Resolution on the approval of the Guidelines for Financial Market Participants on the implementation of international sanctions

[pic]

BOARD OF THE BANK OF LITHUANIA

RESOLUTION ON THE APPROVAL OF THE GUIDELINES FOR FINANCIAL MARKET PARTICIPANTS ON THE IMPLEMENTATION OF INTERNATIONAL SANCTIONS

30 May 2023 No 03-98 Vilnius

Pursuant to Article 42(4)(1) of the Republic of Lithuania Law on the Bank of Lithuania, Article 11(7) of the Republic of Lithuania Law on International Sanctions, and Article 4(3) of the Republic of Lithuania Law on the Restructuring of the Financial Market Supervisory System, the Board of the Bank of Lithuania has r e s o l v e d: 1. To approve the Guidelines for financial market participants on the implementation of international sanctions (attached); 2. To repeal: 2.1. Resolution No N-133 of the Insurance Supervision Commission of the Republic of Lithuania of 2 November 2005 on the Approval of the Guidelines on the Supervision of the Proper Implementation of International Sanctions in the Field of Regulation of the Insurance Supervision Commission of the Republic of Lithuania; 2.2. Resolution No 1K-20 of the Securities Commission of the Republic of Lithuania of 7 July 2005 on the Approval of the Guidelines on the Supervision of the Implementation of International Sanctions in the Field of Regulation by the Securities Commission of the Republic of Lithuania. 3. The present Resolution comes into effect on 1 September 2023.

Chairman of the Board Gediminas Šimkus APPROVED by Resolution No 03-98 of the Board of the Bank of Lithuania of 30 May 2023

GUIDELINES FOR FINANCIAL MARKET PARTICIPANTS ON THE IMPLEMENTATION OF INTERNATIONAL SANCTIONS

CHAPTER I GENERAL PROVISIONS

1. The Guidelines for Financial Market Participants on the Implementation of International Sanctions (hereinafter, the Guidelines) shall establish the basic principles and requirements for financial market participants (FMPs) in relation to internal policies and internal control procedures for the implementation of international sanctions. 2. The Guidelines shall apply to FMPs supervised by the Bank of Lithuania, as specified in Article 42(1) of the Republic of Lithuania Law on the Bank of Lithuania, except for issuers that are not simultaneously other FMPs as indicated in Article 42(1) of the Law on the Bank of Lithuania. 3. For the purposes of the Guidelines: 3.1. Internal control system for the implementation of international sanctions means the totality of measures applied by FMPs in order to ensure that the international sanctions implemented in the Republic of Lithuania are complied with in accordance with the procedure established by the legislation and are properly implemented. The totality of measures shall include all measures applied by the FMPs to take actions required by international sanctions implemented in the Republic of Lithuania and/or to refrain from any action which would result in non-compliance with or avoidance of restrictions and obligations imposed by international sanctions implemented in the Republic of Lithuania; 3.2. International sanctions risk means the likelihood that the FMPs will fail to comply with, evade (participate in the evasion of) and/or violate (participate in the violation of) international sanctions implemented in the Republic of Lithuania. 4. Terms used in the present Guidelines shall have the meanings assigned to them in the Republic of Lithuania Law on International Sanctions (hereinafter, the Law).

CHAPTER II GENERAL REQUIREMENTS

5. The internal control system for the implementation of international sanctions shall be an integral and indispensable part of the overall internal control system of FMPs, ensuring an uninterrupted proper implementation of international sanctions by FMPs. 6. The FMPs shall establish the internal control system for the implementation of international sanctions consistent with the type, size, organisational structure, nature, scale, scope and complexity of the FMP’s activities, the services and/or products it provides and the international sanctions risk that the FMP faces. 7. The internal control system for the implementation of international sanctions is based on the internal control policy on the implementation of international sanctions. The implementation of the provisions of the internal policy on the implementation of international sanctions shall be set out in the internal control procedures. 8. FMPs shall ensure that the internal control system for the implementation of international sanctions includes the continuous and effective identification, assessment and management of risks related to international sanctions and their implementation. The FMPs’ internal policies and internal control procedures for the implementation of international sanctions shall be established taking into account, inter alia, the results of the FMPs’ assessment of international sanctions risk, which shall be carried out in accordance with the provisions of Chapter III of the Guidelines. 9. The internal control system for the implementation of international sanctions shall include at least: 9.1. a system for the provision of information to the management bodies to enable timely decisions on the implementation of international sanctions; 9.2. the appointed responsible person to organise the implementation of international sanctions in the activities of the FMPs, to be responsible for taking decisions to freeze the funds and economic resources belonging to, owned, managed or controlled by the sanctioned entities, and/or other decisions on the imposition of international sanctions, to report to the competent authorities and the Bank of Lithuania, and to monitor the implementation of international sanctions in the activities of the FMPs at regular intervals; 9.3. the staff competence consistent with the employees’ job functions, clearly defined areas of responsibility as well as segregation and distribution of their functions and duties; 9.4. The measures to implement international sanctions that are intended, at least, to: 9.4.1. determine whether the FMP’s customers, counterparties to transactions, financial institutions or other persons involved in the transaction or its execution are sanctioned entities; 9.4.2. determine whether the FMP’s service providers, business partners, intermediaries, shareholders and management bodies are sanctioned entities; 9.4.3. determine whether the transactions/operations of the FMP itself or its customers fall within the scope of restrictions and/or prohibitions imposed by international sanctions; 9.4.4. prevent the FMP from violating, circumventing or evading international sanctions and/or prevent taking advantage of the FMP in taking such actions; 9.5. an adequate information technology system to ensure the continuous collection, processing and use of data aimed at proper implementation of international sanctions. The information technology system must be adapted to the measures referred to in paragraph 9.4 for the implementation of international sanctions, taking into account the manner in which they are applied (e.g. manual tools, automated tools), their nature and complexity. 10. FMPs shall ensure that the employees appointed as persons responsible for proper implementation of international sanctions at the FMP have adequate knowledge of the legislation regulating international sanctions and the application thereof and sufficient resources and means to identify possible infringements, circumvention and/or evasion of international sanctions. 11. Measures applied by the FMPs to manage/mitigate the international sanctions risk and/or measures applied for the implementation of international sanctions must be objectively justified and comply with the content of the international sanctions implemented in the Republic of Lithuania, as laid down in the legal acts imposing international sanctions.

CHAPTER III INTERNATIONAL SANCTIONS RISK MANAGEMENT

12. An effective internal control system for the implementation of international sanctions must ensure that the international sanctions risks are identified and assessed and that appropriate measures are taken to manage/mitigate the risks. 13. In order to effectively identify, assess and manage international sanctions risks, the FMP shall carry out an assessment of international sanctions risks taking due account of the FMP’s business model and the nature of the services/products provided. 14. The FMP shall ensure that the FMP’s international sanctions risk assessment is performed, revised and updated regularly and at least once a year and/or upon any significant change in international sanctions risk. The FMP’s international sanctions risk assessment may be carried out in conjunction with the FMP’s business-wide AML/CTF risk assessment or separately. Upon any significant changes in international sanctions risk, the FMP may decide to review and update only those parts of the international sanctions risk assessment (areas) that are affected by the changes. A significant change in international sanctions risk shall be at least: 14.1. a change in the legal acts regulating the implementation of international sanctions in the Republic of Lithuania, the entry into force of new international sanctions implemented in the Republic of Lithuania, a substantial (large-scale) renewal of existing international sanctions, or the lifting of existing international sanctions, where the new, renewed or lifted sanctions regime may have a significant impact on the FMP and/or its activities; 14.2. the launch of new services, products of the FMP, or any new channels for the provision of services/products; 14.3. a significant increase in the number of customers, number or value of transactions carried out by the FMP, and/or changes in the activity of the FMP’s clients, indicating a higher risk of international sanctions; 14.4. new geographic regions, territories and/or countries in which the FMP provides services directly or through intermediaries, branches, representative offices and/or subsidiaries; 14.5. intended significant changes in the FMP’s operations, management and/or organisational structure. 15. The international sanctions risk assessment carried out by the FMP shall at least cover the following risks (groups of risk factors): 15.1. FMP’s operational risk: 15.1.1. the geographical regions (territories, countries) in which the FMP operates and provides its services, including through its intermediaries, branches, representative offices and/or subsidiaries; 15.1.2. FMP’s services, products, operations and transactions; 15.1.3. FMP’s product, service and transaction channel risk; 15.2. FMP’s customer risk: 15.2.1. the risk posed by customers and associated risks posed by customers’ ownership and/or control structures; 15.2.2. the risk posed by the geographical region (territory, state) of the customer; 15.2.3. the risk relating to services and products used and transactions performed by the customer; 15.2.4. the risk relating to channels used for supplying a product, or providing a service and transaction channel risk; 15.3. the risk of proliferation financing associated with the risk of violating international sanctions designed to prevent the proliferation of weapons of mass destruction. 16. The FMP identified in Article 4(1) of the Republic of Lithuania Law on the Prevention of Money Laundering and Terrorist Financing assesses the risk factors listed in subparagraphs 15.1 and 15.2 of the Guidelines in the context of the international sanctions risk. 17. The assessment of international sanctions risks shall be carried out by the FMP in the context of all international sanctions implemented in the Republic of Lithuania, referred to in Article 6 of the Law. 18. All international sanction risk assessments performed by the FMP and subsequent amendments and/or updates relating to such risk assessments shall be documented. The outcome of any such assessment shall be notified to the FMP’s management body responsible for adopting measures for eliminating any shortcomings detected and for managing/mitigating risks and controlling their implementation. 19. After conducting an international sanctions risk assessment and determining that the existing international sanctions risk management measures are insufficient, the FMP shall draw up a risk management plan to be approved by the FMP’s management body.  20. Irrespective of whether the assessment of the risks of international sanctions is carried out in conjunction with the FMP’s business-wide AML/CTF risk assessment or separately, international sanctions risks must be assessed separately from money laundering and terrorist financing risks, considering the types of risks inherent to international sanctions, the likelihood of their occurrence etc.

CHAPTER IV POLICIES AND PROCEDURES FOR THE IMPLEMENTATION OF INTERNATIONAL SANCTIONS

21. The FMP shall ensure policies and internal control procedures for the implementation of international sanctions that: 21.1. are adequately documented and reviewed at least annually or more frequently, for example, in the event of changes in the requirements of the legislation establishing international sanctions or regulating their implementation, changes in the FMP’s measures for the implementation of international sanctions, changes in the risks identified in paragraph 15 of the Guidelines, taking due account of the results of the FMP’s international sanctions risk assessment or other material events, and shall be updated as necessary; 21.2. include procedures for identifying (taking into account the risk factors specified in paragraph 15 of the Guidelines), monitoring, assessing and managing international sanctions risks; 21.3. cover the actions and decision-making procedures of the FMP in the event of the detection of the application, breach, circumvention and/or evasion of international sanctions, including the restrictions (restrictions on accounts, transactions, operations, termination of business relationships, etc.) imposed by the FMP on the customer, service provider, business partner or intermediary in such cases and/or any cases where it is established that the transactions carried out by the FMP and/or its customer fall within the scope of restrictions and/or prohibitions imposed by international sanctions; 21.4. include procedures for the provision of notifications and/or information to the competent authorities in accordance with the requirements of the Law and other legislation governing the implementation of international sanctions; 21.5. include the procedure for assigning the person responsible for organising the implementation of international sanctions at the FMP, responsibilities of the staff member and the allocation of responsibility and reporting; 21.6. cover the allocation of responsibilities and reporting of the FMP’s staff responsible for measures designed for the implementation of international sanctions; 21.7. establish the measures to be applied to ensure proper competence and knowledge of the employees responsible for the implementation of international sanctions; 21.8. include at least the establishment and description of the measures to be taken to implement the international sanctions referred to in Chapter V of the Guidelines, and the procedures for the application and implementation/introduction of such measures; 21.9. include procedures for assessing the adequacy of the internal control system for the implementation of international sanctions referred to in Chapter VI of the Guidelines, as well as the procedure for the assessment of its effectiveness and efficiency. 22. The policy on the implementation of international sanctions of the FMP may be set out in the FMP’s overall risk management policy or in a separate document and approved by the FMP’s Board of Directors or other management body. The internal control procedures for the implementation of international sanctions of the FMP shall be approved by the FMP’s staff member or by the management body approving similar internal documents of the FMP (manager, head of service, etc.). 23. The FMP shall ensure that employees are familiarised with the internal policy and internal control procedures on the implementation of international sanctions approved by the FMP so that they are capable of properly performing their professional functions.

CHAPTER V MEASURES FOR THE IMPLEMENTATION OF INTERNATIONAL SANCTIONS

24. In order to ensure the proper implementation of international sanctions, as set out in the legislation establishing international sanctions and the legislation of the Republic of Lithuania regulating the implementation of international sanctions, the FMPs must establish measures to ensure the implementation of international sanctions, which would allow the identification of at least the customers, counterparties to transactions (operations), financial institutions or other persons involved in the transaction or its execution, FMP’s service providers, business partners, intermediaries, shareholders and management bodies of FMPs that are subject to international sanctions, as well as whether the FMP’s own transactions/operations or those of its customers do not fall within the scope of restrictions and/or prohibitions imposed by the international sanctions and/or otherwise prevent FMP’s involvement in the violation of, or the evasion or circumvention of, the international sanctions, and/or FMP’s taking advantage of such sanctions when performing such actions. 25. The measures to be taken by the FMPs referred to in paragraph 24 of the Guidelines shall include at least the following actions: 25.1. check, before carrying out one-off transactions, concluding transactions or entering into a business relationship with a customer, whether or not the FMP’s customers, counterparties to transactions, financial institutions or other persons involved in the transaction or its execution are sanctioned entities; 25.2. check, before entering into transactions, contracts and/or agreements with a service provider, business partner, intermediary, whether or not they are sanctioned entities; 25.3. in the course of the business relationship with the customer periodically check whether or not the customer is a sanctioned entity. The periodic screening of the customer must be carried out at least in the event of changes in international sanctions (lists of sanctioned entities) and/or changes in the details of the customer; 25.4. during the validity/execution of transactions, contracts and/or agreements periodically check whether or not the persons referred to in subparagraph 25.2 of the Guidelines are sanctioned entities. The periodic screening of the specified persons must be carried out at least in the event of changes in international sanctions (lists of sanctioned entities) and/or changes in personal data; 25.5. verify, prior to the execution of transactions, that one-off transactions carried out by the FMP’s customers, transactions carried out in the course of a business relationship with the FMP, as well as transactions carried out by the FMP itself or by intermediaries acting on its behalf, do not fall within the scope of international sanctions, do not violate international sanctions, and/or are not carried out for the purpose of circumventing or avoiding international sanctions; 25.6. ensure and in all cases follow the most up-to-date and relevant information on international sanctions implemented in the Republic of Lithuania. 26. In order to ensure proper implementation of international sanctions and taking into account the nature and content of the international sanctions implemented in the Republic of Lithuania, the FMP shall ensure that the information referred to in paragraph 25 of the Guidelines is screened to the extent relevant in the context of the applicable international sanctions, and may help to identify the applicable international sanctions, depending on the nature of the services and/or products provided by the FMP. For example, in order to ensure the proper implementation of international financial sanctions, not only the person (customer, service provider, etc.), but also its representative(s), manager(s), persons in the ownership structure, beneficiaries, are screened for matches with the international sanctions, and in cases where the FMP is not obliged to obtain the details of all or part of these persons in the manner provided for in the legislation, the FMP shall take measures and conduct screenings that are proportional to the international sanctions risk in relation to the customer or the transaction(s) it carries out; in order to ensure the proper implementation of international sanctions, all relevant details of a payment transaction are screened prior to the execution of payment transactions, i.e. both the counterparties involved in the payment transaction and the purpose of the payment transaction, as well as the entities and countries involved in the transaction and/or the payment chain. 27. When carrying out the actions referred to in paragraph 25 of the Guidelines, the FMP shall take into account the legislation, guidelines and/or recommendations of the European Union, the United Nations and/or other organisations whose sanctions are implemented in the Republic of Lithuania (for example, when assessing whether an entity is not to be considered sanctioned due to its ownership and/or control structure).

CHAPTER VI ASSESSMENT OF THE ADEQUACY, EFFECTIVENESS AND EFFICIENCY OF THE INTERNAL CONTROL SYSTEM FOR THE IMPLEMENTATION OF INTERNATIONAL SANCTIONS

28. The adequacy of the elements of the internal control system for the implementation of international sanctions referred to in paragraphs 7 and 9 of the Guidelines, as well as the effectiveness and efficiency of their application shall be assessed both on an ongoing basis (as part of the staff’s day-to-day duties) and periodically, but at least once every two years. 29. Periodic assessment may be carried out through internal or external audits, verification, testing of measures taken to implement international sanctions or other elements of the internal control system for the implementation of international sanctions, or other means selected by the FMP. The outcome of any such assessment shall be notified to the FMP’s management body responsible for adopting measures for eliminating any shortcomings detected and for managing/mitigating risks and for controlling their implementation. 30. Irrespective of the periodicity of the assessment of the internal control system for the implementation of international sanctions as specified in paragraph 28 of the Guidelines, the adequacy, effectiveness and efficiency of the elements of the FMP’s internal control system for the implementation of international sanctions must be assessed and appropriate changes/improvements to the elements of the system made in the following cases: 30.1. In case the FMP, the competent authority or the Bank of Lithuania has identified deficiencies in the FMP’s assessment of international sanctions risks and/or in the internal control system for the implementation of international sanctions, and/or the FMP has identified cases when the internal control system for the implementation of international sanctions did not ensure the proper application of the implementation of international sanctions and, as a result, requirements of the legislation establishing international sanctions, the Law and/or other legal acts regulating the implementation of the international sanctions have been inadequately and/or not fully enforced; 30.2. In the cases referred to in subparagraphs 14.1–14.5 of the Guidelines.

CHAPTER VII CONTROL OF INTERMEDIARY ACTIVITIES

31. Where the FMP provides services in the Republic of Lithuania or another country through intermediaries who are natural or legal persons and who provide payment services or other financial services on behalf of the FMP, the FMP shall ensure that: 31.1. intermediaries are duly familiarised with the requirements of the FMP’s internal policy on the implementation of international sanctions and the internal control procedures governing the implementation of international sanctions; 31.2. intermediaries are duly familiarised with the international sanctions implemented by the FMP and the international sanctions risks to which the FMP is exposed; 31.3. intermediaries are adequately trained to detect breaches of international sanctions, to identify cases of evasion, circumvention and avoidance of international sanctions, and to be able to take immediate action in accordance with the legislation on international sanctions in the event of suspicions, and to pass on the information to competent authorities and to the responsible staff of FMPs; 31.4. intermediaries’ activities are regularly audited and otherwise checked (assessed) in order to verify whether the intermediary respects the legal acts regulating international sanctions or the requirements for the implementation of international sanctions. 32. Where the FMP provides services in the Republic of Lithuania or another country through intermediaries who are natural or legal persons and provide financial services on behalf of the FMP, the FMP shall be held liable for the fulfilment of the requirements set out in the Guidelines.

CHAPTER VIII FINAL PROVISIONS

33. The FMP shall inform the Bank of Lithuania in writing within 5 working days at the latest if it has detected deficiencies in the internal control system for the implementation of international sanctions and/or cases where the FMP’s internal control system for the implementation of international sanctions has not been functioning or has been functioning inadequately, which has had an impact on the implementation of the international sanctions by the FMP.

---