New Payment Product & Services (NPPS) - AML/CFT : FATF

 New Payment Products and Services (NPPSs) can pose risks to anti-money laundering (AML) and counter-terrorist financing (CFT) efforts. NPPSs are innovative payment services that can be used to:

 

·         Co-mingle legitimate business takings with illicit cash

·         Move illicit funds across borders

·         Conceal criminal proceeds and send them offshore

NPPSs include:

·         Prepaid cards

·         Mobile payment services

·         Internet-based payment services

·         Virtual currencies

·         Internet-based loans

·         Alternative remittance services 

 

The FATF has developed guidance for countries and the private sector on how to apply a risk-based approach to AML/CFT measures for NPPSs. This guidance includes:

 

·         Considering the risks posed by alternative currencies

·         Regulating and supervising entities involved in providing NPPSs 

New technologies can improve the efficiency and effectiveness of AML/CFT measures. They can help financial institutions and supervisors assess risks more accurately and comprehensively

 

Guidance for a Risk-Based Approach to Prepaid Cards, Mobile Payments and Internet-Based Payment Services[2013]

The guidance is structured as follows: 

1.      Section II explains how new payment systems work, who the entities involved in the provision of NPPS are, and their roles/activities 

2.      Section III examines which entities involved in the provision of NPPS are already covered by the FATF Recommendations (i.e., because they fall within the FATF definition of a financial institution)

3.      Section IV determines the risks involved in the provision of NPPS, including through consideration of any relevant risk factors and risk mitigation measures

4.      Section V considers the impact of regulation on the NPPS market, including whether such regulation would impact financial inclusion and the positive implications of money deposits moving to regulated financial institutions

5.      Section VI examines how to regulate and supervise entities involved in providing NPPS, and consider the impact of such regulation and supervision on the effective implementation of AML/CFT measures

6.      Section VII discusses considerations when determining how to apply appropriate AML/CFT regulation of NPPS which addresses the risks, acknowledging that there may be multiple regulated entities

Role of entities involved in NPPS

A.   Entities involved in the provision of prepaid cards may include the following:

(a) Acquirer – The entity which maintains the relationship with the retailer, provides the infrastructure needed for accepting a card payment (e.g. access to the point of sale (POS) terminal or the payment services supporting an e-commerce website) and normally operates the account in which the proceeds of the sale transaction are deposited.

(b) Distributor (including retailer) – The entity that sells, provides, or arranges for the sale of, prepaid cards on behalf of the issuer to consumers. Distributors may also offer a range of services to their customers.

(c) Payments network operator – The entity that provides the technical platform to perform transactions with the card at ATMs or points of sale at merchants.

(d) Issuer – The entity that issues prepaid cards and against which the customer has a claim for redemption or withdrawal of funds.

(e) Programme manager – The entity responsible for establishing and managing the prepaid card programme in cooperation with a bank or electronic money institution. The programme manager usually markets the prepaid cards and establishes relationships with banks and distributors or customers, and in many cases provides the data processing capability. Some prepaid card issuers also manage their card programmes themselves (i.e. without using programme managers).

(f). Agent – For the purposes of this guidance, an agent is any natural or legal person providing prepaid card services on behalf of another entity involved in the provision of prepaid cards, whether by contract with or under the direction of the entity. The entities having roles in the prepaid card market may frequently act on behalf of other entities, depending on the business model selected for the prepaid card programme.

B.   Mobile Payments

the financial institutions that facilitate mobile payments, including person-to-business (P2B), person-to-person (P2P) or government-to-person (G2P) transactions, can be traditional payment service providers (banks or depository institutions) or non-bank payment service providers, designated in the FATF glossary as money or value transfer services (MVTS).

Depending on the business model and technology used, various types of service providers are essential partners to financial institutions providing mobile payments services. These partners include mobile network operators (MNOs), and may include mobile telephone equipment manufacturers, telecommunications industry standards setting groups, payment networks, and software developers. In terms of technology used, business models use a range of approaches to facilitate mobile payments including text messaging, mobile Internet access, near field communication (NFC), programmed subscriber identity module (SIM) cards and unstructured supplementary service data (USSD).

The nature and operation of mobile payment services varies greatly between business models, and commonly involves new technologies and links with other types of NPPS, which presents challenges for countries in developing effective AML/CFT regulation. Business models can vary based on which service provider has the lead role, whether the service is pre-paid or post-paid, meaning the customer pays after receiving the service, and the technical platform used. The description of the models of mobile payment services below is not an exhaustive description and does not describe any particular scheme. Rather, it provides a generalization of typical features of mobile payment services to assist in the development and application of AML/CFT measures and regulation.

In a bank-centric mobile payment model the customers are account holders of the bank which offers the mobile payments service. However, this differs from the provision of traditional banking services through the mobile phone as the bank either develops new products offered through the mobile phone to serve the previously unbanked which are tied to limited transaction accounts, or alternatively, is a provider of electronic money that is not tied to a payment account. The bank partners with software developers and a payment processor to allow bank customers to send and receive payment messages via the access mechanism of a mobile phone, with the payments cleared through the domestic automated clearinghouse network or a payment card network. Funds are drawn from and/or deposited to a customer bank or payment card account. The role of the MNO in this example is limited to providing the telecommunication network facility which enables the transfer of payment messages, and it does not manage or hold the customer’s funds at any stage. Therefore, the Mobile Network Operator(MNO) would not require a financial services license as the bank is the payment service provider.

Under the MNO-centric mobile payment model, MNOs offer mobile payment services as a means to add value to their core communications service. Commonly, customer funds are held in a prepaid account by the MNO itself or a subsidiary. Although in some jurisdictions even if the MNO is the business owner (the entity which assumes the bulk of the financial risk and operational responsibility of offering the service), a partner bank formally holds the license. If the funds are post-paid, the MNO can be considered to be providing short-term credit or payment service to its customers, in the same way as some three-party payment card schemes.6 In this respect, a prepaid account eliminates credit risk for the MNO, while a customer with a post-paid account has a credit relationship with the MNO. MNOs are often international companies with the ability to extend their services across borders. This may also apply to payment services where there are no legal or technical impediments to the provision of cross-border payment services.

Between these two cases, there can be a range of mobile payment services offered by financial institutions and MNOs who have partnered to create agent networks to reach new customers in geographic areas which are typically underserved by the banking system. In such cases, MNO retail outlets and other storefront retailers offer similar services to those of limited purpose bank branches, signing up customers, taking in deposits, and paying out cash to settle mobile payment transactions. The payment service may be branded under the name of the bank or under the name of the MNO.

Mobile payment services are increasingly interconnected with other payment services. MNOs are partnering with electronic funds transfer networks to allow domestic customers to access ATMs for cash withdrawals by entering a code, rather than swiping a payment card. To allow customers international access to cash, MNOs are partnering with payment card issuers to offer open-loop prepaid cards.

Entities involved in the provision of mobile payments may include the following:

(a) MNO – The entity that provides the technical platform to allow access to the funds through their mobile phone.

(b) Distributor (including retailer) – The entity that sells, or arranges for the issuance of funds on behalf of the issuer to consumers, if such funds can be used for payments. Distributors may also offer a range of services to their customers, such as technical support.

(c). Electronic money issuer – The entity that issues electronic money. For the purposes of this paper, electronic money is a record of funds or value available to a consumer stored on a payment device such as chip on a prepaid card, mobile phones or on computer systems as a non-traditional account8 with a banking or non-banking entity.

C. Internet Based Payment Services

 The Internet opened up the world of e-commerce and led to the development of various types of Internet-based payment services which emerged in the late 1990s to intermediate between online buyers and sellers (P2B) and for personal transfers (P2P) transactions. During the last decade, financial institutions and retailers have continued to develop electronic payment instruments which use the Internet and are available to a wide range of consumers.

Internet-based payment services provide mechanisms for customers to access, via the Internet, pre-funded accounts which can be used to transfer the electronic money or value held in those accounts to other individuals or businesses which also hold accounts with the same provider.

The recipient then redeems the value from the issuer by making payments or withdrawing the funds. Withdrawals occur by transferring the funds to a regular bank account, a prepaid card, or another money or value transfer service. While typically customers hold funds in pre-paid accounts, customers are not required to do so. When the account needs to be funded, this can happen with a debit from a bank account or payment card account, or supplied via another funding source as needed.

FATF DEFINITION OF “FINANCIAL INSTITUTIONS”

In applying AML/CFT preventive measures to NPPS, countries should consider which entities fall within the scope of the FATF Recommendations. In defining financial institutions, the FATF provides a list of financial activities or operations in the glossary to be covered for AML/CFT purposes.

FATF Definition of “financial institutions” Financial institutions means any natural or legal person who conducts as a business one or more of the following activities or operations for or on behalf of a customer:

1.      Acceptance of deposits and other repayable funds from the public.

2.      Lending.

3.      Financial leasing.

4.      Money or value transfer services.

5.      Issuing and managing means of payment (e.g. credit and debit cards, cheques, traveller's cheques, money orders and bankers' drafts, electronic money).

6.      Financial guarantees and commitments.

7.      Trading in:

a)       Money market instruments (cheques, bills, certificates of deposit, derivatives etc.);

b)       Foreign exchange;

c)       Exchange, interest rate and index instruments;

d)       Transferable securities;

e)       Commodity futures trading.

8.      Participation in securities issues and the provision of financial services related to such issues.

9.      Individual and collective portfolio management.

10.  Safekeeping and administration of cash or liquid securities on behalf of other persons.

11.  Otherwise investing, administering or managing funds or money on behalf of other persons.

12.  Underwriting and placement of life insurance and other investment related insurance.

13.  Money and currency changing.

Providers of NPPS fall within the definition of financial institution by conducting money or value transfer services, or by issuing and managing a means of payment, and therefore should be subject to AML/CFT preventive measures as required by the FATF Recommendations, including, for example, customer due diligence, record keeping, and reporting of suspicious transactions. There can be difficulty, however, in determining which entity (or entities) in the provision of NPPS should be responsible for the implementation of preventive measures and the application of such measures at the national level. This paper provides guidance to countries in section VII as to which entity (or entities) could be considered the responsible NPPS provider, and therefore subject to AML/CFT regulation.

POSSIBLE RISK-BASED EXEMPTION FROM AML/CFT MEASURES

 Countries may exempt the activities listed in the definition of financial institution from the relevant preventive measures required by the FATF Recommendations, under certain circumstances. The Interpretive Note to Recommendation 1 states that there are two situations in which countries may decide not to apply some of the FATF Recommendations requiring financial institutions to take certain actions:

(a) provided there is a proven low risk of money laundering and terrorist financing; this occurs in strictly limited and justified circumstances; and it relates to a particular type of financial institution or activity, or DNFBP; or

(b) when a financial activity (other than the transferring of money or value) is carried out by a natural or legal person on an occasional or very limited basis (having regard to quantitative and absolute criteria), such that there is low risk of money laundering and terrorist financing.

 Countries should note that the Interpretive Note to Recommendation 1 further states that while the information gathered may vary according to the level of risk, the requirements of Recommendation 11 to retain information should apply to whatever information is gathered. Of further relevance to countries in relation to NPPS is that MVTS cannot benefit from the exemption due to financial activity being conducted on an occasional or very limited basis.

To implement a risk-based approach to AML/CFT and NPPS, it is essential that countries and private sector institutions identify and assess the ML/TF risks posed by NPPS when developing AML/CFT regulation for NPPS and when designing NPPS. Under FATF Recommendation 1, countries should identify, assess and understand the ML/TF risks for the country and should also require financial institutions to identify and assess ML/TF risks. Of particular relevance for NPPS is Recommendation 15 which requires countries and financial institutions to identify and assess the ML/TF risks that may arise in relation to the development of new products and business practices, and the use of new or developing technologies. In addition, under Recommendation 15 countries should also require financial institutions to identify and assess risks of new products, business practices or the use of new technologies prior to their launch.

 This section features a series of risk factors and risk mitigation measures to assist both countries and private sector institutions in assessing the risk of NPPS. In assessing the risks posed by NPPS, countries should consider the FATF Guidance for ML/TF risk assessment. In addition, countries and financial institutions should consider the risk factors outlined in the Interpretive Note to Recommendation 10 on customer due diligence. While these examples are not mandatory elements of the FATF Recommendations, they provide useful examples of risk indicators, many of which are discussed in further detail below with respect to the ML/TF risks posed by NPPS. 

RISK FACTORS

This section of the paper identifies a range of risk factors that help to identify the ML/TF risks associated with NPPS. Many NPPS may have characteristics which mitigate ML/TF risk and these should be considered as part of a holistic approach when assessing the risks associated with a particular NPPS. The level of ML/TF risk posed by a particular NPPS will depend on a consideration of all risk factors, the existence of risk mitigates and its functionality.

 

i. Non-face-to-face relationships and anonymity

As with many banking methods, NPPS can allow for non face-to-face business relationships. Depending on their characteristics, NPPS can be used to quickly move funds around the world, to make purchases and access to cash (both directly and indirectly) through the ATM network. The absence of face-to-face contact may indicate a higher ML/TF risk situation. If customer identification and verification measures do not adequately address the risks associated with non-face to face contact, such as impersonation fraud, the ML/TF risk increases, as does the difficulty in being able to trace the funds.

While monitoring and reporting mechanisms can be put in place to identify suspicious activity, an absence of CDD increases the difficulty for the service provider to do so. For example, this impacts on the ability of the service provider to identify instances of customers holding multiple accounts simultaneously.

 

For prepaid cards, the risk posed by anonymity (not identifying the customer) can occur when the card is purchased, registered, loaded, reloaded, or used by the customer. The level of risk posed by anonymity is relative to the functionality of the card and existence of AML/CFT risk mitigation measures such as funding or purchasing limits, reload limits, cash access, and whether the card can be used outside the country of issue. Prepaid cards can be funded in various ways with different degrees of CDD including through banks, the Internet, at small retail shops, or at ATMs. While funding via a bank account or through the Internet normally starts from an account or a payment instrument whose holder has been identified, cash funding or funding through other NPPS is possible and can be fully anonymous. In addition, prepaid cards can easily be passed on to third parties that are unknown to the issuer, including, but not restricted to, ‘twin cards’ which are specifically designed to allow third parties remittances, and may advertise anonymity as a feature of the product. This is concerning when the providers of these products are based in countries where prepaid card providers are insufficiently regulated and supervised for AML/CFT purposes, but sell their products internationally.

Mobile payment services may establish their customer relationships either through agents, online or through the mobile payment system itself. The same channels are used for loading funds into the mobile account. The risk posed by anonymity occurs when the mobile payment service is used or reloaded, and is relative to the functionality of the mobile payment service and the existence of AML/CFT risk mitigation measures such as CDD or funding thresholds.

 

For Internet-based payment services there is typically no face-to-face customer contact. This may increase the risk of identity fraud or customers providing inaccurate information potentially to disguise illegal activity if effective measures to address this risk are not employed. However, this lack of face-to-face contact is often counterbalanced through the adoption of alternative identification mechanisms, which can provide adequate risk mitigation measures. The risk posed by anonymity or not identifying the customer when the Internet-based payment service is used or reloaded is relative to the functionality of the service, the funding mechanisms (if funds come from a regulated account the risks can be substantially reduced) and the existence of AML/CFT measures.

ii. Geographical reach

The extent to which a particular NPPS can be used globally for making payments or transferring funds is an important factor to take into account when determining the level of risk.

Open-loop prepaid cards often enable customers to effect payments at domestic and foreign points of sales through global payment networks. These cards are accepted as a means of payment everywhere a similarly-branded card (debit or credit) is accepted. Providers of prepaid cards may be based in one country and sell their product internationally through agents or the Internet. These cards can then be used to purchase goods and services, or access cash, internationally. Additionally, some prepaid card programmes allow cardholders to transfer funds from person-to-person. This global reach of some prepaid cards to make payments, access cash and transfer funds are all features that make those products attractive for ML/TF purposes. The compact physical size of prepaid cards also makes them potentially vulnerable to misuse by criminals who use them, instead of cash, to make physical cross-border transportations of value. Prepaid cards which can be used to access funds internationally are particularly vulnerable due to the logistical benefits of transporting a discreet number of prepaid cards that have accounts loaded with high fund values which cannot be determined from the card itself, rather than transporting large, bulky amounts of cash using cash couriers. Countries should also consider whether Recommendation 32 applies to certain prepaid access products, such as prepaid cards, that would qualify as bearer negotiable instruments.

Mobile payment services and Internet-based payment services that can be used to transfer funds globally, or can be used in a wide geographical area, with a large number of counterparties are more attractive to criminals for ML/TF purposes than purely domestic business models. In addition, NPPS providers located in one jurisdiction may offer these services to customers located in another jurisdiction where they may be subject to different AML/CFT obligations and oversight. This is of concern where the NPPS provider is located in a jurisdiction that has weak AML/CFT controls.

 iii. Methods of funding

The methods by which a NPPS can be funded impacts on the level of ML/TF risk posed. Anonymous funding methods obscure the origin of the funds, creating a higher ML/TF risk. Cash poses the highest potential risk as cash is anonymous and provides no transaction history. However, while NPPS provide a platform for transaction monitoring, funding a NPPS product via another payment service that does not verify customer identification can also create an anonymous funding mechanism. In addition, NPPS that use a prepaid model means that the absence of credit risk for the provider may reduce the incentive for providers to conduct comprehensive CDD, thereby increasing the ML/TF risk.

The ML/TF risk posed by prepaid cards is increased by allowing cash funding and, in some rare cases, reloadability without any limit on the value placed on the card account or CDD requirements. This makes prepaid cards vulnerable to abuse by criminals who can use them, for example, as a means to launder the proceeds of crime by placing those proceeds into the financial system or using the prepaid cards as an alternative to the physical cross-border transportation of cash.

Mobile payment services allow accounts and transactions to be funded in different ways; many services, whether bank- or MNO-centric model, draw funds from a bank or payment card account, others allow cash funding through a network of agents. While the former funding method limits ML/TF risk (but also limits potential access), cash and non-bank payment options open up payment system access but also obscure the origin of the funds creating a heightened risk for ML/TF. A mobile payment service that facilitates account-to-account transfers is also permitting funding through third parties, which may increase the ML/TF risk, if the holder of the funding account was not properly identified.

Internet-based payment services that allow third party funding from anonymous sources may face an increased risk of ML/TF. A special case of third party funding is the use of exchangers or virtual bureaux de change. Such exchangers can circumvent an Internet-based payment service provider’s ban on certain funding methods (e.g. a ‘no cash funding’ policy) if they accept the banned payment methods when reselling the issued digital currency or electronic money funds. Further, the provider will only see the exchanger´s name in its monitoring, but will not see who actually instructed the exchanger to fund the account.

iv. Access to cash

 Access to cash through the international ATM network increases the level of ML/TF risk. Such access to cash may be direct, as in the case of prepaid cards which can allow funding in one country and cash withdrawals in another. Alternatively, mobile payment services and Internet payment services are increasingly becoming interconnected with other NPPS such as prepaid cards which indirectly allow access to cash withdrawals.

v. Segmentation of services

The provision of NPPS commonly requires a complex infrastructure involving several parties for the execution of payments. Prepaid cards may involve several parties for the execution of payments including the programme manager, issuer, acquirer, payment network, distributor and agents, while mobile payments service providers must often coordinate with a number of interrelated service providers, and partner with international counterparts to provide cross-border transactions.

A large number of parties involved in the provision of NPPS, especially when spread across several countries, can increase the ML/TF risk of the product due to the potential of segmentation and the potential loss of customer and transaction information. This is a particular concern when it is not clearly established which of the entities involved are subject to AML/CFT obligations, who is responsible for complying with such obligations, and what country among those involved in the transaction process is responsible for regulating and supervising for compliance with AML/CFT measures.

Using agents and relying on unaffiliated third parties for establishing customer relationships and reloading raises potential ML/TF risks, particularly if the collected information is not shared with the entity responsible for AML/CFT requirements. A service provider that can take responsibility for all aspects of the customer relationship (i.e. registration, cash-in/cash-out and transactions) can pose a lower risk. Of relevance is the organizational structure and processes set up for the training, management and control of the network of agents.

Additionally, entities providing NPPS often come from sectors, such as MNOs, which are unfamiliar with AML/CFT controls. Consequently, CDD know-how could be limited in comparison to, for example, the traditional banking sector, and CDD generally may remain restricted to analysing atypical transactions and feedback from distributors. In addition, the chain of information could create difficulties in tracing the funds. For example, the chain of information for a single financial transaction could involve more entities; some of which may be located in different countries. This could slow down the investigation process, which is further complicated by the speed of money flows, and the challenges of trying to seize and freeze criminal proceeds which can be quickly transferred or transported to another country using NPPS.

NPPS providers maintain bank accounts and use the banking system for periodic transactions to settle accounts with agents and MVTS partners. However, while a bank settling wholesale transactions between NPPS providers has CDD obligations in relation to the NPPS provider, it has no, or limited visibility into the NPPS providers’ customers and is unable to oversee transactions between the NPPS provider and their customers.

Internet-based payment services that handle all aspects of the customer relationship (i.e. registration, cash-in/cash-out and transactions) and are subject to AML/CFT requirements may pose a lower risk than de-centralized services. Providers that rely on unaffiliated third parties for the issuance or redemption of electronic currency may also lead to segmentation of services and increased ML/TF risk. The segmentation of Internet-based payment services is particularly concerning as their cross-border nature means that providers may be located in jurisdictions with inadequate AML/CFT regulation and supervision.

 vi. Risk matrix

The risk matrix below22 features a series of risk factors that, although not exhaustive, help to identify the risks associated with any type of individual NPPS, including prepaid cards, mobile payments and Internet-based payment services. It is important to take a holistic approach when assessing the risks associated with a particular NPPS. Rather than considering the risk factors listed in the matrix one-by-one, the risks, risk mitigants, and functionality of a particular NPPS should be considered together to determine whether the product poses a high or low ML/TF risk. The risk factors below are intended to be illustrative and some NPPS may contain elements of both higher risk and lower risk factors which should be considered, and combined with the existence of risk mitigants, to determine the overall level of risk.

Although the risk matrix applies fully for NPPS, the nature and functionality of the NPPS can vary considerably in comparison to other payment instruments (e.g. credit and debit cards), and product can be tailored in different ways to allow for different uses. For this reason, the risk assessment of NPPS should be developed on a case-by-case basis, taking into consideration the specific features of the single product. In doing so, consideration should be given to the following specific risks which are associated with NPPS.

 

This risk matrix was first published in the FATF typologies report on Money Laundering Using New Payment Methods (2010). It is an updated version of the risk matrix which was published in an earlier FATF typologies report, the Report on New Payment Methods (2006).

RBA Risk Matrix from FATF 

The following Criteria are identified by FATF to look at risk arising from anonymity following RBA

CDD : Identification, Verification, Monitoring- anonymous, recorded

Record keeping-like FACTA 2010 with USA, No records, Records kept

Value limits - Amount, No. of transactions

                             Methods of funding -Anonymous, Account only

           Geographical limits- Liquid Currencies, Abroad, Domestic

                        Usage limits- Negotiability (Merchant Acceptability), Utility, 

Withdrawal

                        Segmentation of services- Inhouse/Outsourced

Explanation

FATF Recommendations & NPPS Supervision

RBA from the Country’s Responsibilities	[Recommendation 1& 15]
CDD & Implications of Simplified CDD	[Recommendation 10]
Licensing & Registration Requirements , including those for Agents	[Recommendation 14]
NPPS share common features with Wire Transfers	[Recommendation 16]
Identification of Responsible Authority	Many Mobile Network Operators(MNOs) offer mobile payment Services, Communication Authority , not automatically best placed to monitor MNOs for AML/CFT compliance u  Assessment of capacity of authority should be made u  Provide Training & Education in AML/CFT to develop expertise and u  Close cooperation with the financial supervisors , essential to ensure consistent, coordinated approach
Determining NPPS provider subject to AML/CFT compliance	Look for the entity which u  Has visibility and management of NPPS u  Maintains relationship with customers u  Accepts the funds from the customer and u  Against which the customer has claim for those funds

Happy Reading,

Those who read this, also read:

1. CDD: Non-Face-to-Face Customers(NFTF)

2. Cross-Border Payment Guidelines- RBI, India

3. RBI, India's  AML/CFT Guidelines for NPPS