The Fifth Pillar of AML/BSA Compliance: Final Rule for New Customer Due Diligence

1. The “Fifth Pillar” of AML / BSA ComplianceFinal Rule for New Customer Due DiligenceThe views expressed in this presentation are strictly those of the author and do not necessarily represent the views of BB&T Bank. Carolinas Credit Union League – January 18, 2017

2. Learning Objectives: At the end of this presentation, participants will be able to: Articulate the tenets of FinCEN's final rule on obtaining and retaining beneficial ownership information; Position their organizations to comply with the new beneficial ownership rules by offering ideas for any needed changes to processes, procedures or systems; and List instances where obtaining and retaining beneficial ownership information may be helpful to monitor BSA/AML risk. Carolinas Credit Union League – January 18, 2017

3. Customer Due Diligence Notice of Proposed Rule Making How We Got Here Carolinas Credit Union League – January 18, 2017

4. Why The Need For Additional Due Diligence • United Nations identified abuse of illegal entities as an international problem as far back as 1998 • Concern regarding risks with shell companies and trusts identified in 2007 National Money Laundering Strategy • Government Accountability Office (GAO) reports focused on vulnerabilities with company formation in the United States • Department of the Treasury’s attempts to address beneficial ownership challenges through legislation never gained traction Carolinas Credit Union League – January 18, 2017

5. Why The Need For Additional Due Diligence • Law enforcement has repeatedly reported that major drug trafficking organizations use shell companies to launder drug proceeds • Increased global focus on financial transparency through G7; G8; G20 and FATF • Reliance of FATCA and corresponding foreign approaches to tax reporting on beneficial ownership collected through CDD Carolinas Credit Union League – January 18, 2017

6. Financial Action Task Force (FATF) • United States was primarily criticized for: • lack of sufficient Customer Due Diligence (CDD) regulatory requirements, particularly for capturing information on beneficial ownership • lack of requirements to collect beneficial ownership information under company formation laws Carolinas Credit Union League – January 18, 2017

7. The Life Cycle of the Fifth Pillar Carolinas Credit Union League – January 18, 2017

8. Actions on CDD and Beneficial Ownership • Interagency Guidance—compilation of regulations, rulings and guidance covering CIP, private banking & correspondent banking was issued in 2010 • Advanced Notice of Proposed Rule issued in March 2012 • The Final Rule for the establishment of a risk based Customer Due Diligence program was imposed July 11, 2016 • Covered financial institutions must be fully compliant by May 11, 2018 Carolinas Credit Union League – January 18, 2017

9. Customer Due Diligence Requirements for Covered Financial Institutions Considerations for the Final Rule Carolinas Credit Union League – January 18, 2017

10. Understand the tenets of the new rule • Begin to examine how the new rule will affect your institution • What processes and departments will be impacted? • What will need to be updated? Policies, procedures, job aids, training programs? • What systems are involved? Do I need to rely on outside vendors or internal systems for compliance? Do I have the right systems? • How will I prepare people for the changes? Are these significant or minor changes? • Build a coalition of affected stakeholders • Begin to develop a plan, and provide internal education to your stakeholders Carolinas Credit Union League – January 18, 2017

11. Customer Due Diligence Requirements for Covered Financial Institutions Key Elements of the New Regulation Carolinas Credit Union League – January 18, 2017

12. Key Elements (1 of 6) • Applicability Date: Implementation period extended from one to two years. • Applicability of beneficial ownership requirement to existing accounts: Rule maintains risk-based approach to identifying and verifying the identity of beneficial owners for existing accounts. • BO identification and certification form: Rule provides Certification Form (Appendix A) as an option rather than requirement; certification to the best of the certifying person’s knowledge required. Carolinas Credit Union League – January 18, 2017

13. Two “Prongs”: Identify “Natural Persons” with 25% or more Ownership of the “Legal Entity” Ownership Identify at least One Individual with Responsibility to Control, Manage or Direct the “Legal Entity” Control Carolinas Credit Union League – January 18, 2017

14. Standard Certification Form Information Requirement • (Appendix A of FinCEN document) • TOP PORTION OF FORM – OWNERSHIP PRONG • Name and Title of Natural Person Opening Account • Name and Address of Legal Entity for Which the Account is Being Opened • Following info, each PERSON with 25% or more equity interest: • Name • DOB • Address: residential or business STREET address • For U.S. persons: SSN • For foreign persons: Passport # and Country of Issuance, or other similar ID # Page 1 of 3 of Form Carolinas Credit Union League – January 18, 2017

15. Standard Certification Form Information Requirement • (Appendix A of FinCEN document) • FORM CONTINUED – CONTROL PRONG • Information for one individual with significant responsibility for managing the legal entity: • An executive officer or senior manager (e.g., Chief Executive Officer, Chief Financial Officer, Chief Operating Officer, Managing Member, General Partner, President, Vice President, Treasurer); or • Any other individual who regularly performs similar functions. • Name / Title • DOB • Address: residential or business STREET address • For U.S. persons: SSN • For foreign persons: Passport # and Country of Issuance, or other similar ID # Page 2 of 3 of Form Carolinas Credit Union League – January 18, 2017

16. Standard Certification Form Information Requirement • (Appendix A of FinCEN document) • FINAL PORTION OF FORM • Attestations: • I, ________________ (name of natural person opening account), hereby certify, to the best of my knowledge, that the information provided above is complete and correct. • Signature: ______________________________ Date: ___________ • Legal Entity Identifier ___________ (Optional) Page 3 of 3 of Form Carolinas Credit Union League – January 18, 2017

17. Key Elements (2 of 6) • BO verification of identity: Rule allows FIs to generally and reasonably rely on copies in the case of documentary verification and only requires elements of CIP rule rather than identical procedures. • BO verification of status: Rule clarifies that FIs may generally and reasonably rely on certification of the customer. • Use of BO information: Rule clarifies that FIs should use BO information as they use CIP information to facilitate compliance with other requirements (e.g., sanctions screening and CTR aggregation reporting), except for 314(a) information-sharing requests. Carolinas Credit Union League – January 18, 2017

18. Key Elements (3 of 6) • Definition of Beneficial Owner: • Clarifies that information collected is a snapshot subject to risk-based updates; • Maintains ownership prong at 25% direct or indirect ownership by natural person; • Maintains control prong; • Establishes a trustee as the BO in cases where a trust owns 25% or more of a legal entity customer. Carolinas Credit Union League – January 18, 2017

19. Key Elements (4 of 6) • Legal Entity Customer: Rule further clarifies that entities that fall within this definition include a corporation, LLC, or other entity created by the filing of a public document with a Secretary of State or similar office; a general partnership, and any similar entity formed under the laws of a foreign jurisdiction, that opens an account. Rule maintains exclusion of trusts, sole proprietorships or unincorporated associations. • Account: Rule refers to definition used in CIP rules, which excludes ERISA accounts. • Legal Entity Customer Exclusions: • Adopts all ten exclusions from NPRM except Charities and Nonprofit Entities, which are now subject to the control prong of the BO definition; • Expands exclusions to include the following additional regulated entities: (i) Bank Holding Companies; (ii) Pooled Investment Vehicles Operated or Advised by an Excluded FI; (iii) State Regulated Insurance Companies; and (iv) Financial Market Utilities designated by the FSOC; Carolinas Credit Union League – January 18, 2017

20. Key Elements (5 of 6) • Legal Entity Customer Exclusions (cont.): • Expands exclusions to include the following foreign entities: (i) Foreign FIs where the relevant foreign regulator holds BOI; Non-U.S. Governmental Subdivisions that engage only in governmental rather than commercial activities; • Expands exclusions to include any Legal Entity Customer only to the extent that it opens a private banking account; • Only requires FIs to obtain BOI under the control prong of the BO definition for Non-excluded Pooled Investment Vehicles; • Clarifies that the Intermediary is the customer in intermediated accounts and that the BO requirement applies to the intermediary rather than the intermediary’s customers (BOI is not KYCC); • Treats Escrow and Client Trust Accounts as intermediary accounts; Carolinas Credit Union League – January 18, 2017

21. Key Elements (6 of 6) • Covered Financial Institutions: Rule confirms coverage of CIP-covered FIs; need for and interest in dialogue with other types of FIs to appropriately consider possible extension of CDD requirements. • New Account Exemptions: Rule exempts: • Private Label Retail Credit Accounts Established at the Point-of-Sale and with credit limits up to $50,000, but not for cards co-branded with major credit card associations; • Accounts Established to Purchase and Finance Postage; Commercial Accounts to Finance Insurance Premiums; and Accounts to Finance the Purchase or Lease of Equipment subject to third party payment and cash refund prohibitions. Carolinas Credit Union League – January 18, 2017

22. CDD /Beneficial Ownership Tools Carolinas Credit Union League – January 18, 2017

23. NIST Cybersecurity Framework Carolinas Credit Union League – January 18, 2017

24. Money Laundering Process - Review Carolinas Credit Union League – January 18, 2017

25. Sidebar: Some Additional Terminology • ‘Perplexity through use of a Fraudulent Company’ • Shell: Legal entity without assets • Shelf: Legal entity formed/registered but not yet used • Front: Legitimate business adding illicit funds to earnings Carolinas Credit Union League – January 18, 2017

26. Transaction Monitoring for ‘Bene’ • CHALLENGES • VARYING FORMATS • VARIANCE IN DATA CONTENT • AML 4 “V’s” • Volume • Velocity • Value • Variance CHIPs FEDWIRE Carolinas Credit Union League – January 18, 2017

27. Transaction Monitoring for Beneficial Ownership Payment Monitoring → Automation Tools • Compliance Processes: • BSA/AML Program • Transaction Monitoring • CDD • EDD • CIP • OFAC, Sanctions, etc. • Beneficial Ownership • Customer Data • Customer Activity • Related Activity (i.e. between entities) • Payments Inputs: • Core Systems • DDA/SVG • Treasury Systems • CIF/PII Sources • Online Banking • Mobile/Other • Card (Credit/Debit) • Internal Transacting • Etc. • External • Other FI’s • Card Networks • Electronic Networks • Etc. Payment Software Applications Carolinas Credit Union League – January 18, 2017

28. Key Takeaways (1 of 3) • Final Rule is substantially similar to the Proposed Rule and retains a risk-based approach supported by clear baseline requirements. • Beneficial Ownership is an Extension of CDD/CIP. • Look for Cybersecurity Integration to BSA/AML. • Transactions are an Important Component – Use cases: • Payment data details can be used to enhance efforts; • “Data in Transit” is an opportunity to support compliance. Carolinas Credit Union League – January 18, 2017

29. Key Takeaways (2 of 3) • Unprecedented BSA regulatory development, outreach and preparation efforts preceding issuance of the Final Rule. • Significant percentage of covered FIs already implementing beneficial ownership requirements. • Extended implementation period provides FIs with the time to adapt IT systems, training, onboarding systems and processes, policies and procedures, and educate customers as necessary to comply with Final Rule. Carolinas Credit Union League – January 18, 2017

30. Key Takeaways (3 of 3) • Implementation of Final Rule does not rely upon but will benefit from Congressional legislation enacting meaningful company formation reform regarding beneficial ownership information. • Active support from the financial services industry needed to facilitate Congressional legislation enacting meaningful company formation reform. • Compliance function should capitalize on the rule to strengthen risk management and the compliance culture across their institutions. Carolinas Credit Union League – January 18, 2017

31. Carolinas Credit Union League – January 18, 2017

32. Resources https://www.financialservicesperspectives.com/2016/07/the-fifth-pillar-of-amlbsa-compliance-fincen-issues-final-rule-for-new-customer-due-diligence-requirements-under-the-bank-secrecy-act/ http://www.bankerstoolbox.com/wp-content/uploads/wpaper_CDD_newrule.pdf http://www.fatf-gafi.org/topics/fatfrecommendations/documents/internationalstandardsoncombatingmoneylaunderingandthefinancingofterrorismproliferation-thefatfrecommendations.html Carolinas Credit Union League – January 18, 2017