strictly manage the reputational risk to which they are exposed, it should be noted that these very behaviours might damage their reputation if, as a result, they were to be accused of not fully or satisfactorily assuming their specific societal responsibilities, or even of promoting discriminatory behaviour in the exercise of their activities, of hindering economic development and financial inclusion, of participating in the destabilisation of the financial system or of disregarding some of their legal public-order obligations.

NBB_2022_03 - 1 February 2022 Circular - Page 3/18 Moreover, where financial institutions adopt such restrictive and defensive behaviours, they may fail to contribute effectively to the prevention of ML/FT, instead rejecting out of any control transactions that may be related to ML/FT issues. The Bank therefore expects financial institutions under its jurisdiction to take great care in defining and implementing balanced AML/CFT policies which, while ensuring effective implementation of the obligations set out in or under the Anti-Money Laundering Law, also enable them to comply with all their other legal public-order or mandatory obligations and to fulfil all their specific societal responsibilities. On the basis of Article 86, § 2, 1°, of the Anti-Money Laundering Law, the Bank hereby addresses a number of comments and recommendations to financial institutions under its remit to assist them in achieving this balance. These comments and recommendations take full account of the communiqués issued by the FATF on 23 October 2014, 26 June 2015 and 23 October 2015 dealing specifically with de-risking (see Annexes 1 to 3 hereto) as well as the various sets of Guidance in which it clarified the scope of the risk-based due diligence obligations of financial institutions and took a position on the issue of de-risking. Reference is made in particular to the following sets of Guidance, which are also available on the Bank's website:

• Guidance dated 4 November 2017 on AML/CFT measures and financial inclusion, with a supplement on customer due diligence
• Guidance dated 21 October 2016 on Correspondent Banking
• Guidance dated 23 February 2016 for a Risk-Based Approach for Money or Value Transfer Services
• Guidance dated 27 October 2014 for a Risk-Based Approach for the Banking Sector
• Guidance dated 23 October 2015 for a Risk-Based Approach: Effective Supervision and Enforcement by AML/CFT Supervisors of the Financial Sector and Law Enforcement These comments and recommendations also take full account of the European Banking Authority (EBA) publications on de-risking, which are available on the Bank's website:
• EBA Opinion of 5 January 2022 on de-risking
• EBA Report of 5 January 2022 on de-risking and its impact on access to financial services
• Pre-existing provisions in EBA instruments that help to address the main drivers of de-risking decisions (see Annexe 4). The Bank urges financial institutions to take note of these publications and to take them into account when implementing their legal obligations to prevent ML/FT.

Circular - Page 4/18 NBB_2022_03 - 1 February 2022 I. The implications of the overall risk assessment and customer acceptance policy It appears that some financial institutions have tried to justify their refusal to enter into business relations with a number of customers on the grounds that their customer acceptance policy would prohibit entering into business relations with persons in the category to which the potential customer concerned belongs. In this respect, note should be taken of the following. Pursuant to Article 7 of the Anti-Money Laundering Law, the entities under supervision, including financial institutions, are required to implement the AML/CFT measures required by the Law in a differentiated manner, depending on their assessment of ML/FT risks, in particular due diligence measures with respect to transactions and business relationships. In order to do so, the entities under supervision are required to carry out an “overall risk assessment” in accordance with Article 16 of the Anti-Money Laundering Law, taking into account risk factors relating to customers, products and services offered, distribution channels and relevant geographical areas (see the page on the Risk-based approach and overall risk assessment on the Bank's website). It is therefore not only appropriate but also mandatory that, on the basis of their overall risk assessment, entities should classify according to ML/FT risks the various categories of customers to whom they offer their financial services and products, taking into account their general characteristics (natural persons or legal entities, residence in Belgium or abroad, economic sector of activity, sources of income or wealth, etc.). This classification of customers, combined with that resulting from other risk factors relating inter alia to the financial products or services requested, the distribution channel used or the geographical areas to which the customers or their transactions are linked, must enable them to establish, in accordance with Article 4 of the NBB Regulation of 21 November 2017 on the prevention of money laundering and terrorist financing (the “NBB Anti-Money Laundering Regulation”), an appropriate risk classification to take into account the characteristics of all the activities conducted. The aim of risk classification is to ensure that financial institutions are able to apply appropriate due diligence measures in each specific situation (see the page on Risk classification on the Bank's website). Based on the overall risk assessment, the risk classification provides the basis for each financial institution to define risk-differentiated policies, procedures, processes and internal control measures as required by Article 8 of the Anti-Money Laundering Law (see the page on Policies, procedures, processes and internal control measures on the Bank's website). In particular, according to the Bank's recommendations, financial institutions' AML/CFT policies should include a “customer acceptance policy” which “[i]n terms of principles, (…) primarily aims to determine the conditions regarding the reduction of ML/FT risk which the financial institution imposes on itself for entering into a business relationship with its customers or to become involved in performing occasional transactions for its customers. This customer acceptance policy should enable institutions to adequately take into account the overall risk assessment and the diversity of the risks mapped in terms of nature and intensity. This diversity should also be reflected in the risk classification. The customer acceptance policy should thus enable institutions to define appropriate procedures and arrangements for entering into a business relationship with or performing transactions for these customers.” It may be envisaged that acceptance of certain categories of customers with high ML/FT risks may be conditional on the implementation of specific risk mitigation measures. Risk mitigation measures may include (but are not limited to):  providing the financial institution with better guarantees as to the honesty of the customer's approach in general (e.g. the customer's formal commitment to respect labour and social law in Belgium or the communication of an extract from the criminal record which must be free of any recent conviction for one of the crimes underlying the BC/FT, as listed in the Anti-Money Laundering Law).

NBB_2022_03 - 1 February 2022 Circular - Page 5/18  providing the financial institution with guarantees of honesty and transparency in the conduct of the customer's transactions (e.g. by requiring documentation of the transactions, such as a copy of the invoice to be paid, or even a document from the customer's auditor certifying that they have carefully examined the transaction in question and have not detected any indication of BC/FT).  adapting, without prejudice to other applicable legal provisions, the offer of products and services to high-risk customers by limiting or excluding from such offer those products and services identified in the overall risk assessment as being most likely to be used for ML/FT purposes.  facilitating the understanding and management of CB/FT risks through organisational measures (e.g. by centralising the management of business relationships with certain categories of customers in a centre of expertise). In the context of these same recommendations, the Bank made a point of emphasising that “the customer acceptance policy is essentially intended to serve as a framework for the decision-making process as regards the establishment of a business relationship or the execution of the occasional transaction and the nature and intensity of the due diligence measures to be implemented. However, these decisions may not result automatically from the customer acceptance policy, but require an individual risk assessment carried out in accordance with Article 19 of the Anti-Money Laundering Law that allows the possible specificities of each individual case to be taken adequately into account.” The Bank also specifies that this policy should include, inter alia, the listing of general criteria for allocating customers to the various risk categories, and the principles for the differentiated allocation of the power to decide to enter into the business relationship or to carry out the transaction requested by the customer to persons of an appropriate hierarchical level in relation to each risk category. (See Chapter 2.1.2. of the Bank's Comments and Recommendations on Internal Control Policies, Procedures, Processes and Measures). The Bank thus confirms that it is not appropriate, nor is it consistent with AML/CFT legal and regulatory requirements, for a financial institution's customer acceptance policy to exclude all business relationships with potential or existing customers on the basis of general criteria such as, inter alia, their belonging to a particular economic sector or a link to a high-risk country (without prejudice to any other legal provisions that may be applicable or measures to implement binding financial embargo provisions). Thus, for example, the Bank considers that it would be inappropriate and inconsistent with AML/CFT legal and regulatory provisions for the customer acceptance policy of a “generalist” credit institution, whose service offering includes the provision of payment accounts to all of its customers, to prohibit a priori the provision of this service to certain categories of natural or legal persons on the basis of their membership of a particular economic sector. The Bank therefore urges financial institutions whose acceptance policy includes such provisions to repeal them as soon as possible. II. Individual risk assessment and refusal to enter into a business relationship on grounds related to AML/CFT It appears that some financial institutions have tried to justify their refusal to enter into business relationships with certain customers by alleging that the Anti-Money Laundering Law prohibits them from entering into such business relationships where there is a high risk of ML/FT. The Bank emphasises that the Anti-Money Laundering Law does not formulate such a prohibition, but instead requires a financial institution to implement enhanced due diligence measures in situations where it identifies high ML/FT risks. In this respect, one should bear in mind the following. In accordance with Article 19 of the Anti-Money Laundering Law, financial institutions are required to carry out an “individual risk assessment” as soon as they enter into a business relationship with a customer or when the customer requests them to carry out an occasional transaction of € 10,000 or more. This individual risk assessment should enable the financial institution concerned to determine, in accordance with its

Circular - Page 6/18 NBB_2022_03 - 1 February 2022 customer acceptance policy, the scope and intensity of the due diligence measures implemented, according to the BC/FT risks specifically associated with the customer concerned. As a reminder, the due diligence measures required are as follows:  To identify and verify the identity of the customer and, where applicable, of their agent(s) and beneficial owner(s);  To assess the characteristics of the customer and the purpose and proposed nature of the business relationship or occasional transaction; and  To exercise continuous due diligence with regard to the business relationship and the customer's transactions. Certain de-risking decisions may have originated from an inadequate interpretation of the scope of these due diligence requirements, in particular in the context of correspondent banking activities or with regard to payment institutions. As the FATF itself has pointed out (see Guidance dated 21 October 2016 on Correspondent Banking, p. 3), the Bank confirms in this respect that where the customer is another financial institution, the due diligence obligations relate to that financial institution in its capacity as customer, and do not include implementing due diligence measures in respect of the customers of that client financial institution (“KYCC”). In this regard, reference is made to the commentary on Article 23 of the Law of 18 December 2017 in its preparatory works, which explicitly states that “[w]here transactions are intended to enable a financial institution to effectively provide its own customers with the products and services it offers, these transactions are to be considered as transactions for the financial institution's own account, and not for the account of its customers. In this case, the latter do not have the possibility of determining any of the terms and conditions of these transactions. This is the case, for example, where a credit institution takes out interbank loans to finance its loan portfolio or where it uses the clearing and settlement services provided by another financial institution to ensure the proper execution of the services it offers to its customers in the area of payments or securities transactions.” (Chambre des représentants / Kamer van volksvertegenwoordigers, 2016-2017, DOC 54 2566/001, p. 109. See on the Bank's website: Explanatory Memorandum to the Anti-Money Laundering Law, Article 23, point A3: Articles 21 to 25). The absence of a systematic legal obligation on KYCC does not preclude the examination of atypical transactions carried out by the client financial institution in accordance with Article 45 of the Anti-Money Laundering Law in order to determine whether they are suspicious of being related to ML/FT (e.g. due to a significant and unanticipated increase in the amount of the transactions carried out by the client financial institution, the counterparties or beneficiaries of such transactions, their country of establishment, etc.). In this case, the client financial institution may be asked for additional information on the transactions of its customers underlying the detected atypical transaction in accordance with § 1, paragraph 2, of Article 45 of the Anti-Money Laundering Law. In this respect, reference is made to the page on “Analysis of atypical facts and transactions” on the Bank's website. Attention is drawn to the commentary on this provision in the explanatory memorandum to the Law of 18 September 2017, which states that “[n]evertheless, the information available to [the institution] in this way may be insufficient to enable it to decide whether there are suspicions of ML/FT. In this case, paragraph 2 of § 2 requires the entity under supervision to take (at the initiative of its AMLCO) such additional measures to those already applied in the context of ongoing due diligence as are necessary to be able to assess whether or not such transactions or activities seem suspicious.” (Chambre des représentants / Kamer van volksvertegenwoordigers, 2016-2017, DOC 54 2566/001, p. 155. See on the Bank's website: Explanatory Memorandum to the Anti-Money Laundering Law, Articles 45 and 46). Concerns have also been expressed that when, conversely, a Belgian financial institution maintains correspondent banking relationships as a client of a foreign correspondent institution, the latter may refuse or terminate the business relationship on the grounds that the Belgian institution accepts to serve customers with a high BC/FT risk profile, and that this Belgian institution may thereby lose its access to the currency market of the third country concerned. However, the Bank notes that, much more than the risk profile of the client institution's customers, it is the quality and effectiveness of the due diligence measures implemented by this client institution, taking into account the risk profile of its customers, that are analysed by the

NBB_2022_03 - 1 February 2022 Circular - Page 7/18 correspondent bank1, with the aim of ensuring as much as possible that any criminal financial flows are identified and reported by the client bank to the competent local authorities before being injected into the correspondent banking relationship. In order to properly implement all due diligence requirements on the basis of the risks, and in addition to the risk criteria identified in general by the overall risk assessment and reflected in the customer acceptance policy, the individual risk assessment should enable the financial institution to take into account characteristics that are specific to the customer (e.g. where the customer is a professional who is himself exposed to the risk of being used by third parties for ML/FT purposes, the quality of the measures the customer has implemented themselves to manage and reduce this risk), the product or service requested (e.g. the particular terms or conditions requested by the customer), the distribution channel (e.g. the particular circumstances surrounding the request to enter into a business relationship) or any links with risky geographical areas (e.g. the nature and intensity of these links). This individual risk assessment should either confirm the level of risk that is determined on the basis of the risk criteria that have been identified generally for all customers, or lower or raise the level of risk where specific information so requires. Article 19, § 2, paragraph 2, of the Anti-Money Laundering Law specifies that where the individual risk assessment associated with a business relationship leads the financial institution to identify high risks, the institution is obliged to take enhanced due diligence measures. For more details on the individual risk assessment, please refer to the page on Individual Risk Assessment on the Bank's website, and in particular to the EBA Guidelines of 1 March 2021 on ML/TF risk factors and the NBB's Comments and Recommendations published there. In this context, the Bank notes that the Anti-Money Laundering Law only provides for a prohibition on entering into or continuing the business relationship in a limited number of cases, namely:

• Where entities under supervision cannot fulfil their obligations to identify and verify the identity of the customer, or, where applicable, of the customer’s agents or beneficial owners (Article 33, § 1, paragraph 1, of the Anti-Money Laundering Law),
• Where entities under supervision cannot fulfil their obligation to assess the characteristics of the customer and the purpose and nature of the business relationship (Article 34, § 3, paragraph 1, of the Anti-Money Laundering Law), and
• Where they have reason to consider that they will not be able to satisfy: o their obligation to scrutinise the transactions carried out during the business relationship and, if necessary, the origin of the funds, or o their obligation to update the identification data of the customer and of any agents and beneficial owners of the customer, as well as other information collected which is necessary to assess the characteristics of the customer and the purpose and nature of the business relationship (Article 35, § 2, paragraph 1, of the Anti-Money Laundering Law). Consequently, the Bank is of the opinion that the refusal to enter into a business relationship on the basis of the Anti-Money Laundering Law is only required by the above-mentioned legal provisions in situations where the financial institution concerned can justify that it is unable to comply with the due diligence obligations concerned. However, these prohibitions do not apply merely because the financial institution's individual risk assessment has determined that high BC/FT risks are associated with the business relationship, so that enhanced due diligence measures are required by law. 1 For example, by using the Wolfsberg Group Correspondent Banking Due Diligence Questionnaire, which focuses extensively on BC/FT prevention measures as implemented by the client bank.

Circular - Page 8/18 NBB_2022_03 - 1 February 2022 Where the financial service or product for which the financial institution is solicited by the customer is consistent with the financial institution's habitual range of financial services and products, the financial institution must, pursuant to Article 8 of the Anti-Money Laundering Law, have the appropriate AML/CFT organisation and internal control mechanisms in place with respect to its “business model”. This internal AML/CFT scheme must enable it to adequately manage all ML/FT risk situations that may arise in the context of the activities covered by its business model, including high-risk situations. In this context, the Bank considers that the mere fact that the implementation of enhanced measures requires the financial institution to perform additional or more intensive work than in the case of more ordinary risks in order to meet its due diligence obligations does not mean that the situation is so impossible for the financial institution that it must refuse to enter into a business relationship. On the other hand, where the business relationship requested by the customer is not consistent with the ordinary offer of financial services or products that fall within its business model or commercial strategy, the effective exercise of the above-mentioned due diligence obligations may require substantial changes to its organisation and internal control measures. Where such changes are not justified in the light of the financial institution's business model, the Bank considers that the failure to meet the above due diligence requirements may be due to the fact that the financial institution cannot reasonably be expected to have the appropriate organisation and internal control mechanisms to manage the ML/FT risks that are specific to this business relationship situated outside its business model. The Bank would also like to point out that where a financial institution is obliged to refuse a customer's request to enter into a business relationship in application of the above-mentioned articles of the Anti￾Money Laundering Law, it is also obliged to examine, in accordance with Article 46 of the Law, whether the reasons for the failure to comply with the due diligence obligations are such as to give rise to a suspicion of ML/FT and whether CTIF should be informed. In this respect, reference is made to Article 33, § 1, paragraph 2, Article 34, § 3, paragraph 2, and Article 35, § 2, paragraph 2, of the Anti-Money Laundering Law. In view of the above, the Bank considers that the provisions of Articles 33, § 1, paragraph 1, 34, § 3, and 35, § 2, of the Anti-Money Laundering Law should only be invoked to justify the refusal to enter into a business relationship requested by the customer in cases where the entity under supervision can justify that it is proven impossible for it to fulfil the due diligence obligations imposed by the Anti-Money Laundering Law. The Bank also recommends that in such cases, in accordance with Article 24 of the NBB Anti-Money Laundering Regulation, the entity should carefully establish and keep in its records: (i) the individual risk assessment and the justification for the impossibility of fulfilling the legal due diligence obligations on which the refusal to enter into a business relationship is based, and (ii) an analysis of the causes of this impossibility that led to determining whether or not CTIF should be informed. III. Updating individual risk assessments and breaking up existing business relationships As noted in some cases of refusal to enter into a business relationship, it appears that some financial institutions have tried to justify the termination of existing business relationships with certain customers by alleging that the Anti-Money Laundering Law prohibits them from maintaining such business relationships where it is revealed in the course of the business relationship that high ML/FT risks are associated with it. As is well known, Article 35, § 1, paragraph 1, 2°, of the Anti-Money Laundering Law requires updating the identification data and information relating to the characteristics of the customer and the purpose and nature of a relationship as held by a financial institution, in particular where elements relevant to the individual risk assessment referred to in Article 19 of the Law have been modified. The individual risk assessment must be updated whenever events occur that may have such significant influence on the risks associated with the business relationship that the due diligence measures implemented might no longer be adequate and sufficient in view of the new level of risks. The Bank has also considered that, in order to ensure the current relevance of individual risk assessments, internal procedures may usefully provide for a periodic review of

NBB_2022_03 - 1 February 2022 Circular - Page 9/18 these assessments and the information held on which they are based, where this is appropriate to the activities carried out (see the following pages on the Bank's website: Due diligence on business relationships and occasional transactions and detection of atypical facts and transactions: Comments and recommendations by the NBB, Identification of the customer's characteristics and of the purpose and nature of the business relationship or the occasional transaction: Comments and recommendations by the NBB, and Individual risk assessment: Comments and recommendations by the NBB) Where the individual risk reassessment leads to an increase in the level of risk that the financial institution associates with the business relationship, the Anti-Money Laundering Law requires the financial institution to also increase the level of due diligence it exercises in respect of that business relationship. As in the case of entering into a business relationship, the Anti-Money Laundering Law does not however require the financial institution to terminate the business relationship if the level of risk is higher than previously assessed, except in cases where the financial institution:

• cannot fulfil its obligation to update and verify the identification data of the customer or, where applicable, of their effective authorised representatives or beneficial owners (Article 33, § 1, paragraph 1, of the Anti-Money Laundering Law),
• cannot fulfil its obligation to update its assessment of the characteristics of the customer and the purpose and nature of the business relationship (Article 34, § 3, paragraph 1, of the Anti-Money Laundering Law), or
• has reason to believe that it will not be able to satisfy: o its obligation to scrutinise the transactions carried out during the business relationship and, if necessary, the origin of the funds, or o its obligation to subsequently update the identification data of the customer and of any authorised representatives and beneficial owners, as well as other information collected which is necessary to assess the characteristics of the customer and the purpose and nature of the business relationship (Article 35, § 2, paragraph 1, of the Anti-Money Laundering Law). The comments made above regarding the impossibility of fulfilling the relevant obligations in the case of entering into a business relationship are equally applicable. However, the Bank would like to point out that where a suspicious transaction report has been sent to CTIF, the financial institution must update the individual risk assessment of the customer concerned by the report, in accordance with Article 22 of the NBB Anti-Money Laundering Regulation. In this context, the analysis of the intensity of the suspicion of money laundering or terrorist financing, of the amount or frequency of the suspicious transactions, may lead the financial institution to consider that the enhanced due diligence measures that it could implement with regard to the customer concerned would not allow it to sufficiently protect itself from the risk of being involuntarily involved in future money laundering or terrorist financing transactions by the customer, and to decide to terminate the business relationship with the customer. In view of the above, the recommendations made by the Bank in the previous chapter apply, mutatis mutandis, where a financial institution terminates a business relationship due to its inability to fulfil its due diligence obligations. IV. The cost of due diligence It appears that some financial institutions have sought to justify their refusal or termination of business relationships with certain customers by invoking the costs of performing the due diligence required by the Anti-Money Laundering Law, particularly where high ML/FT risks are associated with the business relationship. As a rule, the cost of AML/CFT controls is covered by the ordinary fees that financial institutions charge their customers for the provision of their financial services and products. Their pricing policy does

Circular - Page 10/18 NBB_2022_03 - 1 February 2022 not necessarily differentiate between the different levels of ML/FT risk associated with business relationships, as reflected in the risk classification. In this respect, although the implementation of AML/CFT due diligence is intended to reduce the potential future costs that ML/FT risks are likely to generate if they materialise, and which may be extremely heavy or even unbearable for financial institutions, the Bank is aware that, like all internal control measures of any kind, the implementation of the due diligence measures required by the Anti-Money Laundering Law generates an immediate cost which increases where, due to a high level of ML/FT risks, the law requires an increased level of due diligence. The Bank therefore does not rule out that, in compliance with any other legislation that may be applicable, the additional cost of implementing additional due diligence measures may be objectively reflected in the charges that financial institutions apply to their customers. On the other hand, the Bank is not of the opinion that it would be legitimate for a financial institution to de￾risk categories of customers on the grounds that the pricing of the products and services provided would be insufficient to cover the costs incurred by the exercise of due diligence required by the Anti-Money Laundering Law. In view of the above, it could be accepted that financial institutions, to the extent legally permitted, take into account the objectively assessed cost of the due diligence measures required by the Anti-Money Laundering Law in pricing the financial services and products they offer to their customers. The Bank considers that it may be legitimate to apply differentiated charges according to the nature and level of due diligence required, provided that such differentiation can be objectively justified in such a way that it cannot be qualified as discriminatory or prohibitive. V. The risk of administrative remedial measures, administrative sanctions and civil or criminal convictions It appears that some financial institutions have also tried to justify their refusal to enter into business relations with certain customers or their decision to terminate them by invoking the risk of being subject to administrative remedial measures as listed in Articles 93 and 94 of the Anti-Money Laundering Law or to administrative sanctions as defined in Article 132 of the Law, or even criminal sanctions based on Article 505 of the Criminal Code in the event that the customer uses the financial relationship to carry out ML/FT transactions. Where suspicious transaction reports are sent to CTIF and the funds concerned are frozen as a result, there is also a risk that the customer will file a claim for compensation if the report to CTIF was not made in good faith. It should be stressed, however, that when considering whether to impose the above-mentioned administrative measures or to initiate an administrative sanction procedure against a financial institution, the Bank will take into account, in accordance with the positions adopted in this respect by the FATF (see in particular its communiqué of 23 October 2015 in the enclosed Annexe 3 and the FATF “Guidance dated 23 October 2015 for a Risk-Based Approach: Effective Supervision and Enforcement by AML/CFT Supervisors of the Financial Sector and Law Enforcement”), the fact that the risk-based approach that financial institutions are legally obliged to implement does not strictly ensure that they cannot be misused for ML/FT purposes. Consequently, administrative remedial measures are not systematically imposed or administrative sanction procedures initiated whenever the Bank finds that the due diligence obligations required by the Anti-Money Laundering Law have only been imperfectly implemented in the context of particular business relationships, or in every case where suspicious transactions have not been detected and reported to CTIF. In the face of such findings, the Bank will determine whether it is necessary and appropriate for it to take serious measures of this nature on the basis of an assessment of the seriousness of the established facts. Criteria shall be taken into account for this purpose such as the amounts involved, the repetitive nature of the breaches or the fact that the breaches are the result of clear and inexcusable negligence or a known serious

NBB_2022_03 - 1 February 2022 Circular - Page 11/18 deficiency in the internal organisation that has not been remedied, or, a fortiori, when they are the result of a deliberate act. Administrative measures or sanction procedures may be justified in particular if the Bank has serious indications that the breaches observed result in the financial institution not being able to cooperate effectively in the prevention of ML/FT as required by law. With regard to the risk of criminal sanctions based on Article 505 of the Criminal Code, the Bank wishes to stress that it has no competence in criminal matters and cannot, in particular, give an opinion on the conditions under which a financial institution, its directors or employees may be prosecuted and sentenced under this article of the Criminal Code as perpetrators, co-perpetrators or accomplices in a criminal money laundering offence. The Bank also notes that in cases where suspicious transaction reports have been sent to CTIF, the civil and criminal immunity granted by Article 57 of the Anti-Money Laundering Law is not absolute, but subject to the condition that the suspicious transaction report has been sent “in good faith”. The interpretation of this notion is not a matter for the Bank, but for the Courts of law. Where this condition is not met, the risk of a claim for compensation or prosecution and criminal sanction cannot be excluded. Nevertheless, the Bank considers that Article 57 of the Anti-Money Laundering Law, like Article 37 of Directive 2015/849 of 20 May 2015 and FATF Recommendation 21, which it transposes, aims to provide security for entities under supervision that report suspicions in good faith, by protecting them from possible prosecution, particularly judicial prosecution, including prosecution based on the money laundering transactions they have reported. It should also be recalled in this respect that, in civil law, the case law indicates that “good faith” as referred to above presupposes in particular that the atypical transactions by customers have been the subject of a specific analysis, as required by Article 45 of the Anti-Money Laundering Law, which effectively takes into account all the information held by the financial institution or which results from such additional measures to those referred to in Articles 19 to 41 of the Law as are necessary to support this analysis, and which the financial institution is required to implement, pursuant to the same Article 45 of the Law. The Bank wishes to bring back to mind that the best way for financial institutions to avoid the risk of serious administrative measures or sanctions for breaches of the Anti-Money Laundering Law, or even the risk of criminal prosecution for assisting money laundering transactions by its customers, and the risk of claims in civil courts due to reports made to CTIF without due analysis, is to ensure the effective implementation of appropriate and effective money laundering prevention measures, including and especially in cases where high ML/FT risks are identified. A copy of this circular is addressed to your institution’s accredited statutory auditor(s). Yours faithfully, Pierre Wunsch Governor

Circular - Page 12/18 NBB_2022_03 - 1 February 2022 Annex 1 « FATF clarifies risk-based approach: case-by-case, not wholesale de-risking » Paris, 23 October 2014 (https://www.fatf-gafi.org/documents/news/rba-and-de-risking.html) The FATF Plenary discussed the issue of de-risking on 22 October. Generally speaking, de-risking refers to the phenomenon of financial institutions terminating or restricting business relationships with clients or categories of clients to avoid, rather than manage, risk in line with the FATF’s risk-based approach. De￾risking can be the result of various drivers, such as concerns about profitability, prudential requirements, anxiety after the global financial crisis, and reputational risk. It is a misconception to characterise de-risking exclusively as an anti-money laundering issue. This issue is of crucial importance to the FATF for two main reasons:

1. De-risking can introduce risk and opacity into the global financial system, as the termination of account relationships has the potential to force entities, and persons into less regulated or unregulated channels. Moving funds through regulated, traceable channels facilitates the implementation of anti-money laundering / countering the financing of terrorism (AML/CFT) measures.
2. It is central to our mandate to ensure that the global AML/CFT standard is well understood and accurately implemented, and that countries and their financial institutions are provided with support in designing AML/CFT measures that meet the goal of financial inclusion. Recent supervisory and enforcement actions have raised the consciousness of banks and their boards about these issues. However, it is important to put into context that these were extremely egregious cases involving banks who deliberately broke the law, in some cases for more than a decade, and had significant fundamental AML/CFT failings. “De-risking” should never be an excuse for a bank to avoid implementing a risk-based approach, in line with the FATF standards. The FATF Recommendations only require financial institutions to terminate customer relationships, on a case-by-case basis, where the money laundering and terrorist financing risks cannot be mitigated. This is fully in line with AML/CFT objectives. What is not in line with the FATF standards is the wholesale cutting loose of entire classes of customer, without taking into account, seriously and comprehensively, their level of risk or risk mitigation measures for individual customers within a particular sector. The risk-based approach should be the cornerstone of an effective AML/CFT system, and is essential to properly managing risks. The FATF expects financial institutions to identify, assess and understand their money laundering and terrorist financing risks and take commensurate measures in order to mitigate them. This does not imply a “zero failure” approach. The FATF is committed to financial inclusion, and effective implementation of AML/CFT measures through proper implementation of the risk-based approach. Given the importance of this issue, and in light of these discussions the FATF has agreed:  To gather further evidence and analysis on the drivers and scale of de-risking. The FATF’s country assessments will be critically important in this regard, not least for FATF to reinforce its expectations on risk understanding and management. The FATF will also make full use of the work being conducted in other relevant international groups and forums, including the G20 Global Partnership for Financial Inclusion, the IMF, the World Bank Group, and the Basel Committee on Banking Supervision.  To continue to disseminate its various reports on risks, methods and trends allowing service providers to better understand money laundering and terrorist financing risks related to specific categories of customers and devise effective risk-based approaches.  To continue a number of existing activities and projects providing information and guidance to inform risk-based decision-making, including work on the risk-based approach for banks, the risk￾based approach for money or value transfer services, best practices on combating the abuse of non-profit organisations, effective supervision and enforcement.

NBB_2022_03 - 1 February 2022 Circular - Page 13/18  To stay abreast of developments in this area and to continue to interact with all actors relevant to this topic including the sectors most affected, regulators, supervisors, and banks.  To consider, on the basis of the evidence on the drivers and scale of de-risking, whether further work is necessary on specific issues. The FATF’s Policy and Development Group will determine this during the February 2015 FATF Plenary. The FATF is adopting at this Plenary Risk-based Approach Guidance for the Banking Sector which gives clear guidance on how to properly implement the risk-based approach, and is explicitly meant to be read in conjunction with the FATF Guidance on AML/CFT and Financial Inclusion. Banks who implement the risk￾based approach, in line with the guidance given in these two papers, will be well-placed to avoid the consequences of inappropriate de-risking behaviour.

Circular - Page 14/18 NBB_2022_03 - 1 February 2022 Annex 2 « Drivers for "de-risking" go beyond anti-money laundering / terrorist financing » Brisbane, 26 June 2015 (http://www.fatf-gafi.org/publications/fatfrecommendations/documents/derisking-goes-beyond-amlcft.html) Situations where financial institutions terminate or restrict business relationships with categories of customer (so-called “de-risking”) is a complex issue that goes far beyond anti-money laundering (AML) and counter-terrorist financing (CFT). The FATF has gathered preliminary information on the potential drivers of “de-risking”, with input from the private sector which highlights that there is a continued need to improve the evidence base in order to determine the causes, scale and impact of de-risking. The FATF approach to “de-risking” is based on the FATF Recommendations which require financial institutions to identify, assess and understand their money laundering and terrorist financing risks, and implement AML/CFT measures that are commensurate with the risks identified. When establishing correspondent banking relationships, banks are required to perform normal customer due diligence on the respondent bank. Additionally, banks are required to gather sufficient information about the respondent bank to understand the respondent bank’s business, reputation and the quality of its supervision, including whether it has been subject to a money laundering or terrorist financing investigation or regulatory action, and to assess the respondent bank’s AML/CFT controls. Although there will be exceptions in high risk scenarios, the FATF Recommendations do not require banks to perform, as a matter of course, normal customer due diligence on the customers of their respondent banks when establishing and maintaining correspondent banking relationships. The FATF is undertaking work to further clarify the interplay between the FATF standards on correspondent banking (Recommendation 13) and other intermediated relationships, and the FATF standards on customer due diligence (Recommendation 10) and wire transfers (Recommendation 16). In doing so, the FATF will consult with regulators and the private sector, and will take into account relevant work on correspondent banking and account closure being undertaken by the Committee on Payments and Market Infrastructures (CPMI), the Financial Stability Board (FSB), the Global Partnership for Financial Inclusion (GPFI), the International Monetary Fund (IMF) and the Union of Arab Banks (UAB), the World Bank Group (WBG), and the World Trade Organisation (WTO). The FATF will also take into account the Basel Committee on Banking Supervision’s Guidance on Sound Management of Risks Related to Money Laundering and Financing of Terrorism which was published in January 2014, and will continue engagement with the Basel Anti-Money Laundering Experts Group (AMLEG). This work will build on actions that the FATF has already taken to address de-risking. The FATF revised the FATF Recommendations in 2012 to establish the risk-based approach as a fundamental requirement of the FATF standards, has discussed the de-risking issue with the private sector in various fora and sought their feedback at the FATF Consultative Forum in March 2015, and published Guidance on the Risk-Based Approach for the Banking Sector, Guidance on AML/CFT Measures and Financial Inclusion, and the Revised Best Practices Paper on Combating the abuse of Non-Profit Organisations (Recommendation 8) which addresses the issue of access to banking services by NPOs. The FATF is also developing guidance on the risk-based approach for money or value transfer services (MVTS) which will address the issue of access to banking services by MVTS, and will undertake further work on financial inclusion and customer due diligence.

NBB_2022_03 - 1 February 2022 Circular - Page 15/18 Annex 3 « FATF takes action to tackle de-risking » Paris, 23 October 2015 (http://www.fatf-gafi.org/publications/fatfrecommendations/documents/fatf-action-to-tackle-de-risking.html) The FATF continues to focus its efforts on de-risking, including through stocktaking and acknowledging the work of other bodies in this area. De-risking is having a significant impact in certain regions and sectors in particular and, although there is currently no evidence that de-risking is adversely impacting global financial stability, the international community continues to study this issue closely. De-risking will remain a priority for FATF. The FATF continues to monitor closely developments related to de-risking, including the fact gathering and analytical work conducted by other bodies – notably the Financial Stability Board (FSB), the Committee on Payments and Market Infrastructure (CPMI), the International Monetary Fund and Union of Arab Banks, the Global Partnership for Financial Inclusion, the Basel Committee, the World Bank Group, and the World Trade Organization. The FATF will also continue to engage with other international bodies, countries, the private sector and civil society on this important issue. The FATF will also invite the Secretariats of the FSB and the CPMI to its next working group meeting to facilitate coordination and engagement on these important issues. Analytical work so far undertaken by different bodies, including the FATF, shows that de-risking is being driven by many different factors. This is a serious concern for FATF and the FATF-style regional bodies to the extent that de-risking may drive financial transactions underground which creates financial exclusion and reduces transparency, thereby increasing money laundering and terrorist financing risks. The drivers of de-risking are complex and include: profitability; reputational risk; lower risk appetites of banks; and regulatory burdens related to the implementation of anti-money laundering and counter-terrorist financing (AML/CFT) requirements, the increasing number of sanctions regimes, and regulatory requirements in financial sector. The FATF is acting quickly to clarify regulatory expectations in four areas that are particularly relevant to de-risking to ensure that AML/CFT measures are being implemented effectively and in line with its risk-based approach. In particular, the FATF is:  developing guidance to clarify how to properly identify and manage risk in the context of correspondent banking and remittances. This guidance will address the issues highlighted by the FATF in its June 2015 statement on de-risking.  developing guidance to help money remitters identify and manage their risks, and to help banks evaluate and manage the risks of providing financial services to money remitters. This guidance will also help governments supervise these activities.  developing best practices on appropriate customer due diligence to facilitate financial inclusion in a manner that strikes an appropriate balance with AML/CFT objectives, and  revising the relevant standard to help governments properly identify those non-profit organisations which are most vulnerable to terrorist financing abuse, and address those risks in a proportionate way. This work builds on the FATF Best Practices on Combating the Abuse of Non-Profit Organisations which was issued in June 2015. The FATF aims to complete its work on these four projects in 2016. In addition to these significant initiatives, the FATF has just issued Guidance on the Risk-Based Approach for Effective Supervision and Enforcement by AML/CFT Supervisors of the Financial Sector and Law Enforcement. This guidance reiterates the existing expectation that regulators and supervisors should use a risk-based approach when supervising financial institutions’ compliance with AML/CFT measures. This is not a “zero failure” or “zero tolerance” approach which means that, when failures are detected, the regulator or supervisor should apply actions that are appropriate and proportionate, taking into account the nature of the failure. Regulators and supervisors should also ensure that financial institutions are taking a risk-based approach to implementing AML/CFT measures, without prejudice to rules-based measures such as targeted financial sanctions. Implementation by financial institutions should be aimed at managing (not avoiding) risks. What is not in line with the FATF standards is the wholesale cutting loose of entire countries and classes of customer, without taking into account, seriously and comprehensively, their level of money laundering and terrorist financing risk and applicable risk mitigation measures for those countries and for customers within a particular sector.

Circular - Page 16/18 NBB_2022_03 - 1 February 2022 Annex 4 “EBA Report On de-risking in the EU and its impact on access to financial services” (extract) Paris, 5 January 2022 https://www.eba.europa.eu/sites/default/documents/files/document_library/Publications/Opinions/2022/Op inion%20on%20de-risking%20%28EBA-Op-2022- 01%29/1025705/EBA%20Opinion%20and%20annexed%20report%20on%20de-risking.pdf

NBB_2022_03 - 1 February 2022 Circular - Page 17/18

Circular - Page 18/18 NBB_2022_03 - 1 February 2022