‘Who are you? Who, who, who, who? I really wanna know.’ So begins the theme tune to the popular US TV crime drama CSI: Crime Scene Investigation. The lyrics are entirely appropriate for a show with the identity of the victim or the killer at the centre of every episode. Fittingly, the band that originally recorded the song was also called The Who.
Identity – the who of you – is central to customer due diligence. This is the process by which a firm assesses the customer’s level of risk according to its risk-based approach. It’s also a legal requirement for regulated firms to prevent the financial system being used to launder money or finance terrorism.
The introduction of a risk-based approach and modernisation of AML has broadened the remit of customer due diligence to include know your business, and even know your customer’s customers, which is especially relevant for card acquirers in master merchant or payment facilitator scenarios.
Why focus on the who?
Regulated entities must verify customer identities using reliable, independent source documents, data, or information. They must understand the purpose and intended nature of the customer’s relationship with their firm and collect information about the client organisation and their beneficial owners where applicable.
This should be sufficient to obtain a complete picture of the risk associated with the business relationship. It also helps provide a meaningful basis for establishing what is normal for a customer, so unusual or out-of-pattern behaviour stands out more clearly. And informs ongoing customer due diligence and monitoring.
While performing adequate customer due diligence is a regulatory requirement from an anti-money laundering (AML) and countering the financing of terrorism (CFT) point-of-view, it’s also good business practice generally for understanding and pricing risk.
When it comes to card acquiring, acquirers guarantee their merchant’s card sales at the time of purchase and into the future. If merchants are selling goods and then failing to deliver them, providing goods not as described, processing sales more than once, failing to seek authorisations and so on, then this opens acquirers up to possible chargebacks.
Too many chargebacks could mean card scheme fines and possible licence revocation in the worst-case scenario. There’s also the reputational damage if merchants have caused consumer disgruntlement, financial loss, or even death in the case of pharmaceutical sales. The antidote to all this is good due diligence, which brings us back to identity.
Ultimate beneficial owners explained
Regulated entities must get behind the ownership and control structure of a business and identify its ultimate beneficial owners or UBOs.
These are the natural persons who ultimately own or control the customer company or the natural persons on whose behalf a transaction or activity is conducted. It also includes those who exercise ultimate effective control over a legal person or arrangement.
The Fourth European Anti-Money Laundering Directive defines a 25% ownership threshold for beneficial owners, although other jurisdictions may work with different numbers.
Unravelling corporate ownership structures can be complex. Companies can be owned by natural persons or legal entities, for example other companies or trusts ‘stacked’ on top of each other, where each company holds some or all of the shares in the one below it. These arrangements may also exist cross-border.
The 25% threshold is helpful but shouldn’t be applied in an arbitrary manner. Context is everything and UBOs with less than 25% ownership could still warrant a follow-up.
For example, a company may have three beneficial owners, two of whom own 49% of the shares and the third owns 2%. Because this third owner could join together with one of their co-owners in votes, they potentially have an influential role in corporate decision-making, disproportionate to their ownership. They effectively have the casting vote.
Regulated entities must identify and verify UBOs on an ongoing basis, recording their full names as a minimum. Additional information, such as date and place of birth, nationality and address may also be retained. Furthermore, it’s advisable to document corporate ownership and control structures, along with the reasons for any complex or opaque structures.
How Web Shield can help
Web Shield has added a new feature to its InvestiGate platform to help make customer due diligence and record-keeping quicker, easier, and more effective: With UBOReveal, our team of experts retrieves corporate documents that are necessary to identify UBOs from the corresponding online register. This includes documents relating to the client’s business but also those of its parent and any further holding companies, until the ownership structure is resolved. All findings concerning shareholders and UBOs as well as documents retrieved are compiled into a single pdf report for record-keeping and monitoring purposes. Contact sales@webshield.com for more information on InvestiGate or UBOReveal.
Over the last six years, more than 600 risk professionals have graduated from the Web Shield Academy. In addition to our popular, in-person courses, we’re now bringing the Academy to students, wherever they are, with a range of new online courses. One of these is Fundamentals of Anti-Money Laundering, a general introduction to the topic which includes an in-depth discussion of UBOs. Coming soon are two follow-up courses focussed on money laundering in payments and building an effective AML framework.
About Christian Chmiel
About Web Shield
Every day we send out a free e-mail with the most important headlines of the last 24 hours.
Subscribe now