Technical Standards for the Management of Money Laundering, Terrorism Financing, and Proliferation Financing Risks

CNBCR-08/2022
NRP-36
TECHNICAL STANDARDS FOR THE MANAGEMENT OF MONEY LAUNDERING, TERRORISM FINANCING, AND PROLIFERATION FINANCING RISKS (3) Approval: 23/09/2022 Validity: 10/10/2022

THE COMMITTEE OF STANDARDS OF THE CENTRAL RESERVE BANK OF EL SALVADOR,

CONSIDERING:
I. That Article 1 of the Special Law for the Prevention, Control, and Sanction of Money Laundering, Terrorism Financing, and Proliferation Financing of Weapons of Mass Destruction establishes that its objective is to prevent, detect, monitor, investigate, and sanction money laundering, terrorism financing, and proliferation financing of weapons of mass destruction; as well as the identification and evaluation of related risks, in order to implement adequate policies and procedures for the application of a risk-based approach. (3)

II. That Article 9 of the Special Law for the Prevention, Control, and Sanction of Money Laundering, Terrorism Financing, and Proliferation Financing of Weapons of Mass Destruction establishes that the obligated subjects established in Article 7 of the aforementioned law must comply with the applicable provisions contained herein and other regulations issued for the development of the aforementioned law, in order to effectively implement an integral system for the prevention of money laundering, terrorism financing, and proliferation financing of weapons of mass destruction according to the identified risk level. (3)

III. That Article 29 of the Special Law against Acts of Terrorism criminalizes the financing of acts of terrorism, so effective measures must be taken, among others, such as the prevention of acts of terrorism, including their financing.

IV. That Article 4, letter j) of the Law for the Supervision and Regulation of the Financial System establishes that the Financial System Superintendence must inform the Attorney General's Office of the Republic of any fact that is allegedly constitutive of a crime, of which it has knowledge in the exercise of its functions.

V. That Article 35, letter d) of the Law for the Supervision and Regulation of the Financial System establishes that supervised entities must comply with the adoption and updating of policies and mechanisms for risk management, including among other actions, identifying, evaluating, mitigating, and disclosing them in accordance with international best practices.

VI. That both international standards issued by supervisory bodies of different financial markets and by the Financial Action Task Force (FATF) require the supervisor to ensure that entities have adequate policies and processes, including customer due diligence rules, to promote high-level ethical and professional standards in the financial sector and prevent entities from being used, intentionally or not, for criminal purposes.

CNBCR-08/2022
NRP-36
TECHNICAL STANDARDS FOR THE MANAGEMENT OF MONEY LAUNDERING, TERRORISM FINANCING, AND PROLIFERATION FINANCING RISKS (3) Approval: 23/09/2022 Validity: 10/10/2022

VII. That the measures established in these Standards intend to generate technical guidelines for the safe promotion of business, of a predominantly preventive nature and of self-interest, with minimum requirements to be followed; it being incumbent upon each entity, in accordance with risk management and the risk appetite defined by it, to adjust and strengthen internal controls in accordance with the changing activities of its industry and as part of its corporate responsibility, in order to achieve a sound, prudent, adequate, and efficient management of the prevention of money laundering, terrorism financing, and proliferation financing of weapons of mass destruction risks, and in this way, prevent funds originating from illicit activities or attempting to finance them from being channeled through the financial system. (3)

VIII. That through Agreement Number 380, the Attorney General of the Republic issued the new Instruction for the Prevention, Detection, and Control of Money and Asset Laundering, Terrorism Financing, and Proliferation Financing of Weapons of Mass Destruction, published in the Official Diary No. 205, Volume 433, dated October 27, 2021, by the Attorney General's Office of the Republic. Therefore, it is necessary to adapt the regulations issued by the Committee of Standards of the Central Reserve Bank of El Salvador so that the corresponding entities have an updated regulatory framework in this matter.

IX. That it is necessary to have a normative framework with a risk-based approach that adjusts to international development and trends, with the purpose of promoting greater effectiveness in the prevention of money laundering, terrorism financing, and proliferation financing of weapons of mass destruction risks. (3)

THEREFORE, by virtue of the regulatory powers conferred by Article 99 of the Law for the Supervision and Regulation of the Financial System, AGREES to issue the following:

TECHNICAL STANDARDS FOR THE MANAGEMENT OF MONEY LAUNDERING, TERRORISM FINANCING, AND PROLIFERATION FINANCING RISKS (3)

CHAPTER I
OBJECTIVE, SUBJECTS, AND TERMS

Objective
Art. 1.- These Standards aim to provide minimum guidelines for the adequate management of money laundering, terrorism financing, and proliferation financing of weapons of mass destruction risks, so that entities comprising the financial system prevent said risks, detect unusual operations, and report operations related to said risks in a timely manner. (3) The adoption of policies and procedures related to the development of methodologies for the management of money laundering, terrorism financing, and proliferation financing of weapons of mass destruction risks must be in accordance with the entity's risk profile, the nature, size, types of products, services, clients, and distribution channels. (3)

Subjects
Art. 2.- The subjects obligated to comply with the provisions established in these Standards are:
a) Commercial or state banks constituted in El Salvador, their offices abroad, and their subsidiaries; (3) b) Investment banks; (3) c) Companies that, in accordance with the law, make up financial conglomerates; (3) d) Institutions administering pension savings funds; (3) e) Insurance companies, their branches abroad, and the branches of foreign insurance companies established in the country; (3) f) Stock exchanges, brokerage houses, companies specialized in the deposit and custody of securities, institutions that provide auxiliary services to the stock market, and specialized agents in securities valuation; (3) g) Banks and savings and credit societies, regulated in Legislative Decree number 849, dated February 16, 2000, published in Official Diary number 65, Volume 346, of March 31, 2000, and its reforms; (3) h) Companies that offer complementary services to the financial services of the members of the financial system; (3) i) Administrators or operators of payment systems and securities settlement societies; (3) j) The Social Housing Fund and the National Popular Housing Fund; k) Foreign currency exchange houses; (3) l) Legal entities that carry out money sending or receiving operations systematically, by any means, at the national and international level; (3) m) Electronic Money Provider Companies; (3) n) Securitization companies; and (3) o) Investment Fund Managers. (3)

CNBCR-08/2022
NRP-36
TECHNICAL STANDARDS FOR THE MANAGEMENT OF MONEY LAUNDERING, TERRORISM FINANCING, AND PROLIFERATION FINANCING RISKS (3) Approval: 23/09/2022 Validity: 10/10/2022

Terms
Art. 3.- For the purposes of these Standards, the terms indicated below have the following meaning:
a) Senior Management: Senior Management shall be understood as the Chief Executive President, General Manager, or those acting in their stead, and the executive positions that report to them. In the case of the Development Bank of the Republic of El Salvador, the President; b) APNFD: Designated Non-Financial Businesses and Professions; c) Client: Any natural or legal person who has maintained or maintains a contractual, occasional, or habitual relationship with the entities; d) Entities: Subjects obligated to comply with these Standards, in accordance with Article 2 thereof; e) Risk Factors: Internal and/or external agents generating money laundering, terrorism financing, and proliferation financing of weapons of mass destruction risks, such as the following: clients, counterparties, employees, users, products and services, distribution channels, and geographic zone; (3) f) Proliferation Financing of Weapons of Mass Destruction: Any act that provides funds or uses financial services, in whole or in part, for the manufacture, acquisition, possession, development, export, transit, fragmentation, transport, transfer, deposit, or use of nuclear, chemical, or biological weapons, their launch means, and other related materials (including technologies and dual-use goods for illegitimate purposes) in contravention of national laws or international obligations, when the latter is applicable; (3) g) Terrorism Financing: Mechanism by which a person or persons, any organization or legal entity, directly or indirectly provides, collects, transports, or provides funds or has them in their possession, or attempts to provide or collect them, dispenses or attempts to dispense financial services or other services with the intention that they be used totally or partially to commit any of the criminal conduct contemplated in the Special Law against Acts of Terrorism, as well as that which directly or indirectly places funds, financial resources or materials, or financial or related services of any other kind, at the disposal of a person or entity that they designate for the commission of any of the crimes foreseen in said Law; (3) h) FATF: Financial Action Task Force. An intergovernmental institution that establishes international standards aimed at preventing money laundering, terrorism, and the financing of proliferation of weapons; (3) i) Financial Investigation Unit Instruction: Instruction for the Prevention, Detection, and Control of Money and Asset Laundering, Terrorism Financing, and Proliferation Financing of Weapons of Mass Destruction, of the Financial Investigation Unit of the Attorney General's Office of the Republic; j) Repealed; (3)

CNBCR-08/2022
NRP-36
TECHNICAL STANDARDS FOR THE MANAGEMENT OF MONEY LAUNDERING, TERRORISM FINANCING, AND PROLIFERATION FINANCING RISKS (3) Approval: 23/09/2022 Validity: 10/10/2022

k) Law: Special Law for the Prevention, Control, and Sanction of Money Laundering, Terrorism Financing, and Proliferation Financing of Weapons of Mass Destruction; (3) l) ML/TF/PF: Money Laundering, Terrorism Financing, and Proliferation Financing of Weapons of Mass Destruction; (3) m) Compliance Officer: The official designated by the Board of Directors or equivalent body. The Compliance Officer shall hold at least a managerial position, enjoy independence and autonomy, having the authority to make decisions regarding the exercise of their functions and obligations, in order to manage ML/TF/PF risks, in accordance with what is established in the Special Law for the Prevention, Control, and Sanction of Money Laundering, Terrorism Financing, and Proliferation Financing of Weapons of Mass Destruction; its Regulations, and the UIF Instruction; (3) n) Compliance Department: Unit of the entity whose fundamental objective is to coordinate activities related to the prevention of ML/TF/PF and follow up routinely on the due compliance of policies and procedures for the prevention of ML/TF/PF, with a risk-based approach; o) PEPs: Politically Exposed Persons; p) Probability of occurrence: The level of certainty that an event will occur, or the ratio between the number of times the event occurred and the number of repetitions of occurrence; q) Risks associated with ML/TF/PF: Those through which ML/TF/PF risks materialize, which are: reputational, legal, operational, and contagion risks; r) Money laundering, terrorism financing, and proliferation financing of weapons of mass destruction risk: The possibility of loss or damage that the entity may suffer due to its propensity or vulnerability to being used directly or indirectly or through its operations as an instrument for money laundering, channeling resources towards the carrying out of terrorist activities, terrorism financing, and the financing of the proliferation of weapons of mass destruction; (3) s) Inherent risk: The level of risk inherent to the activity, without taking into account the effect of controls; t) Sub-agent: The natural or legal person who has a contractual relationship with one or more agents or administrators, to make available to the ordering parties and beneficiaries the infrastructure and means necessary to provide the money sending or receiving service, referring to the establishment or main office, agencies, and service points of the Sub-agent; ATMs, financial kiosks, financial services provided via internet or mobile devices, and other applicable means or infrastructure in accordance with the applicable regulatory framework are also included; u) Superintendence: Financial System Superintendence;

CNBCR-08/2022
NRP-36
TECHNICAL STANDARDS FOR THE MANAGEMENT OF MONEY LAUNDERING, TERRORISM FINANCING, AND PROLIFERATION FINANCING RISKS (3) Approval: 23/09/2022 Validity: 10/10/2022

v) Transactions: Any operation or act carried out within the ordinary course of business in the entities, by their clients; w) Transfers: The transaction carried out by a natural or legal person designated as the ordering party, through an entity authorized in the respective jurisdiction to carry out international or local transfers, via electronic movements, with the aim of making a sum of money available to a natural or legal person designated as the beneficiary, in another entity or agency authorized to carry out this type of operation. The ordering party and the beneficiary may be the same person; x) UIF: Financial Investigation Unit of the Attorney General's Office of the Republic; and y) Users: Any natural or legal person who operates with the entities or makes use of the services they provide to the general public, without any contractual relationship with the entity.

CHAPTER II
ENVIRONMENT FOR THE MANAGEMENT OF ML/TF/PF RISKS

Legal framework applicable to entities
Art. 4.- The aspects related to the powers of the Compliance Department, as well as training programs, internal and external audit, simplified, standard, and enhanced due diligence, unusual operations, identification and knowledge of clients and counterparties, beneficial owner, politically exposed persons, monitoring and control of alert signals, shall be governed by what is established in the UIF Instruction. This is without prejudice to other aspects of said Instruction that must be observed by the entities.

Organizational structure
Art. 5.- Entities must establish an organizational or functional structure adequate to their business model and appropriately segregated, which clearly delimits functions and responsibilities, as well as the levels of dependence and interrelation that correspond to each of the areas involved in the management of ML/TF/PF risks. For these purposes, they must comply with what is established in Title III of the UIF Instruction.

Board of Directors or Equivalent Body Functions Art. 6.- The Board of Directors or equivalent body must fulfill the functions established in the UIF Instruction.
ML/TF/PF Prevention Committee
Art. 7.- The Prevention Committee must comply at minimum with the provisions established in the UIF Instruction.
Senior Management Functions

CNBCR-08/2022
NRP-36
TECHNICAL STANDARDS FOR THE MANAGEMENT OF MONEY LAUNDERING, TERRORISM FINANCING, AND PROLIFERATION FINANCING RISKS (3) Approval: 23/09/2022 Validity: 10/10/2022

Art. 8.- Senior Management is responsible for ensuring that the risk management system for the prevention of ML/TF/PF approved by the Board of Directors or equivalent body is implemented and adequately complied with, in addition to having among other functions the following:
a) Ensure that all business activities carried out by the entity's personnel with clients and users are conducted in accordance with the laws, norms, and ethical standards established to prevent ML/TF/PF risks; b) Ensure that the regulatory framework, as well as the manual of policies and procedures on ML/TF/PF prevention approved by the Board of Directors or equivalent body of the entity, is known to all entity personnel, facilitating their access for consultation through existing technological means or others they consider pertinent, as well as ensuring the execution of the annual training plan on ML/TF/PF prevention approved by the Board of Directors or equivalent body of the entity; c) Create or establish communication channels that facilitate entity personnel to report to the Compliance Department any irregularity that puts the entity at risk and is considered contrary to the applicable legal provisions in the matter of ML/TF/PF prevention; and d) Ensure that the Compliance Department reports to the Board of Directors or equivalent body of the entity the results of their evaluations related to ML/TF/PF prevention, at least quarterly, depending on the risk level of each entity. The report must be presented to the Board of Directors or equivalent body within three months following the reported period.

Submission of information to the Superintendence Art. 9.- The entity must submit the following information to the Superintendence:
a) The Organizational Structure of the Compliance Department, appointment of the Compliance Officer and Alternate Compliance Officer; b) Annual training plan on ML/TF/PF prevention; c) Report of the Compliance Department presented to the Board of Directors or equivalent body, related to the management carried out for the compliance with policies and procedures for the prevention of ML/TF/PF; d) Results of the internal audit evaluation presented to the Board of Directors or equivalent body on the compliance and effectiveness of the norms applicable to the policies and procedures for the prevention of ML/TF/PF in accordance with what is established in Article 8 of the UIF Instruction; and e) Policies, Manuals, and/or regulations and Procedures related to the prevention of ML/TF/PF.

CNBCR-08/2022
NRP-36
TECHNICAL STANDARDS FOR THE MANAGEMENT OF MONEY LAUNDERING, TERRORISM FINANCING, AND PROLIFERATION FINANCING RISKS (3) Approval: 23/09/2022 Validity: 10/10/2022

The information detailed in the aforementioned letters shall be submitted by the means established by the Superintendence, within a period not exceeding ten business days after approval or knowledge by the Board of Directors or equivalent body, with the exception of letter "a)" which shall be submitted within the period established in the UIF Instruction.

CHAPTER III
MANAGEMENT OF ML/TF/PF RISKS

Stages of the ML/TF/PF risk management process Art. 10.- For the management of ML/TF/PF risks, entities must have a continuous and documented process in order to establish a methodology designed to identify, measure, control, monitor, and communicate potential ML/TF/PF risk events that may affect them, with the purpose of preventing, detecting, and mitigating them in a timely manner, in accordance with the risk management system approved by the Board of Directors or equivalent body. Likewise, for risk-based management, entities must apply a methodology in the identification and treatment of ML/TF/PF risks derived from business activities that offers guarantees that the risk is being managed within the level of risk appetite defined by the entity itself. The Compliance Department must carry out periodic reviews of the due compliance of the entity's policies, procedures, and risk management measures for ML/TF/PF, based on the results of its risk assessment in response to the current legal framework.

Identification of ML/TF/PF risks
Art. 11.- Entities must identify the

CNBCR-08/2022
NRP-36
TECHNICAL STANDARDS FOR THE MANAGEMENT OF MONEY LAUNDERING, TERRORISM FINANCING, AND PROLIFERATION FINANCING RISKS (3) Approval: 23/09/2022 Validity: 10/10/2022