Resolution Coaf No. 36, of March 10, 2021

Regulates the manner of adoption of policies, procedures and internal controls for the prevention of money laundering, terrorism financing and the financing of the proliferation of weapons of mass destruction that allow compliance with the provisions of arts. 10 and 11 of Law No. 9,613, of March 3, 1998, by those who subject themselves, under the terms of its art. 14, § 1, to the supervision of the Council for the Control of Financial Activities (Coaf). This resolution entered into force on June 1, 2021.

Published on 12/03/2021 20:48 • Modified on 02/06/2021 21:37

---

Official Gazette of the Union

Published on: 11/03/2021 | Edition: 47 | Section: 1 | Page: 55

Agency: Ministry of Economy / Central Bank of Brazil / Council for the Control of Financial Activities

[RESOLUTION COAF No. 36, OF MARCH 10, 2021]

Regulates the manner of adoption of policies, procedures and internal controls for the prevention of money laundering, terrorism financing and the financing of the proliferation of weapons of mass destruction that allow compliance with the provisions of arts. 10 and 11 of Law No. 9,613, of March 3, 1998, by those who subject themselves, under the terms of its art. 14, § 1, to the supervision of the Council for the Control of Financial Activities – Coaf.

The PRESIDENT OF THE COUNCIL FOR THE CONTROL OF FINANCIAL ACTIVITIES – COAF, using the authority conferred by item IV of art. 9 of the Statute approved by Decree No. 9,663, of January 1, 2019, kept in force, in the form of art. 9 of Law No. 13,901, of November 11, 2019, insofar as compatible with Law No. 13,974, of January 7, 2020, makes public that the Plenary of the Council, in a session held on February 4, 2021, based on art. 8, items II and IV, of the said Statute, and considering the provisions of arts. 10, item III, and 14, § 1, of Law No. 9,613, of March 3, 1998, resolves:

CHAPTER I

OBJECT AND SCOPE OF APPLICATION

Article 1 This Resolution regulates how those who are subject to the supervision of the Council for the Control of Financial Activities – Coaf, under the terms of art. 14, § 1, of Law No. 9,613, of March 3, 1998, must adopt, in compliance with the duty established in its art. 10, III, policies, procedures and internal controls for the prevention of money laundering, terrorism financing and the financing of the proliferation of weapons of mass destruction – AML/CTF/WMD – that enable them to meet the provisions of arts. 10 and 11 of the Law.

Single paragraph. The provisions of this Resolution do not repeal nor modify norms previously issued by Coaf, being intended to complement them in the regulation of the manner of fulfilling the duty established in art. 10, III, of Law No. 9,613, of 1998.

CHAPTER II

AML AND TERRORISM FINANCING PREVENTION POLICY

Article 2 Supervised entities must implement and maintain a policy formulated with the objective of ensuring compliance with their AML/CTF/WMD duties established in arts. 10 and 11 of Law No. 9,613, of 1998, in a manner compatible with their size and volume of operations and proportional to the corresponding risks.

§ 1 The policy referred to in the caput must at minimum include:

I – Guidelines for:

  a) Definition of roles and responsibilities concerning compliance with the duties specified in Coaf regulations, without prejudice to the broad liability provided for in art. 12 of Law No. 9,613, of 1998;

  b) Definition of procedures aimed at the prior assessment of new products and services, as well as the use of new technologies, regarding money‑laundering, terrorism‑financing and weapons‑of‑mass‑destruction financing risks – AML/CTF/WMD;

  c) Internal risk assessment of AML/CTF/WMD;

  d) Promotion of an organizational culture of AML/CTF/WMD, including employees, outsourced service providers and collaborators in general, as well as partners with relevant activity in business models adopted by the supervised entity, taking into account the corresponding activities;

  e) Selection and hiring of employees, outsourced service providers and collaborators in general, as well as partners with relevant activity in business models adopted by the supervised entity, considering the AML/CTF/WMD risks related to such activity;

  f) Continuous training of employees on the AML/CTF/WMD theme;

  g) Implementation of procedures for:

    h) Collection, verification, validation and updating of registration information, aiming to know clients and other relevant subjects in the context of their activities;

    i) Proper recording of operations, regardless of how they may be formally designated within the supervised entity;

    j) Monitoring, selection and analysis of atypical or suspicious operations and situations;

    k) Forwarding of communications due to Coaf; and

II – Formal commitment of senior management to the effectiveness and adequacy of the AML/CTF/WMD policy, procedures and internal controls.

§ 2 The policy referred to in the caput must be communicated to employees, outsourced service providers and collaborators in general, as well as to partners with relevant activity in business models adopted by the supervised entity, using clear and accessible language, at a level of detail compatible with the roles they perform and the sensitivity of the information.

§ 3 The policy referred to in the caput must be documented, kept up‑to‑date and approved, within the supervised legal entity, by its administrators, without prejudice, in any case, to the broad liability provided for in art. 12 of Law No. 9,613, of 1998, even in the absence of formal approval.

Article 3 It is admitted that a supervised entity that belongs to a conglomerate or economic group, including one with foreign control, fulfills the duty set out in Article 2 by adopting a single AML/CTF/WMD policy possibly observed within the conglomerate or group, provided that such single policy contains the minimum content indicated in § 1 of Article 2.

Article 4 The AML/CTF/WMD policy adopted by supervised entities that belong to conglomerates or economic groups, whether in the manner admitted by Article 3 or not, must in any case contain guidelines for implementing information‑sharing procedures within the conglomerate or group for AML/CTF/WMD purposes, without prejudice to any legal limits that must be observed regarding such sharing.

CHAPTER III

GOVERNANCE OF THE AML/CTF/WMD POLICY

Article 5 Supervised legal entities must have a governance structure compatible with their size and volume of operations and proportional to the AML/CTF/WMD risks related to their activities, aiming to ensure compliance with the policy referred to in Article 2, as well as the related procedures and internal controls.

Single paragraph. Regardless of how the governance structure provided for in the caput is established, administrators do not, in any case, exempt themselves from liability, in the form of art. 12 of Law No. 9,613, of 1998, for compliance with the duties attributed to supervised legal entities by arts. 10 and 11 of the Law and the related Coaf regulations.

CHAPTER IV

INTERNAL RISK ASSESSMENT

Article 6 Supervised entities must carry out an internal assessment of AML/CTF/WMD risks related to their activities, in a manner compatible with their size and volume of operations, with the objective of identifying and measuring such risks.

§ 1 For the identification of the risks referred to in the caput, the internal assessment must consider, at minimum, the following risk profiles:

I – of the clients;

II – of the supervised entity itself, taking into account its business models and areas of activity, including geographic ones;

III – of the operations, regardless of how they may be formally designated within the supervised entity, taking into account their characteristics, notably regarding the form and means of payment, assets, values, products or services involved and the instruments, technologies or channels used in their execution;

IV – of employees, outsourced service providers and collaborators in general, as well as of partners with relevant activity in business models adopted by the supervised entity, taking into account the corresponding activities.

§ 2 The identified risks must be evaluated regarding their probability of occurrence and the magnitude of the impacts associated with them.

§ 3 Risk categories must be defined that enable the adoption of reinforced procedures and controls for higher‑risk situations and simplified ones for lower‑risk situations.

§ 4 When available, assessments carried out by the Public Authority may be used as a subsidy for the internal risk assessment.

§ 5 It is admitted that a supervised entity that belongs to a conglomerate or economic group, including one with foreign control, fulfills the duty set out in the caput by assuming the internal AML/CTF/WMD risk assessment possibly carried out centrally within the conglomerate or group, provided that such centralized assessment contains the minimum parameters provided for in this article.

§ 6 The internal risk assessment must be:

I – Documented and approved, within the supervised legal entity, by at least one formally designated administrator;

II – Communicated to employees, outsourced service providers and collaborators in general, using clear and accessible language, at a level of detail compatible with the functions they perform and the sensitivity of the information;

III – Reviewed at least every two years, or whenever a significant change occurs in the risk profile mentioned in § 1.

CHAPTER V

PROCEDURES TO KNOW CLIENTS

Article 7 Supervised entities must implement and maintain, in a manner compatible with their size and volume of operations, procedures aimed at knowing their clients that ensure due diligence in their identification, qualification and risk classification.

§ 1 In the procedures referred to in the caput, the following must be considered:

I – the client’s risk profile and the risk profile of the associated operation, including reinforced measures for higher‑risk cases;

II – the AML/CTF/WMD policy; and

III – the internal risk assessment.

§ 2 The procedures mentioned in the caput must be formalized in a specific manual, kept up‑to‑date and approved, within the supervised legal entity, by at least one formally designated administrator.

§ 3 Client identification procedures must cover verification and validation of the client’s identity, including in the context of non‑face‑to‑face operations.

§ 4 Client qualification procedures must include measures aimed at:

I – assessing the compatibility between the client’s economic‑financial capacity and the associated operation;

II – verifying the client’s status as a politically exposed person, pursuant to the regulation established by Coaf on the matter; and

III – obtaining the information necessary for client knowledge required to compose the minimum sets of registration data specified in Coaf regulations applicable to the segment in which the supervised entity operates.

§ 5 Risk‑classification procedures must consider the risk categories defined in the internal risk assessment and incorporate the information obtained in the client qualification procedures.

Article 8 The identification, qualification and risk‑classification procedures for clients must be extended, proportionally to the involved risk profiles, to administrators and partners when dealing with corporate clients, also covering representatives, attorneys or agents involved in the context of the operation associated with the client.

Single paragraph. In the case of clients constituted as public companies or cooperatives, pursuant to the corresponding legislation, the procedures referred to in the caput may be waived with respect to partners, except for those who must be identified as ultimate beneficial owners in compliance with art. 9.

Article 9 The qualification procedures for corporate‑person clients must include the identification of ultimate beneficial owners, defined as the natural persons who ultimately control the legal entity or who have decisive power to direct, influence or benefit from it, regardless of formal titles such as controller, administrator, officer, representative, attorney or agent.

§ 1 The use of a minimum reference shareholding percentage for identifying the ultimate beneficial owner is permitted, which must be established based on the client’s risk classification and may not exceed 25 % (twenty‑five percent) of the share capital, considering, in any case, both direct and indirect participation.

§ 2 A natural person who is a representative of the legal entity, including as attorney or agent, who effectively commands it, is also considered an ultimate beneficial owner.

§ 3 At minimum, the natural persons referred to in the caput must be subject to the qualification procedures defined for the client’s risk category.

Article 10 It is prohibited, for the purpose of complying with this Chapter V, to commence a business relationship without first adopting the identification and qualification procedures provided herein.

CHAPTER VI

PROCEDURES TO KNOW EMPLOYEES, OUTSOURCED SERVICE PROVIDERS, OTHER COLLABORATORS AND PARTNERS

Article 11 Supervised entities must implement and maintain, in a manner compatible with their size and volume of operations, procedures aimed at knowing their employees, outsourced service providers and collaborators in general, as well as relevant partners in business models they adopt, with the objective of ensuring due diligence in their identification, qualification and risk classification, in the same manner as Chapter V.

Article 12 Supervised entities must keep up‑to‑date the information relating to their employees, outsourced service providers, collaborators in general and relevant partners in business models they adopt, notably regarding any changes that imply a change in their risk classification.

CHAPTER VII

FINAL PROVISIONS

Article 13 The application of the provisions of this Resolution may be waived for a supervised entity that falls into a lower‑size and lower‑volume category, at Coaf’s discretion, provided that, through a detailed justification, the supervised entity concludes that it is covered by such categorization and that its internal risk assessment shows low AML/CTF/WMD risks relative to its activities.

§ 1 The detailed justification referred to in the caput must be documented and approved, within the supervised legal entity, by its administrators, without prejudice, in any case, to the broad liability provided for in art. 12 of Law No. 9,613, of 1998, even in the absence of formal approval.

§ 2 It is incumbent upon the President of Coaf to establish, by a separate act, the parameters that allow the waiver provided for in this article, including the criteria for classifying entities into lower‑size and lower‑volume categories mentioned in the caput.

§ 3 Supervised entities must provide documentary proof, when requested, of the conditions required for the waiver provided for in the caput.

§ 4 The conclusion of the supervised entity based on the detailed justification referred to in the caput does not eliminate the possibility of liability for non‑compliance with the duties set out in this Resolution, in the form of art. 12 of Law No. 9,613, of 1998, through an administrative sanctioning process that ensures the parties the observance of the principles of adversarial proceedings and full defense, should an inconsistency of the mentioned conclusion be verified.

§ 5 The internal risk assessment referred to in the caput must be updated at least every two years, or whenever a significant change occurs in the related risk profile.

Article 14 The documents and information referred to in this Resolution must remain available to Coaf for a minimum period of five years counted from the date of their production.

Article 15 To supervised entities, as well as, in the case of legal persons, to their administrators, who fail to comply with the duties set out in this Resolution, Coaf will apply, cumulatively or not, the sanctions provided for in art. 12 of Law No. 9,613, of 1998, through the competent administrative sanctioning process.

Article 16 This Resolution enters into force on June 1, 2021.

Ricardo Liáo