Supervisory Guidance Paper on Politically Exposed Persons

1 Guidance on Politically Exposed Persons

1. Executive Summary 1.1 The Prevention of Money Laundering and Funding of Terrorism Regulations (PMLFTR) deal, amongst other, with the subject of politically exposed persons (PEPs). These are defined, in line with the EU 4th Anti-Money Laundering Directive, as individuals entrusted with a “prominent public function”. In view of the higher risk attributed to PEPs, the PMLFTR require subject persons to apply enhanced due diligence (EDD) measures when they are offering services to PEPs. 1.2 The Malta Financial Services Authority (MFSA) expects all persons and entities licensed or otherwise authorised by it and which qualify as subject persons under the PMLFTR, to comply with their anti-money laundering and combating financing of terrorism (AML/CFT) obligations under the PMLFTR, including the requirement to apply a risk based approach to identifying PEPs and to apply appropriate EDD measures when dealing with PEPs. 1.3 Family members of PEPs and persons known to be close associates of PEPs are subject to the same EDD measures that are applicable to PEPs in view of the similar higher risk that they pose. 1.4 This guidance on the identification and treatment of PEPs is therefore being issued by the MFSA in order to assist subject persons falling under its regulatory function. This guidance should be in line with the FIAU Implementing Procedures and will be revised as necessary should the need arise. In the case of any conflict between this guidance and the Implementing Procedures, the Implementing Procedures shall prevail. 1.5 Subject persons are required to carry out customer due diligence (CDD) measures which are proportionate to the risks posed by the customer. This applies also to PEPs and family members and persons known to be a close associate of PEPs. Not all PEPs pose the same level of risk and the EDD measures to be applied should be proportionate to the risk attributed to a particular PEP. 1.6 The PMLFTR do not provide an explanation of what is a “prominent public function” however they provide a list of non-exhaustive examples as to who is to be considered as holding a prominent public function and therefore as a PEP. Middle ranking and junior officials are not to be considered as PEPs. 1.7 Subject persons are required to assess on a case by case basis whether a particular office presents characteristics which would fall within the definition of a ‘prominent public

2 function’. While a public function may in one case or country lead to its holder being considered a PEP, in another situation or country the same public function may be considered differently. 1.8 The PMLFTR do not distinguish between local and foreign PEPs. Any person entrusted with a prominent public function whether in Malta, or in any other jurisdiction (including in a supranational institution or within inter-governmental bodies such as the European Union and the United Nations), is considered to be a PEP and a subject person is required to carry out the EDD measures. 1.9 This guidance applies the examples of prominent public functions indicated in the PMLFTR to the Maltese context and gives a non-exhaustive list of persons occupying a prominent public function in Malta which should be considered as PEPs. 1.10 The guidance covers also family members of PEPs and persons known to be close associates of PEPs. Once again in the case of family members, the PMLFTR provides a non-exhaustive list of examples while in the case of close associates the PMLFTR provide an explanation of sorts which should assist subject persons to identify a customer falling under this category. 1.11 Subject persons are required to maintain risk management procedures to determine whether a customer or a beneficial owner is a PEP. This requirement is applicable to both prospective and existing customers given that a customer may become a PEP in the course of an ongoing relationship. This forms part of the on-going monitoring obligation. 1.12 Guidance is also provided on how subject persons can verify whether a customer is a PEP or not, including relying on publicly available information or obtaining information directly from the customer or using commercial databases. 1.13 The application of EDD to PEPs, their family members and close associates is mandatory as long as a PEP remains entrusted with a prominent public function, and for a subsequent 12 month period from when he/she ceases to be a PEP. The risk based approach shall however continue to apply, and CDD measures proportionate to the risk, including EDD where appropriate, should be applied. 1.14 Not every PEP poses the same risk of ML/FT and therefore subject persons are required to assess and determine the level of ML/FT risk posed by a particular PEP, family member or close associate, and then determine, based on the risk assessment undertaken, the level of EDD measures required in each particular case. A PEP, family member or close associate of the PEP deemed to be low risk are nevertheless not exempt from the application of EDD measures. However in such cases the subject person may apply a lighter level of EDD measures. 1.15 This guidance provides also indications of the characteristics that might suggest that a PEP is of a high risk or of a low risk and of the characteristics that might suggest a family member or a close associate poses a higher risk.

3 1.16 Finally the guidance notes also outline and provide information on the application of the EDD measures that are to be taken by subject persons in the case of PEPs, family members and close associates. These consist of obtaining senior management approval prior to providing a service to a PEP, family member or close associate; taking adequate measures to establish the source of wealth and funds involved; and conducting enhanced ongoing monitoring.

4 2. Introduction 2.1 The Malta Financial Services Authority (MFSA) expects all persons and entities licensed or otherwise authorised by it and which qualify as subject persons under the PMLFTR, to comply fully with their anti-money laundering and combating financing of terrorism (AML/CFT) obligations under the PMLFTR and the Implementing Procedures issued by the Financial Intelligence Analysis Unit (FIAU). Amongst these obligations is the requirement to apply a risk based approach to identifying PEPs and to apply appropriate EDD measures when dealing with PEPs. 2.2 The MFSA therefore has decided to issue this guidance on the identification and treatment of PEPs in order to assist subject persons falling under its regulatory function. The FIAU shall be issuing in due course revised Implementing Procedures, including on PEPs, for all subject persons. This guidance should be in line with the FIAU Implementing Procedures and care has been taken to ensure this. This guidance will be revised as necessary should the need arise. Nevertheless in the case of any conflict, the Implementing Procedures shall prevail. 3. PEPs, risk and enhanced due diligence 3.1 PEPs pose a high risk of money laundering and financing of terrorism (ML/FT). This is due to the position they occupy and the influence they exercise. These may be abused for private gain resulting in, for example, proceeds from corruption, bribery, abuse of public funds etc. which would need to be laundered. Certain PEPs in certain positions may also be exposed to the possibility of being involved in FT. The application of EDD measures is therefore necessary to mitigate the potential risks associated with PEPs. 3.2 Family members of PEPs and persons known to be close associates of PEPs may also benefit from, or be used to facilitate abuse by a PEP. Therefore the same EDD measures that are applicable to PEPs are also applicable in the case of family members or persons known to be close associates of a PEP. 3.3 The PMLFTR, in Regulation 11(5) require subject persons to apply EDD measures when the customer and/or the beneficial owner is a PEP, both when establishing or continuing business relationships, or undertaking occasional transactions. 3.4 It should be pointed out that the application of EDD measures to PEPs and their family members and persons known to be close associates does not necessarily mean that their business relationship or occasional transactions are connected to ML/FT. 3.5 Subject persons are required to carry out customer due diligence (CDD) measures which are proportionate to the risks posed by the customer. When dealing with PEPS (or a family member or person known to be a close associate of a PEP), additional measures in the form of EDD are to be applied by the subject person in order to mitigate the higher ML/FT risks. However subject persons are not required to turn away a prospective customer or close a business relationship simply on the basis that the customer, or

5 beneficial owner, is a PEP (or a family member or person known to be a close associate of the PEP). 3.6 It should be made clear however that if after conducting proper CDD on the customer or the beneficial owner, and after conducting a risk assessment, the subject person determines that the customer or beneficial owner falls outside its risk appetite (for example when the high risk posed by the customer is higher than can be effectively mitigated), the subject person should decline or close the business relationship, or not carry out the occasional transaction. 4. Who are those individuals that should be considered as a PEP? 4.1 Regulation 2 of the PMLFTR defines a PEP as a natural person who is or has been entrusted with a prominent public function, other than middle ranking or more junior officials. While middle ranking or more junior officials are not considered as PEPs and therefore are not considered as requiring the application of EDD measures in terms of Regulation 11(5), this does not exclude the possibility that EDD measures may still have to be applied to middle ranking or junior officials where it is determined that there is a high risk of ML or FT - Regulation 11(1)(b). 4.2 There is no explanation of what constitutes a ‘prominent public function’ in the PMLFTR. This depends on a number of factors such as the type, size, budget, powers and responsibilities associated with a particular public function and the organisational framework of the government or international organisation concerned, and other factors that are considered as part of the risk assessment. 4.3 The PMLFTR however, in Regulation 2, provide a list of examples of who is to be considered to hold a prominent public function and therefore as a PEP:  Heads of State, Heads of Government, Ministers, Deputy or Assistant Ministers, and Parliamentary Secretaries;  Members of Parliament or similar legislative bodies;  Members of the governing bodies of political parties;  Members of the superior, supreme, and constitutional courts or of other high-level judicial bodies whose decisions are not subject to further appeal, except in exceptional circumstances;  Members of courts of auditors, or of the boards of central banks;  Ambassadors, charge d’affaires and other high ranking officers in the armed forces;  Members of the administrative, management or supervisory boards of state-owned enterprises;  Anyone exercising a function equivalent to those set out in paragraphs (a) to (f) above within an institution of the European Union or any other international body. 4.4 This list is not exhaustive and subject persons are required to assess on a case by case basis whether a particular office presents characteristics which would fall within the definition of a ‘prominent public function’. The same public function may in one case or country lead to its holder being considered a PEP, while in another situation or

6 country this may not be the case. By way of example, the position and powers of a mayor of a large city or head of a region in a foreign jurisdiction might not necessarily be equivalent to those of a mayor of a small village in Malta, and therefore a mayor may be treated differently depending on the jurisdiction concerned. 4.5 The PMLFTR do not distinguish between local and foreign PEPs. Any person entrusted with a prominent public function whether in Malta, or in any other jurisdiction (including such persons in a supranational institution or within inter-governmental bodies such as the European Union and the United Nations), is considered to be a PEP and the subject person is required to carry out the EDD measures specified in Regulation 11(5). 4.6 In the Maltese context the examples indicated in the PMLFTR of persons occupying a prominent public function and therefore considered as PEPs should be understood as follows: Heads of State, Heads of Government, Ministers, Deputy and Assistant Ministers and Parliamentary Secretaries:  the President of the Republic of Malta;  the Prime Minister;  Ministers and Parliamentary Secretaries; Members of Parliament or similar legislative bodies:  members and the Speaker of the House of Representatives of the Republic of Malta;  Maltese members of the European Parliament; Members of the governing bodies of political parties:  persons falling within this category would include individuals entrusted with the management and administration of a political party but do not include paid up members or regional or town representatives; Members of the judiciary or of other high-level judicial bodies whose decisions are not subject to further appeal, except in exceptional circumstances:  judges and magistrates; Members of courts of auditors, audit committees or of the boards of the Central Bank:  the Auditor General and Deputy Auditor General;  the Governor and Deputy Governor of the Central Bank of Malta; Ambassadors, charge d’affaires and other high ranking officers in the armed forces:  ambassadors and charges d’affaires of foreign jurisdictions in Malta;  Maltese ambassadors and charges d’affaires abroad. Honorary Consuls are not to be considered as PEPs;  the Commander and Deputy Commander of the Armed Forces of Malta; Members of the administrative, management or supervisory boards of state-owned enterprises:

7  members of the administrative, management or supervisory boards of commercial entities and companies in which the Government of Malta has an ownership interest or control of more than 50%. 4.7 It must be reiterated that the above list of who should be considered as a PEP in Malta is not exhaustive and represents only the list of examples set out in the PMLFTR. There are other public functions in Malta that can be considered as being “prominent” public functions which are not indicated above and which would qualify their holder to be considered as a PEP. Such prominent public functions include:  permanent secretaries within all the ministries;  chiefs of staff within all the ministries;  the Commissioner and Deputy Commissioners of police;  the Attorney General; 4.8 All Maltese individuals who are entrusted with a prominent public function equivalent to the above in an EU institution or other international body would also be considered PEPs. These include the Maltese EU Commissioner, Maltese Members of the European Parliament, Maltese Members of the European Court of Auditors and of the European Court of Justice. 4.9 It is therefore emphasised that subject persons are required to assess on a case by case basis whether a particular office presents characteristics which would fall within the definition of a ‘prominent public function’. 4.10 With respect to the term ‘family members’ of PEPs, the PMLFTR provide that the term includes:  the spouse, or any person considered to be equivalent to a spouse;  the children and their spouses, or persons considered to be equivalent to a spouse; and  the parents. The list of “family members” is not an exhaustive list and therefore subject persons are required to assess the nature of a particular family relationship and whether in the specific circumstances of the case the relationship may be considered to be similar to those in the indicative list in the PMLFTR. 4.11 With respect to the term ‘persons known to be close associates’, the PMLFTR provide that the term means:  a natural person known to have joint beneficial ownership of a body corporate or any other form of legal arrangement; or any other close business relations, with that PEP; or  a natural person who has sole beneficial ownership of a body corporate or any other form of legal arrangement that is known to have been established for the benefit of that PEP. 4.12 In the case of personal relationships, the social, economic and cultural context may also play a role in determining how close those relationships generally are. This process may

8 become difficult when seeking to form a view on the status of close family members, such as children and their spouses, who may, in certain circumstances, be quite distant or estranged from their parent/s or other relative having a PEP status. 5. What should a subject person do to determine that a person is a PEP? 5.1 This is provided for in Regulation 11(5) of the PMLFTR which requires subject persons to maintain risk management procedures to determine whether a customer or a beneficial owner is a PEP. This requirement is not only applicable to prospective customers but also to existing customers, given that existing customers, or their family members or close associates, may become PEPs at a point in time in the course of an ongoing relationship. Subject persons should therefore ensure that their risk management procedures include a mechanism to ascertain when an existing customer becomes a PEP. This forms part of the on-going monitoring obligation. 5.2 In determining whether the customer or a beneficial owner is a PEP, subject persons are required to:  rely on publicly available information; or  obtain such information directly from the customer or beneficial owner; and  use commercial databases. 5.3 Where publicly available information is used, subject persons should assess the reliability of the sources being relied upon. Subject persons should refer to different sources and should not rely solely on one particular source. All searches undertaken by the subject person should be duly documented and retained by the subject person. 5.4 Information obtained directly from the customer may be obtained in response to a question posed in the application or on-boarding form. Alternatively, subject persons may develop a questionnaire with specific reference to criteria that identify PEPs including family members and persons known to be close associates of the PEP. Such a questionnaire would be required to be completed and signed by the customer and the beneficial owner, where applicable. 5.5 Subject persons should also determine whether the use of commercial databases, to confirm the information provided by the customer, is necessary. Prior to making use of any commercial databases, subject persons should understand how commercial databases are populated and how these are able to detect and flag PEPs, family members and persons known to be close associates of PEPs. 5.6 The application of EDD to PEPs, their family members and close associates is mandatory as long as a PEP remains entrusted with a prominent public function, as defined above, and for a subsequent 12 month period from when he/she ceases to be a PEP. The risk based approach shall however continue to apply, and CDD measures proportionate to the risk, including EDD where appropriate, should be applied.

9 6. EDD measures to be applied in relation to PEPs 6.1 Regulation 11(5) and (8) of the PMLFTR require subject persons to apply specific EDD measures in relation to PEPs, their family members and persons known to be close associates. 6.2 Since not every PEP poses the same risk of ML/FT, subject persons are required to assess and determine the level of ML/FT risk posed by that particular PEP, family member or person known to be a close associate. Subject persons should therefore assess the different types of risks it is exposed to (geographical, product/service/transaction, customer, delivery/distribution channel/interface) and determine, based on the risk assessment undertaken, the level of EDD measures required in each particular case. 6.3 It is important to point out that, by classifying the PEP, family member or person known to be a close associate of the PEP as low risk, the subject person is not, however, exempt from applying the EDD measures set out in Regulation 11(5) of the PMLFTR. This notwithstanding, in case where the customer, or beneficial owner, is considered to be a low risk PEP, the subject person may apply a lighter level of EDD measures than in the case where the customer, or beneficial owner, is a high risk PEP. 6.4 The following characteristics might suggest that a PEP is of a low risk:  customer is seeking to have access to a product/service/transaction which has been assessed by the subject person to pose a low risk (such as products, services or transactions to which SDD measures may be applied);  customer does not have executive decision-making responsibilities (e.g. an opposition member of the House of Representatives, or a member of the House of Representatives of the party in government but with no ministerial office);  the PEP is subject to rigorous disclosure requirements (such as registers of interests, independent oversight of expenses etc); and  the PEP is entrusted with a prominent public function in a jurisdiction where information is available showing that the jurisdiction has the following characteristics (the jurisdiction would have to be assessed separately): i. low levels of corruption; ii. political stability, and free and fair elections; iii. strong state institutions; iv. strong compliance with AML/CFT rules; v. a free press with a track record for probing official misconduct; vi. an independent judicial and criminal justice system free from political interference; vii. a track record for investigating political corruption and taking action; viii.legal protections for whistleblowers. ix. well-developed registries for ownership of land, companies, etc.

10 6.5 The following characteristics might suggest that a PEP is of a higher risk:  where the customer is seeking to have access to a product, service or transaction which is capable of being misused to launder the proceeds of corruption or bribery;  personal wealth or lifestyle inconsistent with known legitimate sources of income or wealth;  credible allegations of financial misconduct; and  the PEP is entrusted with a prominent public function in a jurisdiction where there is a higher risk of corruption and where information is available showing that the jurisdiction has any of the following characteristics (the jurisdiction would have to be assessed separately): i. high levels of corruption; ii. political instability; iii. weak state institutions; iv. weak AML/CFT defences; v. armed conflict; vi. non-democratic forms of government; vii. widespread organised criminality; viii. political economy dominated by a small number of people or entities with close links to the state; ix. lack of a free press where journalistic investigation is constrained; x. a judicial and criminal justice system vulnerable to political interference; xi. lacking expertise and skills related to book-keeping, accountancy and audit, particularly in the public sector; xii. law and culture antagonistic to the interests of whistleblowers; xiii. weaknesses in the transparency of registries of ownership for land, companies, etc.; xiv. human rights abuses. 6.6 Moreover, the following characteristics might suggest a family member or a close associate of a PEP poses a higher risk:  wealth derived from the granting of government licences (such as mineral extraction concessions, licence to act as a monopoly provider of services, or permission for significant construction or other projects);  wealth derived from preferential access to the privatisation of former state assets;  wealth derived from commerce in industry sectors associated with high-barriers to entry or a lack of competition, particularly where these barriers stem from law, regulation or other government policy;  wealth or lifestyle inconsistent with known legitimate sources of income or wealth;

11  appointment to a public office that appears inconsistent with personal merit;  credible allegations of financial misconduct (e.g. facilitated, made, or accepted bribes). 6.7 When undertaking additional CDD measures on PEPs, their family members or persons known as close associates, subject persons must apply all the EDD measures set out in Regulation 11(5) of the PMLFTR, namely: a) obtaining senior management approval 6.8 This means having the approval of an officer or employee of the institution with sufficient knowledge of the subject person’s ML/FT risk exposure and sufficient seniority to take decisions affecting its risk exposure. Such officer or employee need not be a member of the board of directors or equivalent body. The approval of senior management should be clearly documented. 6.9 What will constitute senior management will depend on the size, structure and the nature of the subject person and it is possible that this decision be also taken by an internal committee of the institution. Senior management approval ensures that the necessary precautions and controls are in place before deciding to do business with a PEP. Senior management approval is required irrespective of the level of risk a PEP may pose. However the level of escalation within the subject person’s structure will vary depending on the risk posed by the customer, as well as the entity structure and the level of delegation within the subject person’s structure. 6.10 When considering whether to approve a PEP relationship, senior management should base their decision on the level of ML/FT risk the subject person would be exposed to if it entered into that relationship and how well equipped it is to manage that risk effectively. b) taking adequate measures to establish the source of wealth and funds involved 6.11 A subject person must take adequate measures to establish the source of wealth and the source of funds of the customer, in order to be satisfied that it does not handle the proceeds from corruption or other criminal activity. The extent of information and/or documentation to be requested by the subject person will vary depending on the risk posed by the customer. 6.12 It is always necessary to seek source of wealth information however in case of lower risk situations, the subject person may take less intrusive and less exhaustive steps to establish the source of funds and source of wealth of the PEP, family members or known close associates of the PEP. In such cases, the subject person may use information already available to the subject person (such as transaction records) or may rely on publicly available information and is not required to make further inquiries unless the

12 subject person identifies certain anomalies from the information available to him. In all lower risk cases, especially when dealing with products, services or transactions that carry a lower risk of ML/FT, subject persons can minimise the amount of information they collect and how they verify the information provided. 6.13 In higher risk situations, subject persons are required to be more intrusive and take more exhaustive steps, and should consider whether to collect documentation from the customer in order to establish the source of funds and source of wealth of the PEP, family members or known close associates of the PEP. Subject persons may wish to refer to information sources such as asset and income declarations, which some jurisdictions expect certain senior public officials to file and which often include information about an official’s source of wealth and current business interests, and may be publicly available. Subject persons should also be aware that some jurisdictions impose restrictions on their PEP’s ability to hold foreign bank accounts or to hold other office or paid employment. 6.14 As part of its EDD measures, subject persons should consider, on a risk sensitive basis, whether the information regarding source of wealth and source of funds should be evidenced. For example, for source of wealth or funds from inheritance, a copy of the will could be requested, or if from a sale of property, evidence of transfer of legal title could be sought. c) conducting enhanced ongoing monitoring 6.15 For low risk customers, the subject person is required to undertake less formal frequent reviews than higher risk customers. In the case of low risk customers, the subject person would be required to review the CDD measures undertaken at the establishment of the business relationship and update the CDD documentation as appropriate. Subject persons would also be required to update the CDD documentation undertaken at the commencement of the business relationship or the undertaking of an occasional transaction when a new product, service or transaction is requested. 6.16 For higher risk customers, a subject person’s ongoing monitoring should be conducted more regularly and more thoroughly, and a closer analysis should be undertaken on the transactions and their origin. Subject persons should also consider whether the business relationship with such customers should be maintained or the occasional transaction undertaken. 6.17 Subject persons should remember that new and existing customers may not initially meet the definition of a PEP, but may subsequently become a PEP during the course of a business relationship. It is for this reason that an automated system of checks against publicly available information, or through specialist PEP databases of commercial service providers, would be useful in this respect.

13 6.18 Subject persons should identify unusual transactions and regularly review the information they hold to ensure that any new or emerging information that could affect the risk assessment is identified in a timely fashion. 6.19 In the case of long-term insurance business, subject persons shall take reasonable measures to determine whether the beneficiaries of a policy and, where applicable, the beneficial owner of such beneficiary, are PEPs, their family members or known close associates, and such measures shall be taken no later than the time of payout or the time of the assignment, in whole or in part, of the policy. 6.20 Therefore, not later than the time of payout, or the time of the assignment, subject persons are first expected to check whether there is any involvement of PEPs, family members or known close associates in the transaction. In the event that the beneficiary of the policy or, where applicable, the beneficial owner of the beneficiary are PEPs, family members or known close associates, senior management approval is required before proceeding with the payout under the policy. Moreover, subject persons are required to scrutinise the relationship with the policy holder to ensure that the policy would not have been misused to channel funds to the PEP (e.g. a long-term insurance is set up and withdrawn within a short period of time, or there seems to be no apparent or logical sense for the particular customer to be a beneficiary in a policy). 6.21 Subject persons should be careful to assess the logical and economical rationale of the entire set up. The extent of the checks to be undertaken will vary depending on the level of risk which the customer poses. 8 th October 2018