AML-FT / KYC Policies
DEFINITIONS
All capitalized terms in this Policy shall have the meanings listed below:
"ABR", "risk-based approach", means the methodology whereby financial institutions and other regulated entities assess and mitigate money laundering and terrorist financing risks based on the identification, assessment, and understanding of the risks to which they are exposed, applying enhanced due diligence measures proportionate to the level of risk identified;
"Affiliate" means, in relation to FacilitaPay, any Subsidiaries, Parent Companies, companies under common control and other companies that are part of its economic group;
"BCB" means the Central Bank of Brazil;
"BSA" means the Bank Secrecy Act of the United States, as codified in various sections of Title 31 of the United States Code, including but not limited to 31 U.S.C. 5330, under which FacilitaPay, as a Money Services Business (MSB), is subject to federal registration, reporting, and compliance requirements pursuant to the implementing regulations found in 31 CFR Chapter X;
"Final Beneficiaries" or “UBOs” means the natural persons who ultimately own or control a legal entity or on whose behalf a transaction is being conducted, including those persons who exercise ultimate effective control over a legal person or arrangement;
"Client" means the individuals or legal entities, as the case may be, who contract or use the products and services offered by FacilitaPay;
"Circular No. 3,978/20" means Circular No. 3,978, of January 23, 2020, issued by the BCB, as amended, which provides for the policy, procedures and internal controls to be adopted by the institutions authorized to operate by the BCB in order to prevent the use of the national financial system for the practice of money laundering and terrorist financing crimes, together with the corresponding U.S. federal regulations under 31 CFR 1022.380 which outline parallel requirements for MSBs, including registration maintenance, record-keeping obligations, and agent list requirements;
"COAF" means the Council for the Control of Financial Activities, a body created by the Ministry of Economy for the purpose of disciplining, applying administrative penalties, receiving, examining and identifying the occurrences of suspected illegal activities provided for in Law No. 9,613/98, without prejudice to the competence of other bodies and entities, and which serves functions analogous to those of FinCEN (Financial Crimes Enforcement Network) under the U.S. Department of the Treasury for anti-money laundering and counter-terrorist financing oversight;
"Subsidiaries" means the company or entity that is controlled by another person or entity, according to the definition of control provided for in article 116 of Law No. 6,404, of December 15, 1976;
"Parent Company" means the person or entity that has the power of control of a given company, as defined in article 116 of Law No. 6,404, of December 15, 1976;
"Employee" means any and all individuals or legal entities that have a position, function, position, corporate, employment, professional, contractual or trust relationship with FacilitaPay;
"FinCEN" means the Financial Crimes Enforcement Network, a bureau of the U.S. Department of the Treasury that administers the Bank Secrecy Act and requires MSB registration pursuant to 31 U.S.C. 5330 and implementing regulations under 31 CFR 1010.100(t) and (ff), which provide the regulatory definition of "money services business," and 31 CFR 1022.380(b)(2), which mandates biennial registration renewal on or before December 31st;
"UNSC" means the United Nations Security Council;
"Close Collaborator" means any natural person known to be a close associate or collaborator of a Politically Exposed Person, including business partners, advisors, or other individuals who maintain close professional, personal, or financial relationships with such PEPs;
"FacilitaPay" means Facilita Instituição de Pagamento S.A., FacilitaPay US LLC, FPay Internacional SA de CV., FPay Colombia SAS, or FacilitaPay Chile SPA, together or separately;
"Family members" means spouses, partners, children and their spouses or partners, parents, siblings, and any other relatives by blood, marriage, or adoption who maintain close personal or financial relationships with a Politically Exposed Person;
"Terrorist Financing" means the financing of terrorist acts, and of terrorists and terrorist organizations, regardless of whether a terrorist act occurs, including the provision or collection of funds, by any means, directly or indirectly, with the intention that they be used or in the knowledge that they are to be used, in full or in part, to carry out terrorist activities;
"Money Laundering" means the process of concealing or disguising the proceeds of crime or converting such proceeds into apparently legitimate assets, encompassing any act or attempted act to conceal or disguise the identity of illegally obtained proceeds so that they appear to have originated from legitimate sources;
"Money Laundering Law" means Law No. 9,613, of March 3, 1998, and with respect to U.S. operations, includes compliance obligations under the Bank Secrecy Act as implemented through 31 CFR Chapter X;
"MSB" means Money Services Business, as defined under U.S. federal law in 31 CFR 1010.100(t) and (ff), requiring registration with FinCEN pursuant to 31 U.S.C. 5330 and adherence to the regulatory framework established under the Bank Secrecy Act and its implementing regulations;
"Anti-Terrorism Law" means Law No. 13,260, of March 16, 2016, (Brazil);
"OFAC" means the *Office of Foreign Assets Control*, which is an agency of the United States of the Treasury Department, responsible for the creation of the Specially Designated Nationals (SDN List), which lists the countries and persons embargoed or restricted to carry out transactions of certain products with certain countries and persons accused of practicing among others, drug trafficking, terrorism, producing, using and proliferating weapons of mass destruction;
"PEPs" or "Politically Exposed Persons" means natural persons who are or have been entrusted with prominent public functions, including heads of state or government, senior politicians, senior government, judicial or military officials, senior executives of state-owned corporations, and important political party officials, as well as their family members and close collaborators;
"PIX" means the instant payment arrangement instituted by the BCB and which FacilitaPay is part of;
"AML/CFT" means prevention of the practice of Money Laundering and Terrorist Financing crimes, encompassing compliance with both Brazilian regulations under the BCB and COAF oversight, and U.S. federal requirements under the Bank Secrecy Act, FinCEN regulations, and OFAC sanctions programs; and
"Policy" means this Policy for the Prevention of Money Laundering and Terrorist Financing Crimes.
OBJECTIVES
The purpose of this Policy is to establish guidelines and responsibilities that govern FacilitaPay's internal procedures, controls and systems in order to ensure that FacilitaPay's internal ecosystem, products and services are not used or involved in illicit activities, especially those described in the Money Laundering Law and the Anti-Terrorism Law.
This Policy was prepared in accordance with the risk profiles of FacilitaPay, its Customers, operations, products and services offered and Employees, as well as in accordance with the legislation and regulations applicable to FacilitaPay, notably in accordance with Circular No. 3,978/20.
SCOPE
This Policy is applicable to all FacilitaPay Employees and Customers, as applicable.
THE CRIMES PREVENTED BY THIS POLICY
According to article 1 of the Money Laundering Law, the crime of "Money Laundering" is defined as the act of "concealing or dissimulating the nature, origin, location, disposition, movement or ownership of goods, rights or values deriving, directly or indirectly, from a criminal offense".
The money laundering process consists of three steps (not necessarily sequential):
- Placement. introduction of money or other assets proceeding from illegal/criminal activities into financial or non-financial institutions;
- Occultation. Separating the proceeds of criminal activities from their origin through the use of layers of complex financial operations. These layers are intended to hinder the audit trail, mask the origin of the funds and provide anonymity; and
- Integration. put the "laundered" resources back into the economy in such a way that they re-enter the financial system as resources of apparently licit origin.
FacilitaPay, as a payment institution authorized to operate by the BCB, as an issuer of electronic money, as well as as a participant in the Brazilian foreign exchange market, may be a victim of offenders in any of the steps mentioned above.
The term "Terrorist Financing" can be interpreted as the financing of terrorist acts, terrorists or terrorist organizations. The Anti-Terrorism Law stipulates a strict penalty for anyone who offers or receives, obtains, keeps, keeps in deposit, requests, invests or in any way contributes to obtaining an asset, good or financial resource, for the purpose of financing, in whole or in part, a person, group of people, association, entity, criminal organization whose main or secondary activity, even on an occasional basis, the practice of terrorist acts.
Additionally, due to the measures adopted by the UNSC involving the fight against the proliferation of weapons of mass destruction. Thus, the UNSC has compelled UN member states to cease any support to non-state actors for the development, acquisition, production, possession, transportation, transfer or use of nuclear, biological and chemical weapons and their means of delivery.
FacilitaPay, when offering its products and services, can be a victim of offenders and criminals, as well as used as an instrument to enable terrorist acts and/or the proliferation of weapons of mass destruction.
RISK-BASED APPROACH
FacilitaPay, as a payment institution issuing electronic money and participating in the Brazilian foreign exchange market, is part of the Brazilian Payment System (SPB) and the Brazilian foreign exchange market, both environments being regulated by the BCB, Bandeiras and other private entities that are partners of FacilitaPay.
In view of the regulatory risks inherent to FacilitaPay's business, as well as due to the reputational risks involving the practice of money laundering, terrorist financing and proliferation of weapons of mass destruction, FacilitaPay has adopted a risk-based approach ("ABR") as the main governance tool for AML/CFT purposes.
The Compliance area is responsible for the analysis, elaboration and implementation of the ABR process at FacilitaPay, which was mapped and prepared aiming at the effective management of the process of identification, monitoring, analysis and mitigation of risks of the practice of money laundering, terrorist financing and proliferation of weapons of mass destruction.
To execute this approach internally, FacilitaPay classifies its Customers, based on their risk profiles and the nature of the relationship, into the following risk categories: (i) "low risk"; (ii) "medium risk"; or (iii) "high risk" which are duly described in the Customer Identification, Qualification and Classification (KYC) Manual.
Such risk ratings must be reassessed by FacilitaPay: (i) annually; or (ii) whenever there are changes in the risk profile and/or nature of the business between Client and FacilitaPay. When reassessing the Client's risk rating, the Compliance team must reassess all the information and variables available in the Client's background check (e.g., KYC and Client Monitoring Dossiers), according to the Client's current risk and procedures described in the Client Identification, Qualification and Classification (KYC) Manual.
REPORTS AND COMUNICATIONS
In order to comply with the requirements of current legislation and regulations aimed at combating financial crimes, the transactions made by all Customers holding prepaid payment accounts are monitored in order to identify payment transactions that may constitute evidence of the practices of money laundering, terrorist financing and/or proliferation of weapons of mass destruction.
FacilitaPay must report to COAF, Brazil's financial intelligence unit, the operations or situations suspected of money laundering and terrorist financing crimes of Customers, Customers in prospecting or operations carried out by non-third parties not classified as Customers.
The decision to communicate the operation or situation to COAF must be based on the information contained in the file of the Client, Prospecting Client or non-client third party, as well as be recorded in detail in the respective dossier.
FacilitaPay shall also file Suspicious Activity Reports (SARs) with the Financial Crimes Enforcement Network (FinCEN) in accordance with 31 CFR 1022.320 for any transaction conducted or attempted by, at, or through FacilitaPay, if FacilitaPay knows, suspects, or has reason to suspect that the transaction meets any of the following criteria:
- the transaction involves funds derived from illegal activity or is intended or conducted in order to hide or disguise funds or assets derived from illegal activity as part of a plan to violate or evade federal law or regulation or to avoid any transaction reporting requirement under federal law or regulation. This includes transactions that appear to be structured to avoid currency transaction reporting requirements or other BSA reporting obligations.
- the transaction is designed to evade regulations promulgated under the Bank Secrecy Act, whether through structuring, the use of multiple accounts, or other means designed to circumvent regulatory oversight and detection.
- the transaction has no business or apparent lawful purpose or is not the sort in which the particular customer would normally be expected to engage, with no reasonable explanation for the transaction after examining the available facts, including the background and possible purpose of the transaction.
- the transaction involves the use of FacilitaPay to facilitate criminal activity, regardless of whether the specific criminal activity is known, and includes transactions that may involve money laundering, terrorist financing, fraud, or other illicit financial activities.
All SARs must be filed electronically through FinCEN's BSA E-Filing System within thirty (30) calendar days of the initial detection of the reportable activity.
FacilitaPay shall maintain complete records of all filed SARs, including supporting documentation, investigative materials, and decision rationale. These records shall be maintained separately from customer files and shall be accessible only to authorized compliance personnel and senior management with a legitimate business need to know.
Identification, Qualification and Customer Classification (KYC)
DEFINITIONS
All capitalized terms in this Manual shall have the meanings listed below:
BSA means the Bank Secrecy Act of the United States, as codified in various sections of Title 31 of the United States Code, including but not limited to 31 U.S.C. 5330, under which ATTRUS, as a Money Services Business (MSB), is subject to federal registration, reporting, and compliance requirements pursuant to the implementing regulations found in 31 CFR Chapter X;
FinCEN means the Financial Crimes Enforcement Network, a bureau of the U.S. Department of the Treasury that administers the Bank Secrecy Act and requires MSB registration pursuant to 31 U.S.C. 5330 and implementing regulations under 31 CFR 1010.100(t) and (ff), which provide the regulatory definition of "money services business," and 31 CFR 1022.380(b)(2), which mandates biennial registration renewal on or before December 31st;.
Final Beneficiaries means (i) individuals who hold, directly or indirectly, twenty-five percent (25%) or more of an equity interest in the Client1; or (ii) the individuals who actually exercise direct or indirect control over the activities of the Client on behalf of which a transaction is being conducted or benefits from it, including their respective attorneys-in-fact or representatives;
Customer means the individuals or legal entities, as the case may be, that contract or use the products and services offered by ATTRUS;
Collaborator means any and all individuals or legal entities that have a position, function, position, corporate, employment, professional, contractual or trust relationship with ATTRUS;
UNSC stands for the United Nations Security Council;
Direct Collaborator means (i) an individual known to have any type of close relationship with PEP, including for: (a) having a joint interest in a legal entity governed by private law; (b) appear as an agent, even if by private instrument of the person mentioned in item (a); or (c) have joint interest in arrangements without legal personality; and (ii) an individual who has control of legal entities or arrangements without legal personality, known to have been created for the benefit of PEP;
ATTRUS means Facilita Instituição de Pagamento S.A., Facilita INC, FacilitaPay North America LLC, FacilitaPay US LLC, FPay Internacional SA de CV., FPay Colombia SAS, or FacilitaPay Chile SPA, together or separately;
Family members means spouses, partners, children and their spouses or partners, parents, siblings, and any other relatives by blood, marriage, or adoption who maintain close personal or financial relationships with a Politically Exposed Person;
USA PATRIOT Act means federal law enacted in 2001 that expanded investigative and enforcement authorities to prevent and combat terrorism, including provisions related to anti-money laundering and counter-terrorist financing.
Manual means this KYC Customer Identification, Qualification and Classification Manual; MSB means Money Services Business, as defined under U.S. federal law in 31 CFR 1010.100(t) and (ff), requiring registration with FinCEN pursuant to 31 U.S.C. 5330 and
1 ATTRUS adopts the percentage of 25% as a criterion for identifying the final beneficiaries of all legal entities, regardless of their risk classification, in accordance with the provisions of Article 25, paragraph 1, of BCB Circular No. 3,978/20. Such an approach follows the best international practices, in line with the guidelines of the FATF (Financial Action Task Force), and is used as a minimum parameter to ensure greater effectiveness in AML/CFT processes. Considering that a significant portion of ATTRUS's customer base is made up of foreign companies, the adoption of this model reinforces adherence to international compliance expectations and standards, promoting greater acceptance and trust by customers. In addition, the objectivity of the criterion ensures greater consistency and reduces subjectivity in the customer identification and verification (KYC) stages, strengthening the institution's internal controls and governance.
adherence to the regulatory framework established under the Bank Secrecy Act and its implementing regulations;
OFAC means the Office of Foreign Assets Control , which is an agency of the Treasury Department of the United States of America, responsible for the creation of the Specially Designated Nationals (SDN List), which lists the countries and persons embargoed or restricted to carry out transactions of certain products with certain countries and persons accused of practicing, among others, drug trafficking, terrorism, producing, using and proliferating weapons of mass destruction;
PEPs or Politically Exposed Persons mean: (i) the holders of elective mandates of the Executive and Legislative Branches of the Union; (ii) the occupants of a position, in the Executive Branch of the Union, of: (a) Minister of State or equivalent; (b) Special or equivalent nature; (c) president, vice-president and director, or equivalent, of indirect public administration entities; and (d) Superior Management and Advisory Group (DAS), level 6, or equivalent; (iii) the members of the National Council of Justice, the Federal Supreme Court, the Superior Courts, the Federal Regional Courts, the Regional Labor Courts, the Regional Electoral Courts, the Superior Council of Labor Justice and the Federal Justice Council; (iv) the members of the National Council of the Public Prosecutor's Office, the Attorney General of the Republic, the Deputy Attorney General of the Republic, the Attorney General of Labor, the Attorney General of Military Justice, the Deputy Attorneys General of the Republic and the Attorneys General of the States and the Federal District;
(v) the members of the Federal Court of Accounts, the Attorney General and the Deputy Attorneys General of the Public Prosecutor's Office at the Federal Court of Accounts; (vi) the presidents and national treasurers, or equivalent, of political parties; (vii) the Governors and the Secretaries of State and of the Federal District, the State and District Deputies, the presidents, or equivalent, of state and district indirect public administration entities and the presidents of Courts of Justice, Military Courts, Courts of Accounts or equivalent of the States and the Federal District; (viii) the Mayors, Councilors, Municipal Secretaries, the presidents, or equivalent, of entities of the indirect municipal public administration and the Presidents of Courts of Accounts or equivalents of the Municipalities; (ix) persons who, abroad, are: (a) heads of state or government; (b) politicians of higher echelons; (c) occupants of government positions of higher echelons;
(d) general officers and members of higher echelons of the Judiciary; (e) senior executives of public companies; or (f) leaders of political parties; and (x) the directors of senior levels of public or private international law entities;
AML/CFT stands for Prevention of Money Laundering and Terrorist Financing Crimes; AML/CFT Policy means the current version of ATTRUS's Policy for the Prevention of Money Laundering and Terrorist Financing Crimes; and
SCOPE
This Manual is applicable to all ATTRUS Employees and Customers, as applicable, and must, however, be executed by the following areas: (i) Registration; (ii) Commercial and New Business; and (iii) Compliance; as the case may be.
RULES
PROCEDURES FOR REGISTERING AND UPDATING CUSTOMERS (KYC)
Identification Procedure
ATTRUS's Customer identification procedure consists of collecting, at least, the information described below to start a new relationship with the Customer, when a legal entity:
a) Tax identification registration number;
b) name of the legal entity;
c) main economic activity;
d) business address;
e) last amendment of the Client's articles of association or bylaws or other equivalent corporate document duly registered with a competent body (containing, when applicable, necessarily the consolidated articles of association or bylaws);
f) annual declarative revenue;
g) representative authorization;
h) corporate email; and
i) Final Beneficiaries, including full name (and CPF/ME for Brazilians).
j) Licenses applicable to the Customer's business model in the jurisdiction where it is registered or any additional applicable licenses;
k) Completion of LGPD Questionnaire provided to the Customer;
l) Copy of the Money Laundering and Terrorist Financing Prevention Manual, preferably signed by the Client's competent board of directors.
In the case of legal representatives, attorneys-in-fact or agents of the legal entity Client authorized to manage ATTRUS's products and services on behalf of the legal entity Client, the following minimum information must be made available:
a) power of attorney, when applicable;
b) photo of Proof of Identity
c) full name;
d) Date of birth;
e) nationality;
f) home telephone
g) home address;
h) annual income (declaratory); and
i) declaration regarding its classification as a PEP.
All the aforementioned information must be forwarded or updated, as the case may be, by the Client to ATTRUS through the KYC form sent by the Commercial team, whose access to the information submitted is exclusive to the Registration/Compliance Team.
If the Client carries out an activity or acts in a sector described in the list of prohibited activities and sectors with which ATTRUS will not do business due to the high risks involved, the Client's registration must be denied.
Qualification Procedure
When validating the above-mentioned documents, the Compliance area must verify: (i) that the documents are complete and contain the elements necessary for their legality;
(ii) if the documents do not contain obstructed or manipulated data; (iii) the necessary
data can be validated in the applicable documentation; and (iv) the documents are not expired or out of date.
Must be validated:
a) Verification of the condition of Politically Exposed Person (PEP), or representative, family member or close collaborator of these people
b) verification of the pertinent information in the avaliable databases, in order to confirm if the name informed by the Client is consistent with the result of the searches to the sources mentioned
c) verification of the pertinent information in the database of lists of internationally sanctioned persons, including those issued by OFAC, UN, among others;
d) verification of the pertinent information in the database of background check tools, intended to verify whether or not the Client actually fits the definition of PEP; and
e) identity validation procedure via facial biometrics tool, in order to check if the image obtained is compatible with the image provided for in the Proof of Identity made available by the Client.
Under no circumstances may ATTRUS initiate a relationship with a Client or maintain its relationship with a Client if the qualification procedures described above have not been successfully completed, except in the case of a simplified Customer qualification procedure.
Additional manual qualification procedures may be performed by ATTRUS depending on the Client's risk assessment and its activities, which includes, but is not limited to, geo-checking its business address, independent internet research on the Client, requesting documents proving declared income, among others, at the discretion of ATTRUS's Compliance area.
Legal Entity Classification Procedure
After completing the procedures for identifying and qualifying Customers, new Customers must have their risk classification carried out in view of the following criteria:
a) level of risk of money laundering, terrorist financing and/or proliferation of weapons of mass destruction, which the Client presents to ATTRUS;
b) nature of the Client and/or Employee, such as government entities, non-regulated funds, trusts, foundations, among others;
c) function of commercial activity, such as the evaluation of activities most susceptible to illegal exploitation (casinos and other activities related to non-permitted gambling, religious and charitable entities, gas stations, among others);
d) risk to ATTRUS's reputation;
e) risk by product, service or activity, in addition to foreign exchange operations;
f) financial impacts;
g) impacts related to Environmental, Social and Governance (ESG);
h) AML-relevant media;
i) PEP - Politically Exposed Persons;
j) accounts opened by proxy;
k) geographical factors, such as border cities or those located in countries at higher risk;
l) number of alerts in monitoring;
m) time of the last registration review;
n) Judicial blockade/Breach of bank secrecy;
o) communications made to COAF;
p) incomplete registration information; and
q) identification of vulnerable audiences.
Clients whose corporate structure has individuals identified as Politically Exposed Persons (PEP), as well as those who maintain direct or indirect ties with such persons, will be duly registered in the internal system.
Once the Customer identification and qualification processes have been completed, the Compliance area must carry out the procedures for classifying the Customer's risk profile, in order to verify the degree of risk of the Customer's practice of money laundering, terrorist financing and/or proliferation of weapons of mass destruction.