The Fifth Pillar of AML BSA Compliance Final

The “Fifth Pillar” of AML / BSA Compliance Final Rule for New Customer Due Diligence The views expressed in this presentation are strictly those of the author and do not necessarily represent the views of BB&T Bank. Carolinas Credit Union League – January 18, 2017

Learning Objectives: At the end of this presentation, participants will be able to: • Articulate the tenets of Fin. CEN's final rule on obtaining and retaining beneficial ownership information; • Position their organizations to comply with the new beneficial ownership rules by offering ideas for any needed changes to processes, procedures or systems; and • List instances where obtaining and retaining beneficial ownership information may be helpful to monitor BSA/AML risk. Carolinas Credit Union League – January 18, 2017

Customer Due Diligence Notice of Proposed Rule Making How We Got Here Carolinas Credit Union League – January 18, 2017

Why The Need For Additional Due Diligence • United Nations identified abuse of illegal entities as an international problem as far back as 1998 • Concern regarding risks with shell companies and trusts identified in 2007 National Money Laundering Strategy • Government Accountability Office (GAO) reports focused on vulnerabilities with company formation in the United States • Department of the Treasury’s attempts to address beneficial ownership challenges through legislation never gained traction Carolinas Credit Union League – January 18, 2017

Why The Need For Additional Due Diligence • Law enforcement has repeatedly reported that major drug trafficking organizations use shell companies to launder drug proceeds • Increased global focus on financial transparency through G 7; G 8; G 20 and FATF • Reliance of FATCA and corresponding foreign approaches to tax reporting on beneficial ownership collected through CDD Carolinas Credit Union League – January 18, 2017

Financial Action Task Force (FATF) • United States was primarily criticized for: o lack of sufficient Customer Due Diligence (CDD) regulatory requirements, particularly for capturing information on beneficial ownership o lack of requirements to collect beneficial ownership information under company formation laws Carolinas Credit Union League – January 18, 2017

The Life Cycle of the Fifth Pillar Step One Initiating Events Step Two ANPR Issued March 2012 Step Three Step Four Step Five Public Outreach Fall of 2012 Publication of Proposed Rule August 2014 Public Comment October 2014 Carolinas Credit Union League – January 18, 2017 Step Six Issue of Final Rule July 11, 2016

Actions on CDD and Beneficial Ownership • Interagency Guidance—compilation of regulations, rulings and guidance covering CIP, private banking & correspondent banking was issued in 2010 • Advanced Notice of Proposed Rule issued in March 2012 • The Final Rule for the establishment of a risk based Customer Due Diligence program was imposed July 11, 2016 • Covered financial institutions must be fully compliant by May 11, 2018 Carolinas Credit Union League – January 18, 2017

Customer Due Diligence Requirements for Covered Financial Institutions Considerations for the Final Rule Carolinas Credit Union League – January 18, 2017

• Understand the tenets of the new rule • Begin to examine how the new rule will affect your institution o What processes and departments will be impacted? o What will need to be updated? Policies, procedures, job aids, training programs? o What systems are involved? Do I need to rely on outside vendors or internal systems for compliance? Do I have the right systems? o How will I prepare people for the changes? Are these significant or minor changes? • Build a coalition of affected stakeholders • Begin to develop a plan, and provide internal education to your stakeholders Carolinas Credit Union League – January 18, 2017

Customer Due Diligence Requirements for Covered Financial Institutions Key Elements of the New Regulation Carolinas Credit Union League – January 18, 2017

Key Elements (1 of 6) 1. Applicability Date: Implementation period extended from one to two years. 2. Applicability of beneficial ownership requirement to existing accounts: Rule maintains risk-based approach to identifying and verifying the identity of beneficial owners for existing accounts. 3. BO identification and certification form: Rule provides Certification Form (Appendix A) as an option rather than requirement; certification to the best of the certifying person’s knowledge required. Carolinas Credit Union League – January 18, 2017

Two “Prongs”: Ownership Control Carolinas Credit Union League – January 18, 2017 Identify “Natural Persons” with 25% or more Ownership of the “Legal Entity” Identify at least One Individual with Responsibility to Control, Manage or Direct the “Legal Entity”

Standard Certification Form Information Requirement (Appendix A of Fin. CEN document) TOP PORTION OF FORM – OWNERSHIP PRONG • Name and Title of Natural Person Opening Account • Name and Address of Legal Entity for Which the Account is Being Opened • Following info, each PERSON with 25% or more equity interest: o o o Name DOB Address: residential or business STREET address For U. S. persons: SSN For foreign persons: Passport # and Country of Issuance, or other similar ID # Page 1 of 3 of Form Carolinas Credit Union League – January 18, 2017

Standard Certification Form Information Requirement (Appendix A of Fin. CEN document) FORM CONTINUED – CONTROL PRONG Information for one individual with significant responsibility for managing the legal entity: • An executive officer or senior manager (e. g. , Chief Executive Officer, Chief Financial Officer, Chief Operating Officer, Managing Member, General Partner, President, Vice President, Treasurer); or • Any other individual who regularly performs similar functions. o o o Name / Title DOB Address: residential or business STREET address For U. S. persons: SSN For foreign persons: Passport # and Country of Issuance, or other similar ID # Carolinas Credit Union League – January 18, 2017 Page 2 of 3 of Form

Standard Certification Form Information Requirement (Appendix A of Fin. CEN document) FINAL PORTION OF FORM Attestations: I, ________ (name of natural person opening account), hereby certify, to the best of my knowledge, that the information provided above is complete and correct. Signature: _______________ Date: ______ Legal Entity Identifier ______ (Optional) Carolinas Credit Union League – January 18, 2017 Page 3 of Form

Key Elements (2 of 6) 4. BO verification of identity: Rule allows FIs to generally and reasonably rely on copies in the case of documentary verification and only requires elements of CIP rule rather than identical procedures. 5. BO verification of status: Rule clarifies that FIs may generally and reasonably rely on certification of the customer. 6. Use of BO information: Rule clarifies that FIs should use BO information as they use CIP information to facilitate compliance with other requirements (e. g. , sanctions screening and CTR aggregation reporting), except for 314(a) information-sharing requests. Carolinas Credit Union League – January 18, 2017

Key Elements (3 of 6) 7. Definition of Beneficial Owner: • Clarifies that information collected is a snapshot subject to risk-based updates; • Maintains ownership prong at 25% direct or indirect ownership by natural person; • Maintains control prong; • Establishes a trustee as the BO in cases where a trust owns 25% or more of a legal entity customer. Carolinas Credit Union League – January 18, 2017

Key Elements (4 of 6) 8. Legal Entity Customer: Rule further clarifies that entities that fall within this definition include a corporation, LLC, or other entity created by the filing of a public document with a Secretary of State or similar office; a general partnership, and any similar entity formed under the laws of a foreign jurisdiction, that opens an account. Rule maintains exclusion of trusts, sole proprietorships or unincorporated associations. 9. Account: Rule refers to definition used in CIP rules, which excludes ERISA accounts. 10. Legal Entity Customer Exclusions: • Adopts all ten exclusions from NPRM except Charities and Nonprofit Entities, which are now subject to the control prong of the BO definition; • Expands exclusions to include the following additional regulated entities: (i) Bank Holding Companies; (ii) Pooled Investment Vehicles Operated or Advised by an Excluded FI; (iii) State Regulated Insurance Companies; and (iv) Financial Market Utilities designated by the FSOC; Carolinas Credit Union League – January 18, 2017

Key Elements (5 of 6) 11. Legal Entity Customer Exclusions (cont. ): Expands exclusions to include the following foreign entities: (i) Foreign FIs where the relevant foreign regulator holds BOI; Non-U. S. Governmental Subdivisions that engage only in governmental rather than commercial activities; • Expands exclusions to include any Legal Entity Customer only to the extent that it opens a private banking account; • Only requires FIs to obtain BOI under the control prong of the BO definition for Non-excluded Pooled Investment Vehicles; • • Clarifies that the Intermediary is the customer in intermediated accounts and that the BO requirement applies to the intermediary rather than the intermediary’s customers (BOI is not KYCC); • Treats Escrow and Client Trust Accounts as intermediary accounts; Carolinas Credit Union League – January 18, 2017

Key Elements (6 of 6) 12. Covered Financial Institutions: Rule confirms coverage of CIPcovered FIs; need for and interest in dialogue with other types of FIs to appropriately consider possible extension of CDD requirements. 13. New Account Exemptions: Rule exempts: • • Private Label Retail Credit Accounts Established at the Point-of-Sale and with credit limits up to $50, 000, but not for cards co-branded with major credit card associations; Accounts Established to Purchase and Finance Postage; Commercial Accounts to Finance Insurance Premiums; and Accounts to Finance the Purchase or Lease of Equipment subject to third party payment and cash refund prohibitions. Carolinas Credit Union League – January 18, 2017

CDD /Beneficial Ownership Tools Carolinas Credit Union League – January 18, 2017

NIST Cybersecurity Framework Carolinas Credit Union League – January 18, 2017

Money Laundering Process - Review Carolinas Credit Union League – January 18, 2017

Sidebar: Some Additional Terminology ‘Perplexity through use of a Fraudulent Company’ § Shell: Legal entity without assets § Shelf: Legal entity formed/registered but not yet used § Front: Legitimate business adding illicit funds to earnings Carolinas Credit Union League – January 18, 2017

Transaction Monitoring for ‘Bene’ CHALLENGES VARYING FORMATS FEDWIRE VARIANCE IN DATA CONTENT AML 4 “V’s” Volume Velocity Value Variance Carolinas Credit Union League – January 18, 2017 CHIPs

Transaction Monitoring for Beneficial Ownership Payment Monitoring → Automation Tools Compliance Processes: Payments Inputs: - Core Systems o DDA/SVG o Treasury Systems o CIF/PII Sources o Online Banking o Mobile/Other o Card (Credit/Debit) o Internal Transacting o Etc. - External o Other FI’s o Card Networks o Electronic Networks o Etc. - BSA/AML Program o Transaction Monitoring o CDD o EDD o CIP o OFAC, Sanctions, etc. - Payment Software Applications Carolinas Credit Union League – January 18, 2017 Beneficial Ownership o Customer Data o Customer Activity o Related Activity (i. e. between entities)

Key Takeaways (1 of 3) 1. Final Rule is substantially similar to the Proposed Rule and retains a risk-based approach supported by clear baseline requirements. 2. Beneficial Ownership is an Extension of CDD/CIP. 3. Look for Cybersecurity Integration to BSA/AML. 4. Transactions are an Important Component – Use cases: • Payment data details can be used to enhance efforts; • “Data in Transit” is an opportunity to support compliance. Carolinas Credit Union League – January 18, 2017

Key Takeaways (2 of 3) 5. Unprecedented BSA regulatory development, outreach and preparation efforts preceding issuance of the Final Rule. 6. Significant percentage of covered FIs already implementing beneficial ownership requirements. 7. Extended implementation period provides FIs with the time to adapt IT systems, training, onboarding systems and processes, policies and procedures, and educate customers as necessary to comply with Final Rule. Carolinas Credit Union League – January 18, 2017

Key Takeaways (3 of 3) 8. Implementation of Final Rule does not rely upon but will benefit from Congressional legislation enacting meaningful company formation reform regarding beneficial ownership information. 9. Active support from the financial services industry needed to facilitate Congressional legislation enacting meaningful company formation reform. 10. Compliance function should capitalize on the rule to strengthen risk management and the compliance culture across their institutions. Carolinas Credit Union League – January 18, 2017

Carolinas Credit Union League – January 18, 2017

• Resources https: //www. financialservicesperspectives. com/2016/07/the-fifth-pillar-of-amlbsacompliance-fincen-issues-final-rule-for-new-customer-due-diligence-requirementsunder-the-bank-secrecy-act/ http: //www. bankerstoolbox. com/wp-content/uploads/wpaper_CDD_newrule. pdf http: //www. fatfgafi. org/topics/fatfrecommendations/documents/internationalstandardsoncombating moneylaunderingandthefinancingofterrorismproliferationthefatfrecommendations. html Carolinas Credit Union League – January 18, 2017