Regulatory Provisions for the Management of Sanctions Risk

Issued pursuant to
Section 13, Paragraph four, Clauses 3, 4, and 5
of the Law on International Sanctions
and National Sanctions of the Republic of Latvia.

I. General Provisions

1. The Regulatory Provisions for the Management of Sanctions Risk (hereinafter - the Provisions) shall be binding upon credit institutions, payment institutions, and electronic money institutions, private pension funds, investment brokerage companies, investment management companies, managers of alternative investment funds, insurance companies, insofar as they are engaged in life insurance or any other insurance activities related to the accumulation of funds, insurance intermediaries, insofar as they provide life insurance or any other insurance services related to the accumulation of funds, reinsurance companies, and branches of all these subjects in Member States and third countries, as well as credit unions (hereinafter collectively - the institution).

2. The Provisions prescribe:

2.1. the minimum requirements for carrying out an assessment of sanctions risk and for the establishment and control of an internal control system for the management of sanctions risk;

2.2. the circumstances to be taken into consideration by the institution when carrying out an assessment of sanctions risk by determining the Member States of the European Union (hereinafter - the EU) or members of the North Atlantic Treaty Organisation the sanctions imposed by which significantly affect the interests of the institution or the financial and capital market;

2.3. the requirements in relation to the application of financial restrictions if such restrictions result from any sanctions imposed by an EU Member State or a member of the North Atlantic Treaty Organisation the compliance with which significantly affects the interests of the institution or the financial and capital market.

3. The terms used in the Provisions:

3.1. sanctions - restrictions imposed in relation to the subject of the sanctions which have been introduced in accordance with the requirements of the Law on International Sanctions and National Sanctions of the Republic of Latvia. For the purpose of these Provisions, any sanctions imposed by an EU Member State or a member of the North Atlantic Treaty Organisation which have been identified in accordance with Paragraphs 15 and 16 of these Provisions shall also be considered sanctions;

3.2. internal control system for the management of sanctions risk - a set of measures which includes activities to be carried out in order to comply with the sanction requirements, providing for appropriate resources and the organisational structure, regulatory and technological provision, as well as provision and training of staff necessary for the implementation of such sanction requirements to prevent, as much as possible, the involvement of the institution in violation, circumvention of the sanctions, or in an attempt to avoid the enforcement of the sanctions. The internal control system for the management of sanctions risk shall be an integral part of the internal control system of the institution;

3.3. sanctions risk - impact and likelihood that the institution may be used for the violation or circumvention of the sanctions;

3.4. subject of the sanctions - a subject of public international law, a natural or legal person, or another identifiable subject on which international or national sanctions have been imposed.

II. Assessment of Sanctions Risk and Internal Control System for the Management of Sanctions Risk

4. The institution shall, according to its type of activity, carry out and document the assessment of sanctions risk in order to identify, assess, understand, and manage the sanctions risk inherent in its activity. When carrying out the assessment of sanctions risk, the institution shall take into consideration at least the following factors affecting the sanctions risk:

4.1. in relation to the activity of the institution:

4.1.1. the region where the institution operates and provides services, including the country where a body of the institution - subsidiary, branch, representative office - operates and provides services;

4.1.2. the countries and territories of operation of the third parties which, in the interests of the institution, are engaged in the attraction, identification of customers or obtaining of information necessary for the customer due diligence (agents);

4.1.3. the services and products offered by the institution;

4.2. in relation to a customer of the institution the institution shall take into consideration the circumstances affecting the risks specified in the Law on the Prevention of Money Laundering and Terrorism Financing - customer risk, country and geographical risk, risk of the services and products used by the customer, and risk of service or product delivery channels, assessing them in the context of the sanctions risk.

5. The institution shall carry out the assessment of sanctions risk in relation to all sanctions referred to in Sub-paragraph 3.1 of these Provisions. The assessment of sanctions risk shall approved by the board of directors of the institution, if appointed, or by the senior management body.

6. The institution shall establish the internal control system for the management of sanctions risk on the basis of the assessment of sanctions risk. The council, if appointed, or the senior management body of the institution shall approve the sanctions risk policies, while the board of directors of the institution, if appointed, or the senior management body, or a unit delegated by it may approve the sanctions risk procedures.

7. Upon establishing the internal control system for the management of sanctions risk, the institution shall take into consideration at least the following indications increasing sanctions risk:

7.1. the customer, cooperation partner of the customer, or transactions of the customer are related to the territory or country to which sanctions are applicable, or the border area of such territory or country;

7.2. the economic or personal activity of the customer, beneficial owner, or cooperation partner of the customer is related to the military sector, to trade, production, export, or import of goods specified in sectoral sanctions or of dual-use goods, or to specialised foreign agencies (military design offices, space technology research agencies, etc.);

7.3. the activity and transactions of the customer do not correspond to its declared economic or personal activity, or information regarding the counterparty of the customer does not correspond to its economic or personal activity;

7.4. it is characteristic for the customer to cooperate with companies having indications of actual economic activity and using their activities to conceal their financial malpractice, including the beneficial owner or economic activity (front companies), or cooperation with companies which have not been actively engaged in economic activity for a longer period of time and whose shareholders, directors, or secretaries are inactive companies (shelf companies);

7.5. instead of the cooperation partner of the customer, the payments are made by a third party who is a resident of the territories or countries that are subject to sanctions, or the customer makes payments instead of a third party who is a resident of the territories or countries that are subject to sanctions;

7.6. the customer uses a service as a result of which goods of the customer are transported across the territory or country to which the sectoral sanctions are applicable, or in the border area of such country or territory;

7.7. the customer cooperates with a service provider on which there is publicly available information that it provides services to companies operating in the territory or country against which sanctions have been imposed;

7.8. carriage of goods involved in the transactions of the customer takes place in the territory or country to which sectoral sanctions are applicable, or in the border area of such territory or country, using vehicles the routes of which cannot be accurately traced by means of publicly available Internet resources;

7.9. the price of goods or services involved in transactions is significantly different from the average market price, the type of transport or storage, route, packaging, or other characteristics of the goods involved in the transactions do not correspond to the general practice in the sector;

7.10. the customer submits the same documents for the purpose of justifying several unrelated transactions;

7.11. the documents justifying transactions submitted by the customer contain indications of falsification which attest to possible evasion of the enforcement of the sanctions;

7.12. in non-account holder money transfers funds are transferred to or received from the countries or territories which are related to the export of goods and services prohibited in sanctions, or it is conducted in the proximity of such countries or territories.

8. Upon establishment of the internal control system for the management of sanctions risk the institution shall provide for at least the following:

8.1. the development of the policies and procedures for the management of sanctions risk, and the requirements for regular review thereof in accordance with amendments to laws and regulations or activity, provided services, management structure, customer base, or regions of activity of the institution;

8.2. the procedures for assessing, documenting, and reviewing the sanctions risk related to the customer, the country of residence (registration) thereof, the economic or personal activity of the customer, counterparties, the services and products used and their supply channels, as well as the executed transactions;

8.3. the procedures for enforcing and complying with the sanctions, and the measures for the management of sanctions risk corresponding to the assessment of sanctions risk, including measures for the mitigation of sanctions risk, also specifying in certain cases the necessary restrictions in relation to the services provided or products offered by the institution;

8.4. the procedures for establishing and examining potential violations or circumvention of sanctions, including timely identification of sanctions risk prior to an occasional transaction, prior to establishment of a business relationship and during business relationship, as well as when entering into agreements with counterparties of the institution;

8.5. the procedures for taking a decision to cooperate with a customer in whose activity an increased sanctions risk has been established, including when assessing sanctions risk of members of a group related to the customer;

8.6. the procedures for informing the body of the institution referred to in the second sentence of Paragraph 5 of these Provisions regarding management of sanctions risk, and for reporting any established or potential violations of sanctions, including circumvention of sanctions, to the Financial and Capital Market Commission (hereinafter - the Commission);

8.7. the procedures for appointing an employee responsible for the management of sanctions risk, including determining the authority of such employee to implement measures for prevention and mitigation of sanctions risk;

8.8. the rights, obligations, and responsibilities of employees, as well as the professional qualification and conformity standards of employees according to their obligations and authority in ensuring of measures for the management of sanctions risk;

8.9. the requirements in relation to assessment of the internal control system for the management of sanctions risk in accordance with the requirements of the laws and regulations in the field of sanctions, and the requirements for the assessment of efficiency of the internal control system for the management of sanctions risk;

8.10. the procedures for ensuring whistleblowing on violations of the requirements for sanctions in the institution and for assessing such reports, if, taking into consideration the number of employees of the institution, whistleblowing is possible;

8.11. the provision of information technologies (hereinafter - the IT) corresponding to the assessment of sanctions risk for the management of sanctions risk, including determining the functional requirements of the system and regular testing of IT provision by documenting the testing results and making necessary improvements in a timely manner.

9. The institution shall, according to the sanctions risk inherent in its activity, update the assessment of sanctions risk on a regular basis, but at least once every three years. Credit institutions, licensed payment and electronic money institutions and branches thereof in Member States and third countries shall review and update the assessment of sanctions risk every 18 months.

10. The institution shall, on a regular basis, but at least once every 18 months, examine and document efficiency of the internal control system for the management of sanctions risk, including review and update the sanctions risk related to the customer, the country of residence (registration) thereof, the economic or personal activity, main cooperation partners of the customer, the services and products used by the customer and their supply channels, as well as the transactions executed by the customer, and, if necessary, perform measures to improve efficiency, including review and update policies and procedures for the management of sanctions risk. Credit institutions, licensed payment and electronic money institutions, as well as branches thereof in Member States and third countries shall, at leas once every 18 months, ensure an independent evaluation of operating efficiency of the internal control system for the management of sanctions risk through involvement of a professional external evaluator.

11. The institution shall, irrespective of regularity of the assessment of sanctions risk specified in Paragraph 9 and regularity of evaluation of the operating efficiency of the internal control system for the management of sanctions risk specified in Paragraph 10 of these Provisions, perform measures to improve the assessment of sanctions risk and the internal control system for the management of sanctions risk in the following cases:

11.1. the institution or the Commission has established that the assessment of sanctions risk or the internal control system for the management of sanctions risk of the institution has deficiencies or it does not correspond to the sanctions risk inherent in the institution;

11.2. the institution plans to make changes in its activity, management, or structure of employees, bodies of the institution (branches, representative offices, subsidiaries), provided services and products and their supply channels, customer base, or change geographical regions of its activity which would lead to an increased sanctions risk inherent in the institution.

12. The institution shall appoint an employee responsible for the management of sanctions risk who is entitled to take decisions and is directly responsible for the compliance with and enforcement of the laws and regulations in the field of sanctions, as well as for ensuring reporting of the existing and potential violations of sanctions and circumvention of sanctions to the Commission and the body of the institution referred to in the second sentence of Paragraph 5 of these Provisions. The institution shall ensure that the employee responsible for the management of sanctions risk has appropriate authority and access to the information necessary for the fulfilment of official duties. The institution shall, within 30 days from the appointment of the employee responsible for the management of sanctions risk or replacement thereof with another employee, inform the Commission in writing.

13. The institution shall ensure that the employees engaged in the management of sanctions risk, including the employee responsible for the management of sanctions risk, are aware of the risks related to the management of sanctions risk, and the laws and regulations in the field of sanctions of the Republic of Latvia, EU, as well as organisations of other countries which the sanctions institution has recognised as significantly affecting the institution or interests of the financial and capital market according to the assessment of sanctions risk thereof. The institution shall regularly provide employee training in order to improve their knowledge and skills in the management of sanctions risk.

14. The institution shall immediately inform the Commission of the following:

14.1. the customer who is the subject of the sanctions;

14.2. the frozen financial resources or financial instruments of the subject of the sanctions;

14.3. the service denied to the subject of the sanctions;

14.4. the established violation of sanctions, including circumvention of sanctions;

14.5. the established circumstances which attest to a potential violation or circumvention of sanctions.

III. Conditions and Requirements in Relation to the Sanctions Imposed by EU Member States or Members of the North Atlantic Treaty Organisation

15. The sanctions imposed by the EU Member State or the member of the North Atlantic Treaty Organisation whose official currency (except for euro) is mainly used for settlements in international trade and financial markets and upon failure to comply with the sanctions imposed by which access of the participants of the financial and capital market to the international financial settlement system could be substantially burdened shall be regarded as sanctions having a significant effect on the interests of the financial and capital market.

16. Upon carrying out the assessment of sanctions risk and evaluating the sanctions imposed by an EU Member State or a member of the North Atlantic Treaty Organisation which significantly affect the interests of the institution, the institution shall evaluate and take into consideration at least the following circumstances:

16.1. the currencies in which the institution provides its services and products;

16.2. the contractual obligations of the institution to other financial institutions or corresponding banks;

16.3. the region of the activity and provision of services of the institution, including the country of activity and provision of services of the body of the institution - a subsidiary undertaking, a branch, a representative office;

16.4. the countries where the customers of the institution operate.

17. If, according to the assessment of sanctions risk, the institution establishes significant influence of the sanctions imposed by an EU Member State or a member of the North Atlantic Treaty Organisation on the institution or the interests of the financial and capital market, the institution shall ensure appropriate management of sanctions risk also in relation to the sanctions imposed by this EU Member State or member of the North Atlantic Treaty Organisation.

18. Upon applying the financial restrictions specified in the sanctions which have been imposed by an EU Member State or a member of the North Atlantic Treaty Organisation, the institution shall assess the risks related to such restrictions, including the legal ones, and provide for restrictions corresponding to the assessment, inter alia specifying that the institution does not provide services to a customer who is a subject of sanctions according to the sanctions imposed by an EU Member State or a member of the North Atlantic Treaty Organisation, or does not execute transactions if the party to the transactions is the subject of the sanctions according to the sanctions imposed by an EU Member State or a member of the North Atlantic Treaty Organisation.

IV. Closing Provisions

19. The institution shall carry out the assessment of sanctions risk in compliance with the requirements of these Provisions by 1 May 2019.

20. The institution shall establish the internal control system for the management of sanctions risks or make improvements to the existing internal control system for the management of sanctions risk by 1 May 2019.

Chairperson of the Financial and Capital Market Commission P. Putniņš

Translation © 2019 Valsts valodas centrs (State Language Centre)