Anti-money laundering & counter-terrorism financing – customer identification and verification

The AML/CTF Act regulates “reporting entities”, being any person or body corporate who carries on the business of providing a “designated service”. Designated services include opening an account, accepting money on deposit and issuing a security (which includes interests in managed investment schemes).

Accordingly, the AML/CTF Act will apply to –

• financial institutions, such as banks and foreign currency traders

• responsible entities of registered funds

• trustees or managers of unregistered funds

• custodians holding assets of registered and unregistered funds, and

• entities who arrange for customers to receive a designated service (such as a licensed financial planners).

The obligation to comply with the AML/CTF Act requires the reporting entity to have first provided a “designated service”. For most fund managers this will be when a security (such as an interest in a fund) is issued to a customer.

The AML/CTF Act places various compliance obligations on reporting entities with respect to their dealings with customers and their involvement in particular transactions.

The key obligations include the following:

• AML/CTF compliance program – the reporting entity must determine its risk exposure to money laundering and terrorism financing. This requires the reporting entity to develop a risk framework to assess these risks across its business. The program must include a risk- based customer identification program and an ongoing customer due diligence program. This will ensure the reporting entity knows who it is doing business with and help identify any unusual or suspicious behaviour.

• AUSTRAC reporting – the AML/ CTF Act requires reporting entities to report a range of matters to AUSTRAC, including the following:

  • Where the reporting entity suspects, on reasonable grounds, that information concerning the provision or possible provision of a designated service may be “relevant to the investigation or prosecution” of a person for tax evasion, a criminal offence, money laundering or financing terrorism.

  • Cash transactions or transfers of $10,000 or more.

  • Compliance with the AML/ CTF Act.

• Training – the reporting entity must establish a training and awareness program for staff to educate them in the AML/CTF requirements and make them aware of what may constitute suspicious activity.

• Employee screening – an employee due diligence program to screen staff members who may be in a position to assist in money laundering or terrorism financing.

• AML/CTF compliance officer – the reporting entity must appoint an AML/CTF compliance officer to take responsibility for AML/CTF compliance.

• Record keeping – the AML/CTF Act places further obligations on reporting entities to keep thorough records of information in connection with the above obligations for a period of seven years.

A reporting entity can fulfil its customer identification and verification obligations through a number of methods, as follows:

• Perform the customer identification and verification itself.

• Appoint an agent to carry out the initial customer identification and verification on its behalf.

• Rely on the customer identification and verification carried out by another entity.

Where a reporting entity intends to rely on the customer identification and verification performed by another entity, then it must be reasonably satisfied the entity has carried out the identification in accordance with the AML/CTF Rules.

This requires an agreement to be in place between the parties. Under the terms of the agreement, the entity performing the customer identification and verification must agree to retain documents used in the verification process and allow the reporting entity to inspect such documents.

Customer identification and verification is only required to be performed on new customers.

Existing customers (ie, those customers who have previously invested in a security or scheme operated by the reporting entity) are not required to be identified and verified. However, if a long period has elapsed since the previous investment, then the reporting entity may choose to perform the customer identification and verification.

Importantly, for a reporting entity to rely on the existing customer exemption, the customer must be the same entity, i.e., it cannot be a new entity, such as a new company, trust or self managed superannuation fund.

Fund managers have a number of alternatives available to them to include information in disclosure documents about AML/CTF, as follows:

General disclosure

It is common practice to include at least a brief description of the AML/CTF obligations and the requirement on fund managers to collect information from prospective customers.

Application form

List of identification and verification documents

The customer identification and verification requirements can be included in the application form of disclosure documents.

Application forms prepared in this way outline the identification documents to be provided based on customer type eg, individual, company, trust etc.

Checkboxes

Application forms can also be prepared to include a number of AML/CTF checkboxes, including the following:

• Confirmation another entity has performed the customer identification and verification.

• Confirmation a customer has invested previously in a security or scheme operated by the reporting entity.

• Confirmation a customer is an unregistered scheme with wholesale clients only.

AML/CTF booklet

As an alternative to including customer identification and verification information in the application form, a separate AML/CTF booklet can be used to accompany the disclosure document. This booklet provides details of all the identification and verification documents required to be provided by the customer.

It is prudent to include AML/ CTF obligations in compliance plans for registered schemes based on the requirements under the Corporations Act. Then, the compliance committee is required to monitor the reporting entity’s compliance with the AML/CTF requirements.

However, just like other procedures in a compliance plan, this does not require the compliance committee to have direct involvement in performing or overseeing the identification or verification of customers, or reporting suspicious matters to AUSTRAC.