Additional external resources
Australian Standards
AS/NZS 4360:2004 Risk Management
AS 4811:2006 Employment Screening
U.K. - Joint Money Laundering Steering Group
"Prevention of money laundering/combating the financing of terrorism", Parts I and II.
Australian sanctions lists
Chapter last updated 11 December 2007
Introduction
This chapter covers Part A of an AML/CTF program, required under Part 7 of the AML/CTF Act.
This chapter should be read in conjunction with chapter 4 of this Guide, which covers requirements for Part B of an AML/CTF program, which also relates to Part 2 of the AML/CTF Act (identification procedures).
When do the provisions commence?
The provisions of the AML/CTF Act relating to Part A of an AML/CTF program commenced on 12 December 2007.
What is the relevant FATF recommendation?
The provisions in Part 7 of the AML/CTF Act implement FATF Recommendation 15. (15)
Appendix H contains the relevant FATF recommendations and associated interpretative notes.
What is Part A of an AML/CTF program?
AML/CTF programs are a new requirement introduced under the AML/CTF Act. The primary purpose of Part A of an AML/CTF program is to identify, mitigate and manage the risk that a reporting entity might knowingly, inadvertently or otherwise, facilitate money laundering or terrorism financing in the provision of designated services.
Identification is the assessment and recognition of ML/TF risks associated with a designated service a reporting entity provides.
Mitigation involves analysis of the identified ML/TF risks, prioritisation of the risks according to likelihood of occurrence and the consequences if it did, developing a strategy to prevent the risk occurring and implementing that strategy.
Management is monitoring and reviewing mitigation strategies.
The requirements for Part A of an AML/CTF program under the AML/CTF Act are:
- to identify, mitigate and manage the risk of money laundering or terrorism financing that a reporting entity may reasonably face in providing designated services at or through a permanent establishment in Australia (16)
- to comply with requirements set out in the AML/CTF Rules
- if a reporting entity provides designated services at or through a permanent establishment in a foreign country, it must also ensure that it takes such action as specified in the AML/CTF Rules.
What are the requirements for Part A of an AML/CTF program?
Important |
|
The requirements for Part A of an AML/CTF program do not apply to AFSL holders that are only providing designated services under item 54 of table 1 in section 6 of the AML/CTF Act. |
Part A of an AML/CTF program must enable the reporting entity to:
identify significant changes in the risk associated with money laundering or terrorism financing it faces
recognise such changes in the risk associated with money laundering or terrorism financing for the purposes of the requirements of Part A and Part B of its AML/CTF program
assess the risk associated with money laundering or terrorism financing posed by:
- all new designated services before introducing them to the market
- all new methods of designated service delivery before adopting them
- all new or developing technologies used to provide a designated service before adopting them.
What are the requirements for Part A of a standard AML/CTF program?
Reporting entities must include the following in Part A of an AML/CTF program:
ML/TF risk awareness training program. Such a program should cover:
- the obligations a reporting entity may have under the AML/CTF Act, as well as the consequences of non-compliance
- the risk of money laundering or terrorism financing the reporting entity may face (and potential consequences of that risk)
- the processes and procedures in the AML/CTF program that are relevant to the work carried out by employees.
Employee due diligence program. Reporting entities must screen their employees for money laundering and terrorism financing risk. A reporting entity should consider the potential for risk associated with money laundering or terrorism financing in relation to individual positions in an organisation and apply the appropriate employee due diligence, or screening, in each case. For example, a reporting entity may determine that frontline staff present a different potential for such risk than staff in a capital markets area or private banking unit. Similarly, cashier staff in a casino may present a different risk from bar staff.
Oversight by boards and senior management. This is a critical governance issue and a reporting entity should ensure that processes are developed and implemented for regular reporting to and monitoring by senior management, as well as receiving feedback from them. Board and senior management oversight should also include a review, at set intervals, of the continuing adequacy of the AML/CTF program.
AML/CTF Compliance Officer. A reporting entity should consider a number of factors in relation to this position, including independence, seniority, accountability, reporting lines, access to executive/board and relevance of the competencies of the incumbent.
Independent review of the AML/CTF program. A reporting entity will need to assess the pros and cons of having the review undertaken by an internal area such as internal audit (or another 'independent' area) or having an external review. In either case, it is important to be able to demonstrate the independence and quality of the review process.
AUSTRAC feedback. Feedback from AUSTRAC on the reporting entity's own program and in relation to industry-wide matters will be a key driver in enhancing and maintaining the currency of a reporting entity's AML/CTF program.
Permanent establishments in a foreign country. A reporting entity will need to consider whether its standard AML/CTF program is relevant to its offshore operations, or whether the program needs to be customised to comply with local obligations. Certain requirements of Part A do not apply to overseas permanent establishments, as specified in the AML/CTF Rules.
The requirements for standard AML/CTF programs are contained in chapter 8 of Anti-Money Laundering and Counter-Terrorism Financing Rules Instrument 2007 (No. 1).
What are the requirements for Part A of a joint AML/CTF program?
The factors relevant to a standard AML/CTF program are also relevant to a joint AML/CTF program.
As mentioned in chapter 2 of this Guide, a joint AML/CTF program applies to reporting entities that elect to become part of a designated business group and choose to adopt a joint program. However, the joint program may need to be modified so that it is relevant to the needs of individual reporting entities within the designated business group.
It may be necessary to undertake a detailed analysis of the business activities of each reporting entity to identify which components of the joint AML/CTF program may need to be modified to meet the needs of individual members.
Requirements for joint AML/CTF programs are contained in chapter 9 of Anti-Money Laundering and Counter-Terrorism Financing Rules Instrument 2007 (No. 1).
Requesting information from customers
Where a reporting entity has a standard or joint AML/CTF program and has reasonable grounds to believe that a customer of a designated service has information that is likely to help the reporting entity comply with Part A of its AML/CTF program, section 92 of the AML/CTF Act allows the reporting entity, by written notice, to request the customer to provide the information within the period specified in the notice.
The AML/CTF Act gives reporting entities powers relating to discontinuing, restricting or limiting the provision of designated services to a customer until the customer provides the information covered by the written notice.
Protection from liability may be available under subsection 92(5) of the AML/CTF Act in relation to suits or proceedings taken against the reporting entity regarding actions it has taken in good faith in the (purported) exercise of this power.
Exceptions and exemptions
Subsections 82(3) to (5) of the AML/CTF Act provide that where a reporting entity has included something in its AML/CTF program which is not required by the AML/CTF Rules, then the reporting entity need not comply with that part of their AML/CTF program.
These provisions ensure that where an AML/CTF program exceeds the minimum legal requirements, reporting entities cannot be prosecuted for non-compliance with the non-legally required parts of their program.
Subsections 93(1) and (2) of the AML/CTF Act provide for designated services of a kind, or provided in circumstances, specified in the AML/CTF Rules to be exempted from specified AML/CTF program obligations.
Exemptions in relation to AML/CTF programs may be available under section 247 (general exemptions) and/or section 248 (exemptions and modifications by way of written instrument by the AUSTRAC CEO). Refer to the AUSTRAC Exemption Policy and AUSTRAC guidance note Exemptions and modifications under the AML/CTF Act for information on AUSTRAC's approach to exemptions which can be located at www.austrac.gov.au. A summary of the AUSTRAC Exemption Policy is in Appendix F.
What are the risk indicators of an inadequate AML/CTF program - Part A?
There are a number of risks associated with developing, implementing and managing Part A of an AML/CTF program. Examples of these risks include, but are not limited to:
- failure to include all the mandatory components
- failure to conduct a proper ML/TF risk assessment
- failure to gain board or executive approval for the program
- insufficient or inappropriate employee due diligence (for example employee screening is not commensurate with the money laundering or terrorism financing risk associated with the employee's position)
- frequency and level of risk awareness training not being aligned with the potential risk of exposure to money laundering or terrorism financing
- changes in business functions not reflected in the AML/CTF program (for example, the introduction of a new product or distribution channel)
- feedback from AUSTRAC not acted on (for example, advice about an emerging risk related to money laundering or terrorism financing)
- failure to independently review the content and application of the AML/CTF program.
What resources are available to assist reporting entities?
Conducting an ML/TF risk assessment
The following three resources may assist reporting entities in conducting a proper ML/TF risk assessment.
1. AUSTRAC guidance note: Risk management and AML/CTF programs |
|
The purpose of this guidance note is to:
- provide general information about risk management frameworks and relevant legislative requirements under the AML/CTF Act and AML/CTF Rules relating to
AML/CTF programs
- assist reporting entities in implementing an AML/CTF program appropriate to their business having regard to the business size, nature and complexity.
Reporting entities may find this document particularly useful where it discusses the application of the AS/NZS 4360:2004 Risk Management framework to the AML/CTF context and in conjunction with the legislative obligations for an AML/CTF program.
This guidance note is available from the AUSTRAC website: www.austrac.gov.au/files/risk_man_and_amlctf_programs.pdf. |
2. AS/NZS 4360:2004 Risk Management |
|
This internationally-respected standard was updated and re-released by Standards Australia in 2004. Widely used, the standard provides a generic guide for managing risk. It may be applied to a wide range of activities, decisions or operations of any organisation and it specifies the elements of the risk management process.
This standard is available from the Standards Australia website: www.standards.org.au |
3. ML/TF Risk Principles Framework |
|
The ML/TF Risk Principles Framework was developed and agreed to in March 2006 by a joint government-industry working group in Sydney during the consultation period of the AML/CTF Bill. This framework is based upon and consistent with the Australian Risk Management Standard (AS/NZS 4360:2004) described above, but like the risk management guidance note is tailored to the ML/TF context.
This framework is available in Appendix B. |
Creating a culture of compliance
AUSTRAC, like other regulators, encourages a culture of compliance within business. In doing so, AUSTRAC recognises the diverse nature of businesses that fall within the AML/CTF Act and the impact this legislation has on the operation of a business.
What is a culture of compliance?
While the AML/CTF Act requires reporting entities to have an AML/CTF program, the implementation of compliance systems alone may not necessarily lead to positive risk management or compliance outcomes. To ensure that the programs and systems established within a business are successful, compliance should become part of an organisation's culture. A culture of compliance is one where commitment to achieving risk management and regulatory objectives is embedded at all levels of the organisation (and in particular, senior management) and compliance is an inherent and expected behaviour that is considered to value add, rather than be viewed or practiced as a separate activity and considered an unwelcome business cost.
To successfully manage ML/TF risks and comply with regulatory obligations, management needs to recognise that establishing the 'right' culture will be a major responsibility for them, in parallel with monitoring and controlling responsibilities.
How can business benefit from a culture of compliance?
A strong culture of compliance will benefit businesses by improving the management and mitigation of both business and regulatory risks. The positive outcomes of a culture of compliance will result from improved employee performance in identifying and dealing with any unlawful conduct channelled through the organisation. Regulatory risk may be reduced, for example, in the event that AUSTRAC instigates legal proceedings, if the demonstrable existence of a culture of compliance were considered a mitigating factor by the court.
As well as reducing the financial and reputational risks associated with regulatory non-compliance, benefits can extend to such aspects of the business as customer service, employee and customer loyalty and ultimately competitive advantage. (17)
How can a culture of compliance be achieved?
AUSTRAC recognises that reporting entities have numerous regulatory obligations and expects that AML/CTF requirements will become part of a business's broader compliance programs and culture.
The values, attitudes and beliefs exhibited by management represent the single greatest influence on the successful implementation of a culture of compliance. If the board and management are not seen to be committed to compliance, it may send the message that compliance is discretionary.
Several of the factors that organisations need to consider to successfully integrate compliance into their culture are also required elements of AML/CTF programs; for example, an ML/TF risk awareness training program and oversight of AML/CTF programs by boards and senior management. However, to ensure that implementation of the AML/CTF program is successful, the following elements (18) of a culture of compliance should be considered in conjunction with the required elements of AML/CTF programs:
- Compliance framework: compliance policies, processes, resources, training, monitoring and reporting are the foundation of a culture of compliance.
- Behavioural factors: for the compliance framework to be effective it needs to be embedded in the culture, which will require training and demonstration and encouragement of the appropriate behaviours by management.
- Structural issues: compliance should be integrated into all operational areas of the business, rather than a separate compliance function.
- Business planning: a formal business plan will assist management throughout the organisation to incorporate compliance activities into units.
- Inter-business unit management: some compliance functions will extend across several business units which will require careful planning and management.
- Resourcing: senior management needs to demonstrate its commitment to compliance by allowing adequate time and resources for compliance activities.
The Australian Competition and Consumer Commission (ACCC) has observed (19) that organisations that effectively institutionalise a culture of compliance typically travel through three phases. While the observations were made in relation to the Trade Practices Act 1974, they are equally applicable to reporting entities seeking to achieve compliance with their obligations under the AML/CTF Act. The three phases are:
- Commitment to comply. Management develops a willingness or commitment to address compliance issues and allocate the resources to achieve it.
- Compliance know-how. Specialist personnel are appointed and made accountable for compliance program development and internal and external expertise is sought and assimilated. Corporate strategy takes account of compliance. Policies and procedures are developed to address compliance issues.
- Compliance as business practice. Compliance becomes the way business is done and is no longer external to it. Compliance policies are considered integral to company objectives. Operational procedures take account of compliance; the performance of work duties in compliance with the law is the company norm.
29-OCT-2009
| 