What is a risk assessment?

The obligation to assess risk is set out in the AML Act and comes in two types. One is the so-called risk assessment concerning the IO’s activities in a specific industry.

When doing a risk assessment, the main considerations are:

• WHAT do we provide – i.e. what industry does the OI operate in, what type of products, services are they?

Does the OI deal in cash, anonymity products, or are they products/services from the AML/CFT high-risk industry (e.g. casinos, real estate)?

• WHOM are we supplying – i.e. which customers are we dealing with?

whether it is a natural person, a legal entity with a complex structure, the duration of the business relationship with the IO, the status of the PEP, the type of activity conducted by the client in the perspective of the risk of money laundering, previous “interest” from the GIIF and law enforcement authorities

• WHERE do we deliver – i.e. in which region does the business take place?

whether the CIO operates in high-risk, sanctioned regions, CIO branches outside Poland, areas of Poland susceptible to the risk of money laundering and terrorist financing (e.g. border areas with non-EU countries)

• HOW we deliver – i.e. what are the logistics and transactions like?

whether they are cross-border transactions, enabling payments to third parties who are not directly customers of the OI, carrying out transactions without the physical presence of the parties, involving the customer’s agent, intermediaries

What is the NRA for an obliged institution?

KOR2023 is a kind of research report on current issues, AML/CFT category practice made by the GIIF. KOR2023 takes into account significant events that have taken place since the last KOR2019 – the SARS-COV-2 pandemic, the war in Ukraine – that have significantly affected AML/CFT practice.

IOs do not have to mandatorily get their policy into the NRA. It is such an ancillary tool when creating an AML/CFT policy and conducting a risk assessment.

However, it may be a good time to review whether our company’s somewhat forgotten AML/CFT policy remains effective, e.g. in light of the conclusions of KOR2023.

• Particularly as the AML Act requires IOs to update their risk assessment at least every two years or sooner when the need arises.

For example, KOR2023 addresses important AML/CFT policy issues such as:

• descriptions and examples of the most commonly used money laundering and terrorist financing mechanisms – what to look out for in business relationships?
• industry vulnerabilities to money laundering and terrorist financing – who needs to be particularly vigilant?
• Measures to mitigate the risk of money laundering and terrorist financing – how do we defend ourselves against money laundering and terrorist financing by our business?

New type of obliged institution

The President signed the so-called Consumer Pawn Loan Act on 22 June 2023, which comes into force on 07 January 2024. In a telegraphic nutshell, this is a law that is expected to regulate the exercise of pawnbroking activities to a large extent.

The enacted law also makes it compulsory for entrepreneurs carrying out pawnbroking activities, as referred to in the Act of 14 April 2023 on consumer pawn lending (Article 2(1)(26) of the AML Act), to join the ranks of obliged institutions.

This means that pawnshops must mandatorily implement the entire AML/CFT procedure by the deadline of 07 January 2024. Otherwise, both pawnshops and their managers risk administrative liability in the form of multi-million dollar fines, among other things.

DOWNLOAD FLIPBBOK >> 

How to assess the level of risk?

The obligation to assess risk is set out in the AML Act and comes in two types:

• Risk assessment concerning the OI itself
• Risk assessment concerning the transaction or business relationship

An IO risk assessment involves identifying and assessing the risk of money laundering in relation to the IO’s business. It is about finding out whether and how vulnerable the IO is to being used for money laundering or terrorist financing. In this way, it is possible to determine how much money and resources should be committed to AML/CFT prevention in our company and which areas of the business need special attention.

The OI risk assessment must be prepared in documentary or electronic form and is subject to update at least every two years, and even more frequently if the need arises (e.g. due to expansion of operations to other countries).

The IO risk assessment is influenced by variables relating to characteristics:

• Clients – i.e. whether it is a natural person, a legal entity with a complex structure, duration of the business relationship with the OI, PEP status, type of activity conducted by the client in the perspective of money laundering risk, previous “interest” from the GIIF and law enforcement authorities
• Countries and geographic areas – i.e. whether the OI operates in high-risk, sanctioned regions, branches of the OI outside Poland, areas of Poland susceptible to the risk of money laundering and terrorist financing (e.g. border areas with countries outside the EU)
• Products, services, transactions, delivery logistics offered – i.e. whether the OI deals in cash, anonymity products, cross-border transactions, enabling payments to third parties who are not directly customers of the OI, carrying out transactions without the physical presence of the parties, with the involvement of a client proxy, intermediaries
• The business profile of the OI and the size of the OI – i.e. whether the OI operates in high-risk areas (e.g. payment intermediation, cryptocurrencies), what is the scale of the transactions conducted, especially cash transactions, the presence of branches and subsidiaries of the OI outside Poland
• Any other factors influencing the risk, for example the effectiveness of the AML/CFT procedures applied to date, the extent of AML/CFT outsourcing, changes in the business, planned acquisitions and mergers

Documents prepared by both state and international institutions, as well as internal studies, can be helpful in assessing IO risk:

• National Risk Assessment prepared by the GIIF
• European Commission Report on Money Laundering and Terrorist Financing Risk Assessment
• Positions and communications of the Polish Financial Supervision Authority, the General Inspectorate of Financial Information, the National Bank of Poland and international institutions such as FATF, EBA
• Expert opinions, audit-type studies, due diligence

Transaction or business relationship risk assessment – the counterparty examination scheme outlined earlier raises the question of when to ‘look at’ customers more intensively and when to stop at just basic verification?

Risk assessment concerning transactions or business relationships is linked to the obligation to keep records in this respect. That is, the results of the research carried out are subject to recording, e.g. in written or electronic form.

Factors influencing the assessment of transactional risk (minimum standard) – i.e. know your client more broadly

• Type of client – i.e. whether it is an individual, a complex legal entity, duration of business relationship with the IO, PEP status, type of business carried out by the client from a money laundering risk perspective , personal and capital links with foreign countries
• Geographical area of the customer – lower degree of risk e.g. EU countries, higher degree of risk e.g. third countries, high degree of risk e.g. countries on a warning list
• Purpose of the account – applies to payment institutions, degree of risk depends on the type of account (e.g. personal, corporate, multiple holders, trust, investment)
• Type of products, services, distribution methods – i.e. whether the transaction or business relationship involves cash, anonymous products, cross-border transactions, prepaid cards, cryptocurrencies
• Level of wealth deposited by the client or value of transactions carried out – as a rule of thumb, the level of risk increases proportionally to the value of the transaction, although consideration is also given to actions such as a series of smaller transactions accumulating ultimately to significant values
• Purpose, regularity or duration of the business relationship – a long-lasting business relationship generally reduces the degree of risk, while single, bump transactions should be assessed differently

Basic methodology for risk identification and assessment

• Scoring – an accurate but resource-intensive method. Risk criteria are scaled in points. Each client/relationship is scored on the adopted scale. The final score allows the client to be assigned to one of the risk groups
• Zero-one – a less authoritative method. Meeting a risk criterion means a value of 1, failing is a value of 0. The more ‘ones’, the higher the degree of risk.
• Mixed – a combination of scoring and the zero-one method.

Degrees of risk and corresponding MTFs

• Low risk – simplified financial security measures (Simplified Due Diligence SDD)
• Standard risk – basic financial security measures (Customer Due Diligence CDD)
• High risk – enhanced financial security measures (Enhanced Due Diligence EDD)
• Unacceptable risk – entering into a business relationship or transaction with the entity in question is inadvisable

What are simplified CBMs and enhanced CBMs?

• There is no catalogue of simplified and enhanced CBMs in the AML Act.
• Simplified and intensified is about adjusting the intensity of the FWBF to the level of risk detected
  • .For example, verifying a customer’s identity through a video call [simplified] vs. verifying a customer’s identity through a live meeting at the IO’s premises [intensified].

How to assess risk?

N.B. : the occurrence of any of the indications does not automatically oblige the application of enhanced or simplified FMLs, but is a signal to analyse the specific case from that point of view.

Specific situations for the application of an FSC

The use of FWAs is a fundamental obligation under the AML Act. IOs are obliged to use them in an appropriate and proportionate manner. However, there are special situations:

• The possibility for the IO to waive the application of the FMC – this refers to the right to waive the identification, the verification of the customer and the beneficial owner and the assessment of the economic relationship in cases of small electronic transactions. Conditions to be fulfilled
  • : the transaction concerns electronic money
  • the payment instrument may not be recharged or the maximum transaction limit is the equivalent of €150 and is limited to the territory of the Republic of Poland the
  • amount stored electronically does not exceed €150
  • the payment instrument may only be used to purchase a service or goods the payment instrument may
  • not be recharged without the application of the CBM
  • the e-money issuer applies the CBM for the ongoing analysis of the transaction or monitors the economic relationship
• Impossibility to apply an FSC – sometimes in practice it happens that IOs are not able to apply an FSC to a customer/beneficiary. For example, it is not possible to verify the customer because he/she does not show the correct identity document to the IO.

The non-applicability of the WSC must involve a firm response from the OI.

Depending on the nature of the existing relationship with the customer, this should occur:

• Failure to establish a business relationship
• Failure to carry out an occasional transaction
• Failure to carry out a transaction through a bank account
• Termination of a business relationship

Lack of FMLA and what next?

• Notification to the GIIFNot
  • always failure to apply the FSC = notification
  • A specific case must be investigated – if the RO assesses that there are grounds due to suspicion of money laundering or terrorist financing or a reasonable suspicion that a specific transaction or specific assets may be related to money laundering or terrorist financing.