DOWNLOAD FLIPBBOK >> 

How to assess the level of risk?

The obligation to assess risk is set out in the AML Act and comes in two types:

• Risk assessment concerning the OI itself
• Risk assessment concerning the transaction or business relationship

An IO risk assessment involves identifying and assessing the risk of money laundering in relation to the IO’s business. It is about finding out whether and how vulnerable the IO is to being used for money laundering or terrorist financing. This makes it possible to determine how much money and resources should be committed to AML/CFT prevention in our company and which areas of the business need special attention.

The OI risk assessment must be prepared in documentary or electronic form and is subject to update at least every two years, and even more frequently if the need arises (e.g. due to expansion of operations to other countries).

The IO risk assessment is influenced by variables relating to characteristics:

• Clients – i.e. whether it is a natural person, a legal entity with a complex structure, duration of the business relationship with the OI, PEP status, type of activity conducted by the client in the perspective of money laundering risk, previous “interest” from the GIIF and law enforcement authorities
• Countries and geographic areas – i.e. whether the OI operates in high-risk, sanctioned regions, branches of the OI outside Poland, areas of Poland susceptible to the risk of money laundering and terrorist financing (e.g. border areas with countries outside the EU)
• Products, services, transactions, delivery logistics offered – i.e. whether the OI deals in cash, anonymity products, cross-border transactions, enabling payments to third parties who are not directly customers of the OI, carrying out transactions without the physical presence of the parties, with the involvement of a client proxy, intermediaries
• The business profile of the OI and the size of the OI – i.e. whether the OI operates in high-risk areas (e.g. payment intermediation, cryptocurrencies), what is the scale of the transactions conducted, especially cash transactions, the presence of branches and subsidiaries of the OI outside Poland
• Any other factors influencing the risk, for example the effectiveness of the AML/CFT procedures applied to date, the extent of AML/CFT outsourcing, changes in the business, planned acquisitions and mergers

Documents prepared by both state and international institutions, as well as internal studies, can be helpful in assessing IO risk:

• National Risk Assessment prepared by the GIIF
• European Commission Report on Money Laundering and Terrorist Financing Risk Assessment
• Positions and communications of the Polish Financial Supervision Authority, the General Inspectorate of Financial Information, the National Bank of Poland and international institutions such as FATF, EBA
• Expert opinions, audit-type studies, due diligence

Transaction or business relationship risk assessment – the counterparty examination scheme outlined earlier raises the question of when to ‘look at’ customers more intensively and when to stop at just basic verification?

Risk assessment concerning transactions or business relationships is linked to the obligation to keep records in this respect. That is, the results of the research carried out are subject to recording, e.g. in written or electronic form.

Factors influencing the assessment of transactional risk (minimum standard) – i.e. know your client more broadly

• Type of client – i.e. whether it is an individual, a complex legal entity, duration of the business relationship with the IO, PEP status, type of business conducted by the client from a money laundering risk perspective , personal and capital links with foreign countries
• Geographical area of the customer – lower degree of risk e.g. EU countries, higher degree of risk e.g. third countries, high degree of risk e.g. countries on a warning list
• Purpose of the account – applies to payment institutions, degree of risk depends on the type of account (e.g. personal, corporate, multiple holders, trust, investment)
• Type of products, services, distribution methods – i.e. whether the transaction or business relationship involves cash, anonymous products, cross-border transactions, prepaid cards, cryptocurrencies
• The level of wealth deposited by the client or the value of the transactions carried out – as a rule, the level of risk increases proportionally to the value of the transaction, although it is also advisable to bear in mind, for example, actions involving a number of minor transactions accumulating ultimately to significant values
• Purpose, regularity or duration of the business relationship – a long-lasting business relationship generally reduces the degree of risk, while single, bump transactions should be assessed differently

Basic methodology for risk identification and assessment

• Scoring – an accurate but resource-intensive method. Risk criteria are scaled in points. Each client/relationship is scored on the adopted scale. The final score allows the client to be assigned to one of the risk groups
• Zero-one – a less authoritative method. Meeting a risk criterion means a value of 1, failing is a value of 0. The more ‘ones’, the higher the degree of risk.
• Mixed – a combination of scoring and the zero-one method.

Degrees of risk and corresponding MTFs

• Low risk – simplified financial security measures (Simplified Due Diligence SDD)
• Standard risk – basic financial security measures (Customer Due Diligence CDD)
• High risk – enhanced financial security measures (Enhanced Due Diligence EDD)
• Unacceptable risk – entering into a business relationship or transaction with the entity in question is inadvisable

What are simplified CBMs and enhanced CBMs?

• There is no catalogue of simplified and enhanced CBMs in the AML Act.
• Simplified and intensified is about adjusting the intensity of the FWBF to the level of risk detected
  • .For example, verifying a customer’s identity through a video call [simplified] vs. verifying a customer’s identity through a live meeting at the IO’s premises [intensified].

How to assess risk?

N.B. : the occurrence of any of the indications does not automatically oblige the application of enhanced or simplified FMLs, but is a signal to analyse the specific case from that point of view.

Specific situations for the application of an FSC

The use of FWAs is a fundamental obligation under the AML Act. IOs are obliged to use them in an appropriate and proportionate manner. However, there are special situations:

• The possibility for the IO to waive the application of the FMC – this refers to the right to waive the identification, the verification of the customer and the beneficial owner and the assessment of the economic relationship in cases of small electronic transactions. Conditions to be fulfilled
  • : the transaction concerns electronic money
  • the payment instrument may not be recharged or the maximum transaction limit is the equivalent of €150 and is limited to the territory of the Republic of Poland the
  • amount stored electronically does not exceed €150
  • the payment instrument may only be used to purchase a service or goods the payment instrument may
  • not be recharged without the application of the CBM
  • the e-money issuer applies the CBM for the ongoing analysis of the transaction or monitors the economic relationship
• Impossibility to apply an FSC – sometimes in practice it happens that IOs are not able to apply an FSC to a customer/beneficiary. For example, it is not possible to verify the customer because he/she does not show the correct identity document to the IO.

The non-applicability of the WSC must involve a firm response from the OI.

Depending on the nature of the existing relationship with the customer, this should occur:

• Failure to establish a business relationship
• Failure to carry out an occasional transaction
• Failure to carry out a transaction through a bank account
• Termination of a business relationship

Lack of FMLA and what next?

• Notification to the GIIFNot
  • always failure to apply the FSC = notification
  • A specific case must be investigated – if the RO assesses that there are grounds due to suspicion of money laundering or terrorist financing or a reasonable suspicion that a specific transaction or specific assets may be related to money laundering or terrorist financing.