Compliance Policy
1. DEFINITIONS
All capitalized terms in this Policy shall have the meanings listed below:
"Senior Management" means Attrus's current board of directors composed of three (3) officers;
"Internal Audit Area" means the department responsible for the analysis of the independent, autonomous and impartial assessment of the quality and effectiveness of Attrus's internal controls, risk management and corporate governance systems and processes;
"Registration Area" means the administrative department responsible for managing the process related to the beginning of Attrus's relationships with Customers, as well as for verifying that the documentation and information provided by the Customer comply with Attrus's internal policies and manuals;
"Commercial and Business Area" means the department responsible for creating and maintaining the relationship with Customers, as well as encouraging the contracting and use of products and services offered by Attrus;
"Internal Compliance Area" means the unit responsible for Attrus's compliance function;
"Risk Management Area" means the department responsible for identifying, measuring, evaluating, mitigating and monitoring risks related to the products and services provided and offered by Attrus, execution of operations and transactions by Attrus and the risks involving Customers, Employees, Partners and Service Providers of Attrus;
“BSA” means the Bank Secrecy Act of the United States, as codified in various sections of Title 31 of the United States Code, including but not limited to 31 U.S.C. 5330, under which ATTRUS, as a Money Services Business (MSB), is subject to federal onboarding, reporting, and compliance requirements pursuant to the implementing regulations found in 31 CFR Chapter X;
“FinCEN” means the Financial Crimes Enforcement Network, a bureau of the U.S. Department of the Treasury that administers the Bank Secrecy Act and requires MSB onboarding pursuant to 31 U.S.C. 5330 and implementing regulations under 31 CFR 1010.100(t) and (ff), which provide the regulatory definition of "money services business," and 31 CFR 1022.380(b)(2), which mandates biennial onboarding renewal on or before December 31st;
“OFAC” means the Office of Foreign Assets Control, which is an agency of the Treasury Department of the United States of America, responsible for the creation of the Specially Designated Nationals (SDN List), which lists the countries and persons embargoed or restricted to carry out transactions of certain products with certain countries and persons accused of practicing, among others, drug trafficking, terrorism, producing, using and proliferating weapons of mass destruction;
"Internal Controls Area" means the department responsible for verifying compliance with the policies, procedures and internal controls described in Attrus's internal policies and documents;
"Whistleblowing Channel" has the meaning given in section 7 of this Policy;
"Customers" means individuals or legal entities, as the case may be, that contract or use the products and services offered by Attrus;
"CMN" means the National Monetary Council;
"Code of Ethics" means Attrus's current ethical conduct manual;
"Employee" means any and all individuals or legal entities that hold a position, function, position, corporate, employment, professional, contractual or trust relationship with Attrus;
"Head of Internal Audit" means the head of Attrus's Internal Audit Area;
"Head of Compliance" means the Employee responsible for and coordinator of the Internal Compliance Area;
"Partners and Service Providers" means individuals or legal entities that provide services of any nature to Attrus, commercial or not, remunerated or not, on an occasional or permanent basis, including, but not limited to, banking correspondents, participants in payment arrangements and other service providers in general;
"Policy" means this Compliance Policy;
“AML/CFT” stands for Prevention of Money Laundering and Terrorist Financing Crimes; and
“AML/CFT Policy” means the current version of ATTRUS's Policy for the Prevention of Money Laundering and Terrorist Financing Crimes.
"Internal Compliance Area Remuneration Policy" means the remuneration policy of those responsible for activities related to the compliance function;
"Compliance Program" means a set of internal processes, controls and procedures that seek to ensure that Attrus adheres to the legal framework, non-legal regulations, recommendations of regulatory bodies, applicable self-regulation codes, operational regulations and other internal documents of Attrus, including the Code of Ethics;
"Integrity Program" means the set of internal processes, controls and procedures for compliance, integrity, auditing, incentive to report irregularities and application of the Code of Ethics, corporate governance guidelines, policies and standards that aim to prevent, detect and mitigate deviations, fraud, irregularities and unlawful acts practiced against the public administration, national or foreign;
"Annual Compliance Report" means Attrus's report, with a minimum annual periodicity, containing the summary of the results of the activities related to the compliance function, its main conclusions, recommendations and measures taken by Attrus's Senior Management;
"Compliance Risk" means the possibility that the institution may suffer legal or administrative sanctions, financial losses, reputational damages, and other damages, resulting from non-compliance or failures to comply with the legal framework, infra-legal regulations, recommendations of regulatory bodies, and applicable self-regulation codes; and
"Attrus" means Attrus Instituição de Pagamento S/A, Attrus US LLC, Attrus North America LLC, Attrus Internacional SA de CV., Attrus Colombia SAS, or Attrus Chile SPA, together or separately;
2. OBJECTIVES AND SCOPE
The purpose and scope of this Policy is to institute and regulate the Compliance Program, for the management, mitigation and control of Compliance Risks. Certain topics addressed in this Policy may be complemented by specific internal policies and rules, which must be read together with this instrument and, in case of divergences, the specific rule for each case will prevail.
This Policy was prepared in accordance with the nature, size, complexity, structure, risk profile and business model of Attrus, as well as in accordance with U.S. laws and regulations, including but not limited to the Bank Secrecy Act (BSA), as amended by the USA PATRIOT Act, and related regulations issued by the Financial Crimes Enforcement Network (FinCEN)., in order to ensure the effective management of its Compliance Risk.
As a financial services provider operating in the United States, the Company affirms that its compliance framework is aligned with applicable federal regulatory expectations, including AML/CFT requirements, sanctions compliance (OFAC), and financial crime prevention standards.
This Policy applies to all employees, officers, directors, and third-party service providers acting on behalf of the Company.
The Compliance Program is designed to identify, assess, monitor, and mitigate compliance risks, including but not limited to financial crime risks, regulatory risks, and reputational risks.
The Company is committed to maintaining an effective BSA/AML compliance program, designed to prevent, detect, and report suspicious activities, in accordance with applicable U.S. regulatory requirements.
3. SCOPE
This Policy is applicable to all Attrus Employees, according to the activity they carry out in the institution.
4. COMPLIANCE PROGRAM
4.1. Integrity Program and Compliance Program
Attrus has a Compliance Program, which covers Attrus's Integrity Program, and aims to ensure Attrus's compliance with the legislation, its internal policies, and the requirements of regulatory authorities, inspectors, external agents and recommendations from the Internal Compliance Area, Head of Compliance and Senior Management.
Attrus's Compliance Program was structured based on the following principles and guidelines for conducting its activities:
- Risk Management: Attrus, on an ongoing basis, aims to identify, map and act to mitigate the Compliance Risk and other risks to which it is exposed, as detailed in section 5 below;
- Monitoring and Prevention: the continuous movement through which Attrus evaluates its activities in line with the applicable internal and external rules aims to verify the need for evolution and improvement of the established processes for preventing occurrences and investigating irregularities. Activities such as "Know Your Customer" (KYC), monitoring of reports from the Whistleblowing Channel, business continuity management, evaluation of subsidiaries and affiliates, periodic testing and audits are examples of actions that make up this element, as detailed in section 6 below;
- Support from Senior Management: Senior Management influences and inspires the conduct of Employees, being fundamental as an example to be followed by other Attrus Employees in conducting their activities. Attrus's Senior Management is at the forefront of the actions and decisions of the Compliance Program, as detailed in section 7 below;
- Awareness and Culture: the disclosure of internal rules and expectations of conduct of Attrus Employees occurs through periodic and specific training regarding their prerogatives and responsibilities. This action is continuous and the use of different tools is fundamental for the success and promotion of Attrus's ethical culture, as detailed in section 9 below;
- Remediation and Reporting: certain situations generate the need to establish action plans for remediation and/or accountability for irregularities that have occurred. Such plans are monitored and reported, allowing the exposed weaknesses to be worked on, promoting the continuous improvement of the institution's internal processes. Attrus is committed to transparency in reporting to internal management bodies and external authorities, such as regulators and self-regulators, evidencing occurrences, investigations, action plans, implementations and improvements generated; and
- Internal Policies and Manuals: Attrus formalizes the commitments and guidelines of its business practices, which guide ethical and technical conduct in the execution of its activities. Through its internal policies, rules and procedures, Attrus guides all Employees on the necessary actions, decisions and reports.
Annually, the Internal Compliance Area shall update the Compliance Program, describing the strategies and plans to ensure compliance with the applicable legislation and regulations and current standards, the Code of Ethics and other principles and rules defined in its internal policies. The Compliance Program must be approved by the Head of Compliance.
The Compliance Program must cover, at least, the following topics:
- implementation of policies and procedures for compliance with regulatory standards and applicable legislation;
- internal rules for handling confidential matters and complying with regulatory requirements, which includes, but is not limited to, regulations on the prevention of money laundering and financing of terrorism and proliferation of weapons of mass destruction, due diligence procedures for hiring Partners and Service Providers and acceptance of Clients;
- establishment of the concept of lines of defense and its application;
- procedures for identifying, assessing, mitigating and monitoring risks, including Compliance Risks, conducting tests and assessments for adherence to laws and regulations, ensuring that they are always up to date;
- periodic presentation of reports to Senior Management on the effectiveness of compliance activities, incidents and any associated losses;
- recommendations for improvements; and
- conducting training.
4.2. Lines of Defense
As part of risk management, each service or business area must have its functions segregated from others with which it may have conflicts of interest and interdependent action (notably the Compliance Area and the Internal Audit Area, under the terms of current regulations), that is, acting autonomously, but evaluating the business context and Attrus's general responsibilities. This segregation and autonomy should be the basis for the establishment of the line of defense, as indicated below:
- 1st line of defense: the members of the Commercial and Business Area and the Registration Area are primarily responsible for identifying, assessing, treating, controlling and reporting the risks related to the activities they perform, respecting the guidelines and policies defined by Attrus and the respective applicable laws and regulatory standards, as detailed in section 7 below. The performance of these areas under the terms of Attrus's legislation and internal policies drastically reduces the occurrence of irregularities by Attrus.
- 2nd line of defense: the Internal Compliance, Internal Controls and Risk Management Areas must act independently and separately from the areas of the 1st line of defense, focusing on the implementation of policies for risk management, monitoring and effective controls and consulting the operational and support areas, for risk identification and mitigation. Periodically, these areas must carry out tests of adherence to regulations, internal policies and procedures, ensuring compliance with guidelines and Attrus's internal risk appetite, periodically reporting, and whenever necessary, the results of these tests to Senior Management. In addition, the areas of the second line of defense are fully segregated from the third line of defense described below.
- 3rd line of defense: The Internal Audit Area is responsible for carrying out independent and objective assessments in relation to the risks identified and the performance of the other units of Attrus, acting as a reviewer of the effectiveness of the work carried out by the first two lines of defense. The scope and extent of the Compliance Area's activities should also be part of this periodic assessment.
5. COMPLIANCE RISK MANAGEMENT
The Compliance Risk must be managed in an integrated manner with the other risks incurred by Attrus. In this sense, Attrus seeks to protect Employees, Partners and Service Providers and Customers against conduct or omissions that imply non-compliance: (i) with applicable laws and regulations, including, but not limited to, the rules, instructions, circulars, resolutions issued by the FinCEN, BSA, OFAC; (ii) institutional values; and (iii) business principles.
6. COMPLIANCE RISK MONITORING
The Internal Compliance Area must prepare a Compliance Risk monitoring plan, which must be approved by the Head of Compliance. The Compliance Risk monitoring plan aims to continuously monitor compliance with the provisions of this Policy, as well as the identification, at an early stage, of patterns of behavior or improper activities that impact Attrus's compliance.
In the event of a non-compliance, suspicion or indication of non-compliance with any of the rules established in this Policy or applicable to Attrus's activities, which come to the attention of the Head of Compliance through the communication made by the Internal Compliance Area or other applicable department, in accordance with the procedures established in this Policy, the Head of Compliance may use Attrus's records and monitoring systems to verify the conduct of the Employees involved.
All content stored and managed by Attrus, as the case may be, may be accessed by the Head of Compliance, in conjunction with the Internal Audit Area, including personal files saved on each Employee's computer.
The Internal Compliance Area must also routinely verify the levels of internal controls and compliance with all areas of Attrus, in order to promote actions to clarify and regularize any non-conformities. The Internal Compliance Area will also analyze the controls provided for in this Policy, proposing the creation of new controls and improvements in those considered deficient, monitoring the respective corrections.
7. ROLES AND RESPONSIBILITIES
7.1. Senior Management
Attrus's Senior Management is currently represented by a Board of Directors composed of three (3) officers. The creation, maintenance and implementation of the Policy effectively and in compliance with current regulations are the responsibility of Senior Management.
Attrus's Senior Management is responsible for:
- ensure the (i) proper management of this Policy; (ii) effectiveness and continuity of the application of this Policy; (iii) the dissemination of compliance standards (including this Policy) to all Employees and Partners and relevant Service Providers so that they are aware of and comply with all the rules set forth therein; and (iv) the dissemination of standards of integrity and ethical conduct as part of Attrus's culture;
- ensure that corrective action is taken when compliance failures are identified;
- promote the necessary means for the activities related to the compliance function to be properly carried out;
- approve the annual budget proposal of the Internal Compliance Area, which must reflect the allocation of sufficient resources to perform the compliance function;
- periodically review the scope and extent of activities of the Internal Compliance Area and the Head of Compliance;
- examine and take action in relation to any requests for authorization, guidance or clarification or cases of occurrence, suspicion or indication of practice that is not in accordance with the provisions of the applicable laws and regulations forwarded by the Head of Compliance;
- approve and periodically review the Compliance Program, this Policy and other associated documents;
- approve the content of the Annual Compliance Report, as well as ensure that any deficiencies identified in the Annual Compliance Report are corrected; and
- prepare the Compensation Policy of the Internal Compliance Area.
Attrus's Senior Management must request the opinion of Attrus's Head of Compliance whenever it makes adjustments to this Policy and other documents associated with Attrus.
7.2. Head of Compliance
Attrus's Head of Compliance must report directly to Senior Management, as well as manage and ensure that Attrus's Internal Compliance Area performs its functions in accordance with this Policy and other internal rules of Attrus.
To ensure the absence of conflicts of interest, Attrus's compliance structure will be led by the Head of Compliance, a specialized professional, with exclusive dedication and who reports directly to Senior Management, with adequate and sufficient staff and resources to carry out Compliance activities.
The Head of Compliance has the following duties:
- coordinate and supervise all compliance issues, and must meet with Senior Management quarterly (or at a shorter interval when necessary) to evaluate and discuss Attrus's performance from a compliance perspective;
- supervise and manage Compliance Risk;
- assist Senior Management in the formulation of Attrus's compliance strategies and execute such strategies, including supervising their development and implementation;
- evaluate any requests for authorization, guidance or clarification or cases of occurrence, suspicion or indication of practice that is not in accordance with the provisions of the applicable legislation and regulations forwarded by the Internal Compliance Area and decide to communicate it to Senior Management;
- report systematically and timely the issues and results of activities related to the compliance function to Senior Management through Attrus's internal systems;
- support the Internal Compliance Area and report to Senior Management the results of tests and recommendations for improvements and results of activities related to the compliance function;
- support and review responses and measures adopted to address audit notes and inspections;
- review the content of the Annual Compliance Report;
- promote investigations in relation to complaints received;
- understand the legislation and regulations applicable to Attrus, as well as the products and services offered by Attrus to its Customers, in order to perform its functions properly;
- review and monitor the solution of the points raised in the report on non-compliance with legal and regulatory provisions prepared by the independent auditor, in accordance with specific regulations; and
- analyze other matters related to compliance.
7.3. Internal Compliance Area
The Internal Compliance Area is composed of highly trained, qualified members who have the necessary experience to carry out activities related to the compliance function, and is composed of: three professionals, in addition to the Head of Compliance.
The Internal Compliance Area will report to the Head of Compliance and indirectly to Senior Management, and will report directly to the Head of Compliance, which ensures the independence, autonomy and effectiveness of Attrus's compliance structure. The Internal Compliance Area is responsible for carrying out all compliance aspects and efforts, which include:
- test and evaluate Attrus's adherence to the legal framework, infra-legal regulations, recommendations from supervisory authorities, the Code of Ethics and other internal rules and policies of Attrus;
- provide support to Senior Management regarding the observance and correct application of the item mentioned above, including keeping them informed of relevant updates;
- assist in informing and training all Employees and relevant Partners and Service Providers on matters related to compliance;
- review and monitor the solution of the points raised in the report on non-compliance with legal and regulatory provisions prepared by the independent auditor, in accordance with specific regulations;
- prepare Attrus's Annual Compliance Report;
- assist Senior Management in the formulation of Attrus's compliance strategies and execute such strategies, including supervising their development and implementation;
- prepare the annual budget proposal of the Internal Compliance Area;
- carry out periodic reviews of compliance processes, especially when changes are made to this Policy and/or applicable regulations and legislation;
- to submit in a timely manner to Senior Management relevant information and documents on changes in the regulatory environment, results of compliance activities and material compliance failures that may generate significant legal or reputational risks, including regulatory sanctions arising from Compliance Risks;
- advising business management with regard to the understanding, interpretation and impact of the regulations and legislation applicable to Attrus's business, monitoring the best practices in its execution, as well as periodically analyzing the regulations issued by the competent bodies;
- monitor and ensure compliance, by Partners and Service Providers acting on behalf of Attrus, with the provisions of the contracts entered into with the institution, Attrus's internal policies and manuals;
- bring to the Head of Compliance any requests for authorization, guidance or clarification or cases of occurrence, suspicion or indication of practice that is not in accordance with the provisions of the applicable legislation and regulations;
- implement improvements to address any audit notes and inspections;
- raise awareness, train and train Employees on the topic of compliance;
- promote the organizational culture of compliance, including, in addition to Employees, any Partners and Service Providers;
- assist Attrus's Employees as soon as possible in relation to questions and application of this Policy and other Attrus's internal policies and documents;
- ensure the confidentiality of any whistleblowers of crimes or infractions, except in cases of need for testimony in court or if so requested by a competent authority;
- identify possible conduct contrary to Attrus's internal policies and manuals, as well as report any suspicions to Attrus's Head of Compliance and Internal Audit Area;
- analyze situations that may be characterized as personal and/or professional "conflicts of interest", and act in line with the guidelines contained in Attrus's Code of Ethics and this Policy;
- maintain the relationship with regulatory, governmental and class associations – such as ABECS, AFRAC, AMCHAM –, acting as a representative of Attrus in the face of the demands established by such regulatory bodies;
- provide assistance to Attrus Employees when answering questions of a legal nature addressed via RDR (Complaint Demand Register) or SAC (Customer Service);
- keep the regulatory matrix updated for the purpose of evaluating and monitoring Attrus's adherence to the legal framework, based on the regulations established by regulatory bodies (such as FinCEN, BSA, USA Patriot Act band any and all locally applicable anti-money laundering legislation);
- implement and keep the Compliance Program up to date, as well as annually issue a diagnosis of adherence to the current regulatory requirements that govern the subject; and
- investigate, investigate and address the reports received in the Ethics Channel, when applicable.
7.4. Commercial and Business Area and Registration Area
Members of Attrus's Commercial and Business Area will be responsible for:
- report to the Internal Compliance Area events that may bring compliance risks to Attrus, as well as establish procedures and internal controls to mitigate them; and
- apply the guidelines of the Compliance Program in order to prevent, detect and stop the occurrence of irregularities, fraud, corruption and other deviations.
Members of the Registration Area must keep their registration updated, carry out the approval of Partners and Service Providers and request, at least, the formal acceptance of all suppliers relevant to the guidelines established in Attrus's Code of Ethics, manuals and internal policies, as defined by the Compliance Area and required by current regulations.
7.5. All Employees and Partners and Service Providers
Attrus's Employees and Partners and Service Providers must conduct their duties in compliance with the applicable legislation and Attrus's internal rules, including this Policy. In addition to the specific obligations and responsibilities defined above, all Attrus Employees must ensure faithful compliance with this Policy and related documents, as well as immediately report via the Whistleblowing Channel any suspicious situation of the practice of money laundering, terrorist financing and/or proliferation of weapons of mass destruction, as well as any other cases related to Compliance Risks.
8. REPORTING CHANNELS
In order to preserve confidentiality and encourage the reporting by Employees of the aforementioned infractions, Attrus's Senior Management provides the whistleblowing channel, which is intended to receive anonymous or identifiable reports regarding possible violations, failures, irregularities and suspicion of illegal acts related to the Compliance Program, Code of Ethics, Policy and other internal policies, manuals and internal guidance documents of Attrus, legislation and regulations applicable to Attrus's activities, as well as inappropriate behavior and other cases of misconduct, conflicts of interest, fraud, moral and sexual harassment, bribery, corruption and practices of discrimination of any kind, at the following address: https://i3dvdja9a3o.typeform.com/fpcanaldenuncia?typeform-source=www.Attrus.com or through the website ("Whistleblowing Channel").
The Whistleblowing Channel is operated by the Human Resources Area, together with the Compliance supervisor, which will proceed with the preliminary internal investigation for the purpose of analyzing and understanding the complaints made anonymously by Attrus Employees. Once the complaint has been analyzed, the Human Resources Area, together with the Compliance supervisor, must prepare an opinion containing the investigation of the complaint, which will be made available to the Head of Compliance for recommendation of the application of a sanction or disciplinary measure, when necessary, and subsequent validation by Senior Management.
Investigations related to complaints involving the Head of Compliance, Head of Internal Audit and/or against members of Senior Management will be conducted:
- in the person being denounced, except if it is necessary to expose the complaint when interviewing him or her and so recommended by the private mediator referred to in the item below; and
- by the unreported members of Senior Management together with: (i) the Head of Internal Audit (if not reported); (ii) the Head of Compliance (if not reported); and (ii) a private mediator specialized in compliance investigations to be hired by Attrus.
Senior Management, Head of Compliance and Head of Internal Audit must observe the recommendations and investigative processes suggested by the private mediator to be hired. Senior Management must ensure that there are no conflicts of interest between the mediator to be hired and the person denounced and to be investigated.
8.1. Sanctions
The eventual definition and suggestion of applying sanctions resulting from non-compliance with the principles established in this Policy is the responsibility of Senior Management. The application of any penalties, as well as the impacts arising from non-compliance with the provisions of this Policy must be reported to the Head of Compliance.
The following sanctions may be applied: penalties of warning, suspension, dismissal or dismissal for cause, under the terms of the applicable labor regulations and legislation, without prejudice to Attrus's right to claim compensation for any losses suffered, losses and damages and/or loss of profits, through the applicable legal measures.
9. ORGANIZATIONAL INDEPENDENCE
The Internal Compliance Area constitutes a specific, permanent and independent department of the Internal Audit Area, which is in the third line of defense within Attrus's organizational structure, as indicated in section 4 above.
The members of the Internal Compliance Area have competence, sufficient resources and unrestricted access to all information necessary to fulfill their responsibilities independently, as well as have free access to any person and any location related to Attrus.
10. TRAINING AND ORGANIZATIONAL CULTURE
Attrus Employees, regardless of their functions and area of expertise, will receive practical and theoretical training aimed at maximizing their professional development.
The formal training program covers face-to-face training practices, online training and courses. Such training is provided and required depending on the position and function of the Employee, always aiming to qualify him according to his activity and degree of seniority.
All Employees are required to undergo compliance training, including annual training. Such training is mandatory regardless of the area of expertise or degree of seniority.
In addition, targeted and personalized training is also carried out according to the activity performed by each area of Attrus, so that the Employee has practical examples and can correlate compliance practices with their daily life at the institution.
When appropriate, we invite law firms or experts from regulatory bodies to lectures in the various areas of Attrus.
11. POLICY REVIEW
This Policy must be approved by Senior Management, and this Policy and the Annual Compliance Report must be available for a minimum period of five (5) years.
Attrus will review the content of this Policy, the Compensation Policy of the Internal Compliance Area and the Annual Compliance Report at least annually.