Money Laundering (ML)/Terrorist Financing (TF) Risk Assessment System (MRAS)

OFFICE OF THE DEPUTY GOVERNOR FINANCIAL SUPERVISION SECTOR 084 MEMORANDUM NO. M-2020-___ To : All BSP-Supervised Financial Institutions (BSFIs) Subject : Money Laundering (ML)/Terrorist Financing (TF) Risk Assessment System (MRAS) The Monetary Board, in its Resolution No. 1461 dated 13 November 2020, approved the adoption of the Money Laundering (ML)/Terrorist Financing (TF) Risk Assessment System (MRAS) (Annex A). The MRAS is a tool to assess the inherent ML/TF and proliferation financing (PF) risk and the quality of risk management system to determine the net ML/TF/PF risk of BSFIs, taking into account their risk and context, business models and operations, among others. The MRAS uses a four (4) point rating scale to describe the net ML/TF/PF risk, as follows: Net Risk Description High Excessive level of residual risk. The risk management and control framework is disproportionate and not commensurate with the high level of inherent risks posed by the nature and complexity of the BSFI’s activities. Most likely to be used as a conduit for the proceeds of unlawful activities, TF and PF. Above Substantial level of residual risk. The risk management and control framework is either average acceptable, with certain areas for improvement, relative to high level of inherent risk, or is inadequate in critical aspects relative to the above average or lower level of inherent risk posed by the nature and complexity of the BSFI’s activities. May be used as conduit for the proceeds of unlawful activities, TF and PF. Moderate Manageable level of residual risk. The risk management and control framework is sufficiently compatible or commensurate with the level of inherent risks posed by the nature and complexity of the BSFI’s activities. Can withstand associated ML/TF/PF risks and there is low to moderate probability to be used for ML/TF/PF activities. Low Marginal level of residual risk. The risk and control framework is robust and/or fully compatible with the level of inherent risks posed by the nature and complexity of the BSFI’s activities. Highly capable of withstanding ML/TF/PF risks and curbing ML/TF/PF activities. The MRAS will replace the existing AML risk rating system (ARRS) and will be implemented along with the Supervisory Assessment Framework (SAFr). Digitally signed by For information and guidance. Chuchi G. Fonacier Date: 2020.11.23 13:10:04 +08'00' CHUCHI G. FONACIER Deputy Governor 23 November 2020 Att: a/s A. Mabini St., Malate 1004 Manila, Philippines * (632) 87087701 * www.bsp.gov.ph * [email protected]

Annex A MONEY LAUNDERING (ML)/TERRORIST FINANCING (TF) RISK ASSESSMENT SYSTEM (MRAS) The MRAS is a tool to assess the ML/TF and proliferation financing (PF) risk profile of BSP- supervised financial institutions (BSFIs), taking into account their risk and context, business models and operations, among others. The MRAS provides the platform for assessing the level of inherent ML/TF/PF risks and the quality of risk management and self-assessment systems of BSFIs, to arrive at their net ML/TF/PF risk profile. The net results will serve as a basis for determining the frequency and scope of examinations as well as the type, intensity, and intrusiveness of supervisory activities. The following will be assessed under the MRAS: • Inherent risk. This refers to the intrinsic ML/TF/PF risks arising from the BSFI’s business and relationships, considering key elements such as nature of the products or services offered, profile of clients or business relationships, delivery channels, as well as the geographical location of the BSFI, its customers and counterparties. • Quality of risk management. This refers to the quality of Board and senior management oversight, adequacy of the money laundering and terrorist financing prevention program (MTPP), and effectiveness of internal controls and implementation of key anti-money laundering/countering the financing of terrorism/ countering proliferation financing (AML/CFT/CPF) processes. The said key processes include, onboarding customer due diligence (CDD), ongoing monitoring of accounts and transactions, targeted financial sanctions, covered and suspicious transaction reporting, record keeping, and AML/CFT training program, among others. • Self-assessment systems. This refers to the compliance and internal audit functions. • Net ML/TF/PF risk – The residual risk after considering the mitigating effects of risk management. I. Inherent Risk Assessment A four (4) point rating scale shall be used to assess inherent risk as follows: High – Excessive level of inherent risk related to identified factors Above average – Substantial level of inherent risk related to identified factors Moderate – Manageable level of inherent risk related to identified factors Low – Marginal level of inherent risk related to identified factors The assessment shall begin with understanding the level of the ML/TF/PF risks of the BSFI, or the extent of its vulnerabilities to ML/TF/PF activities, arising from its business and/or relationships. The factors that will be considered in the assessment include total size and

Annex A value of the relevant products/services, nature of products or services, client base profile, delivery channels, and geographical location of its offices, customers and/or counterparties: a. Total size and value of the products and services This factor indicates the ML/TF/PF vulnerability of a product or service based on the magnitude or volume and value of transactions. The large volume and high value of the product or activity make it easier to conceal the high amount of proceeds from illegal activities. b. Nature of products/services This factor indicates the ML/TF/PF vulnerability of the BSFI considering the intrinsic nature and complexity of the products or services it offers. It includes an assessment of the level and extent of the BSFI’s high risk products or services, such as correspondent banking services, electronic wire/funds transfers, private banking, and those identified in the national, sectoral, and institutional risk assessments. c. Client base profile This factor indicates the level of inherent ML/TF/PF risk based on the nature, type, profile, geographical location, and/or behavior of customers that use or avail of the BSFI’s products and services. It also considers the extent of exposure to high risk customers. Customer risk profile is assessed considering relevant factors, such as nature of product or service to be availed, source of funds and wealth, position and rank or stature, country of origin/residence, presence or absence of negative information, and other relevant factors. d. Delivery Channels This factor indicates the ML/TF/PF vulnerability considering the delivery channels and the level or degree of verification performed by the BSFI as part of CDD, the degree of anonymity in transacting, as well as the ease and speed of performing financial transactions. Delivery channels involving face to face contact with the customer afford higher level of verification. The use of third parties (outsourcing and third-party reliance) and electronic channels adds additional layer in the conduct of CDD. e. Geographical location This factor affects the level of ML/TF/PF vulnerability considering the specific crimes, typologies, public statement, or other relevant information involving the country or geographic area of operations, origin, residence or nationality/citizenship of the BSFI, its customers and counterparties. Higher-risk geographic locations can be either domestic or international. The BSFI is expected to consider the results of relevant risk assessments such as the national or sectoral risk assessments, FATF statements, as

Annex A well as relevant sanctions list such as the United Nations Security Council, the Office of Foreign Assets Control (OFAC) and other domestic and foreign designations. II. Quality of ML/TF/PF Risk Management A four (4) point rating scale shall be used to assess the quality of ML/TF/PF risk management as follows: Strong - highly effective and needs minor improvements Acceptable - substantial level of effectiveness and needs moderate improvements Inadequate - needs major improvements Weak - needs fundamental improvements The factors that will be considered in the assessment are the quality of Board and senior management oversight, adequacy of the MTPP, and effectiveness of internal controls on key AML/CFT/CPF processes and implementation of the MTPP. a. Board and Senior Management (SM) Oversight This reflects the effectiveness of Board and SM oversight in identifying, measuring, monitoring, and controlling ML/TF/PF risks inherent in BSFI’s activities. The Board shall be ultimately responsible for setting a tone and culture of compliance within the organization and ensuring that the BSFI adheres to AML/CFT laws, rules, and regulations. It shall ensure adoption of an appropriate ML/TF/PF prevention framework appropriate to the BSFI’s corporate structure, operations, and risk profile. The said framework, including Know-Your-Employee policies and guidelines, shall be embodied in the Board-approved MTPP. The Board should adopt structure, strategies and processes that will facilitate the implementation of ML/TF/PF-related policies and guidelines, consistent with the identified risk appetite. This factor has the following sub-elements: 1. Corporate Governance. This refers to the established ML/TF/PF risk governance framework and mechanisms to proactively oversee implementation of ML/TF/PF prevention strategies which at the minimum shall demonstrate: (i) Board’s proactiveness and commitment to address AML/CFT issues, continuously improve ML/TF/PF risk management, and ensure effectiveness of internal and external audits; (ii) reliable, timely, and complete management information system (MIS); (iii) adequate screening and recruitment procedures to ensure high standards and conduct of appropriate due diligence required for a position when hiring officers and employees, and robust performance monitoring process; and (iv) effectiveness of compliance office in executing its AML/CFT functions. 2. Institutional risk assessment (IRA). This refers to the conduct of an appropriate IRA and update the same periodically or as necessary, to have an understanding of

Annex A the current ML/TF/PF risks arising from its customers, countries or geographic areas of operations, products, services, transactions, or delivery channels. IRA must consider the results of national and sectoral risk assessments. The BSFI should also identify and assess ML/TF/PF risk arising from new products and services as well as the use of new or developing technologies. Results of the risk assessments should be adequately documented and appropriate measures to manage and mitigate identified ML/TF/PF risks should be taken, which include the enhancement of policies and procedures as embodied in the MTPP. b. Money Laundering and Terrorist Financing Prevention Program (MTPP) This reflects the adequacy and suitability of policies and procedures in ML/TF/PF prevention, as approved by the BSFI’s Board. The soundness of ML/TF/PF prevention policies and procedures is anchored on relevant factors, such as the adoption of a clearly defined, comprehensive, and risk-based MTPP that is appropriate to the BSFI’s operations and risk profile, with due consideration of the requirements of AML/CFT laws and regulations. c. Effectiveness of Internal Controls and Implementation of the MTPP This reflects the suitability, soundness, and effectiveness of internal controls, policies, and procedures of the BSFI on key AML/CFT processes to identify, measure, monitor, and control ML/TF/PF risks, and ensure compliance with relevant AML/CFT laws and regulations. The assessment takes into account the following sub-elements: 1. Onboarding Customer Due Diligence. This refers to the consistent and appropriate conduct of customer/ultimate beneficial owner identification and verification, sanctions screening, risk profiling, due diligence and other applicable preventive measures for customers/ transactions. 2. On-going Monitoring of Customers, Accounts and Transactions. This refers to the adequacy of understanding the normal and reasonable account or business activity of customers through the customer/transaction monitoring system. This is to ensure that the accounts and transactions are consistent with the financial or commercial activities, risk profile, and source of funds/wealth of the customers, and that unusual or suspicious patterns of account activity are proactively detected. Moreover, relevant and suitable alert parameters or scenarios, statistical analysis, and appropriate threshold amounts are adopted for a particular transaction, customer or activity. In this respect, the assessment shall cover the following: a. Transaction Analysis and Identification of Red Flag Scenarios and Alert Parameters (manual or electronic monitoring). This refers to the system’s (electronic or manual, as appropriate) capability to capture circumstances or

Annex A situations of possible ML/TF/PF activity or transactions. The effectiveness of alerts management and disposition process will also be assessed. b. Updating of Customer Information and Risk Profile. This refers to the mechanisms to update, based on risk and materiality, customer information and documents gathered during on-boarding and/or on-going due diligence, to have an updated and current customer risk profile. 3. Covered Transaction Reporting (CTR). This refers to a CTR system, policies and procedures that are able to generate complete and accurate CTRs and to submit the corresponding report to the AMLC within the prescribed period. 4. Suspicious Transaction Reporting (STR). This refers to system, policies and procedures for identifying, analyzing, investigating, and reporting suspicious transactions to the AMLC. BSFIs are expected to file STRs to the AMLC within the prescribed period, manner and form, where any of the suspicious circumstances under AML/CFT laws, rules, and regulations exist, including manually-identified transactions, such as those referred by employees and/or fraud-related cases. 5. Compliance with Freeze Orders and Targeted Financial Sanctions (TFS). This refers to the processes to effectively implement (i) freeze orders, bank inquiry, and asset preservation orders, and other similar directives/orders issued by the courts or the AMLC; and (ii) TFS to comply with relevant laws, rules and regulations. This involves an assessment of, among others, the robustness of the sanctions screening tool, comprehensiveness of the sanctions list database, the adequacy of internal control mechanisms or procedures to identify customers, accounts, transactions, funds or other assets of designated individuals and entities for terrorism, TF, and PF, as well as the capability to immediately implement necessary actions required under the relevant laws, resolutions or designations. 6. Record-keeping. This refers to system to ensure that information obtained in the context of CDD is recorded and retained. This includes: (a) recording and storing the information and documents provided by the customer to the BSFI, when verifying the identity of the customer and the beneficial owner; (b) transcribing in the BSFI’s systems the relevant CDD information contained in such documents or obtained by other means; and (c) preserving electronic copies of CTRs and STRs. CDD and transaction records for existing accounts, closed accounts, terminated business relationships are expected to be maintained and stored within the required retention period and form as prescribed under AML/CFT laws, rules and regulations. A BSFI should display its ability to provide required information to the supervisor in a timely manner. 7. Continuing Education and Training Program (CETP). This refers to the propriety and adequacy of the AML/CFT training program for directors, senior management, officers, and employees, to enable them to fully understand and comply with their

Annex A obligations and responsibilities under AML/CFT laws, regulations and the BSFI’s MTPP. The assessment will cover the following: a. Training Program. This refers to the annual training plan developed and/or adopted by the BSFI after assessing the training needs and gaps of the directors, senior management, officers, and employees. b. Design and Development. This refers to the training and refresher courses, including instruction and presentation methodologies, tailored according to AML/CFT functions of directors, officers, and employees. Effectiveness of the training should be regularly assessed. c. Dissemination. This refers to policies, procedures and guidelines in cascading to all concerned personnel and units the BSFI’s policies as well as the BSP and AMLC issuances, in relation to matters aimed at preventing ML/TF/PF. III. Self-Assessment System This factor will cover the assessment of the effectiveness of both the compliance and internal audit functions in managing ML/TF/PF risks of the BSFI. A four (4) point rating scale shall be used to assess the effectiveness of self-assessment system as follows: Strong - highly effective and needs minor improvements Acceptable - substantial level of effectiveness and needs moderate improvements Inadequate - needs major improvements Weak - needs fundamental improvements a. Compliance Function This reflects the propriety of the structure and stature of the compliance function considering the complexity of the organizational set-up of the BSFI. The compliance function should be independent of business operations and accorded with appropriate stature in the organization. It has a direct reporting line to the Board or any board- level committee on all matters related to AML/CFT compliance and risk management. The AML Compliance Officer should be competent to oversee the identification and management of ML/TF/PF risks. Resources, including skilled manpower complement and tools, should be sufficient in relation to the mandated AML/CFT tasks and responsibilities of the compliance office. The compliance function shall conduct, among others, effective and risk-based compliance checking and results of this exercise are reported to the Board or any designated board-level committee. b. Internal Audit This reflects the propriety of the structure and stature of the internal audit function considering the complexity of the organizational set-up of the BSFI. The internal audit function should be independent of business operations and accorded with

Annex A appropriate stature in the organization. It is responsible for the periodic and independent evaluation of the degree of adherence to internal control mechanisms and effectiveness of risk management systems related to the AML/CFT processes. It should carry out its function independently with direct reporting to the Board or any designated board-level committee. The Internal Audit shall be provided with adequate resources in relation to its functions. Internal audit policies, practices and methodologies shall be risk-based, appropriate, and effective. Audit reports should be relevant and timely communicated. The audit reports should be complemented by an effective exception/correction tracking system. The MRAS uses both quantitative and qualitative data and information, with due consideration of relevant circumstances or factors, including the institutional knowledge of the supervisor. The assessment of quality of ML/TF/PF risk management is not derived using arithmetic average of the component and sub-component ratings. Rather, it is assessed holistically considering the resulting evaluation of each factor and its interrelationship with the other factors. Enforcement Action Consistent with Section 002 (Supervisory Enforcement Policy) and Part Nine of the Manual of Regulations (MOR) for Banks and corresponding AML Regulations of the MOR for Non-Bank Financial Institutions, the Bangko Sentral shall deploy appropriate enforcement actions to promote compliance with AML/CFT laws and regulations, and bring about timely corrective actions. Enforcement actions shall be implemented as warranted, such as in cases of excessive risks that are not adequately managed, presence of serious weaknesses in the BSFI’s ML/TF/PF risk management system and violations of AML/CFT laws or BSP regulations.