Fiduciary management of secured assets and capital in recovery

The Agency shall identify, assess, and understand the risks of money laundering, terrorist financing, and other financial crimes that may be associated with the matters, files, and transactions submitted for analysis.

Every client relationship shall be evaluated according to the particular characteristics of the case.

The assessment may consider: (a) the declared origin of the capital subject to analysis or recovery; (b) the manner in which the loss, transfer, or movement of funds occurred; (c) the natural or legal persons related to the relevant events; (d) the platforms, institutions, intermediaries, or financial service providers involved; (e) the jurisdictions connected with the transactions; (f) the number, frequency, and volume of the transactions analyzed; (g) the existence of virtual assets or new technologies; (h) the use of third parties to receive, transfer, or administer funds; (i) the existence of interposed companies or legal structures; (j) any inconsistency between the information provided and the documentation available.

FATF Recommendation 1 establishes that risks should be identified, assessed, and understood, and that mitigation measures should be proportionate to the identified risk.

The Agency may classify files, clients, and transactions according to different levels of risk.

The classification may consist of low, medium, high, or critical risk, according to the corresponding internal methodology.

Matters classified as presenting a higher level of risk shall be subject to enhanced identification, documentary analysis, and review procedures.

A risk classification shall not, by itself, constitute an accusation or determination of unlawful activity.

The risk assessment shall remain updated throughout the client relationship.

The appearance of new documentation, undisclosed transactions, unknown third parties, additional accounts, or previously omitted legal structures may result in a reassessment or reclassification of risk.

Before formally accepting a chargeback procedure, forensic tax investigation, or capital recovery matter, the Agency shall obtain sufficient information to identify the client.

Identification shall be conducted using reasonably reliable documents, data, or information.

The Agency may require: (a) full legal name or corporate name; (b) official identification document; (c) date of birth or date of incorporation; (d) address; (e) tax information; (f) contact information; (g) documentation related to the origin of the capital under analysis; (h) account statements; (i) payment or transfer receipts; (j) contracts, communications, or documents related to the events subject to the file.

FATF customer due diligence standards include the identification and verification of the customer using reliable sources.

The Agency shall not initiate or maintain files under evidently fictitious identities or where there is a deliberate intention to conceal the client's identity.

The use of a representative must be reasonably justified and documented.

The Agency shall understand the purpose of the requested service.

It shall reasonably determine: (a) the nature of the reported damage or financial loss; (b) the amount being claimed; (c) the manner in which the funds were delivered or transferred; (d) the apparent recipient of the funds; (e) the result the client seeks to obtain; (f) the existence of previous claim, chargeback, or recovery procedures.

Understanding the purpose and intended nature of the relationship is an express component of FATF Recommendation 10.

The obligation to verify information shall not end when a file is opened.

The Agency may request additional documentation during an investigation when identified transactions are inconsistent with the information initially provided.

Activity associated with the file shall be reviewed on an ongoing basis, taking into account available knowledge of the client, the client's activity, and the applicable risk profile.

Ongoing monitoring and the review of transactions form part of the customer due diligence measures established by FATF.

When the Agency cannot reasonably verify the identity of the client, the purpose of the requested service, or fundamental information concerning the file, it may decline to accept the matter.

When a relationship already exists, the Agency may suspend its analysis or terminate the provision of services.

The Agency shall assess whether indicators exist that require an internal suspicious transaction analysis.

FATF Recommendation 10 provides that when customer due diligence measures cannot be satisfactorily completed, a relationship or transaction should not be initiated or should be terminated, and consideration should be given to filing a suspicious transaction report where legally applicable.

When a file involves a legal person, the Agency shall adopt reasonable measures to identify the natural person who ultimately exercises ownership or control or receives the ultimate benefit.

It shall not be sufficient to identify only: (a) the legal representative; (b) the employee who communicates with the Agency; (c) the formal account holder when indicators suggest that the person is acting on behalf of third parties; (d) an intermediary company when a higher ownership structure exists.

FATF Recommendation 10 requires the identification of the beneficial owner and an understanding of the ownership and control structure of legal persons.

When companies, trusts, intermediary entities, or other legal structures are connected with the funds under analysis, the Agency shall reasonably understand their structure.

The Agency may request information concerning: (a) incorporation; (b) directors or administrators; (c) partners or shareholders; (d) ownership interests; (e) persons with the ability to exercise control; (f) beneficial ownership; (g) recent changes in ownership.

FATF Recommendation 24 emphasizes the availability of adequate, accurate, and up-to-date information concerning legal persons and beneficial ownership.

The existence of companies lacking identifiable commercial activity, using multiple corporate layers, or intervening solely to receive and transfer funds may be considered a risk factor.

The Agency shall analyze whether the complexity of the structure bears a reasonable relationship to the declared economic activity.

FATF publications concerning financial crime risks have identified the use of shell and front companies to increase opacity, open accounts, issue documentation, and manage transfers.

The Agency shall maintain reasonable measures to identify whether a client or beneficial owner is a politically exposed person.

Politically exposed person status shall not automatically result in the rejection of a file.

The Agency shall assess the risk level of the relationship.

When a relationship with a politically exposed person presents a higher level of risk, the Agency may: (a) obtain authorization from management or the compliance officer; (b) obtain additional information concerning the source of wealth; (c) analyze the origin of funds related to the file; (d) apply enhanced monitoring.

These measures reflect the enhanced controls contemplated by FATF for higher-risk relationships involving politically exposed persons.

The Agency shall maintain sufficient records of the procedures and transactions analyzed.

Records shall allow the reasonable reconstruction of: (a) the identity of the client; (b) the nature of the case; (c) the capital being claimed; (d) the transactions identified; (e) the accounts involved; (f) the related persons and entities; (g) the documentation examined; (h) the conclusions reached during the analysis.

As an internal standard aligned with FATF Recommendation 11, documentation related to customer due diligence and transaction analysis shall be retained for a minimum period of five years, unless applicable law establishes a longer period.

FATF standards contemplate a minimum five-year period for necessary transaction records and documentation obtained through customer due diligence.

Information contained in files shall be protected against unauthorized deletion or modification.

When material modifications are made, it should be reasonably possible to determine the nature of the modification.

The Agency shall identify and assess risks that may arise from the use of new technologies within its procedures.

Before implementing new tools that materially modify client identification, information processing, or transaction analysis, the impact of such tools on compliance controls shall be evaluated.

FATF standards establish that risks associated with new products, practices, and technologies should be assessed in advance and that measures should be adopted to manage and mitigate those risks.

When an investigation involves virtual assets, digital wallets, online payment services, or other technological mechanisms, the Agency shall consider the specific risks associated with the channel used.

The analysis may consider: (a) available traceability; (b) the origin of the assets; (c) related addresses or accounts; (d) the use of multiple platforms; (e) frequent conversion between different assets; (f) the use of mechanisms intended to increase opacity.

When the Agency uses external service providers to perform identification, analysis, or verification procedures, the Agency shall maintain access to the necessary information.

The provider must be capable of promptly providing documentation related to the verification performed.

Reliance on a third party shall not eliminate the Agency's responsibility for its own customer due diligence procedures.

FATF standards expressly establish that ultimate responsibility for customer due diligence remains with the institution relying on the third party.

The Agency shall implement an internal program intended to prevent money laundering and terrorist financing.

The program shall be proportionate to the size, structure, and risk level of the Agency.

It may include: (a) internal customer due diligence policies; (b) identification procedures; (c) risk assessment; (d) record keeping; (e) analysis of unusual transactions; (f) information protection; (g) internal escalation of higher-risk matters; (h) staff training.

FATF Recommendation 18 requires the implementation of internal AML/CFT programs.

The Agency shall designate a person or department responsible for coordinating its internal compliance controls.

The responsible person or department shall have access to the information necessary to analyze risk situations.

Personnel involved in opening files, financial analysis, tax analysis, documentary review, or capital recovery shall receive training proportionate to their responsibilities.

Training shall include the identification of risk factors and internal escalation procedures.

The Agency shall apply enhanced measures when a file presents material connections with jurisdictions for which FATF has called for enhanced due diligence or additional preventive measures.

FATF Recommendation 19 requires enhanced measures concerning relationships and transactions connected with countries subject to specific FATF calls for action.

The assessment may consider: (a) the country of origin of the transaction; (b) the destination country of the funds; (c) the jurisdiction of incorporation of the entities involved; (d) the location of intermediaries; (e) the existence of multiple jurisdictions without an apparent justification.

The existence of a geographic risk connection shall be assessed together with the other elements of the file.

When the analysis of a file gives rise to reasonable grounds to suspect that certain funds are the proceeds of criminal activity or are related to terrorist financing, the Agency shall conduct an internal analysis of the matter.

Risk factors may include: (a) apparently altered documentation; (b) contradictory information; (c) a lack of correspondence between the economic profile and the funds involved; (d) unjustified use of third parties; (e) successive movements between multiple accounts; (f) companies without apparent economic activity; (g) international transfers without an identifiable explanation; (h) concealment of beneficial ownership; (i) unjustified refusal to provide information; (j) transactions structured without a reasonably identifiable economic purpose.

When the Agency is legally required to submit suspicious transaction reports, it shall promptly communicate relevant suspicions to the Financial Intelligence Unit or other competent authority of the corresponding jurisdiction.

FATF Recommendation 20 establishes the timely reporting of suspicions relating to funds that are the proceeds of criminal activity or are connected with terrorist financing.

Suspicious transaction reports, when legally required, are submitted to the applicable Financial Intelligence Unit or other legally competent authority.

Where a reporting obligation applies, the Agency shall also consider attempted transactions that present elements of suspicion.

The Interpretive Note to FATF Recommendation 20 contemplates reporting suspicious transactions, including attempted transactions, regardless of the amount involved.

Compliance analyses and internal investigations related to suspicious transactions shall be confidential.

Access shall be limited to authorized personnel.

When a suspicious transaction report has been submitted or is in the process of being submitted in accordance with applicable law, the client or third parties must not be provided with information that could alert them to the existence of the report.

FATF Recommendation 21 expressly addresses the prohibition against disclosing that a suspicious transaction report or related information is being submitted to a Financial Intelligence Unit.