1. WORKSHOP ON AML/CFT RISK-BASED SUPERVISION TOOLS FOR FINANCIAL INSTITUTIONS PRESENTED BY AML/CFT DIVISION FINANCIAL POLICY & REGULATION DEPARTMENT, CENTRAL BANK OF NIGERIA

2. OUTLINE  Synopsis of the supervisory process  Benefits of Risk-Based Approach (RBA) to AML/CFT supervision  Overview of Risk- Profiling of Institutions  ML/TF Risk Assessment Form: Input Data by Financial Institutions  Risk Assessment Tools for Bank Examiners 2

3. SYNOPSIS OF THE SUPERVISORY PROCESS 3

4. SYNOPSIS OF THE SUPERVISORY PROCESS (cont’d) a) Traditional Prudential Supervision (PS):  Focuses on capital, solvency, asset quality, earnings, liquidity, management, etc.  Pays attention to legal compliance (LC) (or rules-based approach to supervision) on Laws, Regulations, Circulars, Directives, Guidelines, other enforceable instruments.  Relies on checklist of items and issues  Lays emphasis on financial penalties b) Risk based approach (RBA) to prudential supervision (PS):  Focuses on credit risk, market risk, liquidity risk, operational risk, legal risk, etc.  Ensures compliance with previous recommendations/observations  Sometimes, does not capture or appropriately capture money laundering/terrorism financing risks. NOTE: There is nothing like pure risk-based approach without attention to compliance with laws and regulations. c) RBA to AML/CFT Supervision:  Complements Prudential Supervision and Legal Compliance  Pays special attention to ML/FT risks (in view of their evils)  Complies with FATF Recommendation No. 1 4

5. SYNOPSIS OF THE SUPERVISORY PROCESS (cont’d)  RBA to AML/CFT requires a re-focusing and re-tooling of supervisory practices because of the wide areas and plenty issues to cover urgency required and dangers involved, etc.  Approach to supervision of policies, procedures, guidelines, regulations, etc. often depend on who conducts AML/CFT supervision:  Prudential Supervisor (Central Bank, Securities Commission, Insurance Regulator)  Financial Intelligence Unit (FIU)  General supervisor or specialized AML/CFT Unit  Shared responsibility with various stakeholders - Challenges include lack of coordination, cooperation, fragmented approach, and conflicting priorities. 5

6. BENEFITS OF A RISK-BASED APPROACH  Ensures that institutions have in place structured, uniform approach to measuring and evaluating risks.  RBA focuses on:  Structural/institutional risk factors; and  Principal business lines and activities of FIs.  Enhances more efficient use of time and supervisory resources(safe cost and resources).  Focus is on higher risk areas and risk to significant business activities.  Provides input to conduct sectoral and national risk assessments. 6

7. OVERVIEW OF RISK-PROFILING OF INSTITUTIONS 7

8. OVERVIEW OF RISK-PROFILING OF INSTITUTIONS (cont’d) 1. Analysis of Structural Factors and Components of Know Your Institutions (KYI) General information on FI:  Structural and Institutional issues  Ownership (e.g. complexity, transparency, country)  Size  Age, etc.  Complexity and scope of business and markets  Financial groups, type of clients (retail vs. wholesale), technology, etc.  Management  Fit and proper rules and practice, organizational culture (appetite for risk, compliance) and cooperation with authorities, etc.  Competitive environment and position in the sector  Reputation in the industry  Press reports  Examiners’ Reports 8

9. OVERVIEW OF RISK-PROFILING OF INSTITUTIONS (cont’d) 1. Analysis of Structural Factors and Component of KYI (Cont’d)  Growth Policies: Aggressive vs. conservative.  Funding Sources: Equity, deposits, borrowing.  Liquidity: Surplus vs. shortage.  Solvency and Earnings: Strong vs. weak.  Sources of Income: Interest, premium, fees, commissions, Peer group comparison.  Staff Incentives and Reward System: Salary, bonuses, etc.  STR reporting to NFIU  Other statutory reports to LEAs & Regulatory authorities  Industry intelligent Reports  Is it worthwhile to comply? (cost/benefit analysis) 9

10. OVERVIEW OF RISK-PROFILING OF INSTITUTIONS (cont’d) 2. Overview of Business Activities And ML/FT risk factors 10

11. OVERVIEW OF RISK-PROFILING OF INSTITUTIONS (cont’d) Overview of Business Activities and ML/FT Risk Factors (cont’d) General considerations: i. Type of Customers Note: Primary source of ML/FT risk ii. Products/services Identify those that are most vulnerable to ML/FT iii. Delivery channels Intermediaries, non face-to-face business, e-banking iv. Markets served/geographic zones Local, regional, cross-border risks Other factors  Typologies and schemes used for ML/FT (local and international)  Sources of information: from the sector/industry, supervisors, FIU, law enforcement, etc. 11

12. OVERVIEW OF RISK-PROFILING OF INSTITUTIONS (cont’d) (i)Analysis of Risk Factors on Customer Natural vs. legal/corporate, trusts National vs. Foreigner Retail vs. institutional Financial vs. non-financial; & regulated vs. unregulated Designated Non-Financial Business and Professions Cash intensive, construction/real estate, car dealers, professions (e.g. lawyers, financial advisers, etc.) Politically exposed persons (PEPs) Does your institution have a customer acceptance/rejection policy? What is your experience? 12

13. OVERVIEW OF RISK-PROFILING OF INSTITUTIONS (cont’d) (ii)Analysis of Risk Factors on Products & Services NOTE: Deposits are the main entry point of risk. Why?  Consider in relation with the type of customer, sectors, zones, etc.  Structure of deposit: type and term of deposit (demand vs. certificates)  Local vs. foreign currency  Growth, liquidity issues  Concentrations: large accounts  Interest margins: peer sector drive Loans and credit cards: back-to-back transactions, deposits/loans Other risk services:  Private banking (VIP banking, high net-worth individuals, etc.)  Fiduciary services and trusts  Internet banking and other non face-to-face transactions  Correspondent banking  Cash handling, export/import services  Embassies and PEPs  Wire transfers and drafts  Money remittance and currency exchange  Securities trading for clients  Others 13

14. OVERVIEW OF RISK-PROFILING OF INSTITUTIONS (cont’d) (iii)Analysis of Risk Factors on Delivery Channels Branch banking (face-to-face, non face-to-face) On-line or internet banking Mobile banking Phone banking ATM Mail banking (credit cards) Introducers/Intermediaries 14

15. OVERVIEW OF RISK-PROFILING OF INSTITUTIONS (cont’d) (iv)Analysis of Risk Factors on Geographic Zone Risks  Based on location of clients, branches, subsidiaries, affiliates:  Domestic (high crime zones, etc)  International (countries, regions, OFAC, ICRG, UN, other official listings)  Crime and international compliance factors.  Free trade zones (anywhere) 15

16. OVERVIEW OF RISK-PROFILING OF INSTITUTIONS (cont’d) 3.Risk Mitigation  Role of board and management, corporate governance  oversight and resources, compliance culture  Policies and procedures  scope and sufficiency (risk management, CDD, recordkeeping, hiring and compensation, etc.)  Internal controls  Macro (audit, compliance, etc) and micro (line level systems and procedures, e.g. customer acceptance)  Compliance function, compliance officer  Monitoring and reporting (STR, CTR, etc)  Training  Others 16

17. ML/TF RISK ASSESSMENT FORM: INPUT DATA BY FINANCIAL INSTITUTIONS 17

18. ML/TF RISK ASSESSMENT FORM: INPUT DATA BY FINANCIAL INSTITUTIONS (CONT’D) NAME OF REPORTING INSTITUTION: ADDRESS OF REPORTING INSTITUTION: YEAR OF ESTABLISHMENT: TOTAL ASSET SIZE (N'000): (as at last balance sheet) GROSS INCOME(N'000): ( as at last balance sheet) OWNERSHIP STRUCTURE (State in Percentage) PEP NON-PEP Domestic Foreign LIST OF SUBSIDIARY(IES)/OTHER GROUP MEMBERS : LOCAL - FOREIGN - CONTACT PERSON: NAME: DESIGNATION: TELEPHONE NO.: E-MAIL ADDRESS: TOTAL ASSET SIZE  These should be stated in the nearest million (N’M) and it should consist chiefly of the financial institution’s total loans and investments. 1. GROSS INCOME  This refers to the financial institution’s annual gross income as at the end of the period being reported. These should be stated in the nearest million (N’m) OWNERSHIP STRUCTURE  The ownership structure of the financial institution should be stated in percentages and based on the following category:  Category 1:PEP and Non-PEP  Category 2:Domestic and Foreign 1. NUMBER OF SUBSIDIARY(IES)/OTHER GROUP MEMBERS  Where a financial institution has subsidiaries (whether local or foreign), the names and location should be listed (one per column of the same row) BRANCH INFORMATION 1. BRANCH CODE 2. BRANCH NAME 3. LOCATION/ ADDRESS  State the address of the branch.  STATE : : Indicate the State of the Federation where the branch is located. 18

19. ML/TF RISK ASSESSMENT FORM: INPUT DATA BY FINANCIAL INSTITUTIONS (CONT’D) BRANCH CODE BRANCH INFORMATIONBRANCH NAME LOCATION (ADDRESS) TOTAL STATE NO. OF CUSTOMERS CUSTOMER TYPEINDIVIDUAL 0 0 0 CORPORATE 0 0 0 TOTAL DEPOSIT TRANSACTIONS 0 0 0 1. CUSTOMER TYPE Individual  Indicate the total number of accounts by individual (natural persons) and the total amount (in naira for naira accounts and United States Dollars for foreign currency). This should be Outstanding Credit Balance (i.e. Account Balance) as end of the reporting Month. Corporate  Indicate the total number of accounts by corporate/legal persons and the total amount (in naira for naira accounts and United States Dollars for foreign currency accounts). This should be Outstanding Credit Balance (ie Account Balance) as end of the reporting Month. SIZE OF TRANSACTIONS (DEPOSITS)  This refers to the total number and value of deposits for each branch. These deposits include tenured funds. It is the total deposit balance for the bank at the end of the month. It is the summation of the balances reported under Individual and Corporate Customer Type. 19

20. ML/TF RISK ASSESSMENT FORM: INPUT DATA BY FINANCIAL INSTITUTIONS (CONT’D) INHERENT RISK: Higher Risk Customers 1. Customer PEPs NO.0 N'M0 $'0000 Public Sector clients NO.0 N'M0 $'0000 NGOs/NPOs NO.0 N'M0 $'0000 OIL AND GAS COMPANIESCRUDE OIL DRILLINGNO.0 N'M0 $'000 DISTRIBUTOR/MARKET ER NO.0 N'M0 $'000 IMPORTERNO.0 $'0000 BY-PRODUCT VENDORNO.0 N'M $'0000 IMPORTERS AND EXPORTERS (NON-OIL & GAS) NO.0 N'M0 $'0000 POLITICALLY EXPOSED PERSONS (PEPS)  This refers to all accounts operated by PEPs as defined in Regulation 18 of CBN AML/CFT Regulation 2013 and Section 25 of the Money Laundering (Prohibition) Act, 2012. The total credit balances for these categories of customers’ accounts should be reported here. PUBLIC SECTOR CLIENTS  The total credit balances for all accounts operated by ministries, departments and agencies of government at all the three tiers of government should be stated. NON-GOVERNMENTAL ORGANISATIONS/NOT-FOR PROFIT ORGANISATIONS  This includes faith based organizations, charities, clubs and societies. NGOs can range from large regional, national or international charities to community-based self-help groups. NGOs may also include research institutes, churches, professional associations and lobby groups. NGOs typically depend (in whole or in part) on charitable donations and voluntary service for support. The total credit balances for these categories of customers’ accounts should be reported here. OIL AND GAS COMPANIES  These are clients that are involved in both upstream and downstream sectors of the industry. They are further classified into crude oil drilling; distributor/marketer; importer and by-product vendors. The total credit balances for each of the sub-classifications should be reported here. IMPORTERS AND EXPORTERS (NON-OIL AND GAS)  This refers to accounts of clients that are involved in importing and exporting not related to oil and gas. The total credit balances for these categories of customers’ accounts should be reported here. 20

21. ML/TF RISK ASSESSMENT FORM: INPUT DATA BY FINANCIAL INSTITUTIONS (CONT’D) NON-RESIDENT LEGAL PERSONS & ARRANGEMENTS NO.0 N'M0 $'0000 NON-RESIDENT INDIVIDUALS NO.0 N'M0 $'0000 MONEY SERVICE BUSINESS NO.0 N'M0 $'0000 STORE VALUE CARDS NO.0 $'0000 N'M0 HIGH VALUE BUSINESS NO.0 N'M0 $'0000 SECURITIES BROKERS AND AGENTS, MUTUAL FUNDS MANAGERS/ADMINISTRATORS NO.0 N'M0 $'0000 LAWYERS, TRUSTEES, ACCOUNTANTS, e.t.c NO.0 N'M0 $'0000 REAL ESTATE BROKERS AND AGENTS NO.0 N'M0 $'0000 NON-RESIDENT LEGAL PERSONS AND ARRANGEMENTS  This refers to legal persons such as off-shore trusts and special purpose vehicles (SPV) that are not domiciled in Nigeria. The total credit balances for these categories of customers’ accounts should be reported here. NON-RESIDENT INDIVIDUALS  These are accounts operated by Nigerians that are not resident within the country or non-Nigerian citizen who: (i) is not a lawful permanent resident of Nigeria during the calendar year and who does not meet the substantial presence test or (ii) has not been issued an alien registration permit. The total credit balances for these categories of customers’ accounts should be reported here. MONEY SERVICE BUSINESS (MSB)  This includes bureaux de change, currency dealers; money transmitters; cheque cashers; and issuers of travellers’ cheques, and money orders (such as NIPOST). The total credit balances for accounts operated by this category of clients should be reported here. STORE VALUE CARDS  This includes prepaid cards and gift card issuers, e-money issuers, e.t.c. The total credit balances for accounts operated by this category of clients should be reported here. HIGH VALUE BUSINESS  This refers to dealers in jewelry and precious metals, cars and luxury goods, and other related businesses that deal in high value luxury goods. The total credit balances for accounts operated by this category of clients should be reported here. SECURITY BROKERS AND AGENTS, MUTUAL FUND MANAGERS/ADMINISTRATORS  Examples include Investment Brokers Deposit Brokers, Funds and Portfolio Manager /administrators Accounts (accounts managed by agents on behalf of underlying parties including omnibus and concentration accounts). The total credit balances for accounts operated by this category of clients should be reported here. LAWYERS, TRUSTEES, ACCOUNTANTS, etc.  Clients acting on behalf of others such as Lawyers, Trustees, Accountants and others that are acting on behalf of underlying customers or others. The total credit balances for accounts operated by this category of clients should be reported here. REAL ESTATE BROKERS AND AGENTS 21

22. ML/TF RISK ASSESSMENT FORM: INPUT DATA BY FINANCIAL INSTITUTIONS (CONT’D) 2.INHERENT RISK: Higher Risk Products and Services 0 CASH SECURED CREDITS INCLUDING CREDIT CARDS NO.0 N'M0 $'0000 PURCHASE AND SALE OF MONETARY INSTRUMENTS NO.0 N'M0 $'0000 WIRE TRANSFERSCROSS BORDERNO.0 $'0000 DOMESTICNO.0 N'M0 $'0000 CORRESPONDENT BANKING NO.0 N'M0 $'0000 PRIVATE BANKING SERVICES No0 N'M0 $'0000 TRUSTS NO.0 N'M0 $'0000 1. PRODUCTS AND SERVICES CASH SECURED CREDITS  A cash-secured loan is one that has a cash reserve as backing. The total number and naira value of such activities within the concerned period should be indicated. Note that this should also include secured credit cards. PURCHASE AND SALE OF MONETARY INSTRUMENTS  This covers local and foreign money instruments sold and purchased. WIRE TRANSFERS  Total credit transactions of all wire transfers should be reported here based on the following two sub-groups:  Foreign Wire Transfers  Domestic Wire Transfers  CORRESPONDENT BANKING  Transactions with correspondent banks, including Payable-Through-Accounts (PTA) should be reported here. A PTA is where a foreign financial institution provides its customers, commonly referred to as “sub account holders,” with cheques that allow them to draw funds from the foreign financial institutions account from a Nigerian financial institution. PRIVATE BANKING SERVICE  Private banking clients including high net worth clients and offshore services should be reported in this category. Private banking account means an account (or any combination of accounts) maintained at a financial institution covered by the regulation that requires a minimum aggregate deposit of funds or other assets of not less than United States $50,000 or its equivalent. TRUSTS  This includes financial institutions acting as trustees and other fiduciary services including custody, portfolio and asset management, etc. 22

23. ML/TF RISK ASSESSMENT FORM: INPUT DATA BY FINANCIAL INSTITUTIONS (CONT’D)  DELIVERY RISK  E-BANKING (INTERNET BANKING)  PHONE AND MOBILE BANKING  OTHER NON FACE-TO- FACE SERVICES 23 3.INHERENT RISK: Higher Risk on Delivery risk 0 INTERNET/E-BANKING NO.0 N'M0 $'0000 PHONE AND MOBILE BANKING NO.0 N'M0 $'0000 OTHER NON FACE-T0-FACE SERVICES (Specify) NO.0 N'M0 $'0000

24. ML/TF RISK ASSESSMENT FORM: INPUT DATA BY FINANCIAL INSTITUTIONS (CONT’D)  (AML/CFT) REPORTS FILED Statistics of AML/CFT Reports filed with the Nigeria Financial Intelligence Unit (NFIU) such as:  Currency Transaction Reports (CTRs);  Foreign currency Transaction Reports (FTRs); and  Suspicious Transaction Reports (STRs) should be reported. FRAUD Statistics of fraud committed by customers and staff of each branch within the time under consideration should be reported. ARMED ROBBERIES Statistics of armed robberies that have occurred involving the branch of the bank within the time under consideration should be reported.  AML/CFT PENALTIES IMPOSED Financial institutions that contravene AML/CFT laws and regulations, whether in their home jurisdictions or abroad are penalized. This could be in various forms such as fines, warnings etc. 24

25. RISK MITIGANTS  Financial institutions are expected to put measures in place to mitigate the impact of risks arising from both the structural and inherent risks.  Such measures include: 1) Corporate Governance and Control of the Board Is there AML/CFT policies in place? Has the policies been approved by the Board? How often is it reviewed? Are the policies adequate? Has the Board designate any of its committee to handle AML issues and reports, etc. 25

26. RISK MITIGANTS (Cont’d) 2) Risk Management Does the risk management function include ML/FT risks Is there a specialized Risk Management group or unit within the bank? If so, does its function include ML/FT risk? Does the bank have a ML/FT risk classification system? 3) AML Policies and Procedures Does the bank have written and Board approved policies and procedures for CDD/KYC principles? Have the policies and procedures been disseminated to all bank employees and management? How was this dissemination conducted? Is there a system for testing compliance with the CDD policies and procedures and the AML/CFT legislation? Who is responsible? 26

27. RISK MITIGANTS (Cont’d) 4) Monitoring and Suspicious Activity Reporting Does the bank have an internal system for detecting and reporting unusual and suspicious activities? Is it manual or automated? Are there specific monitoring systems for terrorism finance? What type of customers does the bank refuse to do business with? Why? Are there specific monitoring mechanisms for PEPs? Who analyzes unusual and suspicious activities detected? 5) Internal Controls and Audit functions Does the bank have an Internal Audit Department/function? Does the Internal Audit review and test the AML/CFT program, CDD/KYC policies and procedures? Is there a specific AML/CFT audit plan? Does internal audit review the Compliance function? When was it last reviewed? What were the findings? 27

28. RISK MITIGANTS (Cont’d) 6) Compliance function Has the Board of Directors established a compliance function and approved a compliance policy that covers all significant business lines and processes Has the bank appointed an AML/CFT compliance officer? If so, provide the name, functions and status within the organization? Is it at managerial level? Is there resource allocation to the compliance function? 7) Training Is there an AML/CFT training programme in place for employees? Is it approved by the Board of Directors? What was the AML/CFT training budget for last year? Current year? What type of AML/CFT training, if any, does your institution have for its employees? When was the last training program delivered? What is the frequency of training provided? 28

29. AML/CFT RISK MATRIX FOR BANK EXAMINERS 29

30. RISK ASSESSMENT TOOLS FOR BANK EXAMINERS (a) ML/FT risk assessment matrix (b) Control Function/Mitigants (c) Risk Assessment Summary 30

31. KEY 31

32. STRUCTURAL RISK ASSESSMENT I. STRUCTURAL RISK LowModerateAbove OverageHigh Data Input Gross Total Structural Risk FromToFromToFromToMore than 1. Total Asset Size - - - - - - - - - 2. Ownership structure - a. Local (majority owned): or, i) PEP shareholders (10% or more participation) ii) No PEPs Non-PepsN/A PEP shareholders (10% or more participation) - - b. Foreign(majority owned): i) PEP shareholders (10% or more participation) ii) No PEPs Non-PepsN/A PEP shareholders (10% or more participation) - - 3. Year of establishment a. >= 5 years, or b. < 5 years >= 5 yearsN/A < 5 years - - 32

33. INHERENT RISK INHERENT RISK Higher Risk Customers, Products, Services, Geographic Zones and Delivery Channels 1. Customer LowModerateAbove OverageHigh Data Input Total Inherent Risk (Customers)Weight FromToFromToFromToMore than a. PEPS (national and foreign, including embassies and consulates) NO. 01,800 2,3942,3953,185 0 -0% N'M - 3,500 4,655 4,656 6,192 - -0% $'000 - 7,000 9,310 9,311 12,384 - -0% b. Public sector clients (central, state, local, gov't owned companies and institutions, etc.) NO. - 3,800 5,054 5,055 6,723 - -0% N'M - 62,000 82,460 82,461 109,673 - -0% $'000 - 250,000 332,500 332,501 442,226 - -0% c. NGOs/NPOs (including charities and religious organisations) NO. - 3,300 4,389 4,390 5,839 - -0% N'M - 1,500 1,995 1,996 2,655 - -0% $'000 - 5,000 6,650 6,651 8,846 - -0% 33

34. CONSOLIDATED SCALE & WEIGHT 34

35. CONTROL/MITIGANTS QUESTIONNAIRE 35  The rating given to each of the seven components identified (governance, risk management systems, policies and procedures, internal controls, compliance, reporting and training) is used as data-input to the matrix (mitigants part) to profile each bank’s net risk.  Rating: Use a scale of 1 (Strong) through 4 (weak/non - existence). When assigning a rating, the Supervisor must take into account the balance between policy, procedures and their implementation.  Assessment of implementation will largely be conducted during onsite inspections.

36. 36 1. Corporate governance/ board of directors 1# Strong 2. Risk management 3# Needs Improvement 3. Policies and procedures 4# Weak 4. Internal control 4# Weak 5. Compliance 4# Weak 6. Monitoring and reporting (STRs) 3# Needs Improvement 7. Training 3# Needs Improvement

37. RISK ASSESSMENT RATING Assessment ComponentsRisk Rating 1. Structural/macro-institutional factorsX 2. Net risk:X (1) Inherent AML/CFT risk in Activitiesx (1)Risk mitigants (x) 3. Total RiskXX 37 LowModerateAbove AverageHigh <=11.01 - 2.002.01 - 3.003.01 - 4.00

38. ML/FT RISK MATRIX: SUMMARY 38

39. INSTITUTIONAL RISK PROFILE: ANALYSIS 39

40. SECTORAL RISK MAPPING: INDIVIDUAL FI NET RISK RATINGS 40

41. SECTORAL RISK MAPPING:SUPERVISION STRATEGY, SCOPE AND FREQUENCY OF ONSITE INSPECTIONS 41

42. Questions? 42