ICA International Diploma in Financial Crime Assignment 1

International
Diploma in
Financial
Crime
Prevention
Assignment 1
Student ID: CON- 000229948
Date: 22 January 2018

International Diploma in Financial Crime Prevention
Table of Contents
Executive Summary ....................................................................................................................... 3
1. INTRODUCTION ......................................................................................................................... 4
1.1. Financial Crime Prevention Framework........................................................................................ ...4
2. ROLES AND RESPONSIBILITIES ............................................................................................ 4
2.1. Board of Directors........................................................................................................................... .4
2.2. Senior Management ......................................................................................................................... 5
2.3. Financial Crime Prevention Unit .................................................................................................... 5
3. DETECTION AND PREVENTION OF FINANCIAL CRIME ............................................... 8
3.1 Whistleblowing Program…………………………………………………………………………...8
3.2. Transaction Monitoring and Analysis……………………………………………………………..8
3.3. Policies and Procedures…………………………………………………………………………....8
3.4 Training……………………………………………………………………………………………..9
3.5 Employment Screening……………………………………………………………………………..9
3.6. Enterprise-Wide Risk Assessment (“EWRA”) ……………………………………………….…...9
3.7 Risk-Based Approach (“RBA”) …………………………………………………………………....9
3.8 Customer Due Diligence (“CDD”)…………. ……………………………………………………10
3.8.1 On-boarding ……………………………………………….....................................................10

3.8.2 On-going monitoring…………………………………………………………………………12
3.9 On-going Transaction Monitoring……………………………………………………………….13
4. Appendix 1- Data and Information Security…………………………………………………14

5. Appendix 2- Private Banking Customers and PEPs…………………………………………18
6. References……………………………………………………………………………………….19
Assignment One Page 2

Executive Summary
This report highlights the Bank’s overall financial crime prevention framework. It highlights the key
responsibilities of the Financial Crime Prevention (“FCP”) team and methods to detect and prevent
financial crime in a small branch of an offshore bank in Singapore.
In PwC’s Global Economic Crime Survey 2016, cybercrime, money laundering and bribery and
corruption were among the top five economic crimes in Singapore. Cybercrime and money laundering
rose to 43% and 26% respectively, as compared to 15% and 5% respectively in 2014.
In order to manage financial risk more effectively, it is important for the Bank to have a well-
established Financial Crime Prevention Framework.

1. INTRODUCTION
1.1. Financial Crime Prevention (“FCP”) Framework
The main objective of FCP Framework is to provide the Bank guidance in detecting, preventing and
deterring financial crimes. It outlines the Bank’s exposure to the risks in relation to the financial
crimes and controls.
The framework shall be reviewed and updated annually and whenever there are new legal &
regulatory developments. Changes will be approved by the senior management and Head Office
before circulating to all Bank’s employees.
2. ROLES AND RESPONSIBILITIES
The Senior Management (“SM”) and every employee bear the responsibility of preventing financial
crime and complying with the laws, regulations and Bank’s policies and procedures.
The Bank employs three lines of defence approach in mitigating risks. The ultimate responsibility and
accountability for ensuring compliance rests with the Board of Directors and SM.
2.1. Board of Directors (“Board”)
The Board has to account to the stakeholders for the long-term sustainability and financial success of
the Bank. The main responsibilities of the Board in FCP include:
(a) Ensuring adequate corporate governance frameworks and systems are in place;

(b) Setting a tone for corporate culture and values;

(c) Ensuring compliance with laws and regulations;
(d) Overseeing the execution of the Bank’s overall strategic direction.
2.2. Senior Management (“SM”)
The SM bears the responsibility for the Bank’s day-to-day operations. The SM’s main responsibilities
in FCP include:
(a) Ensuring strong governance and sound risk management and controls;
(b) Ensuring adequate risk mitigating measures are in place;
(c) Setting a right tone to ensure a strong compliance culture;
(d) Approving new and continuous relationships of high risk customer;
(e) Endorse and oversee the implementation of an effective FCP framework.
2.3. Financial Crime Prevention Unit
The main responsibility of FCP Unit is to mitigate the risks of financial crime and consists of the
following functions:
1) Anti-Money Laundering (“AML”)/Counter Financing of Terrorism (“CFT”)

2) Policies, procedures and management information
3) Fraud/bribery and corruption.
AML/CFT Function
The AML/CFT function ensures that the Bank would not be exploited for money laundering and
terrorist financing purposes.
The AML/CFT function responsibilities include:
(a) Developing and implementing a robust AML/CFT programme:

a. Work with Policies and Procedures Officer to establish and implement AML/CFT
policies and procedures;
b. Establish internal controls to ensure that appropriate measures are in place;
c. Conduct AML/CFT training;
d. Perform compliance testing and monitoring.
(b) Conducting Customer Due Diligence (“CDD”);
(c) Transaction and on-going monitoring;
(d) Suspicious transactions investigation and reporting;
(e) Providing advices to BUs.

Case Study
In 2016, MAS fined Standard Chartered Bank S$5.2 million in relation to 1-MDB fund flows.
Investigations showed that there were significant lapses in the Bank’s CDD measures and controls
for ongoing monitoring, deficiencies in policies and procedures, inadequate independent oversight
of front office staff and a lack of awareness of money laundering risks among employees.
Although there are policies and procedures in place to ensure that CDD has been conducted
effectively, there are uncontrollable factors whereby the AML/CFT officer has no control. One
example is when the Bank requests for valid duly certified documents and information like source of
wealth and beneficial ownership but to no avail. This often results in the officer having to investigate
and escalate the case to SM to make a decision on whether to continue or exit the relationship. In
some cases, de-risking could be one of the options, which will result in unnecessary loss of business.
Policies, Procedures and Management Information (“PPMI”) Function
The PPMI function sets clear communication regarding acceptable behaviour and best practices in the
Bank.
The PPMI function has the following responsibilities:
(a) Develop and implement policies and procedures that set out the principles and controls to in
relation to financial crimes;
(b) Review and update the policies and procedures annually;
(c) Provide SM with information to understand the financial crime risks the Bank is exposed to
help them manage those risks;
(d) Understand the Bank’s financial crime systems and controls’ effectiveness;
(e) Obtain information such as number of:
a. high-risk customers and their justifications;
b. STRs filed;
c. customers with PEPs relationship.
(f) Identify the Bank’s information needs and collection of these information in relation to
financial crimes;
(g) Management, storage and distribution of information;
(h) Management reporting for management’s decision-making;
(i) Using information to detect any non-compliance and preventing financial crimes at the
earliest possible time;

(j) Ensure the security, accessibility and quality of the information1.
Although policies and procedures are in place, it is difficult to measure the application of them and
the compliance by employees.
The main challenge to information management includes having too much information and ensuring
the credibility of them to make sound decisions. This can be time-consuming. Having little or no
information is a challenge as the Bank has insufficient information to make decisions.
Case Study
In 2014, the Financial Conduct Authority fined Standard Bank PLC for weaknesses in
application of their AML policies and procedures. ECDD was not performed before
establishment of relationships with corporate customers with PEP relationship and due
diligence was not up-to-date. These resulted in an unacceptable risk of Standard Bank being
used to launder proceeds of crimes.
Fraud/Bribery and Corruption (“FBC”) Function
The FBC function is to combat and reduce instances of fraud, bribery and corruption.
The FBC function has the following responsibilities:
(a) Developing and implementing a fraud-awareness;

(b) Develop an anti-fraud policy, fraud response plan and effective personnel policy;
(c) Establishing a robust fraud-averse culture;
(d) Designing and review systems to combat bribery and corruption.
Despite having bribery and corruption program in place, it is sometimes difficult to measure what
constitutes a bribe. Moreover, whistleblower must report such incidents in order for the FBC unit to
investigate. However, they may not do so if their safety is threatened.
Case Study
In 2014, Singapore’s Corrupt Practices Investigation Bureau’s former assistant director was
jailed for 10 years for criminal breach of trust for misappropriating $1.76 million. Edwin Yeo,
Head of Field Research and Technical Support, was responsible for CPIB’s operational
expenses by using the cash cheques issued by CPIB’s administration and support department.
He then pocketed the funds and used them for personal uses such as gambling at the casinos.
He would use the next sum available to him to cover for the previous sum he has pocketed.
1
Refer to Appendix 1 for mitigation of data and information security risks.

3. DETECTION AND PREVENTION OF FINANCIAL CRIME
3.1. Whistleblowing Program
The Bank shall not withstand any abuse of authorities, misconduct, fraud and corruption. The
whistleblowing program aims to promote responsible and secure whistleblowing without fear of
adverse consequences and encourage anyone to raise any illegal or immoral practice.
The reporting of issues can be done through whistleblowing hotline, email or letter to Whistleblowing
Committee.
Whistleblowers may choose to remain anonymous although it is highly recommended that they do not
do so to increase the credibility and efficiency of the investigation. The Whistleblowing Protection
Program protects whistleblower and treats reports confidential.
Case Study
In July 2017, Wells Fargo & Co was ordered by the US Department of Labor to pay $575,000
and to rehire a whistleblower that the Bank had dismissed in September 2001. The
whistleblower whistleblew over opening of customer accounts without their knowledge.
Wells Fargo was fined in 2016 for opening up to 2.1 million customer accounts without their
knowledge.
3.2. Transaction Monitoring and Analysis
Transactions processed by the Bank shall be scrutinised and transactions deemed suspicious shall be
escalated to the FCP department. The FCP department and SM shall evaluate them and consider if the
need to filing of STR. The basis for its determination shall be documented.
Suspicious transactions shall be reported to the Suspicious Transactions Reporting Office (“STRO”)
and MAS within 15 days from the time the transaction is raised, unless during exceptional
circumstances.
Records of all transactions, whether suspicious or not, needs to be documented and filed together with
all internal findings and analysis in the customer’s file.
3.3. Policies and Procedures
The Bank shall have up-to-date policies and procedures that provide guidance and spells out the
Bank’s approach to complying with its legal and regulatory requirements in relation to financial
crimes. The policies and procedures shall be reviewed and updated annually. The effectiveness shall
be monitored by the internal audit department.

3.4. Training
The Bank provides training for new employees within the first month of their employment and
tailored training to each department. This ensures that employees have adequate and latest knowledge.
All employees shall take Compliance Regulations Test semi-annually to monitor the training’s
effectiveness and test their understanding on the Bank’s policies and procedures, including their
obligations under the relevant laws and regulations.
3.5. Employment Screening
Employment screening is the first line of defence against financial crimes. Qualifications and
reference checks shall be duly conducted and verified.
Background searches and criminal record checks shall be conducted for candidates. These include
directorship, credit and media searches.
3.6. Enterprise-Wide Risk Assessment (“EWRA”)
The Bank shall identify and assess the risks on an enterprise-wide level. The EWRA allows the Bank
to understand its vulnerability to the risks and allocate the Bank’s resources efficiently.
The Bank shall perform EWRA in relation to:
(a) Its customers;

(b) The geographies of customers;
(c) The products, services, transactions and delivery channels of the bank.
3.7. Risk-Based Approach (“RBA”)
The Bank shall adopt RBA to identify, assess and document the risks to assess the Bank’s risk
exposure to the customer and take the appropriate mitigation measures in accordance with the risks.
RBA is used in due diligence and monitoring to allow the Bank to allocate resources effectively.
Under the RBA, the Bank conducts:
(a) Risk identification and assessment;

(b) Risk mitigation;
(c) Risk monitoring;
(d) Documentation.

3.8. Customer Due Diligence (“CDD”)
The Bank collects customers’ information during on-boarding, on periodic basis and whenever
required. By knowing our customer, the Bank can detect any unusual behaviour or transaction that
differs from CDD and prevent establishing relationship with any prohibited customers.
The Bank adopts a RBA framework based on the key aspects of the customer’s profile.
3.8.1 On-boarding

During on-boarding, the Bank shall:
(a) Identify and verify the identity of customers;

(b) Perform PEP, adverse news and sanctions screening;
(c) Perform risk assessment and categorisation.
Identification
The Bank must obtain minimally the following for identification purposes:
Natural Persons Legal Person or Legal Arrangement

Full name, including any aliases
Unique Identification Number Business Registration Number
Residential Address Business Address and Principal Place of Business
Date of Birth Date of Incorporation
Nationality Place of incorporation
The legal form, constitution and powers that

regulate and bind the legal persons or
arrangement
Identify the connected parties of the customer, by
obtaining minimally:
(a) Full name, including aliases; and
(b) Unique identification number.
Identification of Beneficial Owner (“BO”)
The Bank shall identify and inquire the presence of BO of a customer. The following serves as a guide
for identifying BO:
(a) Natural person owning more than 25% of the customer;

(b) Natural person owning less than 25% of the shares but have executive authority in the
customer;
(c) The Bank shall treat the government of the jurisdiction as the BO if it is a 100% government-
owned entity,
For customers who are not natural persons, the Bank shall understand the business nature and
ownership structure.

Verification
The Bank shall verify the identity of the customer using reliable and independent sources. The Bank
may obtain the following for verification purposes:
(a) Individuals: Valid national identity card or passport;

(b) Legal persons: Documentary evidence that organisation exists or equivalent document;
(c) Legal arrangements: documentary evidence of trust formation and existence or equivalent
document.
Residential proof of no less than 3 months shall be obtained for all Authorised Signatories of the
account.
All documents shall be duly certified by a suitably qualified person or sighted original by the Bank’s
employee.
Screening
CDD Screening
All customers and connected persons shall be screened against the criminal, sanctions and PEP lists
by the Bank’s internal screening system and Dow Jones.
Wire Transfer Screening
All wire transfer originators and beneficiaries shall be screened. The Bank shall block or reject any
transactions should there be any true hit in the name screening.
All false positives shall be cleared by FCP and properly documented and filed in the customer’s file.
Decision
ECDD shall be conducted for high risk customers, including PEPs and Private Banking (“PB”)
customers2. All high-risk relationships must be approved by senior management for establishment or
continuing relationship.
3.8.2 On-going monitoring
On-going review
The Bank shall ensure that KYC documents and information are relevant and up-to-date to identify
any changes to existing customer’s risk profile.
2
Refer to Appendix 2.

Risk Grade Frequency of review

Low Every 3 years or upon a triggering event.
Medium Every 2 years or upon a triggering event.
High Annually or upon a triggering event. PEP accounts are to be reviewed on a
semi-annual basis.
In the case where the review is not completed by due date, reasons for extension and mitigating
factors shall be approved by the SM.
3.9. On-going Transaction Monitoring
The Bank shall scrutinise all transactions using the Bank’s transaction surveillance systems to ensure
that transactions conducted by customers are consistent with their business and risk profile and
identify any suspicious transactions.
The bank shall monitor all transactions by each customer daily. Monthly transaction monitoring shall
be conducted to compare 6-month average total transaction amount and count. Should any month’s
transaction exceeds the 6-month average’s total by 10%, further review shall be conducted by the FCP
Unit and submitted to the SM for review and approval.
In conjunction with the on-going review, the Bank shall use graphs to compare the trend of the
customer’s transactions over the review period. The factors to be reviewed by plotting a graph will
include transaction amounts and counts of transactions.
Transactions flagged out by the systems will be escalated and investigated by FCP Unit. When
deemed suspicious, they will be escalated to the SM to approve the filing STR with the authorities.
All parameters and threshold will be reviewed and updated annually to ensure relevance to the Bank’s
business model and customer profile.

Appendix 1- Data and Information Security
The Bank has massive information and data with varying degrees of sensitiveness. The Bank has
established an Information Security framework to ensure that data and information security risks are
mitigated.
Data Classification
The Bank classified the data into the following categories in order of importance:
Classification Description Security Level

Confidential Unauthorised disclosure can seriously Very High
impede the Bank’s operations and harm
the interests of the Bank or its
employee(s).
Information should not be copied or

removed from the Bank and usually be
restricted to Board and senior
management.
Sensitive Disclosure may lead to limited legal High
liability.
Information is usually restricted to

authorised personnel only.
Restricted Disclosure would result in inconvenience Normal but controlled
and disadvantage to the Bank or its
employee(s).
Information is not allowed for circulation

outside the Bank and usually restricted to
junior and middle managers or above.
Public Disclosure is not likely to affect or cause Low
any harm.
Based on the classification of data, the Bank shall put in place measures accordingly to protect them.
Case Study

In July 2016, MAS probed United Overseas Bank regarding its unshredded customers’ data
found in a trash bag under a tree. MAS mentioned that Banks are expected to have measures
in place to safeguard customer’s information and will not hesitate to take action should there
be any breaches.
Roles and Responsibilities
Roles Responsibilities
Senior Management  Oversees and protects of the Bank’s resources
 Familiar with the risks involved and approve and direct the
security program.
Data Owner  Creates, classifies and stores the information
 Periodically reviews the data classification to ensure relevance
 Protects data by ensuring appropriate measures and controls are in
place.
Data Custodian  Responsibilities include periodic data backups, implementation of
security mechanisms and restoration of data from backup.
Data User  Uses the required data and information as part of job.
 Responsible for using the data securely
 Adhere to operational security to ensure the confidentiality,
integrity and availability of data.
Policies and Procedures
The Bank’s IT policy specifies the IT framework and structure. The IT procedure is more detailed and
translates the policy into acceptable work practices and behaviour of all employees.
Physical access controls
Access to computer-based storage or information system shall be granted only to authorised personnel
by means of access cards. Access card must be disabled in a timely manner when:
(a) Employee resigns;

(b) Card is reported stolen or lost;
(c) Employee changes roles.
Portable Media Devices (“PMD”)

Employees are not allowed to use personal PMD in the Bank. Only Bank-issued PMD with
encryption and password-protection capabilities shall be used when necessary and shall not be
brought out of the Bank’s premises.
Computer Records
The Bank has computer systems in place which can create and record the activities and usage of the
systems. Information to be recorded includes but not limited to:
(a) Users of the systems;

(b) Date and time of usage;
(c) Details of what was done in the system.
This allows an audit trail to be created and becomes useful whenever evidence is needed.
Internet Access
Any sites deemed to pose a risk to the Bank shall be blocked. They include social networking sites
and personal email sites.
If employee requires access to blocked sites for work purposes, such as financial crime roles, requests
should be approved by senior management.
Disposal of Physical and Electronic Waste
Any sensitive information that is no longer required shall be shred. The Bank’s shredder shall comply
with the recognised industry standards for shredding security levels.
To dispose electronic data, the Bank shall use overwrite all previously stored data with meaningless
information. For highly sensitive information, the Bank shall degauss the drive.
Staff Training
Periodic bank-wide training shall be provided to boost staff awareness and reiterate the importance of
the IT policies and procedures. The training shall include methods and ways to mitigate data and
information security risks.
User Profile
Staff shall not have access to customer data if they do not require these data to perform their duties.
Access rights shall be reviewed when a new employee joins the Bank and be terminated when a staff
changes role and suspended when a staff resigned. Independent checks are required when access
rights are given or amended at any stage.

Other access control requirements and methods
All employees shall:
(a) Ensure that their computers are locked when they are away from their work station;
(b) Observe a clean-desk policy and keep all documents locked;
(c) Print of confidential documents using a password and to collect the documents immediately
when using shared printers.

Appendix 2- Private Banking (“PB”) Customers and Politically Exposed Persons (“PEPs”)
PB customers are high net-worth customers’ with large amount of assets. BUs are required to conduct
name screening for all customers and BOs to identify if there are PEPs or Relatives/ Close Associates
(“RCAs”). ECDD must be conducted for all PEPs and RCAs.
Identification and Verification of Identity
The bank shall identify each customer and BOs, and verify their identity as per Section 3.8.1. On-
Boarding Verification.
In PB relationship, BO refers to an individual who:
(a) have ultimate control or entitlement to the funds in the account and allows them to move and
manage the account; and/or
(b) the ultimate source of funds for the account.
Enhanced Due Diligence (“ECDD”)
As they are more vulnerable with regards to financial crime due to higher inherent risks, BUs must
conduct additional ECDD by obtaining minimally:
(a) Purpose of account;

(b) Source of Wealth (where the wealth accumulated);
(c) Source of Funds (origin of funds for account opening);
(d) Anticipated account activity;
(e) Estimated net worth;
(f) Sources to corroborate source of wealth and funds.
The Bank shall perform independent verification on the source of wealth to ensure that it is legitimate.
The case shall be escalated to the SM should BUs be unable to make a definitive assessment of the
customer.
Additional enhanced measures include:
(a) Obtaining approval from SM for the on-boarding and/or continuing relationship with the
customer;
(b) All transactions conducted must be screened;
(c) ECDD conducted semi-annually or whenever there is a material change in the customer;
(d) Name and adverse news screening monthly.
References

Anshuman Daga and Marius Zaharia. (2016, Dec 2). Singapore slaps penalties on StanChart, Coutts
in 1MDB-related probe. Retrieved from https://www.reuters.com/article/us-malaysia-scandal-
singapore/singapore-slaps-penalties-on-stanchart-coutts-in-1mdb-related-probe-idUSKBN13R06F.
(accessed: 10 Dec 2017)
Author unknown. (2017-2018). The AML KYC Onboarding Lifecycle Process Flow – 2017-2018
Guide and Overview. Retrieved from https://www.advisoryhq.com/articles/the-aml-kyc-onboarding-
lifecycle-process-flow/ (accessed: 22 Dec 2017)
Dan Freed. (2017, Jul 22). Wells Fargo ordered to pay $575,000, reinstate whistleblower. Retrieved
from https://www.reuters.com/article/us-wells-fargo-accounts-whistleblower/wells-fargo-ordered-to-
pay-575000-reinstate-whistleblower-idUSKBN1A62AV. (accessed: 28 Dec 2017)
Elena Chong. (2014, Feb 20). Ex-CPIB assistant director Edwin Yeo jailed 10 years for criminal
breach of trust. Retrieved from http://www.straitstimes.com/singapore/ex-cpib-assistant-director-
edwin-yeo-jailed-10-years-for-criminal-breach-of-trust. (accessed: 12 Nov 2017)
Jamie Lee. (2016, Jul 19). MAS probes case of UOB's unshredded client data. Retrieved from
http://www.straitstimes.com/business/companies-markets/mas-probes-case-of-uobs-unshredded-
client-data. (accessed: 28 Dec 2017)
Monetary Authority of Singapore. (2013). Board and Senior Management. Retrieved from
http://www.mas.gov.sg/~/media/MAS/Regulations%20and%20Financial%20Stability/Regulatory%20
and%20Supervisory%20Framework/Risk%20Management/Board%20and%20Senior%20Mgmt_1%2
0Apr%202013.pdf. (accessed: 30 Oct 2017)
Monetary Authority of Singapore. (2015). Guidelines to MAS Notice 626 on Prevention of Money
Laundering and Countering the Financing of Terrorism. Retrieved from
http://www.mas.gov.sg/~/media/MAS/Regulations%20and%20Financial%20Stability/Regulatory%20
and%20Supervisory%20Framework/Anti_Money%20Laundering_Countering%20the%20Financing
%20of%20Terrorism/Guidelines%20to%20MAS%20Notice%20626%20%20April%202015.pdf.
(accessed: 30 Oct 2017)
Monetary Authority of Singapore. (2016, Dec 2). MAS Imposes Penalties on Standard Chartered
Bank and Coutts for 1MDB-Related AML Breaches. Retrieved from http://www.mas.gov.sg/news-
and-publications/media-releases/2016/mas-imposes-penalties-on-standard-chartered-bank-and-coutts-
for-1mdb-related-aml-breaches.aspx (accessed: 5 Dec 2017)

PwC. (2016). Economic crime remains an obstinate threat in Singapore. Retrieved from
https://www.pwc.com/sg/en/consulting/assets/economic-crime-
survey/economic_crime_survey_2016_singapore.pdf. (accessed: 11 Jan 2018)

ICA International Diploma in Financial Crime Assignment 1

Enviado por

Dados do documento

Direitos autorais

Formatos disponíveis

Compartilhar este documento

Compartilhar ou incorporar documento

Opções de compartilhamento

Leia este documento em outros idiomas

Você considera este documento útil?

Este conteúdo é inapropriado?

Direitos autorais:

Formatos disponíveis

ICA International Diploma in Financial Crime Assignment 1

Enviado por

Direitos autorais:

Formatos disponíveis

International

Student ID: CON- 000229948

Date: 22 January 2018

1.1. Financial Crime Prevention Framework........................................................................................ ...4

2. ROLES AND RESPONSIBILITIES ............................................................................................ 4

2.1. Board of Directors........................................................................................................................... .4

2.2. Senior Management ......................................................................................................................... 5

2.3. Financial Crime Prevention Unit .................................................................................................... 5

3. DETECTION AND PREVENTION OF FINANCIAL CRIME ............................................... 8

3.1 Whistleblowing Program…………………………………………………………………………...8

3.2. Transaction Monitoring and Analysis……………………………………………………………..8

3.3. Policies and Procedures…………………………………………………………………………....8

3.5 Employment Screening……………………………………………………………………………..9

3.6. Enterprise-Wide Risk Assessment (“EWRA”) ……………………………………………….…...9

3.7 Risk-Based Approach (“RBA”) …………………………………………………………………....9

3.8 Customer Due Diligence (“CDD”)…………. ……………………………………………………10

3.8.1 On-boarding ……………………………………………….....................................................10

4. Appendix 1- Data and Information Security…………………………………………………14

Assignment One Page 2

Assignment One Page 3

1.1. Financial Crime Prevention (“FCP”) Framework

2. ROLES AND RESPONSIBILITIES

2.1. Board of Directors (“Board”)

Assignment One Page 4

(b) Setting a tone for corporate culture and values;

2.2. Senior Management (“SM”)

2.3. Financial Crime Prevention Unit

1) Anti-Money Laundering (“AML”)/Counter Financing of Terrorism (“CFT”)

The AML/CFT function responsibilities include:

(a) Developing and implementing a robust AML/CFT programme:

Assignment One Page 5

Policies, Procedures and Management Information (“PPMI”) Function

The PPMI function has the following responsibilities:

Assignment One Page 6

(j) Ensure the security, accessibility and quality of the information1.

Fraud/Bribery and Corruption (“FBC”) Function

The FBC function has the following responsibilities:

(a) Developing and implementing a fraud-awareness;

Assignment One Page 7

3. DETECTION AND PREVENTION OF FINANCIAL CRIME

3.1. Whistleblowing Program

3.2. Transaction Monitoring and Analysis

3.3. Policies and Procedures

Assignment One Page 8

3.5. Employment Screening

3.6. Enterprise-Wide Risk Assessment (“EWRA”)

The Bank shall perform EWRA in relation to:

(a) Its customers;

3.7. Risk-Based Approach (“RBA”)

Under the RBA, the Bank conducts:

(a) Risk identification and assessment;

Assignment One Page 9

3.8. Customer Due Diligence (“CDD”)

Assignment One Page 10

During on-boarding, the Bank shall:

(a) Identify and verify the identity of customers;

Natural Persons Legal Person or Legal Arrangement

Residential Address Business Address and Principal Place of Business

Date of Birth Date of Incorporation

Nationality Place of incorporation

The legal form, constitution and powers that

Identification of Beneficial Owner (“BO”)

(a) Natural person owning more than 25% of the customer;