Risk-Based Approach – Guidance for Money Service Businesses

Risk-Based Approach – Guidance for Money Service Businesses - July 2009Limitations to the risk-based approach46. There are circumstances in which the application of a risk-based approach will not apply, or maybe limited. There are also circumstances in which the application of a risk-based approach may not applyto the initial stages of a requirement or process, but then will apply to subsequent stages. The limitations tothe risk-based approach are usually the result of legal or regulatory requirements that mandate certainactions to be taken.47. Requirements to freeze assets of identified individuals or entities, in jurisdictions where suchrequirements exist, are independent of any risk assessment. The requirement to freeze is absolute andcannot be impacted by a risk-based process. Similarly, while the identification of potential suspicioustransactions can be advanced by a risk-based approach, the reporting of suspicious transactions, onceidentified, is not risk-based.48. There are a number of components to customer due diligence – identification and verification ofidentity of customers and beneficial owners, obtaining information on the purposes and intended nature ofthe business relationships and conducting ongoing due diligence. Of these components, the identificationand verification of identity of customers are requirements which must be completed regardless of the riskbasedapproach for all customers that have an account or a business relationship and when the appropriatemonetary thresholds are reached (not higher than USD/EUR 15 000 for occasional transactions or nothigher than USD/EUR 1 000 for wire transfers). This is the case for cross-border and domestic transfers offunds between financial institutions, including MSBs. Indeed, Special Recommendation VII requires eachcountry to take measures to require financial institutions, including MSBs, to include accurate andmeaningful originator information (name, address and account number) on funds transfers and relatedmessages that are sent, and the information should remain with the transfer or related messages through thepayment chain. However, for domestic wire transfers, the ordering MSB may include full originatorinformation or only the orignator‟s account number or unique identifier, provided full originatorinformation is available to the beneficiary financial institution and competent authorities within threebusiness days.49. However, in relation to all the CDD components, a reasonably implemented risk-based approachmay allow for a determination of the extent and quantity of information required, and the mechanisms tobe used to meet these minimum standards. Once this determination is made, the obligation to keep recordsand documents that have been obtained for due diligence purposes, as well as transaction records, is notdependent on risk levels.50. Countries may allow MSBs to apply reduced or simplified measures where the risk of moneylaundering or terrorist financing is lower. However, these reduced or simplified measures do notnecessarily apply to all aspects of customer due diligence. Moreover, where these exemptions are subjectto certain conditions being met, it is necessary to verify that these conditions apply, and where theexemption applies under a certain threshold, measures should be in place to prevent transactions frombeing split artificially to avoid the threshold. In addition, information beyond customer identity, such ascustomer location and purpose of the transaction, may be needed to adequately assess risk. This will be aniterative process: the preliminary information obtained about a customer should be sufficient to determinewhether to go further, and in many cases customer monitoring will provide additional information.51. Some form of monitoring, whether it is automated, manual, a review of exception reports or acombination of acceptable options, depending on the risks presented, is required in order to detect unusualand hence possibly suspicious transactions. Even in the case of lower risk customers, monitoring is neededto verify that transactions match the initial low risk profile and if not, trigger a process for appropriatelyrevising the customer‟s risk rating. Equally, risks for some customers may only become evident once the14 - © 2009 FATF/OECD