Time Lesson Title/Description 9:00 A.M. – 9:15 A.M. Introductions 9:15 A.M. – 10:30 A.M. Know Your Customer, CIP and CDD 10:30 A.M. – 11:30 A.M. KYC Platform 11:30 A.M. – 11:45 A.M. Q&A 11:45 A.M. – 12:00 A.M. Day Two Overview Day Two Course Agenda Time Lesson 9:00 A.M. – 9:15 A.M. Recap from Day One 9:15 A.M. – 10:30 A.M. KYC Scenarios/hands on exercise 10:30 A.M. – 11:00 A.M. EDD 11:00 A.M. - 11:45 Ongoing Relationship 11:45 – 12:00 Conclusion Course Objectives
The earlier of: 1) The date the contract has been signed, or 2) After the first service has been provided to the customer. Examples: When the first State Street generated report from the account is delivered to the customer. When servicing commences, generally by way of a signed agreement noting that services should not be performed until the agreement is signed. Topic 10: Overview of the AML Toolkit Overview The AML KYC Toolkit sets the foundation of our AML Program. The following describes the components of the AML KYC toolkit. Component Description Global AML and Sanctions Policies The Global Policies establish comprehensive policies, principles and standards to protect State Street’s, and its employees, shareholders’ and customers’ from exposure to AML and Sanctions risks. Global AML and Sanctions Business Unit Standard Operating Procedures The Global AML and Sanctions Business Unit Standard Operating Procedures are designed to assist the Line of Defense in meeting regulatory expectations as well as State Street’s expectations on processes, activities, and controls defined as part of the AML and Sanctions’ control environment. Customer Translation Table The Customer Translation Table helps the Business Unit map their existing customer types to the new State Street customer types. KYC Requirements Matrix The KYC Requirements Matrix outlines the Policy requirements for KYC at State Street. It includes a description of each requirement including data and evidence that must be acquired, verified and recorded by customer type. KYC Platform The KYC Technology Platform is a tool created to: Facilitate communication and workflow between Business and AML KYC CoE (Shared Services). Provide a facility for uploading and storing of documents. Create a record of compliance with KYC Procedures. The KYC Technology Platform supports all components of KYC as well as risk rating calculations for customers, where State Street has a regulatory obligation. KYC Platform functionality allows a user to:
Negative News All customers, UBOs and any related and specified controlling parties, and associated third parties must be screened for negative news items, and once analyzed, should be designated as relevant or non-relevant. Negative news can be classified as relevant negative news and non-relevant negative news. The following table provides details related to relevant negative news and non-relevant negative news. Relevant Negative News Non-Relevant Negative News Relevant Negative News is when the customer poses a High-risk. Generally, only negative information that reflects the reputation of the customer for legal or regulatory compliance is relevant, such as: Criminal or regulatory enforcement actions Money laundering or Sanctions violations Other illegal activity that was conducted by or facilitated by the customer Negative financial news or information litigation with customers or competitors also generally is not relevant. Crimes committed against the customer generally may not be relevant, such as embezzlement and/or traffic violation. If there is any doubt whether negative news is relevant, the Business Unit AML Officer must be consulted. In the case of a confirmed match and materiality, the Business Unit will contact the Business Unit AML Officer and AML Compliance Financial Intelligence Unit (FIU) on the same day. Non-relevant negative news largely pertains to less significant instances of the activities described above. The offenses are typically isolated and/or minor in nature. Non-relevant negative news corresponds to incidents that reflect no significant reputational, legal, or financial impact on the customer. It should be noted that, multiple instances of a non-relevant behavior that appear to suggest control issues for an individual or institution may collectively be interpreted as relevant. The following table lists examples of relevant and non-relevant negative news that includes but is not limited to a customer’s and/or related party’s established or reasonably substantiated connections. Relevant Negative News Non-Relevant Negative News Terrorist activity related to AML Misdemeanor criminal convictions or judgments AML and Sanctions non-compliance Unremarkable civil awards, settlements or penalties Violations of AML laws, regulations or sanctions Insignificant or extraneous litigation Drug-related offenses due to cash intensive nature increases AML Risk Rogue employee actions
Capture Entity Data Create Entity in KYC Platform Enter all customer information within the below sections: Customer Details Business Details Supplementary Details Risk Add LE Role – Customer/Account Add additional address(es) Add Product Details Add Associated 3rd Parties Business Unit Upload Request Documents Upload all customer documents that were gathered during CIP and CDD Business Unit Assign KYC Tracking Case Assign to Shared Services Shared Services Manager Validate Validate and ensure that all required information and documentation has been gathered, satisfies all requirements and entered correctly. Shared Services Enrich Client Data Perform Customer Verification – Documentary or Onboard Screenings – Sanctions List and Negative News Screenings Capture evidence & upload as documents Shared Services Refer KYC Tracking Case Refer Case back to previous Stage This can happen at any during tasks #3-6 Shared Services Manager Upload Risk Rating Calculate Risk Rating in CRR Tool Upload results as documents Assign value in Products Details Assign value in Risk Rating Upload screen Shared Services Complete AML Perform escalation for High Risk Rating Value Upload evidence/results as doc Note: During this task, all escalations will be performed outside the KYC Platform and a record of the escalations and work completed by the BU and/or AML Compliance must be captured and uploaded into the KYC Platform. Shared Services Approve for Account Opening Review Approve or Refer Shared Services Manager
Step Action Navigate to the Documents tab and upload the Risk Rating Results as a document (See previous step for Adding a Document) Select the Document Type value as Risk Rating Spreadsheet Click Save and Complete – this will bring the user to the Legal Entity Management screen. Navigate to the Products tab in the Legal Entity Management screen to assign the Risk Rating value at the Product Level, and then select Edit from the icon dropdown to the right of the product. In the Product Details screen, complete the following: Select the Risk Rating Click Save Click Back to navigate back to the Legal Entity Management screen. Navigate to the tab in the Legal Entity Management screen and select the Navigate icon to the right of the task to navigate to the Upload Risk Rating Result screen. The following lists the steps that AML KYC CoE (KYC Shared Services) needs to perform during Task 5 – Upload Risk Rating Results. Step Action In the Upload Risk Rating Result screen, perform the following Select a value for each screening performed and then select the value for the Risk Rating Calculation Click Save and Complete – The system will navigate to the Legal Entity Management screen where the Tasks tab will be updated to the next task Complete AML. Note: Risk Category will not be entered in this screen. In Production, this field will be auto-populated with the value input in the Product Details screen. Task 5 – Upload Risk Rating is complete. Topic 6: Complete AML Overview Once Task 5 – Upload Risk Rating has been completed; the next task is AML Complete. The purpose of the Complete AML Task is to capture any escalations that are required if the Risk Rating Value is High. All escalations will be performed outside the KYC Platform, and a record of the escalations and work completed by the Business Unit and Compliance will be captured as documents and uploaded to the KYC Platform. The following table lists the steps that AML KYC CoE (Shared Services) needs to perform during Task 6 – Complete AML.
Step Action If NO escalation is required, navigate to the Tasks tab in the Legal Entity Management screen and select Complete from the icon to the right of the task. Refresh to bring up the next task Approve for Account Opening – this will move the KYC Tracking Case to the Shared Services Manager’s task queue. The Complete AML task is now complete. Task 6 – Complete AML is complete. 7: Approve for Account Opening Overview Once Task 6 – Complete AML has been completed; the next task is Approve for Account Opening. This is the final task of the KYC AML Process in the KYC Platform. The AML KYC CoE (Shared Services) Manager will review all information and documents that have input into the KYC Tracking Case before providing final approval. The following table lists the steps that AML KYC CoE (Shared Services) Manager needs to perform during Task 7 – Approve for Account Opening. Step Action Navigate to the KYC Platform through the KYC Portal. To review and approve, complete the following: From the Work Queue on the left of the screen, click KYC Tracking Click Review & Approve – This will bring up all KYC Tracking Cases that are in the Review & Approve stage. Click on the ID Link to the left of the correct Case – This will bring up the Case Details screen. The following table lists the steps that AML KYC CoE (Shared Services) Manager needs to perform during Task 7 – Approve for Account Opening. Step Action In the Case Details screen, click the Navigate icon to the right of Approve for Account Opening Task – This will bring up the Manager Review screen. In the Manager Review screen, click the Navigate icon to the right of one of the previously completed tasks – This will bring up the Legal Entity Management Screen.
Identify beneficial owners with a 10 percent (%) or greater ownership interest. AML KYC CoE (Shared Services) Utilize business applications and public domain (open source) data to review and validate the provided documentation to ensure that the customer information is accurate. AML KYC CoE (Shared Services) Conduct site visits for MSBs and other customer types where applicable and document the information obtained in a report. Business Unit AML Officer Add the site report to the customer’s KYC file in the KYC Platform. Business Unit AML Officer Use Prime and WorldCheck to screen the related parties (UBOs, controlling parties, and associated third parties) information against all required lists as specified in Section 4.5.5, Screening. AML KYC CoE (Shared Services) Contact the customer for any additional outstanding information, data and/or documentation needed as a result of a potential match. Business Unit Escalate any potential matches which cannot be dispositioned to AML Compliance for review. AML KYC CoE (Shared Services) If, based on the results of the screenings, AML and/or Sanctions policies and guidelines will dictate the relationship is prohibited, terminate the relationship. Business Unit Capture all information, data and/or documentation compiled during the gathering of requirements. AML KYC CoE (Shared Services) The following table lists the steps that the First Line of Defense performs during EDD. Step Action Owner Send an email to AML Compliance FIU that the Enhanced Due Diligence Customer Profile is available for review in the KYC Platform. The Enhanced Due Diligence Customer Profile must contain the reason for rating the customer or account High Risk. AML KYC CoE (Shared Services) Evaluate the risks presented in the Enhanced Due Diligence Customer Profile by the Business Unit and assign any relevant unique mitigants to manage the risks, which will be captured in the Financial Intelligence Unit Assessment. AML Compliance FIU Request any required additional documentation or mitigants from the Business Unit. AML Compliance FIU Contact the potential customer, if required, to gather sufficient information to answer the specific questions from AML Compliance FIU. Business Unit Complete the Financial Intelligence Unit Assessment. This will include the enhanced procedures required to onboard the High AML Risk customer and outline the monitoring and any other AML Compliance FIU
The following table lists the steps that the First line of defense performs for low and medium risk customers. Step Action Owner Contact the appropriate Business Unit representative 90 calendar days in advance of the Periodic Review. Remember: Low is every three years and Medium is every two years. AML KYC CoE (Shared Services) all data elements into the required/specific fields in the Periodic Review Form and retain the form in the KYC Platform after obtaining all required information, data and/or documentation per the AML KYC Requirements Matrix. AML KYC CoE (Shared Services) Review the information, data, and/or documentation received from the customer, including beneficial ownership. AML KYC CoE (Shared Services) Contact the customer if any of the required information, data, and/or documentation for the Periodic Review Form cannot be obtained. Business Unit Validate that all customer KYC information is up to date and accurate in the customer’s KYC file in the KYC Platform and all customer profiles and associated cases (e.g. alerts, investigation and remediation results) are up to date and accurate. AML KYC CoE (Shared Services) Determine if there are any material changes to the customer’s original information. AML KYC CoE (Shared Services) Re-screen the following customer (account/account holder) and associated party information against all the required lists as noted in Section 4.5.5, Screening, using Prime and Worldcheck: Customer’s full name/business name; Parent holding companies; Owners of the business; Board of Directors; Senior Management; and Country of domicile and country of residence, for the individuals for whom it is required to be obtained as part of onboarding per the KYC Requirements Matrix, should also be reviewed to ensure the BU does not enter into a relationship with prohibited countries. See the Global Sanctions Policy for more information. AML KYC CoE (Shared Services) Review the actual activity against the previously documented expected profile. Business Unit The following table lists the steps that the First line of defense performs for low and medium risk customers. Step Action Owner
Notify the Business Unit of completion of the Periodic Review Form by AML Compliance FIU. AML KYC CoE (Shared Services) Review and acknowledge the risks and any unique mitigants provided by AML Compliance FIU. Business Unit Provide the Periodic Review Form to the Business Unit Chief Operating Officer, equivalent and/or delegate and the MLRO, in certain jurisdictions, for review and sign off. AML KYC CoE (Shared Services) Sign off on the High Risk Periodic Review form to accept the risk presented by the customer at the Business Unit level and retain the documentation along with the KYC information in the KYC Platform. Business Unit Chief Operating Officer, equivalent and/or delegate Review and sign off on the and mitigating activities and/or controls to ensure they are implemented as outlined in the EDD Customer Profile and/or customer file as documented in the KYC Platform. MLRO Receive formal approval prior to increasing or decreasing the risk rating to or from High Risk as a result of Periodic Review. AML KYC CoE (Shared Services) Record all findings and attach all documentation to the KYC profile in the KYC Platform. Business Unit and AML KYC CoE (Shared Services) Record all findings and attach all documentation to the KYC profile in the KYC Platform. Business Unit and AML KYC CoE (Shared Services) 4: Event Driven Reviews Overview The event driven review process involves reviewing issues arising from customer and transaction monitoring and screening. These issues will be handled at the time they arise. An event driven review may be warranted before the next scheduled periodic review due to certain trigger events or changes related to the customer or related parties. Where concerns are raised through these processes, these will be escalated to the Business Unit AML Officer who will determine the required course of action, which may result in closing the customer’s account, refreshing of the KYC file, or modifying the risk rating. An is any activity that could negatively impact the overall AML and/or Sanctions risks associated with the customer. The Business Unit identifies an event through: Manual monitoring Information provided by the customer or from other sources
Customer and other related party names and country (i.e., collective investment vehicle name, pension fund name, name of corporation for corporate cash). Beneficial Owners/Material Shareholders names and country. Check the names of the following against the applicable Sanctions lists using Prime and WorldCheck: Controlling parties and associated third parties. AML KYC CoE (Shared Services) Enter the following information into Prime for individual customers: Full legal name (last name, first name, and middle initial); and City and country of residence. AML KYC CoE (Shared Services) the following information into Prime for other related parties (if applicable): to the KYC Requirements Matrix for the related parties’ information to be captured and Appendix G. Information required to be identified in relation to third parties (such as Beneficial Owners) each as defined in the Global AML Policy, must be screened at the time of account opening. AML KYC CoE (Shared Services) Perform investigative to determine whether the customer or related party being screened is the individual or entity against whom the various government have leveled sanctions if a potential match is identified. AML KYC CoE (Shared Services) The following lists the steps that AML KYC CoE (Shared Services) performs to screen the customer. Step Action Owner Compare the name of the customer or related party being screened to the name of the sanctioned party. If no combination of the first and last names of the individual or entity matches those of the sanctioned party, this should be considered a Negative Match (as defined below) and there is no need to proceed to the next steps. It is important to also compare the name of the individual or entity identified screened to all alternate names, or “AKA” shown for the sanctioned party. In the case of businesses/organizations, perform this analysis for the business/organization name. Compare the individual’s DOB (Date of Birth) and POB (Place of Birth if applicable/available) with those shown for the sanctioned party. Compare the individual’s or entity’s identification data to that shown for the sanctioned party. If information sufficient to clear the potential match cannot be obtained, the potential match should be forwarded to the respective Business Unit. AML KYC CoE (Shared Services) If there is a potential match, determine which of the below four scenarios applies: AML KYC CoE (Shared Services)
False Positive The individual or entity identified in the new or ongoing Sanctions screening matched that on the Sanctions List, which was determined to be a false positive based upon address/location not matching the Sanctions list. The individual, Tony Blair, located in Livingston, Zambia, identified in the new or ongoing Sanctions screening as a potential match, was determined to be a false positive based upon location/address not matching the Sanctions List individual, Anthony Charles Lynton Blair, London, England. Positive The individual or entity identified in the new or ongoing Sanctions screening matched that on Sanctions where the potential match was determined to be a false positive based upon name and nationality/address not matching the Sanctions List. The individual, Tony Frederick Blair, of Livingston, Zambia, identified in the new or ongoing Sanctions screening had a potential match, but was determined to be a false positive based upon name not matching the Sanctions List individual, Anthony Charles Lynton Blair of the United Kingdom. Escalation Process When Sanctions related alerts, whether identified at onboarding or ongoing screening, are not timely cleared, the following escalation process will be followed by AML Compliance: Timeframe Escalating parties After five calendar days VP – Business Unit Business Unit Sanctions Compliance Officer GS Compliance Mailbox ten calendar days SVP – Business Unit Business Unit Sanctions Compliance Officer Senior Compliance Officer Global AML Officer GS Compliance Mailbox After fifteen calendar days EVP – Business Unit Business Unit Sanctions Compliance Officer Senior Compliance Officer Global Chief AML Officer Chief Compliance Officer
Topic 11: Board and Senior Management Reporting Overview AML and Sanctions reporting to the board supports State Street’s AML and Sanctions Compliance Program that: Outlines the governance structure, policies, procedures, and standards of Street. Ensures compliance with all relevant laws, codes, rules, regulations, and standards of good business practice. The First Line of Defense is responsible for gathering relevant AML and Sanctions data for senior management and board reporting. Data can be provided on an ongoing basis, or based on ad hoc requests from either senior management and/or AML Compliance. AML Compliance maintains a list of Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs), it collects from the First Line of Defense. In addition to KRI/KPI metrics, AML Compliance and/or State Street management may request information related to: AML and Sanctions projects and initiatives. Records of AML and Sanctions related training. The following table provides details about KRI/KPI for Accounts, Activity, and Assessments. Accounts Activity Assessments Customers (Customers) Accounts Funded Accounts Missing Risk Rating Funded Accounts Missing Documentation Overdue Normal Risk Account Reviews Overdue Higher Risk Account Reviews Normal Risk Accounts High Risk Accounts High Risk Accounts Approved High Risk Accounts Declined Accounts in High Risk Jurisdictions Accounts where UBO is a PEP Accounts for Other High Risk Business Unauthorized Investors Positive Sanctions Hits Sanctions Cases 1-5 Days Sanctions 6-30 Days Sanctions Cases 30+ Days Potentially Suspicious Referrals to the FIU Number Of Exceptions > 30 Days Number Of Exceptions > 60 Days Number Of Exceptions > 90 Days SARs Filed (by Event Type) 314(a) Positive Hits 314(b) Positive Hits PEP Cases Aged 0-30 Days PEP Cases Aged 31-60 Days PEP Cases Aged 61-90 Days PEP Cases Aged 91+ Days AML-Related Regulatory Examinations AML-Related Regulatory Issues Receive AML-Related Regulatory Issues Outstanding AML-Related Corporate Audit Issues Received AML Related Corporate Audit Issues Outstanding Future Regulatory Examinations Expected in Current