The Commission has today published an additional FAQ under the FC&A tab regarding the certification of copy documentation requirements and best practice.

The FAQ can be found at the top of the Financial Crime Supervision and Policy Division’s FAQ page here. http://bit.ly/1xboYiX AND BELOW

Certification of Copy Documentation Requirements and Best Practice

Introduction

Rule 100 of the FSB Handbook and rule 114 of the PB Handbook require that a business takes adequate measures to mitigate the specific risks of non-resident individual customers, to complement those which are required for face-to-face customers. One of these measures includes requiring additional documents.

Where the additional documents obtained are copies of original documentation, rule 101 of the FSB Handbook and rule 115 of the PB Handbook state that the business must ensure that the copy documents have been certified by a suitable certifier.

Purpose of Certification Requirement

The certification requirement is intended to ensure that the business is not provided with fraudulent or misleading documentation as part of the CDD being undertaken of a business relationship or occasional transaction.  The successful use of an “unsuitable certifier” can allow criminals or terrorists to have copies of either stolen identity documents or fraudulently obtained identity documents certified to facilitate, for example:

• The formation of companies utilising fraudulently obtained certified identity documents, hiding the true identity of the criminal / terrorist; and
• The creation of “ghost accounts” (accounts opened utilising fraudulently obtained certified identity documents) through which proceeds can be funnelled.

Purpose of Certifier Requirement

The certifier should be a trusted third party who is providing assurance that the document is a true copy of an original document (or extract thereof) or that the document provided shows the true likeness of the individual, whom the certifier has actually met face to face.

Use of a certifier guards against the risk that identification data provided does not correspond to the individual whose identity is to be verified or the documentation which alleged to have been copied and upon which the business plans to rely.

Policies, Procedures and Controls

The effectiveness of this control depends upon the individual who has certified the documents having actually seen and verified the original documentation or having actually met the individual, as the case may be.  Assessing the suitability of the individual who has certified the documentation is a critical component of ensuring that this control is effective and should be relied upon by the business.

As part of good practice, a business should have, as part of its compliance arrangements:

• A policy and procedures which reflect its risk appetite towards relying upon certified documents;
• Its policy in relation to those individuals whom it considers to constitute “suitable certifiers”; and
• Procedures to verify the suitability of those who have certified documents on which it intends to rely.

Nature of Certification

The basic requirements are described in sections 4.5.2 of the Handbooks.  It is important that the staff of a business understand the difference between the certification required in relation to identification documents and other documents.

Documents which are provided to evidence the identity of an individual must be certified with the statement that the document is a true likeness of the subject individual.  This means that the certifier must have met the individual on a face to face basis.

Businesses should not rely on copies of previously certified documentation which has been re-certified, unless it can verify that the current certifier has actually seen the original documentation or met the individual in question.

Suitability of Certifier

As part of its compliance arrangements relating to CDD, businesses must give consideration to the suitability of a certifier based on the assessed risk of the business relationship or occasional transaction, together with the level of reliance being placed on the certified documents (See Rule 103 of the FSB Handbook and rule 117 of the PB Handbook).

The Commission considers it to be good practice for a business, as part of its compliance arrangements, to have in place a policy and procedures, which explains its assessment process to determine whether an individual is “suitable”, and therefore place reliance upon the certified material provided.

The risk appetite of the business should inform its policy in relation to which types of individuals it will consider to be suitable certifiers.  Key to this is ensuring that there is a means by which the individual’s honesty and integrity can be relied upon, so that the risks of misrepresenting or fraudulently making the required certification, are minimised.

The types of factors that could be taken into account in making this assessment, include whether:

• The individual holds an appropriate public position with a high level of trust and for which background checks or similar vetting of their fitness and propriety has occurred (e.g. a member of the judiciary, customs officer, officer of an embassy, consulate or high commission of the country or territory who has issued the passport or ID, or a serving police officer);
• The individual is a member of a professional body which undertakes independent oversight of compliance with its own rules or standards of professional conduct (e.g. a lawyer, notary, actuary, accountant who  is a member of a recognised professional body);
• The individual is required to satisfy criteria similar to the “fit and proper” requirements of the minimum licensing criteria in Guernsey and are required to be vetted or approved as part of the regulation in the jurisdiction in which it operates (e.g. director, partner, controller, persons holding a controlled function, MLRO, General Representative of a financial services business);
• The individual is employed by another business which forms a part of a group of which the business is also a member, where the same or equivalent AML/CFT policies procedures and controls apply;
• The individual is subject to other professional rules or member of an industry body (or equivalent) providing for the integrity of conduct;  and
• The individual is not closely related to the person whose identity is being certified (e.g. immediate family member, spouse).

Businesses must also exercise caution, especially where such documents originate from a country or territory perceived by the financial services business to represent a high risk, or from unregulated entities in any country or territory.

Contents of the Certification

Rule 106 of the FSB Handbook and rule 120 of the PB Handbook require that a certifier sign and date the copy document and provide adequate information so that contact can be made with the certifier in the event of a query.

The Commission considers that as part of good practice, “adequate information” means:

• The full name of the certifier (i.e. not just the signature);
• The  location where the document was certified (e.g. St Peter Port, Guernsey);
• The professional position or capacity held by the certifier;
• A contact telephone number; and
• An email address at which the certifier can be contacted.

This information may be provided either on the certified document or attached to that document by way of email or other record, which accompanies the certified document.

Verification Enquiries about a Certifier

Procedures should clearly explain the risk-based process by which verification of the identity and position held by the certifier should occur.  The Commission considers best practice to include a greater degree of enquiry to be undertaken given:

• The risk profile of the business relationship or occasional transaction;
• The level of reliance being placed on the documents; and
• Whether the documents originate from a country or territory perceived to represent a high risk or in relation to an unregulated entity.

A business should also consider whether the degree of reliance to be placed in those cases where the certifier is not previously known to the business.  Importantly, the capacity or position of the certifier should be independently verified.

It is also important to check on a risk-basis that where a certification relates to the true likeness of an individual, that the certifier has actually met the individual in person.

Ongoing Monitoring Measures

Businesses should consider, on a risk basis, as part of their ongoing risk relationship monitoring contacting a certifier to ascertain whether any circumstances have changed with respect to the subject individual which would change its known risk profile.  This is particularly relevant where publically available information is not on offer by internet research or where there is no customer relationship manager involvement.

Electronic Certification

Businesses should be aware that the reliance upon alternative methods is a matter for their assessment based on their understanding of the veracity of the certification process.

http://bit.ly/1xboYiX