Onboarding Clients: Anti–Money Laundering Responsibilities during COVID-19

Subsequent to the disruption that COVID-19 has caused, locally and internationally, businesses and legal entities are questioning their client onboarding responsibilities and obligations in terms of AML legislation. On a more local level, what must subject persons as per Maltese AML legislation, more specifically the Prevention of Money Laundering and Funding of Terrorism Regulations (S.L. 373.01) (PMLFTR) look out for now that freedom of movement is severely limited due to COVID-19?

Regulation 7 of the PMLFTR obliges a subject person, that is “any legal or natural person carrying our relevant financial business or relevant activity”, to complete the necessary customer due diligence when taking on a client in order to legitimately proceed with a business relationship with that client. Whereas the actual regulation includes four parts or steps, the last being that of “maintenance” of the business relationship, or as described, “conducting ongoing monitoring of the business relationship”, onboarding is three-fold, in that it consists of: – The identification of the customer and the verification of that identity based on documentation, data and information obtained from a reliable and independent source; – Identification, where applicable, of the beneficial owners, and taking reasonable measures to understand the ownership and structure of the client; and – Assessing and gathering information of the purpose and the intended nature of the business relationship and establishing a risk profile/assessment of the client.

Indisputably, pre-COVID–19, these tasks were not without their difficulties. From a practical aspect, customer due diligence obligations place an onerous burden on the subject person, in that obtaining this information from an individual with whom, at that point in time, you have no relationship with – and who might not understand why you are asking for such information – might result in discouraging the prospective client from forming a business relationship with you and ultimately inhibit you from securing and closing a deal. Add COVID-19 to this, the question flows: how is one to handle said tasks in circumstances where self-isolation and social distancing are the order of the day?

The new face-to-face

The Financial Intelligence Analysis Unit (FIAU) Implementing Procedures Part 1 states that. “Interacting with customers on a non-face-to-face basis need not be considered as automatically presenting a high risk of ML/FT”. Although face-to-face interaction, i.e. the very basic form of client interface, and the most desirable in terms of customer due diligence obligations, is no longer possible, this does not necessarily mean that a client has to be considered as high-risk. Prior to COVID-19, IP1 already catered for “technological means” that can be used in lieu of actual “in the same room” face-to-face interaction. However, a subject person must have the relative checks in place, that is systems addressing identity fraud and impersonation. It is without these measures that a client will be deemed as high-risk. At the moment, video conferencing is the new face-to-face, and everyone’s new “normal”.A subject person must exercise the utmost caution. Instead of attributing the same percentage of attention and prominence to all three steps as priorly listed, one must inevitably recalibrate the emphasis placed on each part.

For example, instead of scheduling a meeting with a client at your office as you normally would have done pre-COVID-19, and if your client cannot, for some reason or another, “meet” you via a conference call or video chat, you would therefore need to verify the identity of that client based on further documentation and data requested under normal circumstances. This means that your previous standard onboarding client checklist – that might have in the past proved satisfactory – must now be readjusted in such a way soas to provide more information. Therefore, the process of identification and verification must be extended and this in direct relation to the third phase of gathering evidence which must become longer and far more time consuming.

Another useful indicator to help the subject person determine whether he or she should take on the client is the client’s cooperation. Should the client prove to be difficult in providing that which is requested of him or her by the subject person without a justifiable reason that in itself assists the subject person in gauging the worth of the business relationship with the client.

Compiling documentation and information

Customer due diligence, whilst imposed on the subject person via legislation, and therefore creating liabilities, is still entangled in the concept of subjectivity based on “reasonableness”. A subject person must firstly identify the nature of the business relationship requested, in that it can either be an ongoing business relationship or an occasional transaction. One can achieve this by spending more time communicating with the prospective client, albeit virtually,and using longer timeframes in order to understand fully the nature of the business relationship requested, with the expectation of potentially establishing such relationship. Having established this rapport, and having already gathered the basic KYC documentation then a subject person should ask for further documentation in order to start compiling a risk assessment and proceed with what can be described as ‘fact finding’ by the subject person. It is to be noted that verification of client’s documentation has become more challenging only because certified copies are harder to obtain since no professional is providing them. Therefore one must really evaluate the reliability of the source, by determining, but not only, the independence of that source from the client.

Furthermore, will non-certified copies now be accepted? COVID-19 requires subject persons to gather more evidence than normally requested for that type of client under normal circumstances from different sources and countercheck said documentation and data where possible, simply because certain physical interactions can no longer be held. Having said this, though, are today’s circumstances creating burdens that are so very different from circumstances pre-COVID-19? A subject person always had the obligation to conduct searches online and check all compliance databases available to him or her. This assignment has now been stressed further since some sources have become less available. Let us remember that when accessing and checking certain sources, such as databases, one has to consider the nature of the database being used – is it updated regularly, are there other controls which validate this database, is it reliable? Due to COVID-19 certain mechanisms have come to a halt and what might have in the past been reliable, might be less so at the moment. Under these present circumstances further checks have to be made and greater standing and weight given to compiling a profile and to the risk-based assessment adopted – which however remains subjective to the subject person.

Challenges and liabilities

Issues such as false positives, albeit more difficult to presently handle, have and will always remain an issue for a subject person where the latter would spend substantial amount of time and money investigating other sources to identify the risk related to that client, and therefore time-consuming measures adopted in that area should not be attributed to the new reality of COVID-19.

In cases where the subject person or the person responsible for customer due diligence is in self-isolation or is actually ill with COVID-19, the subject person retains the responsibility imposed on it by law. A staff member in isolation can work remotely and proceed with the checks that he or she would have at the office. It is practical to always have access to the relevant company servers/databases wherever one continue operating and if not, now is the time to create a system in which folders and files become shared. If one is ill and unable to perform then these responsibilities have to be shifted onto someone who is able to work.

Amongst COVID-19-induced uncertainty, what is certain is that AML obligations and requirements have not been waived simply because compliance cannot be afforded. The repercussions are too grave – even though other considerations, such as those of financial cutbacks, economic decline resulting in lack of business, and difficulties of enforcement – being that even the courts are closed except for that which is necessary and urgent – can adversely affect the very creation of client-professional relationships. Even within a COVID-19 scenario, it is better to be safe than sorry in terms of client onboarding – all the more so since utmost caution is advised and expected.

For information on how we may provide assistance with your AML/CFT needs, please contact Dr Christina M. Laudi, Partner – christina.laudi@thecitylegal.com

DISCLAIMER: The information contained in this document does not constitute legal advice or advice of any nature whatsoever. Although we have carried out research to ensure, as far as is possible, the accuracy and completeness of the information contained in this article, we assume no responsibility for inaccuracies, errors or other inconsistencies herein.