[ad_1]
The guidance is part of rapidly evolving anti-money laundering rules aimed at promoting the UAE as a best-practice jurisdiction.
On August 1, 2022, the Central Bank of the United Arab Emirates (CBUAE) published Guidelines on Payment-Related Risks for Licensed Financial Institutions.[1]
This guide is issued to implement the requirements of Federal Decree No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organizations. It sets out the CBUAE’s expectations for appropriate compliance measures to be taken in the payments ecosystem.This guidance is not intended to modify or replace existing CBUAE requirements and should be read in conjunction with CBUAE’s existing rules[2] and guidance material[3].
The CBUAE guidance was drafted based on guidance issued by the Financial Action Task Force (FATF) to promote the UAE as a jurisdiction that complies with anti-money laundering best practices. However, it does not lay out an exhaustive list of measures, and financial institutions will ultimately conduct their own risk-based assessments of the appropriate measures to take.
The guidelines are effective from the date of publication, and financial institutions are expected to demonstrate compliance within a month.
definition
- The guidance applies to CBUAE licensed financial institutions, including UAE banks, branches of foreign banks, exchanges, financial companies, stored value facilities, retail payment service providers and card schemes (LFIs). It applies to any LFI, whether they are primarily payments sector players or have limited exposure.
- This guide addresses LFI in “Payment field”, which is broadly defined as “different forms of payment transmitted and exchanged through various delivery channels, often using digital platforms, systems, services and products”. Among other things, this definition will cover Any activity related to the mobile application.
- Under the guidance, the payments segment covers traditional payment products and services (PPS) and novel payment products and services (NPPS), which refer to new and innovative payment products and services that provide alternatives to traditional financial services. An example of NPPS is a prepaid card.
Understand the risks
The main issue that the guidance seeks to address is that when operating in the rapidly evolving payments industry, LFIs may have exposure not only to other LFIs, but also to third parties that operate globally and are not necessarily licensed by the CBUAE or any other regulator. Exposure may be both direct (within the same payment system) or indirect (through a third party).
Payment transactions are often highly intermediated, which results in no one having complete knowledge of the money transfer chain. Payment industry players typically only conduct checks on their direct customers or counterparties, or tend to rely on their counterparties (for example, correspondent banks or affiliates in different jurisdictions) to check on others. Control gaps arise in many situations, especially where activities are not regulated.
As such, the payments sector is attractive to illicit actors who often opt for specific PPS and NPPS due to limited control over financial flows, regulatory gaps, and transaction speed.
The combined effect is that LFIs may be involved in complex, obscure and multi-layered activities that increase money laundering risks.
Therefore, this guidance is intended to educate LFIs about the main risks and transaction types that need to be reviewed. Examples include peer-to-peer payments, cross-border transfers, intermediaries, nesting (where the LFI sees only most operations, not individual transactions of the end customer), using agents or affiliates, dealing with merchants, dealing with correspondent banks, and outsourcing .
reduce risk
The guidance requires LFIs to take a risk-based approach to mitigating and managing risks associated with the payments sector. It details the recommended compliance measures that apply to LFIs providing retail services and services to other payments sector players to varying degrees.
Key provisions include a plan of steps that LFIs should follow as they approach compliance:
- LFI should map risk What they face should cover all PPS provided by the relevant LFI, as well as their relevant UAE and foreign direct relationships. The assessment should be reflected in the risk rating.
The analysis should be tailored to the type of service in question and focus primarily on the geographic area of operation (e.g. are there any high-risk jurisdictions), the scope of transactions allowed (e.g. whether peer-to-peer payments are allowed), regulatory status (licensed entities vs. no licensing entities), use of intermediaries, etc.
- LFI should Implement the design and operation of the compliance program to ensure more focus on higher risk areas. A compliance program needs to ensure continuous monitoring and accuracy of information.
This step should include, in the case of retail services, customer due diligence (know your customer, including through UAE government services such as UAE Pass), use of location indicators, imposing restrictions on certain types of transactions (e.g. maximum stored value ), merchant due diligence (e.g. number of complaints received, volume of operations). It should also include sanctions screening.
For corporate clients, the LFI needs to identify the beneficial owner who owns 25% or more of the shares or, if no one meets this criterion, who holds a senior management position in the entity. LFIs should ensure that they have contractual rights to this information and consider terminating the relationship if they are unable to provide access.
LFIs should also analyze materials related to payments industry players, including reviewing their promotional materials, websites, identifying key merchants, and evaluating policies and controls.
The guidance also sets out specific requirements for correspondent bank due diligence. These requirements include gathering information on the nature of the business and assessing regulatory status, policies (including merchant due diligence) and controls (especially nested transactions). They also include obtaining approval from senior management prior to establishing a new correspondent banking relationship, reviewing reports and audit findings, and understanding and documenting AML-related areas of responsibility.
In some cases (for example, providing payment services as part of a network), LFI shall assume full responsibility for customer due diligence.
- LFI should Implement appropriate controls and training Minimize or eliminate characteristics that make PPS and NPPS attractive to illegal actors.
For example, the guidance recommends that LFIs offering retail services should consider the use of geolocation to prevent customers from entering from high-risk countries, implement transaction restrictions, require customers to fund and withdraw funds to accounts only through regulated domestic financial institutions, and use a variety of – Factor authentication.
Appropriate regular training should be provided to employees and agents, including delivery agents, onboarding agents and cash accepting agents. Knowledge of employees and agents in these areas should be regularly tested.
- The guide also reiterates Submit a suspicious transaction report Sent to the UAE Financial Intelligence Unit (FIU) using the ‘goAML’ portal. The general principle under the Guiding Principles is that LFIs are ultimately responsible for using all the information they have to monitor transactions processed or conducted through them. The guidance encourages LFIs to outsource transaction monitoring.
in conclusion
The guidance is part of the UAE’s rapidly evolving anti-money laundering rules and increasing use of traditional and new payment services. It complements existing rules with compliance recommendations designed to ensure that LFIs determine the nature of their business and take steps to exercise a degree of control over businesses and service providers to combat illicit financing.
Latham & Watkins will continue to monitor developments related to anti-money laundering rules in the Middle East, including upcoming additional rules and regulations.
endnotes
[1] https://www.centralbank.ae/media/ggbcp1uz/amlcft-guidance-for-licensed-financial-institutions-on-the-risks-relating-to-payments.pdf
[2] For example, (1) Federal Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organizations, as amended by Federal Law No. (26) of 2021; (2) Cabinet Decision No. (10) of 2019 , Regarding the Implementation Regulations of Federal Decree No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organizations, as amended by Cabinet Decision No. (24) of 2018; (3) Cabinet Decision No. (74) of 2020, Management of the Terrorism List and Implementation of the United Nations Security Council (UNSC) Resolutions on the Suppression and Combating of Terrorism, Terrorism Financing, Combating the Proliferation of Weapons of Mass Destruction and Their Financing and Related; (4) Stored Value Facility (SVF) Regulations 2020 (5) Retail Payment Services and Card Schemes Regulations 2021; (6) High Value Payment Systems Regulations 2021; (7) Retail Payment Systems Regulations 2021.
[3] Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organizations Procedures (issued by Circular No. 74/2019 of 19 June 2019) and Guidelines for Financial Institutions on Anti-Money Laundering and Combating the Financing of Terrorist and Illegal Organizations (issued by 19 June 2019) Notice No. 79/2019 of the 27th).
[ad_2]
Source link