Analysis of atypical facts and transactions: Comments and recommendations by the NBB
If the mechanisms used for exercising due diligence with respect to transactions and business relationships report an atypical fact or transaction, the financial institution is expected to first pre-analyse the said reporting to ensure that it is justified (see point 1 below). Financial institutions must also have a system for analysing the facts or transactions whose atypical nature has thus been confirmed, in order to establish, where appropriate on the basis of a wider range of information, whether the financial institution must consider that it knows, suspects or has reasonable grounds to suspect that the funds, transaction or fact are related to money laundering or terrorist financing (see point 2 below). The system for analysing atypical facts and transactions must also be subjected to internal control measures (see point 3 below).
1. Preliminary analysis of the reportings generated by the system for detecting atypical facts and transactions
As specified on the page “Due diligence on business relationships and occasional transactions and detection of atypical facts and transactions”, the system for detecting atypical facts and transactions is based on 2 elements: (I) detection by the persons who are in direct contact with customers or instructed with carrying out their transactions and (ii) an additional automated monitoring system.
Where this appears indicated in light of the characteristics of the reporting, taking into account in particular the complexity of the transaction or fact concerned, the number of participants, the amounts involved, etc., or because of serious doubts as to the validity of the information on which the reporting is based, the Bank recommends to conduct a preliminary analysis in order to verify that the information directly available to the financial institution does not contradict the atypical nature of the fact or transaction reported. This preliminary analysis allows to make a first assessment of the circumstances surrounding the transaction that has led to the reporting, in order to ensure the relevance of this reporting.
As a rule, the NBB recommends that this preliminary analysis be carried out by the AMLCO or a member of his team. However, inter alia for reasons of proportionality, the NBB allows this task to be carried out by an “AML correspondent” of another service provided that he is subject to dual reporting lines: on the one hand to the AMLCO or the person responsible for the Compliance function, for his tasks relating to the preliminary analysis of reportings, and on the other hand to another operational department, for his other tasks and functions. In all cases, the persons who carry out the preliminary analysis of the reportings must receive their instructions in this regard from the AMLCO under whose supervision they carry out these tasks. They must have adequate AML/CFTP experience and skills, have received adequate AML/CFTP training and have access to the information necessary to perform their tasks. In addition, financial institutions are expected to ensure that the person(s) carrying out this preliminary analysis has(have) sufficient human and technical resources to validate the reportings. If insufficient resources are allocated to this task, it may be impossible to analyse the reportings generated in a timely manner, which, in turn, may cause harmful delays in submitting validated reportings to the AMLCO for analysis, or, conversely, lead to an excessive number of files being submitted to the AMLCO, including files based on incorrect information, which may reduce the effectiveness of the capacity of the latter to conduct an in-depth analysis.
The preliminary analysis, which consists in examining the information directly available concerning the context of the facts or transactions that have led to the reporting, may lead to either a duly justified closing of the case without further action in case of a ‘false alert’, or to submission of the file to the AMLCO for further analysis. The result of this preliminary analysis must be documented on the basis of a simple and if possible structured justification (such as “false alert because…” or “Reporting requiring further analysis because…”) in order to facilitate an ex post control.
If the file is submitted to the AMLCO, the person or persons instructed with conducting this preliminary analysis must immediately cooperate fully and help him collect, if necessary, as much available information as possible concerning the customer, the fact or transaction concerned or the context.
2. Analysis of atypical facts and transactions by the AMLCO
2.1. Purpose of the analysis - Determination of the suspicion of money laundering or terrorist financing
If the relevance of the reporting is validated as indicated above, the financial institution must ensure that the atypical fact or transaction concerned is analysed in sufficient depth, also taking into account its context, to determine whether the financial institution should consider that it “knows, suspects or has reasonable grounds to suspect” that the funds, transaction or fact concerned are related to money laundering or terrorist financing.
The determination of suspicion must be the result of an intellectual process and the conclusion of a documented analysis. It cannot be carried out by automated systems alone but requires human intervention based on the analysis of atypical facts and transactions and their circumstances, to decide whether these atypical facts or transactions are suspected of being related to ML/FT and must therefore be reported to CTIF-CFI or, conversely, that their analysis allows to rule out such suspicions and close the case without further action.
This analysis must be conducted taking full account of the legal definition of money laundering and terrorist financing.
2.1.1 Suspicions of money laundering
A. General principles
Article 2 of the Anti-Money Laundering Law defines money laundering by listing acts (conversion, transfer, concealment, etc.) relating to proceeds of criminal activities and aimed essentially at evading or enabling to evade the legal consequences of unlawful acts.
The predicate money laundering offences are numerous. They are listed exhaustively in Article 4, 23° of the Anti-Money Laundering Law, which defines them as "any kind of involvement in the commission of an offence related to:
- terrorism or terrorist financing;
- organised crime;
- illicit trafficking in narcotic drugs and psychotropic substances;
- illicit trafficking in goods and merchandise, and weapons, including anti-personnel mines and/or submunitions;
- smuggling of human beings;
- trafficking in human beings;
- exploitation of prostitution;
- illicit use in animals of hormonal substances or illegal trade in such substances;
- illicit trafficking in human organs or tissues;
- fraud detrimental to the financial interests of the European Union;
- serious fiscal fraud, whether organised or not;
- social fraud;
- embezzlement by public officials and corruption;
- serious environmental crime;
- counterfeiting currency or bank notes;
- counterfeiting products;
- stock market-related offence;
- an improper public offering of securities;
- the provision of banking services, financial services, insurance services or funds transfer services, or currency trading, or any other regulated activity, without having the required licence for these activities or meeting the conditions to carry out these activities;
- breach of trust;
- misappropriation of corporate assets;
- the state of bankruptcy;
- computer crime."
However, Article 47, § 1, second paragraph, of the Anti-Money Laundering Law specifies that the financial institutions are not required to identify the offence underlying the suspected money laundering activity. A fortiori, they are not required to verify that the constituent components of the criminal offences concerned are present, nor gather evidence of them. If their analysis of the atypical transactions and facts leads them to know, suspect or have grounds to suspect that these transactions or facts are related to any of the offences listed, the atypical fact or transaction concerned must be qualified as suspicious. In most cases, the reporting entities cannot know precisely which are the offences underlying the suspected money laundering activity. It is up to CTIF-CFI to conduct an in-depth analysis in order to find the link between the funds concerned, the suspicious transaction or the facts reported and one of the forms of offences referred to in the Law. In this respect, CTIF-CFI plays a sorting/filtering role and enriches the reportings sent to it, thus avoiding that the offices of the prosecutor are overloaded with irrelevant reportings. This does not prevent the reporting entities from referring to any predicate offence when they know, suspect or have reasonable grounds to suspect that the laundered funds stem from any of the criminal activities mentioned in Article 4, 23°, of the Anti-Money Laundering Law.
The terms “suspect” or “have reasonable grounds to suspect” indicate that the financial institution must qualify the funds involved, the transaction or the fact concerned as suspicious if the analysis of the information collected in accordance with the due diligence obligations for the purpose of conducting the analysis, leads to a suspicion (“suspect”) or includes elements that do not reasonably allow it to dispel the doubt (“have reasonable grounds to suspect”) as to the lawful origin of the amounts or of the transaction or as to their economic, legal or tax justification.
B. Individual cases of money laundering
§1. Laundering of the proceeds of serious fiscal fraud, whether organised or not
It should be recalled, pursuant to the principle set out in Article 47, § 1, second paragraph, of the Anti-Money Laundering Law, that a financial institution must qualify an atypical transaction as suspicious if the analysis of this transaction leads it to consider that it knows, suspects or has reasonable grounds to suspect that the funds concerned have an illicit origin that may consist in any of the forms of crime listed in the Law, including serious fiscal fraud, without having to determine which of these crimes has been committed (see above).
The Bank therefore considers that funds and transactions relating to funds of which the financial institution knows, suspects or has grounds to suspect that they could stem from fiscal fraud, must be qualified as suspicious since the financial institution cannot reasonably exclude, on the basis of the information in its possession, that a serious fiscal fraud has been committed. The suspicion that a serious fiscal fraud may have been committed or the existence of reasonable grounds to suspect so, are sufficient to qualify the transaction as suspicious. This may be the case in particular if the suspicion of fiscal fraud is combined, either with a large amount of funds involved, or with an amount that is abnormal in view of the customer's activities or financial situation, or with a suspicion of forging of documents or use of false documents.
However, this does not imply in any way that the financial institution must be certain or must have evidence that the suspected fiscal fraud actually meets the legal conditions to be qualified as "serious, whether organised or not". It is up to CTIF-CFI, to which this suspicious transaction must be reported, to determine, on the basis of a more detailed analysis, whether or not there is predicate serious fiscal fraud.
It is also pointed out that, in order to promote the detection of atypical transactions that may be related to laundering of the proceeds of serious fiscal fraud, Article 39 of the Anti-Money Laundering Law requires enhanced due diligence measures with regard to transactions, business relationships or persons involved that are in any way linked to a no-tax of low-tax State included in the list established by Royal Decree in accordance with Article 307, § 1/2, third paragraph, of the Income Tax Code 1992. In this respect, see the page “States with low or no taxes”.
See also the page “Due diligence on business relationships and occasional transactions and detection of atypical facts and transactions” for a list of indicators of atypical transactions that may lead to suspicions of serious fiscal fraud.
§2. Laundering of the proceeds of social fraud
The list of predicate offences in the Anti-Money Laundering law has been updated to include social fraud and computer crime.
The notion of social fraud includes, for example, undeclared work, misappropriation of benefits, non-compliance with the regulations relating to the occupation of foreign workers, etc.
The NBB invites financial institutions to consult CTIF-CFI’s activity reports on this subject.
§ 3. Laundering of the proceeds of computer crime
The concept of “computer crime” is used in the Anti-Money Laundering Law to cover, on the one hand, offences where a computer system is the target of the criminal activity, i.e. acts directed against a computer system or the data it contains (e.g. unauthorised access to a computer system, also known as hacking), and, on the other hand, offences where a computer system is used merely as a tool to commit a criminal activity (e.g. the distribution of paedophile images via computer networks).
The NBB invites financial institutions to consult CTIF-CFI’s activity reports on this subject.
2.1.2. Suspicions of terrorist financing
The NBB draws the attention of financial institutions in particular to the fact that the analysis of atypical transactions and facts must also enable the financial institution to determine whether it “knows, suspects or has reasonable grounds to suspect” that the funds, transaction or fact concerned are related to terrorist financing. Article 3 of the Anti-Money Laundering Law defines terrorist financing as the provision or collection of funds or other assets, by any means, directly or indirectly, with the intention that they be used or in the knowledge that they are to be used, in full or in part, by a terrorist organisation or by a terrorist acting alone, even without any link to a specific terrorist act.
Financial institutions must therefore verify the consistency of the origin and/or destination of funds relating to one or more transactions with the up-to-date knowledge of their customers. They should exercise enhanced due diligence with regard to transfers of funds (credit transfers and money remittances) from or to geographical areas considered to be at risk with regard to terrorism or terrorist financing or with regard to transactions carried out in these areas.
Financial institutions are reminded of the need for their AML/CFTP policies to integrate the risks associated with the countries/territories from which or to which the funds are transferred. They must be alert to transactions carried out by their customer in "sensitive" countries, but also to those carried out in countries which, to their knowledge, are not in any way linked to their customer, as some countries may be used as transit countries to hide the final country of destination or the origin of the funds. Particular attention must also be paid to patterns showing that one and the same person makes multiple transfers of funds over a short period of time to beneficiaries in high-risk geographical areas or, conversely, that one and the same person receives a large number of transfers of funds initiated by different persons.
The due diligence measures must however be taken in various domains in order to address the changing nature of terrorist financing. Indeed, recent events show that transactions are carried out in all countries, without there being any link with conflict areas or with the business relationship.
Changes in a customer's attitude or in the functioning of the business relationship also require specific attention.
2.1.3. Suspicions of financing of the proliferation of weapons of mass destruction
The analysis of atypical transactions and facts must also enable the financial institutions to comply with the provisions of European Law imposing restrictive measures against certain countries in order to fight against the proliferation of weapons of mass destruction and its financing, and in particular with the obligation to report to CTIF-CFI any transaction involving funds for which there are reasonable grounds to suspect that they could be linked to the financing of weapons of mass destruction-related activities or programmes.
The Bank considers that a specific analysis of atypical transactions and facts is required where the characteristics of the funds, in particular their origin and destination, the nature and characteristics of the transactions or of the persons involved in the transaction or business relationship, including the customer, his agents, his beneficial owners or the counterparties to the transactions, have links with the countries concerned or with persons or entities known to be involved in the proliferation of weapons of mass destruction.
Is must be stressed that, in the same way as for the fight against ML or TF, there is no need for the financial institution to be certain or to have evidence that a transaction or funds can be related to the financing of the proliferation of weapons of mass destruction, to consider that this is the case: the fact that there are reasonable grounds to suspect this, is sufficient.
2.2. Responsibilities of the AMLCO
One of the AMLCO's main operational responsibilities is to conduct the above analysis of detected atypical facts and transactions in order to determine whether or not there is a suspicion of ML/FT or whether or not there are reasonable grounds for this suspicion, and whether the facts, funds or transactions concerned should therefore be reported to CTIF-CFI in accordance with Article 47 et seq. of the Anti-Money Laundering Law.
In order to be able to fulfil this responsibility, the AMLCO must have easy access to all information held by the financial institution that is relevant to its analysis.
Contrary to the preliminary analysis described in point 1 above, the analysis to be carried out by the AMLCO pursuant to Article 45 of the Anti-Money Laundering Law may not be limited to the mere validation of the information directly related to the atypical transaction or fact.
The AMLCO is expected to carry out an in-depth analysis of all the information that has been collected as part of the process of detecting atypical facts or transactions and their preliminary analysis, i.e. (i) reportings from either persons who are in direct contact with customers or who are instructed with carrying out their transactions, or the automated monitoring system and (ii) all the information collected and documented as part of the preliminary analysis.
This initial information is usually insufficient to decide whether or not the funds, the transaction or fact should be qualified as suspicious. The analysis of atypical transactions and facts by the AMLCO should generally be more thorough and rely on a wider range of information to support the decision. The NBB therefore expects the AMLCO to appropriately expand the range of information on which he bases his analysis, depending on the circumstances and needs.
To this end he must, for the purpose of his analysis, collect the information available within the financial institution concerning the customer, his risk profile, the business relationship with him - including an overview of the transactions he has carried out over a sufficient period of time, depending on the circumstances - and any relevant background information. However, it is important that the AMLCO be able to collect all the information held by the financial institution, regardless of the service or department of the financial institution that holds it, if it is relevant to properly assess whether or not the atypical transactions or facts considered are suspicious.
Depending on the circumstances, this analysis may also require the reconciliation of the transactions of the customer concerned with those of other customers with whom he appears to have a financial relationship.
In addition to the abovementioned searches for information in the institution's internal databases, the analysis of the facts or transactions concerned may require measures complementary to those already taken in the context of due diligence on business relationships and occasional transactions (see Articles 19 to 41 of the Anti-Money Laundering Law). Such additional measures may include, in particular:
- asking additional information or supporting documents from the customer himself;
- initiating procedures to share information within the group for the purpose of combating ML/FT (see the section “Organisation and internal control within groups”), in order to obtain, in particular, information held by other entities of the group on the transactions or business relationships of that customer with these other entities of the group, their knowledge of that customer, and even, where applicable, their possible suspicions regarding the customer or any reportings of suspicions concerning the customer that they would have addressed to the financial intelligence unit in their country of establishment;
- consulting public sources of information, in particular on the internet,
Attention should be drawn to Article 45 of the Anti-Money Laundering Law, which provides that as part of this analysis, the AMLCO (or members of his team acting under his authority) must examine, as far as possible, the background and purpose of transactions that meet at least one of the following conditions: (i) they are complex, (ii) they are unusually large, (iii) they are conducted in an unusual pattern, and (iv) they do not have an apparent economic or lawful purpose.
As to the purpose of the transactions, financial institutions must try to gain insight into, for example, a legal arrangement, the interdependence of companies or financial movements between different persons. The institution carries out the analysis on the basis of all the information which is at its disposal or to which it has access (search of the beneficial owner, purpose of the transactions concerned, operation of the accounts, etc.).
The scope of the searches and the depth of the analysis may be determined on the basis of the characteristics and importance of the cases examined, but must be sufficient to prevent transactions or facts either from being qualified as suspicious without taking into account important information that was available within the financial institution and that was clearly of such a nature as to remove the suspicion or, conversely, to prevent them from being closed without further action because no account has been taken of information that is nevertheless available, and which, together with the analysis, would constitute reasonable grounds to suspect a link with ML or FT.
As the decision to qualify a transaction or fact as suspicious must result from the analysis described above, financial institutions may not automatically qualify certain transactions or facts as suspicious solely on the basis of predefined objective indicators, without carrying out the required analysis.
Thus, transactions may not be automatically qualified as suspicious without an analysis having been conducted to justify the suspicion, where this suspicion is solely based on:
- a mere assumption concerning the activity of the customer, his address or his country of residence or registration;
- a transaction of a large amount which has been fixed a priori and, more generally, without establishing that it is unusually large taking into account the profile of the business relationship or, in the case of occasional customers, the transactions usually carried out by the institution;
- difficulties between the financial institution concerned and its customer or the latter's conduct, in particular in a personal interview;
- the opening of a judicial inquiry or a request for information from, for example, CTIF-CFI or an administrative or judicial authority;
On the other hand, such indicators appear to be particularly useful in identifying atypical facts or transactions that should be submitted to the AMLCO for analysis.
For example, unusual behaviour by a customer generally does not in itself suffice to establish, without further analysis, a link between his transactions or acts and money laundering or terrorist financing. It may however be a relevant indication to qualify his transactions or acts (including attempted transactions) as atypical, and may thus give rise to an analysis by the AMLCO to determine whether there is a suspicion of ML/FT. In this respect, it is recalled that the internal procedures relating to the due diligence on business relationships and transactions must include in particular appropriate criteria allowing persons who are in direct contact with customers or carrying out their transactions, to detect atypical transactions and facts (see Article 16, 1°, of the Anti-Money Laundering Regulation of the NBB). In this respect, see the page “Policies, procedures, processes and internal control measures”.
Similarly, the fact that the financial institution is informed of the opening of a judicial inquiry into a customer, or the fact that it has received a request for information from, for example, CTIF-CFI or an administrative or judicial authority, does not suffice to automatically consider the transactions carried out by his customer as suspicious without the AMLCO having analysed these transactions to determine whether there are suspicions of ML/FT. Likewise, the observation that the assets of a customer, his agent or beneficial owner are frozen is not sufficient in itself to consider all the transactions of the customer concerned as suspicious, but must lead the financial institution to re-examine the business relationship in greater detail to determine whether certain transactions may be suspected of being linked to terrorist financing.
However, if the AMLCO, after analysing the transactions carried out by a customer, suspects that they are related to ML/FT, the fact that the financial institution has been informed of the opening of a judicial inquiry or even of criminal proceedings against a customer does not exempt it from reporting the suspicious transactions.
For further information see the page “Reporting of suspicions” and the information on that page about reportings made in good faith.
2.3. Result and documentation of the analysis conducted by the AMLCO in a written report
The analysis of the atypical fact or transaction may lead to the case being closed without further action, or to the fact, the funds or the transaction being qualified as suspicious. In both cases, the decision rests with the AMLCO (without the intervention of the senior officer responsible for AML/CFTP).
Since the purpose of this analysis is to determine whether or not suspicious facts, funds or transactions should be reported to CTIF-CFI in accordance with Article 47 of the Anti-Money Laundering Law, financial institutions must ensure that their AMLCO is able to analyse the reportings addressed to them with the required due diligence to ensure that the reporting deadlines set out in Article 51 of the Law can be met (see the page “Reporting of suspicions”). The AMLCO must give priority to the analyses of atypical transactions presenting the most alarming characteristics, in particular in terms of the amounts involved and the nature and likelihood of a possible link with the ML/FT.
Whenever atypical facts or transactions are submitted to the AMLCO for analysis, the latter must document the results of the analysis in a written internal report. In particular, this internal analysis report should make it possible to understand the reasons why the AMLCO has concluded that either there is or there is not a suspicion of ML/FT, to justify his decisions a posteriori and to monitor the effectiveness and relevance of the decision-making process.
In accordance with the principle set out in Article 47, § 1, second paragraph, of the Anti-Money Laundering Law, neither the analysis of the AMLCO nor the written analysis report must however identify the offence underlying the suspicious transaction (see above).
3. Resources and internal control measures
The analysis of atypical facts and transactions as described above to determine whether or not there are suspicions of ML/FT, which must be carried out before suspicious transactions, funds or facts are reported to CTIF-CFI, is a key element of the mechanism to prevent ML/FT that financial institutions are legally required to have.
It is recalled that Article 18 of the Anti-Money Laundering Regulation of the NBB also provides that financial institutions should adopt appropriate procedures enabling them to analyse atypical transactions as soon as possible (see the page “Policies, procedures, processes and internal control measures”).
The NBB also expects financial institutions to provide their AMLCO with the necessary human and technical resources to enable them to carry out this analysis effectively and to adequately follow it up within the deadlines set out by the Law.
Generally, financial institutions are expected to periodically and continuously monitor the effective exercise of AML/CFTP-related tasks by all persons responsible for such tasks within the institution. This also includes all the AMLCO's tasks and responsibilities, in particular his task to analyse atypical transactions. In this respect, see point 3 on the page “Policies, procedures, processes and internal control measures”.
With regard in particular to the supervision of the system for analysing atypical facts and transactions that is implemented by the AMLCO, the NBB recommends that the internal audit function pay particular attention to:
- the effectiveness of the preliminary analysis and analysis of atypical transactions by the AMLCO;
- the adequacy of the work carried out by the AMLCO to collect information as part of his task to analyse atypical transactions;
- the sufficiency of the human and technical resources allocated to the AMLCO to analyse atypical facts and transactions.