AML/FT & KYC Policies Overview
DEFINITIONS
All capitalized terms in this Policy shall have the meanings listed below:
“ABR”, “risk-based approach”, means the methodology whereby financial institutions and other regulated entities assess and mitigate money laundering and terrorist financing risks based on the identification, assessment, and understanding of the risks to which they are exposed, applying enhanced due diligence measures proportionate to the level of risk identified;
“Affiliate” means, in relation to ATTRUS, any Subsidiaries, Parent Companies, companies under common control and other companies that are part of its economic group;
“AML/CFT” means prevention of the practice of Money Laundering and Terrorist Financing crimes, encompassing compliance with both Brazilian regulations under the BCB and COAF oversight, and U.S. federal requirements under the Bank Secrecy Act, FinCEN regulations, and OFAC sanctions programs;
“Anti-Terrorism Law” means Law No. 13,260, of March 16, 2016, (Brazil);
“ATTRUS” means ATTRUS Instituição de Pagamento S.A., ATTRUS US LLC, FPay Internacional SA de CV., Fpay Colombia SAS, or Facilitapay Chile SPA, together or separately;
“BCB” means the Central Bank of Brazil;
“BSA” means the Bank Secrecy Act of the United States, as codified in various sections of Title 31 of the United States Code, including but not limited to 31 U.S.C. 5330, under which ATTRUS, as a Money Services Business (MSB), is subject to federal registration, reporting, and compliance requirements pursuant to the implementing regulations found in 31 CFR Chapter X;
“Circular No. 3,978/20” means Circular No. 3,978, of January 23, 2020, issued by the BCB, as amended, which provides for the policy, procedures and internal controls to be adopted by the institutions authorized to operate by the BCB in order to prevent the use of the national financial system for the practice of money laundering and terrorist financing crimes, together with the corresponding U.S. federal regulations under 31 CFR 1022.380 which outline parallel requirements for MSBs, including registration maintenance, record-keeping obligations, and agent list requirements;
“Client” means the individuals or legal entities, as the case may be, who contract or use the products and services offered by ATTRUS;
“Close Collaborator” means any natural person known to be a close associate or collaborator of a Politically Exposed Person, including business partners, advisors, or other individuals who maintain close professional, personal, or financial relationships with such PEPs;
“COAF” means the Council for the Control of Financial Activities, a body created by the Ministry of Economy for the purpose of disciplining, applying administrative penalties, receiving, examining and identifying the occurrences of suspected illegal activities provided for in Law No. 9,613/98, without prejudice to the competence of other bodies and entities, and which serves functions analogous to those of FinCEN (Financial Crimes Enforcement Network) under the U.S. Department of the Treasury for anti-money laundering and counter-terrorist financing oversight;
“Employee” means any and all individuals or legal entities that have a position, function, position, corporate, employment, professional, contractual or trust relationship with ATTRUS;
“Family members” means spouses, partners, children and their spouses or partners, parents, siblings, and any other relatives by blood, marriage, or adoption who maintain close personal or financial relationships with a Politically Exposed Person;
“Final Beneficiaries” or “UBOs” means the natural persons who ultimately own or control a legal entity or on whose behalf a transaction is being conducted, including those persons who exercise ultimate effective control over a legal person or arrangement;
“FinCEN” means the Financial Crimes Enforcement Network, a bureau of the U.S. Department of the Treasury that administers the Bank Secrecy Act and requires MSB registration pursuant to 31 U.S.C. 5330 and implementing regulations under 31 CFR 1010.100(t) and (ff), which provide the regulatory definition of “money services business,” and 31 CFR 1022.380(b)(2), which mandates biennial registration renewal on or before December 31st;
“Money Laundering Law” means Law No. 9,613, of March 3, 1998, and with respect to U.S. operations, includes compliance obligations under the Bank Secrecy Act as implemented through 31 CFR Chapter X;
“Money Laundering” means the process of concealing or disguising the proceeds of crime or converting such proceeds into apparently legitimate assets, encompassing any act or attempted act to conceal or disguise the identity of illegally obtained proceeds so that they appear to have originated from legitimate sources;
“MSB” means Money Services Business, as defined under U.S. federal law in 31 CFR 1010.100(t) and (ff), requiring registration with FinCEN pursuant to 31 U.S.C. 5330 and adherence to the regulatory framework established under the Bank Secrecy Act and its implementing regulations;
“OFAC” means the Office of Foreign Assets Control, which is an agency of the United States of the Treasury Department, responsible for the creation of the Specially Designated Nationals (SDN List), which lists the countries and persons embargoed or restricted to carry out transactions of certain products with certain countries and persons accused of practicing among others, drug trafficking, terrorism, producing, using and proliferating weapons of mass destruction;
“Parent Company” means the person or entity that has the power of control of a given company, as defined in article 116 of Law No. 6,404, of December 15, 1976;
“PEPs” or “Politically Exposed Persons” means natural persons who are or have been entrusted with prominent public functions, including heads of state or government, senior politicians, senior government, judicial or military officials, senior executives of state-owned corporations, and important political party officials, as well as their family members and close collaborators;
“PIX” means the instant payment arrangement instituted by the BCB and which ATTRUS is part of;
“Subsidiaries” means the company or entity that is controlled by another person or entity, according to the definition of control provided for in article 116 of Law No. 6,404, of December 15, 1976;
“Terrorist Financing” means the financing of terrorist acts, and of terrorists and terrorist organizations, regardless of whether a terrorist act occurs, including the provision or collection of funds, by any means, directly or indirectly, with the intention that they be used or in the knowledge that they are to be used, in full or in part, to carry out terrorist activities;
“UNSC” means the United Nations Security Council.
OBJECTIVES
The purpose of this Policy is to establish guidelines and responsibilities that govern ATTRUS’s internal procedures, controls and systems in order to ensure that ATTRUS’s internal ecosystem, products and services are not used or involved in illicit activities, especially those described in the Money Laundering Law and the Anti-Terrorism Law.
This Policy was prepared in accordance with the risk profiles of ATTRUS, its Customers, operations, products and services offered and Employees, as well as in accordance with the legislation and regulations applicable to ATTRUS, notably in accordance with Circular No. 3,978/20.
SCOPE
This Policy is applicable to all ATTRUS Employees and Customers, as applicable.
IDENTIFICATION, QUALIFICATION AND CUSTOMER CLASSIFICATION (KYC)
ATTRUS's Customer identification procedure consists of collecting, at least, the information described below, in addition to any other information required under the internal KYC Manual, to start a new relationship with the Customer:
a) Tax identification registration number;
b) name of the legal entity;
c) main economic activity;
d) business address;
e) Final Beneficiaries, including full name and Tax ID.
f) Licenses applicable to the Customer's business model.
ATTRUS shall also maintain, in the internal KYC Manual, the specific procedures for the identification, verification, and classification of Customers, including legal entities, natural persons, and customers represented by a legal representative.
QUALIFICATION
When validating the documents, the ATTRUS’s responsible area identify, verify and validates the pertinent information in the available sanction lists and other databases, in order to confirm if the information provided by the Client and the result of the searches to the sources mentioned, along with the procedures set forth in the internal KYC Manual.
Under no circumstances may ATTRUS initiate a relationship with a Client or maintain its relationship with a Client if the qualification procedures have not been successfully completed.
Additional manual qualification procedures may be performed by ATTRUS depending on the Client's risk assessment and its activities, at the discretion of ATTRUS's responsible area.
New Customers must also have their risk classification carried out, as set forth in the internal KYC Manual.
Clients whose corporate structure has individuals identified as Politically Exposed Persons (PEP), as well as those who maintain direct or indirect ties with such persons, will be duly registered in the internal system.
THE CRIMES PREVENTED BY THE AML POLICY
According to article 1 of the Money Laundering Law, the crime of "Money Laundering" is defined as the act of "concealing or dissimulating the nature, origin, location, disposition, movement or ownership of goods, rights or values deriving, directly or indirectly, from a criminal offense".
The money laundering process consists of three steps (not necessarily sequential):
- Placement. introduction of money or other assets proceeding from illegal/criminal activities into financial or non-financial institutions;
- Occultation. Separating the proceeds of criminal activities from their origin through the use of layers of complex financial operations. These layers are intended to hinder the audit trail, mask the origin of the funds and provide anonymity; and
- Integration. put the "laundered" resources back into the economy in such a way that they re-enter the financial system as resources of apparently licit origin.
ATTRUS, as a payment institution authorized to operate by the BCB, as an issuer of electronic money, as well as as a participant in the Brazilian foreign exchange market, may be a victim of offenders in any of the steps mentioned above.
The term "Terrorist Financing" can be interpreted as the financing of terrorist acts, terrorists or terrorist organizations. The Anti-Terrorism Law stipulates a strict penalty for anyone who offers or receives, obtains, keeps, keeps in deposit, requests, invests or in any way contributes to obtaining an asset, good or financial resource, for the purpose of financing, in whole or in part, a person, group of people, association, entity, criminal organization whose main or secondary activity, even on an occasional basis, the practice of terrorist acts.
Additionally, due to the measures adopted by the UNSC involving the fight against the proliferation of weapons of mass destruction. Thus, the UNSC has compelled UN member states to cease any support to non-state actors for the development, acquisition, production, possession, transportation, transfer or use of nuclear, biological and chemical weapons and their means of delivery.
ATTRUS, when offering its products and services, can be a victim of offenders and criminals, as well as used as an instrument to enable terrorist acts and/or the proliferation of weapons of mass destruction.
RISK-BASED APPROACH
ATTRUS, as a payment institution issuing electronic money and participating in the Brazilian foreign exchange market, is part of the Brazilian Payment System (SPB) and the Brazilian foreign exchange market, both environments being regulated by the BCB and other private entities that are partners of ATTRUS.
In view of the regulatory risks inherent to ATTRUS's business, as well as due to the reputational risks involving the practice of money laundering, terrorist financing and proliferation of weapons of mass destruction, ATTRUS has adopted a risk-based approach (ABR) as the main governance tool for AML/CFT purposes.
To execute this approach internally, ATTRUS classifies its Customers, based on their risk profiles and the nature of the relationship, into the following risk categories: (i) "low risk"; (ii) "medium risk"; or (iii) "high risk" which are duly described in the Customer Identification, Qualification and Classification (KYC) Manual.
Such risk ratings must be reassessed by ATTRUS based on the criteria established in the internal AML Manual. When reassessing the Client's risk rating, all the information related and variables available in the Client's background check must be reassessed, according to the Client's current risk and procedures described in the Client Identification, Qualification and Classification (KYC) Manual.
REPORTS AND COMMUNICATIONS
In order to comply with the requirements of current legislation and regulations aimed at combating financial crimes, the transactions made by all Customers holding prepaid payment accounts are monitored in order to identify payment transactions that may constitute evidence of the practices of money laundering, terrorist financing and/or proliferation of weapons of mass destruction.
ATTRUS must report to COAF, Brazil's financial intelligence unit, the operations or situations suspected of money laundering and terrorist financing crimes of Customers, Customers in prospecting or operations carried out by non-third parties not classified as Customers.
ATTRUS shall also file Suspicious Activity Reports (SARs) with the Financial Crimes Enforcement Network (FinCEN) in accordance with 31 CFR 1022.320 for any transaction conducted or attempted by, at, or through ATTRUS, if ATTRUS knows, suspects, or has reason to suspect, that the transaction involves funds derived from illegal activity or is intended or conducted in order to hide or disguise funds or assets derived from illegal activity as part of a plan to violate or evade federal law or regulation or to avoid any transaction reporting requirement under federal law or regulation.
Reporting may also be conducted based on other criteria defined by Attrus.
ATTRUS shall maintain complete records of all filed SARs, including supporting documentation, investigative materials, and decision rationale.