Frequently Asked Questions - The Guidelines on Digitization of Customer Records (DIGICUR Guidelines), lssued as Anti- Money Laundering Council (AMLC) Regulatory Issuance A, B and C, No. 2, Series of 2018

BANexo SeNrnaL Ncl PILIPINAs OFFICE OF THE DEPUTY GOVERNOR FINANCIAL SUPERVISION SECTOR ctRcutAR LETTER NO. Ct-2019-083 To : All BSP-Supervised Financial Institutions Subject : Frequently Asked euestions - The Guidetines on Digitization of customer Records (DlGlcuR Guidelinesf, lssued as Anti- Money Laundering council (AMtcl Regulatory tssuance A, B and C, No. 2, Series of 2019 This is to disseminate the AMLC,s Frequently Asked euestions (FAq on the DlGlcuR Guidelines, issued as AMLC Regulatory lssuance A, B and c, No. 2, series of 2018 (copy attached). The FAQ provides crarification and guidance on the implementation, scope, objectives and requirements of the DIGICUR Guidelines. It further reiterates that non-compliance with the DIGICUR Guidelines is considered a grave violation under the AMLC's list of administrative offenses which shall be subject to fines provided under the AMLC,s Rules of Procedure in Administrative Cases. For information and guidance. CHIG. FONACIER eputy Governor Att.: A/S I November 2019 " ii;:lIi 7ir377*.i . v",v;,;v.Li\tr;_itrv.i;ir " hspr:r,*iiiari1Lp_ii$v.i)t)

AMLC PRIMER NO. 1 Series of 2019 Frequently Asked euestions (Feqsl The Guidelines on Digitization of customer Records (DlGtcuR Guidelines), lssued as AMLC Regulatory lssuance (ARt) A, B and g No. 2, series of 201g QUG$tion5 Aaswers I IMPTEMENTATION 1. What are the relevant dates to remember about the DIGICUR lX September 2018 Guidelines? *lvlfC epptorl Per AMLC Resolution No. 149, Series of 2018 lssuance as AnalC Regulatory lssuance (ARl) A, B and C, No. 2, Series of ll September 2018 2018: '' .: ::aa: Effectivity: lP moh€r tnrA 2. Within what period should the The covered person must update its MLpp within six (6) covered person update its Money months from effectivity of the DIGICUR Guidelines. Since the Laundering and Terrorist Financing DIG]CUR Guidelines took effect on 13 October 2019, the Prevention Program (Mtpp)? covered person must update its MLPpI not later than 13 April 2019 (Section 6.a). 3. After the covered person updates its After its MLPP takes effect, the covered person must begin MLP% what step should it take next? digitizing all customer records that it will receive, create or open. Thus, if the covered person's MLpp took effect on 1 March 2019, the covered person must, from that date, digitize the customer records of its new customers (Section 6.b). 4. Within what period must the Within two (2)years after 13 April ZOL9, or until 13 April20ZL, covered person complete the covered person must completely digitize all existing digitization of customer records? 1 MTPP in the 2018 lmplementing Rules and Regulations of the Anti-Money Laundering Act of 2001, as Amended.

Questicnt Answerc customer records and establish the required central database (Section 6.b). 5. lf a covered person has already lf the covered person has already adopted a digital system for adopted a digital system for customer records even before the AMLC adopted the customer records even before the DIGICUR Guidelines, and stores these digital records in a AMLC adopted the DIGICUR central database, it should continue to follow its system. Guidelines, and stores these customer records in a central database, are there other requirements under these Guidelines that it must comply with? 6. Do the DIGICUR Guidelines require As a rule, the DIGICUR Guidelines require covered persons to covered persons to digitize the digitize customer records of closed accounts if those records customer records of closed are within the five (S)-year retention period for record accounts? keeping under the AMLA (Section 3b). As an example, let us assume that Account No. 123 in Bank ABC was closed on 2 May 2015. Under the AMLA, Bank ABC must keep the records of Account L23 for five (5) years, or until 2 May 2020. lf Bank ABC's MLPP took effect on 1 March 2019, Bank ABC should digitize the records of Account No. L23 because it falls within the five (S)-year record keeping period (2 May 2O2Ol. However, if the account was closed in May 2OL3, then it will not be required to digitize since the five (S)-year record keeping period has already expired. To clarify: The DIGICUR Guidelines must be fully implemented not later than 13 April 2021. Therefore, customer records of accounts closed on 13 April 2016 must still be digitized. Customer records of accounts closed on L2 April 2015 need not be digitized. il. SCOPE 7. Who are obliged to comply with the In general, all covered persons must comply with the DIGICUR DIGICUR Guidelines? Guidelines. However, the DIGICUR Guidelines do not apply to money service businesses (MSBs). But if the business model of the MSB is such that the customer

Qrutbns Answerc is able to open, keep and maintain an account as an electronic wallet or other similar electronic product or service, then that MSB must still observe the DIGICUR Guidelines (Section 3). il. PURPOSE AND OBJECTIVES 8. Why did the Anti-Money Laundering The AMLC approved the DIGICUR Guidelines to: Council (AMtCl approve the DIGICUR Guidelines? (a) Maintain the confidentiality of the financial investigations of the AMLC by preventing tipping off to customers under investigation; and (b) Ensure swift retrieval of customer records by covered persons. This in turn ensures promptness in the AMLC's financial analysis, investigations and legal actions (Section 1). Did the DlGlcuR Guidelines replace, No. The DIGICUR Guidelines did not replace, supersede or supersede or amend the record- amend the record-keeping requirement under the AMLA. keeping requirement under the Anti- Covered persons must, therefore, continue to observe this Money Laundering Act of 2001, as record-keeping requirement under the AMLA and its amended (AMtAl? implementing rules and regulations, which remain in force and effect. The AMLA and its implementing rules require covered persons to observe the five (S)-year retention period for all transactions and customer records (Section 7). tv. DEFINITION 10. What are customer records? Under the DIGICUR Guidelines, customer records refers to: (a) Customer Due Diligence (CDD) records/documents such as customer information files, copies of official identification documents or similar documents that establish the true and full identify of customers; account files and business correspondences; results of the covered person's analysis to establish the background and purpose of complex and large transactions; and (b) Account transaction histories or statements of accounts, whether in Philippine pesos or other currency (Section 2). 11. Are deposit and withdrawal slips, No, because these documents are neither CDD records nor fund transfer slips, checks, transaction histories or statements of accounts, the DIGICUR passbooks, and debit and credit Guidelines do not require covered persons to digitize them. memos included as customer records under the DIGICUR Guidelines?

Questlong Answ tt However, covered persons must still keep records of these documents as part of the record-keeping requirement (Section 2). 12. Why must account files, business These documents must be digitized because they form part of correspondences and analysis of the the CDD process for high-risk customers, whose true and full background and purpose of a identities must be determined following enhanced due custome/s complex and large diligence (EDD) (Section 2). However, if these documents are transactions required to be not being required by the covered person or form part of the digitized? customer informatlon file (e.g., analysis of the background and purpose of transactions), then digitizing the Customer Information Form (ClF) will suffice. v. REqU|REMENTS 13.In general, what do the DIGICUR ln general, the DIGICUR Guidelines require covered persons Guidelines require? to digitize customer records and to establish a central database where these digitized records can be uploaded and retrieved (Section 3c). 14. What does digitizing customer Digitizing customer records entails rendering customer records entail? records in digital format that may be stored in the covered person's database, and retrieved, if the AMLC requires the covered person to submit the digitized customer records (Section 3b). 15. Do the DIGICUR Guidelines require a No. The covered person is free to adopt its own digital format. specific digital format? However, digitized customer records must be in a form that may be used as evidence in court, and in such form as the AMLC may require (Section 3e). For example, Bank QRS may opt to digitize customer records from the very beginning, that is, when customer XyZ opens an account, and submits customer due diligence documents. Thus, XYZ's customer records, which would later include her statements of accounts, are already in digital form ("end to end"). These may be uploaded in Bank eRS's central database. lf the AMLC requests for XyZ's customer records, Bank QRS would retrieve them from its central database and upload these digitized customer records to the AMLC portal. As another example, if Bank KLM requires customer DEF to fill out a customer information form (in paper), Bank KIM may later scan the filled-out and signed form and store this, along with the statements of accounts (whether scanned, in an Excel/MS word file, or other form) and store these in Bank KLM's central database. Bank KLM may later retrieve these

auectbm Angwerc records from its central database and upload them to the AMLC portal, upon request. Acceptable digital formats for scanned documents include pdl jpeg, and bmp, to name a few. 16.In Section 3.e of the DIGICUR It means that the digitized customer records may be admitted Guidefines, what does admissible in (or used) as evidence in a court case. This is especially true court mean? where the customer records are electronic or digital from "end to end", as discussed in Answer 15. lf these are uploaded in the AMLC portal, and downloaded bythe AMLC from there, the printed copies are deemed originals. In this case, the printed copies are considered electronic evidence that are admissible under the Rules on Electronic Evidence. lf the digitized customer records are scanned copies of the original records in paper, the scanned copies cannot be used as evidence in court. To be admissible, copies of the originals must be obtained from the covered person. These copies must be authenticated and their due execution must be proven, as required under the Rules of Court. 17.In Section 3.e of the DIG|CUR It means that the AMLC may recognize and require other Guidefines, what does ln such other forms of digitized customer records, particularly where new form as may be prescribed by the technologies create other digital formats that are acceptable AMLC mean? under the DIGICUR Guidelines. The AMLC may also disallow certain digital formats that have become obsolete, easily tampered or unsecured, or can no longer be used as evidence in court. 18. To comply with the DIG|CUR Since these transaction histories and statements of accounts Guidelines, should covered persons are already in digital format in the covered person's database, print and scan transaction histories they need not be scanned. However, the compliance officer and statements of accounts that are or any duly authorized officer who is independent from already stored in their database? operations should be able to access and retrieve the same whenever the AMLC requests their production. (Section 3c). 19. Can covered persons keep the Yes, provided thot: transaction histories and statements of accounts in MS Excel or MS Word (a) those documents can no longer be edited by any user, format? or are otherwise locked for editing; (b) the compliance officer of the covered person must have direct and unimpeded access to those files;

Qucgtlons Anewerc (c) those documents must not be obtained from branches or other offices, and must be obtained only from the central database, if requested by the AMLC; and (d) confidentiality of the AMLC's investigation is otherwise observed, and tipping off is avoided (Section 3d). 20. Where should the digitized customer The digitized customer records must be stored in the covered records be stored? person's central database. lt should be maintained in the head office or the main branch of foreign banks operating in the Philippines (Section 3c). 21.In what manner should the covered The covered person must ensure complete, accurate, timely person submit customer records to and secure submission of requested customer records to the the AM[C? AMLC (Section 4b). 22. What is the covered person,s first The covered person must first update its Money Laundering task in implementing the D|GICUR and Financing of Terrorism Prevention Program (MLpp) to Guidelines? ensure that its duties under the DIGICUR Guidelines are established and controls are in place (Section 3f). 23.at the AMIC requests customer lf the AMLC requests customer records, the covered person, records, what should the covered through its compliance officer or any duly authorized officer person do? or representative shall extract those digitized customer records from the central database and upload these to the AMLC's portal (or the File Transfer and Reporting Facility [FTRF]), using the covered person's log-on credentials. The compliance officer may also submit the requested customer records in such other modes that the AMLC may prescribe (Section 4a). vt. CENTRAI DATABASE 24. Does a central database mean that No. A central databose under the DIGICUR Guidelines does the covered person must have only not mean that the covered person must have only one central one database system? databose. A covered person may have more than one database. The DIGICUR Guidelines only require that the centrol dotabase must be maintained in the head office or the main branch of foreign banks operating in the philippines (Section 3c). 25. Who shall have access to the central The compliance officer or any duly authorized officer or database? representative must have direct, immediate and unimpeded access to the database. This means that the compliance officer or the duly agthorized officer need not have to request

other persons, including branch personnel, to access the central database (Section 3c). v||. PEil/Un8S AI|D S tcrpN 26. What senctlons and pcnaltles may Non-compliance with the DIGICUR Guidelines, a grave be imposed on covrrcd pcrsons for violation under the AMLCs list of administrative offenses, non-compllence with the DIGICUR shall be subject to fines as provided under the AMLCs Rules Guldellnes? of Procedure in Administrative Cases (RPACI (Section 8, as amended by the RPAC). --Nothing follows-- PageT of7