AML/CFT/CPF Policy

01

Introduction

Here we present the Anti-Money Laundering, Counter Terrorism Financing, and Counter Proliferation Financing Policy for Greenwich Capital Markets Limited (hereinafter referred to as “GCML” or “the firm”).

Money laundering

In general terms, money laundering is defined as the process of converting money or property derived from illegal activities to give it a legitimate appearance. There are three stages in money laundering:

1. Placement — the physical disposal of proceeds derived from illegal activities.
2. Layering — separating the illicit proceeds from their source through transactions that disguise the audit trail and provide anonymity.
3. Integration — integrating the laundered proceeds into the economy as normal funds.

Money laundering has been further defined as the act of a person who engages, directly or indirectly, in a transaction that involves proceeds of any unlawful activity: acquires, receives, possesses, disguises, transfers, converts, exchanges, carries, disposes, uses, removes from or brings into Nigeria proceeds of any unlawful activity; or conceals, disguises or impedes the establishment of the true nature, origin, location, movement, disposition, title of rights with respect to, or ownership of, proceeds of any unlawful activity — where, as may be inferred from objective factual circumstances, the person knows or has reason to believe that the property is proceeds from any unlawful activity; or, in respect of the conduct of a natural person, the person without reasonable excuse fails to take reasonable steps to ascertain whether or not the property proceeds from any unlawful activity.

Financing of terrorism

Financing of terrorism generally refers to carrying out transactions involving funds that may or may not be owned by a terrorist, or that have been, or are intended to be, used to assist the commission of terrorism. Essentially, financing of terrorism includes providing or collecting property for carrying out an act of terrorism; providing services for terrorism purposes; arranging for retention or control of terrorist property; or dealing with terrorist property. In the financing of terrorism, the focus is on the determination or use of funds, which may have been derived from legitimate sources.

Proliferation financing

Proliferation Financing of Weapons of Mass Destruction is the act of providing funds or financial services which are used in whole or in part, for the manufacture, acquisition, possession, development, export, trans-shipment, brokering, transport, transfer, stockpiling or use of nuclear, chemical, or biological weapons and their means of delivery and related materials (including both technologies and dual-use goods for non-legitimate purposes) in contravention of national laws or, where applicable, international obligations.

Statutory and regulatory requirements for AML/CFT/CPF

The following laws and regulations regulate the AML, CFT & CPF regime in Nigeria:

1. The Securities and Exchange Commission AML/CFT/CPF Regulations 2022.
2. The Money Laundering (Prevention and Prohibition) Act 2022.

By way of adopting and implementing international best practices in AML, CFT & CPF, the firm shall strive to adopt and implement the requirements of the following standard setters:

1. The Financial Action Task Force (FATF) 40 recommendations and other guidelines and standards issued by the body.
2. The Office of Foreign Assets Control (OFAC) sanctions requirements.
3. The United Nations Security Council sanctions requirements.
4. The European Union (EU) sanctions requirements.
5. His Majesty’s Treasury (HMT) sanctions requirements.
6. Other AML, CFT & CPF laws, regulations, principles, guidelines or standards that the firm may be required to comply with.

02

Customer acceptance policy

The firm has developed a customer acceptance policy and procedures to address the establishment of a business relationship with the customer. For that purpose, the firm identifies and assesses the risks of customers — that is, risk profiling — especially in identifying the types of customers associated with a high risk of money laundering, financing of terrorism and proliferation financing.

Reflective of the risk profiling conducted, the firm has reasonable measures in its internal policies and procedures, including customer due diligence, to address the different risks posed by each type of customer.

03

Risk profiling

In creating the risk profile of a particular customer or type of customer, the firm takes into consideration the following factors:

1. The origin of the customer and location of business.
2. Background or profile of the customer.
3. Nature of the customer’s business.
4. Structure of ownership for a corporate customer.
5. Any other information suggesting that the customer is of higher risk.

Following the initial acceptance of the customer, the firm continuously monitors each customer’s transaction activity pattern to ensure it is in line with the customer’s profile. Unreasonable differences prompt the firm to reassess the customer’s risk profile.

04

Customer due diligence (CDD)

The firm’s staff is expected to conduct customer due diligence and obtain satisfactory evidence to properly establish the identity and legal existence of any person applying to do business with it. Such evidence must be substantiated by reliable and independent source documents.

The firm must conduct customer due diligence when it is:

1. establishing a business relationship with any customer;
2. carrying out a cash or occasional transaction that involves a sum in excess of the amount specified by the regulators;
3. suspicious of money laundering or financing of terrorism; or
4. in doubt about the veracity or adequacy of previously obtained information.

The customer due diligence undertaken by the firm shall, at least, comprise the following:

1. identify and verify the customer;
2. identify and verify beneficial ownership and control of such transaction;
3. obtain information on the purpose and intended nature of the business relationship or transaction; and
4. conduct on-going due diligence and scrutiny, to ensure the information provided is updated and relevant.

Unwillingness of the customer to provide the information requested and to cooperate with the firm’s customer due diligence process may itself be a factor of suspicion. The firm does not commence a business relation or perform any transaction — or, in the case of an existing business relation, it terminates such relation — if the customer fails to comply with the customer due diligence requirements, and it considers lodging a suspicious transaction report with the Economic and Financial Crimes Commission (EFCC) and the Nigerian Financial Intelligence Unit (NFIU).

In certain special circumstances where the risks of money laundering, financing of terrorism and proliferation financing are low, or where measures are already in place to effectively manage such risk, the firm shall — not later than 14 days after the business relationship has been established — furnish the relevant documents.

Individual customers

In conducting customer due diligence on an individual customer, the firm obtains from the customer at least the following information:

1. Full name.
2. Driver’s licence, international passport number, National ID (issued by NIMC) or Permanent Voter’s Card.
3. Permanent and mailing address.
4. Date of birth.
5. BVN.
6. Nationality.

The firm substantiates the above required information by requiring the individual to furnish the original and provide a copy of the relevant documents. Where there is any doubt, the firm requests the customer to produce other supporting identification documents, preferably bearing a photograph of the customer issued by an official authority, to enable the customer’s identity to be ascertained.

Corporate customers

In conducting customer due diligence on a corporate customer, the firm requires the company or business to furnish the original, and provide a copy of, each of the following documents:

1. Memorandum, Article or Certificate of Incorporation/Partnership.
2. Identification documents of Directors, Shareholders or Partners.
3. Authorisation for any person to represent the company or business.
4. Identification document of the person authorised to represent the company or business in its dealings with the firm.

Where there is any doubt, the firm conducts a basic search or enquiry into the background of such company or business to ensure that it has not been, or is not in the process of being, dissolved or liquidated, and verifies the authenticity of the information provided with the Corporate Affairs Commission (CAC).

The staff of the firm is expected to know the beneficial owners and control structure of corporate customers, and to determine the source(s) of funds of the company or business in order to ascertain any suspicion concerning changes to the company or business structure, ownership, or payment profile of its account.

Where the firm’s corporate customer is a public company subject to regulatory disclosure, it would not be necessary for the firm to identify or verify the identity of any shareholder.

Clubs, societies and charities

In conducting customer due diligence on a club, society or charity, the firm requires the entity to furnish the relevant constituent documents (or other similar documents), including a certificate of registration and the identification of the office bearer and authorisation for any person to represent the club, society or charity.

Legal arrangements

Legal arrangements can be used to avoid customer due diligence on the beneficiary of transactions and disguise the source of funds involved. The firm needs to establish whether the customer is acting on behalf of another person as a party to a legal arrangement — for example, a trustee or nominee.

The firm is expected to take reasonable measures to understand the relationship among the relevant parties in handling a trustee or nominee business, and to obtain satisfactory evidence of its legal status, the identity of the trustee, settlor or nominee, authorised signatories, beneficiaries and the nature of their capacity and duties as trustee or nominee.

It shall be reasonable for the firm to rely on the trustee or nominee to verify or confirm the identity of the beneficial owners. For this purpose, the firm should require a written undertaking from the trustee or nominee that identification documents of the beneficiaries have been obtained, recorded and retained, and that such documentation is made available promptly to the firm upon request.

Beneficial ownership and control

The firm should conduct customer due diligence on any natural person who ultimately owns or controls the customer’s transaction if it suspects a transaction is conducted on behalf of a beneficial owner and not the customer conducting such transactions. The customer due diligence conducted should be as stringent as that for an individual customer. Where the beneficial owner is identified as a politically exposed person (PEP) based on the firm’s risk management framework, the requirement for PEPs applies.

Where the firm uses the services of intermediaries, such as licensed sub-brokers, to introduce business, it relies on the customer due diligence conducted by such intermediaries — however, the ultimate responsibility for customer due diligence remains with the firm. The relationship between the firm and its intermediaries is governed by an arrangement or agreement that clearly specifies the rights, responsibilities and expectations of all parties. At the minimum, the firm must be satisfied that the intermediary:

1. has an adequate customer due diligence process;
2. has a reliable mechanism to verify customer identity;
3. can provide the customer due diligence information and make copies of the relevant documentation available immediately upon request; and
4. where appropriate, is properly regulated and supervised by the respective authorities.

In addition, customer due diligence procedures should be performed either on the firm’s own records or via a copy of records obtained from the introducing entity. The firm pays special attention when establishing and conducting business relationships via information and communication technology — for example, the internet, post, fax or telephone — since any relationship or transaction that avoids face-to-face contact without proper customer identification and verification may be subject to abuse by money launderers and financiers of terrorism.

The firm should only establish a business relationship upon completion of the customer due diligence process conducted through face-to-face interaction, and is also required to establish appropriate measures for customer verification, and implement monitoring and reporting mechanisms, to identify potential money laundering, financing of terrorism and proliferation financing activities. Where there is a contract to outsource CDD, the requirement still applies, because the “outsource” or agent is regarded as synonymous with the firm — that is, the processes and documentation are those of the firm itself.

Politically exposed persons (PEPs)

PEPs are individuals who are, or who have been, entrusted with prominent public functions — such as heads of state or government, senior politicians, senior government officials, judicial or military officials, and senior executives of public organisations. The concern in dealing with PEPs lies with the possibility of such PEPs abusing their public powers for their own illicit enrichment, especially in countries where corruption is widespread.

The firm has, in addition to its customer due diligence process, a risk management framework to determine whether current or new customers are PEPs. In establishing whether a customer is a PEP, the firm should gather sufficient and appropriate information from the customer and through publicly available information. Once a PEP is identified, the firm takes reasonable and appropriate measures to establish the source of wealth and funds of that person.

The decision to enter into or continue business relationships with PEPs should be made by the Senior Management of the firm at the head office. In addition, the firm should conduct enhanced ongoing due diligence on PEPs throughout its business relationships with them — noting that business relationships with family members or close associates of PEPs involve similar reputational risks to those with PEPs themselves.

Higher-risk customers

For higher-risk customers, the firm shall conduct enhanced customer due diligence, which should include at least: obtaining more detailed information from the customer and through publicly available information, in particular on the purpose of the transaction and source of funds; and obtaining approval from the Senior Management of the firm before establishing the business relationship. Senior Management refers to any person(s) responsible for the management and administration of the firm.

Examples of higher-risk customers include:

1. High-net-worth individuals.
2. Non-resident customers.
3. Persons from locations known for high rates of crime (for example, drug production, trafficking or smuggling).
4. Countries or jurisdictions with inadequate AML/CFT/CPF laws and regulations, such as the Non-Cooperative Countries and Territories (NCCT).
5. PEPs.
6. Legal arrangements that are complex — for example, trusts or nominees.
7. Cash-based businesses.
8. Unregulated industries.

Existing customers

The firm should take the necessary measures to ensure that the record of existing customers, including its customer profile, remains updated and relevant. In addition, further evidence in identifying existing customers should be obtained to ensure compliance with the firm’s current customer due diligence standards. The firm should conduct regular reviews of existing customer records, especially when:

1. a significant transaction is to take place;
2. there is a material change in the way the account is operated;
3. the customer’s documentation standards change substantially; or
4. it discovers that the information held on the customer is insufficient.

The firm, based on risk assessment, may require additional information consistent with its current customer due diligence standards from existing customers considered to be of higher risk.

05

Record-keeping

Retention period

The firm should keep all records and documents of transactions, in particular those obtained during customer due diligence procedures, for at least six years after the transaction has been completed or after the business relationship with the customer has ended. In situations where records are subject to ongoing investigations or prosecution in court, they shall be retained beyond the stipulated retention period until it is confirmed that such records are no longer needed.

Audit trail

The firm must ensure that the retained documents and records are able to create an audit trail on individual transactions that is traceable by the relevant regulatory, supervisory and law enforcement agencies. In addition, the records kept must enable the firm to establish the history, circumstances and reconstruction of each transaction. The records shall include, at least:

1. the identity of the customer;
2. the identity of the beneficiary;
3. the type of transaction (for example, deposit or withdrawal);
4. the form of transaction (for example, by cash or by cheque);
5. the instruction and the origin and destination of fund transfers; and
6. the amount and type of currency.

Format

The firm should retain the relevant documents in a form that is acceptable and retrievable, upon request, in a timely manner.

06

Ongoing monitoring

The firm shall conduct ongoing customer due diligence to examine and clarify the economic background and purpose of any transaction or business relationship that appears unusual, does not have any apparent economic purpose, or where the legality of such transaction is not clear — especially with regard to complex and large transactions or higher-risk customers. All findings must be documented and made available to the relevant supervisory authority upon request.

An effective customer due diligence process would enable the firm to detect related money laundering, financing of terrorism and proliferation financing transactions at the point of customer contact (based on the front-line staff’s ad hoc report). Generally, most detection would be made through analysing patterns or activities of the customer.

07

Management information system

The firm shall have in place an adequate management information system to complement its customer due diligence. The management information system should provide the firm with timely information on a regular basis to enable it to detect any suspicious activity — such as multiple transactions over a certain period, large transactions, anomalies in transaction patterns, and transactions exceeding any internally specified threshold.

The management information system should be part of the firm’s information system that contains its customers’ normal transaction/business profile, which is accurate and updated.

08

Special attention

The firm should establish internal criteria (“red flags”) to detect suspicious transactions, and may be guided by examples of suspicious transactions provided by the Central Bank of Nigeria (CBN) or sourced from other competent authorities and international organisations, such as the Bank of International Settlements (BIS), the International Association of Insurance Supervisors (IAIS), or the International Organisation of Securities Commissions (IOSCO). The firm should be prompted to conduct enhanced due diligence if any transaction matches the “red flags” list, and transactions that match should be subject to ongoing monitoring.

The firm should also conduct due diligence or monitoring of business relationships and transactions with individuals, businesses, companies and financial institutions from countries which have insufficiently implemented internationally accepted AML/CFT/CPF measures, such as the Non-Cooperative Countries and Territories (NCCT). Such relationships and transactions require the firm to make further enquiries, as detailed as possible, about their background and purpose, and to document the findings in writing. These findings should be made available to the relevant supervisory authority.

09

Suspicious transaction reporting

The firm is required to promptly submit a suspicious transaction report to the EFCC when any of its employees suspect, or have reason to suspect, that a transaction or attempted transaction involves proceeds from an unlawful activity, or that a customer is involved in money laundering or financing of terrorism. For this purpose, the firm must establish a reporting system for the submission of suspicious transaction reports to the NFIU.

10

Reporting mechanisms

The firm should appoint one officer (or more) at Senior Management level to be the Compliance Officer responsible for the submission of suspicious transaction reports to the NFIU. In addition, the firm should appoint a Compliance Officer at each branch, responsible for channelling all internal suspicious transaction reports received from employees of that branch to the Chief Compliance Officer at the head office; for employees at the head office, such reports are channelled directly to the Compliance Officer.

Upon receiving any internal suspicious transaction report, whether from the head office, branch or subsidiary, the Compliance Officer should evaluate the grounds for suspicion and, if suspicion is confirmed, promptly submit the report to the EFCC and NFIU. Where the Compliance Officer decides there are no reasonable grounds for suspicion, they should document that decision, ensure it is supported by the relevant documents, and file the report.

The Compliance Officer should submit all suspicious transaction reports to the Financial Intelligence Unit in the specified suspicious transaction report form and, where applicable and upon the advice of the Financial Intelligence Unit, submit reports online. The Compliance Officer should ensure that the suspicious transaction report is submitted within the next working day from the date the suspicion is established.

In submitting a suspicious transaction report, utmost care must be taken to ensure that reports are treated with the highest level of confidentiality. The Compliance Officer must be given the independence to report suspicious transactions without needing to go through any elaborate approval process, and is authorised to cooperate with the NFIU/EFCC in providing additional information and documentation as requested, and to respond promptly to further enquiries regarding any suspicious transaction report.

The firm should ensure that the suspicious transaction reporting mechanism is operated in a secured environment to maintain confidentiality and preservation of secrecy. The firm shall also consider submitting a suspicious transaction report when it is unable to complete the customer due diligence process on any new or existing customer that is unreasonably evasive or uncooperative (basing such a decision on normal commercial criteria and its internal policy), and when any customer’s transaction or attempted transaction fits the firm’s list of “red flags”.

11

Other issues

The firm must ensure that the Compliance Officer maintains a complete file on all internally generated suspicious transaction reports and any supporting documentary evidence, regardless of whether such reports have been submitted to the EFCC.

The firm must undertake reasonable measures to ensure that all employees involved in conducting or facilitating a customer’s transaction are aware of these reporting procedures, and that failure to report a suspicious transaction when there are reasonable grounds to believe that the transaction is “suspicious” is an offence.

12

Combating the financing of terrorism

The firm should ensure that its existing suspicious transaction reporting system and mechanism for identifying suspicious transactions are extended to cover financing of terrorism.

In ensuring efficient detection of suspected financing of terrorism, the firm should maintain a database of names and particulars of terrorists in the UN Consolidated List and such other orders as may be issued by the National Security Adviser (NSA), and should consolidate its database with other recognised lists of designated persons/entities. The firm shall ensure that the information in the database is updated, relevant, and made easily accessible to employees at the head office, branch or subsidiary for the purpose of identifying suspicious transactions.

The firm shall conduct regular checks on the names of new and existing customers against the names in the database. Where a match is found, the firm shall immediately:

1. inform the EFCC;
2. reject the customer if the transaction has not commenced; and
3. freeze the customer’s transaction if it is an ongoing customer.

Where the firm suspects that a transaction is terrorist-related, it should make a suspicious transaction report to the relevant authority(ies).

13

Policies, procedures and controls

The firm’s Board of Directors and Senior Management should be aware of the money laundering, financing of terrorism and proliferation financing risks associated with all its products and services, and understand that the AML/CFT/CPF measures required by law, regulation, guidelines and industry standards are best practice, as well as the importance of implementing AML/CFT/CPF measures to prevent the firm from being abused by money launderers and financiers of terrorism. It is the duty of the Board of Directors to maintain adequate oversight of the overall AML/CFT/CPF measures undertaken by the firm, and the duty of Senior Management to ensure the Board of Directors is updated with timely information.

The Board of Directors should be fully committed to establishing an effective internal control system for AML/CFT/CPF. It is the responsibility of Senior Management to ensure such internal controls are in place and implemented effectively, including the mechanism to monitor and detect complex and unusual transactions.

The Board of Directors shall ensure that the firm has, at minimum, policies on AML/CFT/CPF procedures and controls. For this purpose, Senior Management will assist the firm in formulating the policies and ensure that they are in line with the risks associated, the nature of business, complexity, and the volume of transactions undertaken by the firm.

The Board of Directors shall set minimum standards and approve the policies regarding AML/CFT/CPF measures within the firm, including those required for customer acceptance, suspicious transactions and combating the financing of terrorism. Senior Management must ensure that such procedures are formulated and effectively implemented, and the Board of Directors shall assess implementation of the approved AML/CFT/CPF policies through regular updates and audits.

To ensure effective implementation, the Board of Directors should define the lines of authority and responsibility for implementing AML/CFT/CPF measures, ensuring a separation of duty between those implementing the policies and procedures and those enforcing the controls. In line with this, the Board of Directors should ensure that:

1. a Compliance Officer at the Head Office is appointed; and
2. the effectiveness of internal audit in assessing and evaluating the controls to prevent money laundering and the financing of terrorism is ensured.

The Board of Directors shall review and assess the AML/CFT/CPF policies and procedures in line with changes and developments in the firm’s products, services and technology, as well as trends in money laundering and the financing of terrorism. Senior Management is responsible for implementing necessary changes to the AML/CFT/CPF policies and procedures, with the Board of Directors’ approval, to ensure current policies remain sound and appropriate.

The Board of Directors and Senior Management should ensure that adequate AML/CFT/CPF training is provided for the firm’s employees, including promoting employees’ awareness of their AML/CFT/CPF obligations.

14

Staff integrity

Senior Management must ensure the integrity of the firm’s employees at all times by establishing an appropriate employee assessment system — commensurate with the size of operations and risk exposure of the firm to money laundering, financing of terrorism and proliferation financing — that is approved by the Board of Directors to adequately screen its employees.

The employee assessment system shall include evaluation of an employee’s personal information, including criminal records, employment and financial history, as part of the recruitment process.

15

Compliance officer

The firm’s Senior Management is responsible for appointing the Compliance Officer at Senior Management level, who is “fit and proper” to carry out AML/CFT/CPF responsibilities and can effectively discharge them. In general, the Compliance Officer acts as the reference point for AML/CFT/CPF matters, including employee training and reporting of suspicious transactions.

The firm should inform, in writing, the supervisory regulatory bodies (i.e. the SEC) of the appointment or change in appointment of the Compliance Officer, including details such as their name, designation, office address, office telephone number, email address and such other information as may be required.

The firm shall ensure that the role and responsibilities of the Compliance Officer are clearly defined and documented. The Compliance Officer should ensure:

1. the firm’s compliance with AML/CFT/CPF requirements;
2. that implementation of AML/CFT/CPF procedures — including customer acceptance policy, customer due diligence, record-keeping, ongoing monitoring, and reporting of suspicious transactions and combating the financing of terrorism — is effective;
3. that the AML/CFT/CPF mechanism is regularly assessed to ensure it remains effective and sufficient to address any change in money laundering and financing-of-terrorism trends;
4. that the channel of communication from employees to the Compliance Officer is secure and that information is kept confidential;
5. that all employees are aware of the firm’s AML/CFT/CPF measures, including policy control mechanisms and the channel of reporting;
6. that internally generated suspicious transaction reports are appropriately evaluated by the Compliance Officer before submission to the EFCC; and
7. the identification of money laundering and financing-of-terrorism risks associated with new products or services, or arising from the firm’s operational changes, including the introduction of new technology and processes.

It is important and imperative that the Compliance Officer appointed by the firm has the necessary knowledge, experience and required authority to effectively discharge their responsibilities — including knowledge of AML/CFT/CPF obligations required under the relevant laws and regulations, the latest developments in money laundering and financial terrorism techniques, the AML/CFT/CPF measures undertaken by the industry, and timely access to customer due diligence documentation and other relevant information.

16

Staff training and awareness programmes

The firm must conduct awareness and training programmes on AML/CFT/CPF practices and measures for its employees, in particular front-line staff and officers in charge of processing and accepting new customers, as well as staff responsible for monitoring transactions.

Senior Management must ensure that a proper channel of communication is in place to effectively communicate the AML/CFT/CPF policies and procedures to all levels of employees. Employees should be aware that they may be held personally liable for any failure to observe the internal AML/CFT/CPF requirements. In this regard, the firm should make available its AML/CFT/CPF measures, which should at least contain the relevant guidelines on AML/CFT/CPF and the firm’s internal AML/CFT/CPF policies and procedures.

Training conducted for employees shall be appropriate to their level of responsibility in detecting money laundering, financing of terrorism and proliferation financing faced by the firm. The firm shall, at minimum, adapt its training to the following levels of employees:

1. New employees — a general background on money laundering and financial terrorism, the requirement and obligation to monitor and report suspicious transactions to the Compliance Officer, and the importance of the “Know Your Customer” policy.
2. “Front-line” employees — employees who deal directly with customers are the first point of contact with potential money launderers and financiers of terrorism, and must be trained to conduct effective ongoing customer due diligence, detect suspicious transactions, and understand the measures to be taken upon determining a transaction as suspicious — including factors that may give rise to suspicion, such as dealing with non-regular customers, large transactions, PEPs, higher-risk customers, and circumstances where enhanced customer due diligence is required.
3. Employees establishing business relationships (marketing personnel) — and employees responsible for accepting new customers must receive training focused on customer identification, verification and customer due diligence procedures, including when to conduct enhanced due diligence, and circumstances requiring establishing a business relationship to be deferred until customer due diligence is completed and until any obligation to report a suspicious transaction to the EFCC has been discharged.
4. Supervisors and managers — a higher level of instruction covering all aspects of AML/CFT/CPF procedures, in particular the risk-based approach to customer acceptance, customer due diligence and risk profiling of customers. Other areas include penalties for non-compliance with AML/CFT/CPF requirements, procedures for addressing financing-of-terrorism issues such as the Consolidated List and other lists of terrorists under the Terrorism (Prevention) Act, internal suspicious transaction reporting procedures, and the requirements for customer due diligence and record-keeping.

These training and awareness programmes should be conducted regularly and supplemented with refresher courses for employees, with special emphasis for those exposed to higher risk of potential money laundering, financing of terrorism and proliferation financing activities — for example, front-line employees. These programmes shall update staff on the latest AML/CFT/CPF developments, such as products or transaction modes susceptible to such risk, and remind them of their responsibilities under the AML/CFT/CPF programme.

17

Independent audit

The Board of Directors is responsible for ensuring regular independent audit of the internal AML/CFT/CPF measures to determine their effectiveness and compliance with the law and other regulatory requirements.

The Board of Directors shall ensure that the roles and responsibilities of the auditors are clearly defined and documented, and shall at least include:

1. checking and testing the compliance, and effectiveness, of the AML/CFT/CPF policies, procedures and controls; and
2. assessing whether current measures are in line with the latest developments and changes in the relevant AML/CFT/CPF requirements.

The auditor must submit a written report on the audit findings to the Board of Directors, which should be used to highlight inadequacies of any internal AML/CFT/CPF measures and controls — and the Board of Directors should ensure that the necessary steps are taken to rectify any inadequacies.

18

Appendix: definition of terms

Beneficial owner

Refers to any natural person(s) who ultimately owns or controls a customer and/or the person on whose behalf a transaction is being conducted. It also incorporates persons who exercise ultimate effective control over a legal person or arrangement. For companies, the person(s) who ultimately own or control a customer and/or the person on whose behalf a transaction is being conducted includes the natural person with a controlling interest, and the natural persons who comprise the mind and management of the company.

Constituent document

In relation to a firm, means the statute, charter, memorandum of association and articles of association, rules and by-laws, partnership agreement, or other instrument under, or by, which the firm is established and its governing and administrative structures and the scope of its functions and business are set out — whether contained in one or more documents.

Intermediaries

Generally refer to third parties, namely persons or businesses who are relied upon by the firm to conduct the customer due diligence process.

Person

Includes a body of persons, corporate or unincorporated.

Property

Means (a) assets of every kind, whether corporate or incorporated, moveable or immovable, tangible or intangible, however acquired; or (b) legal documents or instruments in any form, including electronic or digital, evidencing title to, or interest in, such assets — including bank credits, traveller’s cheques, money orders, shares, securities, bonds, drafts and letters of credit.

Terrorist property

Means (a) proceeds from the commission of a terrorist act; (b) property that has been, is being, or is likely to be used to commit a terrorist act; (c) property that has been, is being, or is likely to be used by a terrorist, terrorist entity or terrorist group; (d) property owned or controlled by or on behalf of a terrorist, terrorist entity or terrorist group, including funds derived or generated from such property; or (e) property that has been collected for the purpose of providing support to a terrorist, terrorist entity or terrorist group, or funding a terrorist act.

Terrorist act

An act or threat of action, within or beyond Nigeria, that (a) involves serious bodily injury to a person; (b) involves serious damage to property; (c) endangers a person’s life; (d) creates a serious risk to the health or safety of the public or a section of the public; (e) involves the use of firearms, explosives or other lethal devices; (f) involves releasing into the public, or any part of the public, any dangerous, hazardous, radioactive or harmful substance, any toxic chemical, or any microbial or other biological agent or toxin; (g) is designed or intended to disrupt, or seriously interfere with, any computer system or the provision of any services directly related to communications infrastructure, banking or financial services, utilities, transportation or other essential infrastructure; (h) is designed or intended to disrupt, or seriously interfere with, the provision of essential emergency services such as police, civil defence or medical services; (i) involves prejudice to national security or public safety; or (j) involves any combination of the acts specified in paragraphs (a) to (i), where the act or threat is intended or may reasonably be regarded as being intended to (aa) intimidate the public or a section of the public, or (bb) influence or compel the Government of Nigeria, the Government of any State in Nigeria, any other government, or any international organisation to do or refrain from doing any act — and includes any act or omission constituting an offence under the Aviation Offences Act.