Procedures for the prevention of money laundering and terrorist financing, including the making and retention of appropriate records, must satisfy local law and the following minimum standards:
Know Your Customer
Transactions or other services must only be undertaken for customers of the TBI who have been properly identified and are reasonably deemed to be reputable. The true identity of persons on whose behalf an account is opened or a transaction is undertaken must be verified. Staff responsible for customer management or transaction processing who may become aware of money laundering or terrorist financing must keep sufficiently informed of the nature of their customers' business activities to be satisfied that they are legitimate and to detect transactions which are inconsistent with those activities. Where TBI's customer is an intermediary (e.g., another bank, an accountancy or law firm, a broker, a supplier of goods and services to others, or an introducer of business), and deals in products or services that are susceptible to money laundering, terrorism or the financing of terrorism, further information may be required on TBI's customer's business to confirm that it is not connected to money laundering, terrorism or the financing of terrorism. (This is often referred to as Know Your Customer's Business, KYCB or KYCC).
Ongoing Monitoring
Staff must be alert to money laundering and terrorist financing. Particular focus is to be given to higher risk situations such as transactions involving countries designated as "non co-operative countries and territories" by the Financial Action Task Force ("FATF"), complex, large or unusual transactions, and unusual patterns of transactions that have no apparent economic or lawful purpose. Additional information may be required for customers, places, financial entities or transactions designated as "primary money laundering concern" under United States legislation. Cash transactions greater than USD10,000 or its local equivalent must be promptly reviewed and reported if required by local laws. Each business unit/country must ensure that its customer name database and transaction records are frequently searched to detect any "named person".
Designated Money Laundering Reporting Officer
Each business unit must appoint a designated Money Laundering Reporting Officer ("MLRO") to be responsible for overseeing that business unit's compliance with this Policy, including ensuring adequate, independent testing and record retention. The MLRO must be appropriately supervised by senior management.
Blocking transactions
Transactions identified as involving someone known to be a "named person" must be blocked and immediately reported to the MLRO (or other officer or team nominated by the MLRO).
Reporting Suspicious Transactions
Staff must refer suspicious transactions (including proposed transactions, even if they do not proceed) to a designated officer (usually MLRO), as soon as identified. The MLRO (or an officer or a team nominated by the MLRO) should review the transactions for appropriate action such as blocking the transactions, further monitoring or investigation of the account in order to determine whether the transactions are legitimate and if not, whether, ultimately, the account should be closed. (In some business units, referral of a suspicious transaction to the MLRO may be actioned by forwarding a Suspicious or Suspect Transaction Report to the MLRO.)
Where required or enabled by local law, suspicious transactions must be reported to the relevant authorities as soon as practicable.
Unless required by local law, staff must not reveal to the customer or any other person outside of TBI that a suspicious transaction report has been made and the customer may be investigated (in some countries, such "tipping off" is a criminal offence).
Identification of a "named person" must immediately be reported to the MLRO, the relevant Business Unit's senior operating risk personnel, and to the Head of Regulatory Compliance, or other officer nominated by the Head of Regulatory Compliance.
Reporting Actual or Potential Money Laundering to Group Head Office
Any advice to a Business Unit from a local regulator or other authority, any press report and any rumour of such advice or press report about TBI's products or services being used for money laundering or the financing of terrorism must be reported immediately to the Head of Regulatory Compliance, via the relevant Business Unit's
senior operating risk personnel.
Record Keeping
Records of customer identification, transactions carried out by or for customers, action taken under internal and external money laundering reporting, debt recovery from insolvent customers and staff money laundering training are to be retained for 7 years, unless required otherwise by local law or government agency or regulator.
Staff Awareness
All TBI staff must be aware of this Policy and the potential effect on TBI and its employees from non-compliance with this policy.
Training
All staff responsible for customer management or transaction processing where they may become aware of money laundering or terrorist financing must undertake training which deals with awareness of money laundering and terrorist financing and the responsibilities of staff under this policy at least once every three years.
Independent Testing
Each business unit must ensure that independent testing is annually undertaken of its money laundering and antiterrorism compliance.
Annual Money Laundering Compliance Report
Each business unit must complete an annual Money Laundering Compliance Report which includes the number of Suspicious Transaction Reports made for the year, the number of "named persons" identified during the year, and an analysis of the effectiveness of the business unit's procedures for detecting money laundering and terrorist financing, including the results of the independent testing and recommendations for amendment to the procedures and this policy if appropriate. This report must be provided to Group Operating Risk annually and at other times if requested by the Head of Regulatory Compliance, Group Operating Risk.