The Hidden Depths of KYC

COMPLIANCE

K

YC checks are often met with sighs and moans - they are time consuming, bothersome to investors and slow down fund launches. In extreme cases, KYC backlogs can even mean missing an investment opportunity.

Managers often push their administrators to rush through KYC processes, and in some cases request they accept investors without full KYC approval, hoping that an information letter will suffice. But KYC is so much more than just a passport and a utility bill.

In order to better understand KYC, and therefore give it the time and attention needed, knowing its background, why fund administrators really need to complete KYC checks, why it is so time consuming, and most importantly, the repercussions if KYC is not properly obtained, is vital.

KYC IN MOTION In addition to collecting a passport and a utility bill, what else is your administrator required to complete as part of the KYC process?

Three tier test

Where an investor is a corporate entity, partnership, trust or other type of legal arrangement, an assessment is performed to identify the controlling beneficial owners.

Where there are no controlling beneficial owners, the requirement pivots to identifying those who control the entity. Where there are no individuals with direct control, the requirements pivot again for KYC to be collected on those who control the entity through other means (such as veto rights or influence). This process of identification is often referred to as a three tier test.

In a simple structure, such as a company with a single shareholder, an administrator collects the passport and utility bill of the shareholder, together with certain governing documents of the company, and potentially copies of the passports and utility bills of the directors.

As the ownership and control of an investor’s structure becomes more complex, so does the KYC collection process. A single corporate investor entity might require the administrator to collect dozens of certified documents including up to date members registers, directors registers, memorandum and articles of association, registry formation certificates, partnership agreements, trust agreements, powers of attorney and more. When looking to raise a fund with 100 institutional investors, this could mean the certification, collection, review and filing of thousands of documents.

22 May 2022

CHAIN REACTION THE HIDDEN DEPTHS OF KYC KYC is so much more than just a passport and a utility bill. Highvern’s Ken Ritchie details the intricacies of KYC compliance.

Suitable certification

Unless the administrator is provided with original documents, which is seldom the case, copies of all KYC need to be certified. To combat the risk of fraud and forgery, the FATF and by extension most well-regulated jurisdictions, set restrictions on who can certify a KYC document and how the certification should be completed.

Traditionally, certification can only be performed by a member of the judiciary, a senior civil servant, or a serving police or customs officer; an officer of an embassy, consulate or high commission of the country of issue of documentary evidence of identity; an individual who is a member of a professional body that sets and enforces ethical standards; an individual qualified to undertake certification services under authority of the Certification and International Trade Committee (such as a formal Chamber of Commerce); or a director, officer, or manager of a regulated financial services business that operates in a well-regulated country or territory.

Certification doesn’t stop there, as the administrator is also required to apply a risk based approach to collecting information and validating the credentials of certifiers. If a certifier is not suitable, investors may have to recertify all documents before acceptance into the fund. Failure to comply with the requirements of suitable certification could be deemed a breach of law or regulation in most jurisdictions.

Source of funds and source of wealth

To combat money laundering and terrorist financing, the administrator must understand how an investor generated its overall wealth, as well as how it obtained the specific funds they are using to invest. In most cases these are one and the same, however situations may arise where an investor’s source of funds differs from their source of wealth, such as a bank loan secured against their property or monies belonging to a third party.

It can be difficult to quantify how much evidence the administrator needs to get comfortable with an investor’s source of wealth and source of funds, with evidence requirements ranging from as little as a profile on an employer’s website through to collecting certified copies of contracts, bank statements and third party KYC. In these situations, experience and good judgement is key to complying with the regulation.

Scrutiny systems

Administrators are required to evaluate prospective investors against sanctions lists and to search for evidence of criminality, and other heightened risk factors (such as

Where does KYC originate from?

Requirements for KYC largely originate from the Financial Action Task Force (FATF), a global policy-making body and watchdog for money laundering and terrorist financing.

FATF’s role is to publish and maintain a series of recommendations, standards and methodologies for each country to adopt.

FATF is also tasked with testing and monitoring each country on a periodic basis, and releasing Mutual Evaluation reports to the public. These evaluation reports are important in assessing how robust a country's AML regime is, and how much comfort one should take when seeking to rely on regulated parties and financial institutions from that jurisdiction.

Why do KYC requirements differ from one country to another?

As each country creates their own legal and regulatory framework for FATF compliance, KYC requirements may differ from one jurisdiction to another. Among well-regulated jurisdictions the differences could be driven by slight nuances in the law or reliance on other controls the country has implemented to counter money laundering and terrorist financing.

However, in a poorly regulated jurisdiction the discrepancies in KYC requirements could be a result of a country’s failure to meet the FATF requirements.

politically exposed persons lists). Generally, systems such as World Check provided by Refinitiv are used to perform these searches.

Open source searches

Much like World Check, administrators perform open-source searches or use software such as RiskScreen to identify heightened risk factors that would impact the adequacy of the KYC collected. The results of these searches need to be reviewed, and where hits arise, appropriate assessments need to be carried out by those with experience and good judgement.

Tax information and regulatory confirmations

In addition to KYC requirements, most administrators seek to collect necessary tax information (such as FATCA and CRS) and regulatory confirmations. While tax information may not always hold up an investor’s subscription, failure to receive regulatory confirmations is generally a requirement prior to an investor being accepted into a fund.

Internal forms and data population

Following collection of relevant KYC, administrators will likely have internal forms, risk assessments, digital profiles, data systems and document storage portals that need to be populated, reviewed and signed off in accordance with internal policies, before an investor can be accepted.

Risk indicators

As KYC works on a risk-based approach, a country's laws, regulation or guidance will generally seek to set statutory minimum amounts of KYC required, putting the responsibility on the administrator to collect further information as risk increases.

Risk can include a multitude of factors, including the jurisdiction of the investor, where they made their wealth, the source of their funds, whether a politically exposed party is involved, the industry in which they operate, their willingness to provide information, discrepancies in the information they provide, open-source information and more.

Risk indicators add significant uncertainty to the KYC process, and are generally the cause for delays or enhanced information requests.

WEAKEST LINK: THE COSTS OF GETTING IT WRONG What are the implications to you and your administrator for failing to collect appropriate KYC? Regulators all around the world have a wide range of actions that can be taken on regulated entities that fail to comply with their own internal processes and consequently breach laws or regulations.

Implications include:

• Freezing all of a fund’s assets: If due diligence fails to identify red flags relating to an investor and financial crime is later highlighted, a fund’s assets can be frozen while criminal investigations are carried out.

• Public statements: Where regulators deem failings sufficiently serious, the circumstances around any failures to comply will be published on their website.

• Civil penalties or fines: Where significant failings are identified, which results in a breach of a regulation or legislation, criminal or regulatory fines may be issued.

• Loss of regulatory licences: In extreme cases where the regulator feels there can’t be effective and appropriate remediation of the weaknesses identified, it may revoke the regulatory licence of the administrator or manager.

May 2022 23