Counterparty due diligence, beneficial ownership and UIAF reporting

Where the programme breaks down

A flawless risk matrix is worth nothing if the sales team onboards customers without asking for a single document. The programme is won or lost in the know-your-counterparty procedure, and that procedure is run by people who are not lawyers, who have a sales target and who need a clear rule: what do I ask for, from whom, at what point, and what do I do if something is missing.

Knowing the customer, the supplier and the partner

• Minimum information by counterparty type, distinguishing individuals, companies, non-profit entities and foreign counterparties.
• Beneficial ownership. How far up the ownership chain to go, and what to do when the structure makes it impossible to get there.
• Timing of the check. Before onboarding, not after the first order has shipped.
• Exceptions. Who may authorise them, on what written justification and within what limit.
• Refresh. How often information is updated and which event forces an early review.

Lists, politically exposed persons and enhanced diligence

Screening against the binding lists of the United Nations Security Council is mandatory and admits no nuance. Beyond that, the company decides which other lists it screens, and that decision is worth recording in writing together with the rule on what happens on a hit: who validates it, how a namesake is ruled out and who authorises proceeding. The same applies to politically exposed persons: identifying them does not mean rejecting them, it means applying enhanced due diligence and recording who approved the relationship.

Unusual transactions and reporting to the UIAF

The analysis of an unusual transaction always ends in a decision, and both possible decisions —to report or not to report— have to be documented with their reasoning. We design the procedure so that the analysis exists, has an owner and leaves a trail.

• Criteria for separating the unusual from the merely atypical within the client's business.
• An internal escalation route, with its own timeframes and with a named decision-maker at each level.
• Suspicious transaction reporting to the UIAF and a register of the other reports the company must file.
• Retention rules for the documentation, which is what sustains the company's position years later.

And one rule worth being clear about from day one, because it is the one most often broken on impulse: the reported counterparty is not tipped off. Not by the salesperson who handles the account, not by the manager who has known them for years.

The information collected also has to be looked after

Due diligence generates files holding identity documents, shareholding structures and personal data of individuals. We define who inside the company may access that information, how it is stored and how long it is kept, so that the procedure built to reduce one risk does not end up creating a different one.

How we leave it running

1. We review the real commercial process, from first contact through to dispatch or payment.
2. We insert the due diligence at the points where the process already stops, so as not to create a parallel formality nobody will follow.
3. We draft the forms and checklists in operational language, not in manual language.
4. We train the people who will use them and work through the first real cases with them.
5. We review a sample of files a few months later and fix whatever did not work.

What the client receives

• The know-your-counterparty procedure, with the information required by type and the corresponding forms.
• The rules for list screening, handling hits and dealing with politically exposed persons.
• The procedure for analysing unusual transactions and deciding on reporting, with its formats.
• The retention and access rules for the documentation collected.
• Training for the team that runs the procedure and a later review of a sample of files.