Internal control rules: how to develop and what you need to know about them from 2022

Who are the changes for?

Decree of the Government of the Russian Federation of July 14, 2021 No. 1188 (hereinafter referred to as Decree No. 1188) approved certain requirements for internal control rules that develop:

• lawyers;
• notaries;
• persons providing legal or accounting services;
• audit companies and individual auditors.

These requirements were adopted to comply with the provisions of the Federal Law of August 7, 2001 No. 115-FZ “On combating the legalization (laundering) of proceeds from crime and the financing of terrorism” (hereinafter referred to as Law No. 115-FZ). Namely, according to paragraph 1 of its Art. 7.1, the requirements of this Federal Law regarding the organization of internal control apply to the listed persons.

Federal Law of December 29, 2017 N 470-FZ “On Amendments to Certain Legislative Acts of the Russian Federation”, which entered into force on March 30, 2021.

, provided clients of organizations with additional guarantees when organizations take AML/CFT measures in terms of refusing to carry out a client transaction due to failure to provide documents or suspicions of money laundering and terrorist financing. Among other things, a mechanism was also established for the “rehabilitation” of clients included in the “black list” of Rosfinmonitoring. We talked about this in detail in our previous articles.

In connection with these changes, all organizations and entrepreneurs listed in Article 115-FZ, without exception, are required to adjust their internal control rules

.

It would be an unforgivable mistake on the part of organizations and entrepreneurs to simply transfer the new provisions and norms of N 115-FZ into the internal control rules without indicating specific actions and procedures of employees aimed at their implementation. This approach to updating the Law of Internal Code is formal and does not ensure the implementation of legislation.

We are already developing completely new internal control rules

for various organizations and entrepreneurs supervised by Rosfinmonitoring, the Bank of Russia, the Assay Chamber and even Roskomnadzor.

These internal control rules can always be ordered from us

. But if you prefer to independently work on updating the internal control rules, then today we decided to talk about what adjustments our readers may need to reflect in their internal control rules, based on our experience in developing internal control rules.

Chapter 1.

Jewelers, real estate agencies, leasing and factoring companies, payment acceptance operators, lotteries, gambling, telecom operators.

Chapter 2.

Pawnshops, microfinance organizations, credit consumer cooperatives, insurance companies, insurance brokers, non-state pension funds, professional participants in the securities market, management companies and other non-credit financial organizations.

Chapter 1. Jewelers, real estate agencies, leasing and factoring companies, payment acceptance operators, lotteries, gambling business, telecom operators.

The organizations specified in this chapter are obliged, by April 30, 2021, to make a new edition of the internal control rules for AML/CFT, changing it:

— a program regulating the procedure in case of refusal to execute a client’s order to perform a transaction;

— the procedure for ensuring the confidentiality of information obtained as a result of the application of internal control rules;

— the procedure for sending information to Rosfinmonitoring;

— other sections depending on the text of your ICs.

In the program for refusing to execute a client’s order to perform a transaction

It is advisable to expand the procedure for further actions of employees in relation to the client in the event of refusal to carry out the client’s order to complete a transaction, reflecting, for example, the following provisions.

1. The procedure for the organization or entrepreneur to accept documents and (or) information submitted by the client about the absence of grounds for making a decision to refuse, indicating the persons responsible for this.

For example, among other things, it can be stated in the AML/CFT ICR that when accepting documents and (or) information submitted by the client about the absence of grounds for making a decision to refuse, the Responsible Officer is obliged to ensure the client unhindered acceptance of such documents or information.

2. The procedure for reviewing the provided documents and (or) client information, indicating the persons responsible for this.

So, for example, the ICR may provide that the Responsible Officer, after receiving the specified documents and (or) client information, is obliged to ensure their comprehensive, complete and objective consideration with the involvement of persons responsible for working with the client in this process.

3. The procedure for informing the client about the elimination of the grounds, according to which a decision was previously made to refuse to carry out the operation or about the impossibility of eliminating the relevant grounds.

4. The procedure for carrying out the client’s operation in the event of a decision to eliminate the grounds on which the decision to refuse the operation was previously made.

In the program for ensuring the confidentiality of information obtained as a result of the application of the Internal Control Rules

, it is recommended to clarify the cases in which it is possible to inform clients about some of the AML/CFT measures taken (for example, among other things, the client can be informed about the refusal to execute his order to carry out transactions, about the refusal to conclude a bank account (deposit) agreement, about termination of the agreement bank account (deposit) and their reasons).

In the section of the ICR on AML/CFT, which concerns the submission of information to Rosfinmonitoring

It is advisable to set out the procedures and provisions related to the fact that from now on, when eliminating the grounds for refusing to execute a client’s order to carry out a transaction, in accordance with which a decision was previously made to refuse to carry out the operation, information about which was submitted to Rosfinmonitoring, organizations and entrepreneurs are obliged submit to Rosfinmonitoring information about such elimination no later than the working day following the day the relevant grounds were eliminated, in the manner established by the Government of the Russian Federation.

In the Program defining the organizational basis for the implementation of internal control

, it is recommended to reflect the procedures for interaction between employees of an organization or entrepreneur aimed at further actions in relation to the client in the event of refusal to carry out the client’s order to perform a transaction.

It may be necessary to introduce other provisions into the text of the internal control rules based on the content of specific AML/CFT rules of internal rules.

Don’t forget that jewelers, real estate agencies, leasing and factoring companies, payment acceptance operators, after adjusting the internal control rules, must send them to Rosfinmonitoring through a special form posted in your personal account on the department’s website.

Chapter 2. Pawnshops, microfinance organizations, credit consumer cooperatives, insurance companies, insurance brokers, non-state pension funds, professional participants in the securities market, management companies and other non-credit financial organizations.

The organizations specified in this chapter are required to make a new edition of the internal control rules for AML/CFT by July 30, 2021.

We recommend finalizing the Program for organizing work on refusal to execute a client’s order to perform a transaction

, adding to it provisions related to the procedure for informing clients about the reasons for the organization’s decision to refuse to execute the client’s order to perform a transaction if they contact the organization. Thus, when informing the client about the reasons for making a decision to refuse to execute an order to carry out a transaction, the organization also simultaneously informs the client about his right to submit documents and (or) information about the absence of grounds for making a decision to refuse to execute an order to carry out a transaction, methods their presentation, indicating the structural unit or person authorized to review such documents and (or) information submitted by the client.

It is advisable to create in the internal control rules a new separate Program for organizing work with documents submitted by the client and (or) information about the absence of grounds for making a decision to refuse to execute the client’s order to complete a transaction, requests and decisions of the interdepartmental commission created at the Bank of Russia

, in which it is possible to provide the following subsections.

1. Provisions on determining the structural unit (structural units) and (or) person (persons) authorized to review the documents submitted by the client and (or) information about the absence of grounds for making a decision on refusal, inform the client about the elimination of the grounds, in accordance with whom a decision was previously made to refuse or on the impossibility of eliminating the relevant grounds based on documents and (or) information provided by the client, to comply with requests from the interdepartmental commission created under the Bank of Russia (hereinafter referred to as the Commission) to provide a reasoned justification for the decision to refuse and reasoned justification about the impossibility of eliminating the grounds on which this decision was made, based on the documents and (or) information provided by the applicant in accordance with clause 13.4 of Art. 7 N 115-FZ, provide the Commission with reasoned justifications.

2. The procedure for accepting documents and (or) information submitted by the client about the absence of grounds for making a decision on refusal, ensuring unhindered acceptance of such documents and information in the structural unit that made the decision on refusal.

In this subsection of the new ICR program for AML/CFT, for example, it can be stated that when accepting documents and (or) information submitted by the client about the absence of grounds for making a decision to refuse, the responsible employee is obliged to ensure the client unhindered acceptance of such documents or information. It is advisable to indicate the specific procedure for interaction between employees of the organization when accepting documents. You can also indicate that if a client asks for confirmation of the acceptance of documents and (or) information about the absence of grounds for making a decision to refuse, the employee accepting the documents issues him a confirmation at the time of acceptance, the form of which is established by the organization in the AML Rules of Internal Affairs /FT.

3. The procedure for reviewing, taking into account the deadline established by N 115-FZ, documents submitted by the client and (or) information about the absence of grounds for making a decision on refusal, ensuring their comprehensive, complete and objective consideration.

In accordance with amendments to N 115-FZ, the organization is obliged to review the documents and (or) information submitted by the client and, no later than ten working days from the date of their submission, inform the client about the elimination of the grounds in accordance with which the decision was previously made to refuse to conduct operation or the impossibility of eliminating the relevant grounds based on the documents and (or) information provided by the client. Therefore, in this subsection of the new ICR program for AML/CFT, it is possible to provide, among other things, that in order to review the client’s documents, the responsible employee, if necessary, involves employees responsible for working with the client, and also, if necessary, requests from them all additional information necessary for a comprehensive, complete and objective review of documentation.

4. The procedure for preparing and sending a message to the client about the elimination (about the impossibility of eliminating) the grounds on which the decision to refuse was previously made.

In this subsection, it can be provided, for example, that the responsible employee is the person who prepares and sends to the client a message about the elimination (about the impossibility of eliminating) the grounds according to which the decision to refuse was previously made. It is necessary to indicate the methods of sending the message, as well as the possible content of its text.

5. The procedure for communicating to persons authorized to carry out the operation information about the elimination (about the impossibility of eliminating) the grounds on which the decision to refuse was previously made. If the grounds on which the decision to refuse was previously made are eliminated, the procedure for carrying out the corresponding operation in the event of an application from the client (applicant) is also included.

Here, in addition to other provisions, it is possible to stipulate that if the grounds on which a decision to refuse was previously made are eliminated, when the client applies, the corresponding operation must be carried out. An employee of the organization carrying out the relevant operation in the event of a client’s (applicant’s) request carries out the client’s operation, after which, in accordance with the procedure and time frame established in the AML/CFT ICR, he informs the responsible employee about the fact of the operation.

6. The procedure for consideration and execution, taking into account the deadline established by the Commission, of a request to provide reasoned justifications for the decision to refuse and the impossibility of eliminating the grounds on which the decision to refuse was made, as well as the procedure for submitting such reasoned justifications.

Let us remind you that if you receive a message from an organization about the impossibility of eliminating the grounds on which a decision was previously made to refuse to carry out an operation, based on documents and (or) information provided by the client, the client has the right to submit an application and the specified documents and ( or) information to the Commission. Before considering the merits of the application and documents and (or) information provided by the applicant, the Commission is obliged to first request the organization, and the organization is obliged to submit, within the time limits established by the Commission in the request, a reasoned justification for the decision to refuse to carry out the operation, as well as a reasoned justification for the impossibility eliminating the grounds on which this decision was made.

In order to implement these actions, the ICR on AML/CFT, among other things, can indicate that in order to fulfill the Commission’s request to provide motivated justifications, the responsible officer collects all available documents and information related to motivated justifications, and also, if necessary, involves employees responsible for working with client. It can be provided, for example, that the responsible employee attaches to the motivated justifications copies of all documents and information available to the organization that relate to the motivated justifications. It is also advisable to indicate the procedure for sending reasoned justifications to the Commission.

7. The procedure for executing the Commission’s decision on the absence of grounds on which the decision to refuse was previously made, and the decision of such a commission on the absence of grounds for revising the decision made by the organization, based on the documents and (or) information provided by the applicant. The procedure for informing persons authorized to carry out the operation of information about the Commission’s decision, and in relation to the Commission’s decision on the absence of grounds for refusal, also the procedure for carrying out the corresponding operation in the event of an application from the client (applicant).

According to the amendments to N 115-FZ, based on the results of consideration of the application and documents and (or) information provided by the applicant, as well as motivated justifications of the CPC, the Commission makes a decision on the absence of grounds according to which the CPC previously made a decision to refuse to carry out the operation or a decision about the absence of grounds for reviewing the decision made by the organization, based on the documents and (or) information provided by the applicant. The commission informs the applicant and the organization for which it is mandatory about the decision made no later than three working days from the date of its adoption in the manner established by the Bank of Russia in agreement with Rosfinmonitoring.

Therefore, in order to implement these provisions, it would be advisable, among other things, to prescribe the procedure and timing for communicating the Commission’s decision to the organization’s employees, as well as the procedure for carrying out the corresponding operation in the event of a client (applicant) request.

8. The procedure for informing Rosfinmonitoring about the elimination of the grounds on which a decision on refusal was previously made, information about which was submitted to Rosfinmonitoring.

9. The procedure for recording and storing documents submitted by the client and (or) information about the absence of grounds for making a decision to refuse, messages about eliminating (the impossibility of eliminating) the grounds in accordance with which a decision to refuse was previously made, requests for the provision of motivated justifications, motivated justifications, decisions of the Commission.

In the already existing section of the ICR on AML/CFT, which concerns the submission of information to Rosfinmonitoring

it is advisable to set out the procedures and provisions related to the fact that when eliminating those specified in paragraph 11 of Art. 7 N 115-ФЗ grounds, according to which a decision was previously made to refuse to carry out an operation, information about which was submitted to Rosfinmonitoring, the organization is obliged to submit to Rosfinmonitoring information about such elimination no later than the business day following the day of elimination of the corresponding grounds, in the manner established by the Bank of Russia in agreement with Rosfinmonitoring

In the AML/CFT system organization program

It is recommended to reflect the procedures for interaction of CCP employees aimed at working with documents submitted by the client and (or) information about the absence of grounds for making a decision to refuse to execute the client’s order to perform a transaction, requests and decisions of the Commission. In the same Program, it is recommended to clarify the cases in which it is possible to inform clients about certain AML/CFT measures taken (so, among other things, the client can be informed about the refusal to execute his order to carry out transactions, about the refusal to conclude a bank account (deposit) agreement) , on termination of a bank account (deposit) agreement and their reasons).

It is possible to introduce other provisions into the text of the internal control rules based on the content of specific AML/CFT rules of internal rules.

Please note that the Bank of Russia has currently developed a draft directive of the Bank of Russia “On amendments to Bank of Russia Regulation No. 445-P dated December 15, 2014 “On the requirements for internal control rules of non-credit financial organizations in order to combat the legalization (laundering) of income, obtained by criminal means and the financing of terrorism.” The draft amendments were developed to reflect in the Regulations of the Bank of Russia dated December 15, 2014 N 445-P, changes made to Federal Law N 115-FZ by Federal Law dated December 29, 2017 N 470-FZ.

When updating the internal control rules and writing this article at the beginning of April 2021, we were guided by the text of the draft regulatory act of the Bank of Russia. It is possible that in the final version of the document, which will be adopted and come into force, there will not be so many differences from the specified project. However, if there are still differences, organizations will certainly have to rely on the Bank of Russia document.

Well, if our readers cannot cope with updates to internal control rules on their own, we will be happy to help you!

expert on financial monitoring, editor-in-chief of the media “Bulletin of Financial Monitoring”, Ph.D. history Sciences, lawyer Pavel Smyslov

When using and quoting material, a link to the site is required!

* * *

Check out our many articles on financial monitoring and AML/CFT here:

List of our practical articles and publications on financial monitoring, AML/CFT, anti-money laundering legislation, 115-FZ and other related issues

* * *

Our services in the field of financial monitoring and AML/CFT:

— any documents and rules of internal control (IRAC for AML/CFT);

— training and instruction on financial monitoring;

— audit, subscriber services for AML/CFT;

— electronic signature and special software for financial monitoring;

— assistance during inspections;

- and much more.

More details HERE

.

Subscribe to the “Financial Monitoring Bulletin”

— the first free and regular news release in Russia in the field of financial monitoring:

We are in social networks:

What changes to consider

The internal control rules regulate the procedures for the actions of the above-listed persons for anti-money laundering purposes. They are prepared in paper or electronic form. In the latter case, the listed persons certify them with their enhanced qualified electronic signature (for example, the head of a law firm, lawyer or notary). Until January 13, 2022, these rules are drawn up on paper.

Internal control rules drawn up on paper can be stored as an electronic image of the document.

There are fewer mandatory programs that need to be included in the internal control rules. This applies to:

• documenting information;
• suspension of operations;
• actions in case of refusal to execute the client’s order to perform a transaction.

Which operations are subject to the new requirements?

The new requirements are related to the development of internal control rules for the following transactions with funds or other property carried out by these persons:

• real estate transactions;
• management of funds, securities or other property of the client;
• management of bank or securities accounts;
• raising money to create organizations, ensure their activities or manage them;
• creation of legal entities and foreign structures without forming a legal entity, ensuring their activities or managing them, as well as the purchase and sale of legal entities and foreign structures without forming a legal entity.

But we’ll talk about how tax authorities control your company and what to do if they call you to talk about problematic counterparties in a free webinar tomorrow. Sign up.

Who monitors the implementation of 115-FZ

There are regulatory bodies in the Russian Federation, their purpose is to monitor compliance with the law in the field of AML/CFT. Such bodies include the Central Bank, Rosfinmonitoring, the Federal Assay Chamber and Roskomnadzor.

Each subject of 115-FZ has its own regulator depending on the type of activity of the organization:

• The Central Bank is responsible for monitoring the functioning of banks, pawnshops, microfinance enterprises, consumer credit cooperatives, non-state pension funds and securities market participants in compliance with AML/CFT provisions
• Rosfinmonitoring monitors real estate agencies, leasing and factoring companies, outsourced accountants, lawyers, payment collection operators, lotteries and sweepstakes
• The Federal Assay Chamber controls the jewelry industry
• Roskomnadzor monitors mobile operators and Russian Post

Contents of internal control rules

Internal control rules from 2022 must contain 9 mandatory programs:

• organizational basis of the internal control system;
• identification of clients, client representatives and/or beneficiaries, as well as beneficial owners;
• client research;
• risk assessment and risk management of money laundering and terrorist financing;
• identifying transactions and financial transactions with signs of laundering or terrorist financing and submitting information about them to Rosfinmonitoring;
• procedure for freezing (blocking) funds or other property;
• training and education of personnel in the field of combating money laundering, the financing of terrorism and the proliferation of weapons of mass destruction;
• audit of the internal control system;
• storage of information and documents obtained as a result of fulfilling obligations to combat money laundering, financing of terrorism and the proliferation of weapons of mass destruction.

Decree No. 1188 defines in detail the content of each program.

Examples of violations

It is worth considering some situations in which, during the period of on-site control, the regulator identified deviations under 115-FZ.

Errors when filling out the FES

Example 1. An employee of the National Bank for the Republic of Tatarstan exercised control over a credit consumer cooperative called “Finance-Credit”. As a result, violations were discovered in the filling out of formal electronic messages by CCP employees based on the results of checking clients with the list of terrorists, extremists and weapons distributors. Thus, violations of the requirements of paragraphs. 7 clause 1 art. 7 and paragraph 6 of Art. 7.5 115-FZ.

“Finance-Credit” was brought to administrative liability under Part 1 of Art. 15.27 Code of Administrative Offenses of the Russian Federation : a penalty was issued in the amount of 56 thousand rubles. The cooperative drew up a complaint and sent it to the Arbitration Court with a request to replace the penalty with a warning.

According to the law, consumer credit cooperatives are obliged to:

• carry out a reconciliation of the client database with individuals and legal entities to whom measures were applied to freeze or block funds or other property, at least once every 3 months (clause 7, clause 1, article 7 115-FZ)
• correlate the customer base with the register of distributors of weapons of mass destruction at least once every 3 months (clause 6 of article 7.5 115-FZ)
• send FES with the results of inspections (Instruction of the Bank of Russia dated October 17, 2018 No. 4937-U)

The cooperative was previously assigned administrative liability under Part 1 of Art. 15.27 Code of Administrative Offenses of the Russian Federation . The arbitration court rejected the enterprise's appeal.

Example 2. During the period of inspection by the regulator of Rublev-Grad Pawnshop LLC, it turned out that the company’s employees incorrectly filled out the FES: they entered data into fields with errors, and selected incorrect names for messages. Moreover, the internal control rules were drawn up incorrectly.

The regulator issued a resolution imposing administrative liability on the enterprise under Part 1 of Art. 15.27 of the Code of Administrative Offenses of the Russian Federation in the form of a fine in the amount of 50 thousand rubles. The company sent an application to the Arbitration Court to declare the resolution illegal. However, the court did not satisfy this requirement.

Checking compliance with AML/CFT legislation

One of the most common misconceptions is that the organization is not registered with the regulator, and therefore does not have to comply with the requirements of the law. It is not only the regulator that is responsible for checking compliance with AML/CFT legislation, and fines under 115-FZ cannot be avoided.

Example 3. A striking example of such a case was the case of the Region real estate agency in the Moscow region. The organization was not registered with Rosfinmonitoring, although it fell under Art. 5 115-FZ, thus was obliged to follow the requirements of the law. As a result of the prosecutor's scheduled inspection, non-compliance by employees with 115-FZ was revealed in terms of certain provisions:

• the agency is not registered with Rosfinmonitoring
• the organization has not established internal control rules
• employees have not completed AML/CFT training
• specialists do not check clients who have been served with lists of terrorists, extremists and weapons distributors

The prosecutor's office issued a resolution on an administrative offense under Part 1 of Art. 15.27 Code of Administrative Offenses of the Russian Federation . The agency was fined by Rosfinmonitoring in the amount of 60 thousand rubles.

Representatives of the agency attempted to challenge the decision of the prosecutor's office in the arbitration court, insisting that their activities cannot be considered as specified in 115-FZ, because they do not provide intermediary services in organizing sales transactions, but only provide consultations.

However, the court noted that the agency provided intermediary services in the purchase and sale of real estate, which is confirmed by data from the charter and an extract from the Unified State Register of Legal Entities. The realtors' claim was not satisfied.

Example 4. Similar violations were identified by the Federal Tax Service in the activities of the Donald Trade Plus organization, which distributes lottery tickets.

According to Art. 5 115-FZ, the list of organizations carrying out transactions with cash or other property includes “organizations that run sweepstakes and bookmakers, as well as organizing and conducting lotteries, sweepstakes (mutual betting) and other risk-based games, including electronic form". As a result, it is obliged to take measures for AML/CFT purposes.

According to the documentation of the case, the tax office conducted an audit and found violations of the norms of 115-FZ:

• the company did not draw up internal control rules
• a personal account was not created on the Rosfinmonitoring platform to compare the client base with lists of terrorists and extremists

The tax office issued a ruling on an administrative offense under Part 1 of Art. 15.27 Code of Administrative Offenses of the Russian Federation in the form of a warning. Donald Trade Plus tried to challenge this conclusion, however, this claim was not satisfied by the Arbitration Court.