Structural Prerequisites

1. The Money Transmitter Compliance ProgramA Quick Training for Compliance OfficersPresented by:Juan Llanos, CAMS - juanbllanos@hotmail.comAlan Unangst, CAMS - aunangst@crowechizek.comFabio Fernandez, CAMS - fabio@prontomt.com

2. Juan Llanos, CAMS juanbllanos@hotmail.com Structural Prerequisites © 2006 Juan Llanos

3. Juan Llanos, CAMS juanbllanos@hotmail.com Form Handbooks, written policies, talk (lawyers, public relations) Substance Operationalization, quality, walk (compliance officers, managers, leaders) © 2006 Juan Llanos

4. Juan Llanos, CAMS juanbllanos@hotmail.com How L+C+H Interrelate • Leaders and founders role model acceptable behavior and influence hiring, i.e., their actions and omissions create… • Culture, in turn, is assimilated by employees through socialization and observation, and is reinforced via… • HR practices and omissions: selection, performance evaluations, training, promotion, etc. Bad leadership = unhealthy culture Unhealthy culture = Enron, Riggs, AmSouth, etc… © 2006 Juan Llanos

5. Juan Llanos, CAMS juanbllanos@hotmail.com Principles / Beliefs • Compliance • must be a C-level position • is cross-functional / -hierarchical • is an investment center • must be operationalized in business processes • is more about attitude and behaviour than about knowledge of laws and facts • Leaders’ actions and omissions –the tone they set from the top– have an enormous impact on the organization • Leaders must actualize commitment by providing authority, resources and public support • Ultimate responsibility lies with the Board © 2006 Juan Llanos

6. Juan Llanos, CAMS juanbllanos@hotmail.com Evolution VALUES AND CULTURE REGULATORY RELATIONSHIP Minimum Standards As little as can get away with Unthinking, mechanical Policing Enforcement lesson Basic training Compliance Culture By the book Bureaucratic Supervising / Educating Look for early warnings Themed, focused visits Beyond Compliance Risk focused, self-policing Ethical business Educating / Consulting Culture development Lighter touch Values-based Spirit, not just letter Focus on prevention Strong learning Mature relationship Reinforce best practice Benchmark Reallocate resources to problem firms © 2006 Juan Llanos Source: Financial Services Authority, UK

7. Using the Risk Assessment to Drive your AML Program • Identify Specific Inherent Risk Categories • Products/Services and related entity agreements - complexity • Agents – training, experience, supervision/compliance reviews, record keeping and contractual agreements • Customers – identification requirements, recordkeeping and volume • Geographic Locations – regional/national vs. international • Transaction monitoring systems – automated/manual, aggregation • Transaction Volume – frequency, amount and tracking capabilities • Investigations and filing Suspicious Activity Reports (SARS) • OFAC – compliance, review and timeliness of reporting requirements, SDN lists • Organizational factors including your size, market share, structure and complexity of your business • Correspondent Accounts – documentation and settlement

8. Using the Risk Assessment to Drive your AML Program • Risk Rank Each Category • Use available data and document workflows • Interview process • Identify greatest inherent risk categories • Risk rank high/medium/low • Gap Analysis • Review status of outstanding independent audit findings/exams • Identify new issues • Non-compliance with internal policy or regulations • Violations of law (VOL)

9. Using the Risk Assessment to Drive your AML Program • Managing Risk • Project Planning/Execution • Written Policies and Procedures • Monitoring/Self Testing • Internal controls • Transaction Monitoring Systems • Agent location compliance reviews • Reporting and record keeping • Training • Initial and periodic updates and documentation • Adequacy - Does it work/Did you test it • Remediation • System and procedural enhancements • Allocation of resources • Enhanced Due Diligence • Independent Audit • Frequency • Scalability

10. Using the Risk Assessment to Drive your AML Program • Questions to ponder • Is your organization actually taking a risk based approach to it’s AML program? • Is the AML Risk Assessment at a granular enough level that the business can actually use it to balance risk, operational efficiency and profitability? • Has the unique AML risk profile for each business unit been reviewed as to high risk agents (customers), services and geographies? • Are AML training, testing and monitoring programs based on your AML Risk Assessment? • Is management involved in your AML program? • Is your Risk Assessment periodically updated? • Are AML Risks reviewed for all agents/customers? • Are AML Risks considered in the development and pricing of new services before they are implemented?

11. Juan Llanos, CAMS juanbllanos@hotmail.com © 2006 Juan Llanos

12. Critical Elements of AML Supbrograms AML Compliance sub-programs are, in essence, independent components of your company-wide AML Program that establish a reasonable and practicable framework for acceptance, monitoring and termination /reporting of: • Clients: Customer Identification Program or Know Your Customer • Agents: Know Your Agent (KYA) • Correspondent Banks: Know Your Correspondent Bank (KYCB) • Employees: (KYE) • Also others such as independent auditors, acquisition targets, etc.

13. Critical Elements of Your KYC Sub-program Step 1 (Ground ‘0’):Establish a “reasonable” and “practicable” customer identification program (CIP) or Know Your Customer (KYC) policies, procedures and internal controls that…Step 2:Properly identify and verify customers before every transactionStep 3:Monitor activitiesStep 4:Report suspicious transactionsStep 5:Decisions to terminate, to block or to include a customer in the company personal SDN listIn all steps and throughout the customer life cycle: KEEP RECORDS!

14. Critical Elements of Your KYC Sub-program The CIP must be used in connection to your firm’s Suspicious Activity monitoring, investigation, determination and reporting process

15. Critical Elements of Your KYC Sub-program Common Weaknesses Found in KYC Sub-programs • No written program, improper training or communication to key staff • Culture of circumventing the system • Program fails to collect minimum identifying information or only requires minimum information above a certain threshold amount • EDD based solely on requesting more documents without proper verification and authentication of information provided • Client “constellations”: By altering few letters on his/her first or last name, same individual creates different sender/receiver accounts in your system, sometimes even using fraudulently altered IDs and wrong information.