FAQ on KYC and AML-CFT due diligence

AML (Anti-Money Landering): The term anti-money laundering, or AML, refers to laws, regulations and procedures designed to combat financial crime. Although anti-money laundering laws cover a limited range of criminal transactions and behaviors, their implications are far-reaching, covering all types of business today, far beyond financial services alone.

AP Solutions IO delivers a new version of the application every 4 months. Thanks to our SaaS mode, you automatically benefit from these upgrades without any action on your part. We are always ready to listen to your specific needs.

AML-CFT The fight againstmoney launderingand terrorist financing. With the constant evolution of regulations, this has become a major concern for companies, which are subject to heavy fines in the event of non-compliance, and can engage the criminal liability of company directors.

• Before entering into a business relationship: obligation to identify the " Beneficial Owner"; even for an occasional customer, and to screen the lists of Global/Regional Sanctions, Assets Freeze, Politically Exposed Person, RCA Relatives and Close Associates, Unfavorable Media, identification of countries and currencies under embargo...
• Throughout the business relationship: the third-party repository must be constantly updated, and any change in information (such as an IBAN change, company closure or merger, PEP, RCA exposure, etc.) must lead to a new verification by the teams in charge, so daily screening is a must.
• At the end of the business relationship: once the Ultimate Beneficiary's account has been closed, all related documents and information must be archived for a period of 5 years.

Our tools comply with GDPR standards, and make cybersecurity a top priority, with annual penetration tests carried out by independent experts. Our APIs are designed using REST/JSON standards and secured by OAUTH2. Our no-code solutions enable quick and easy evaluation, while our advanced security measures ensure data integrity, confidentiality and traceability.

Our all-in-one tools can operate in complete autonomy and be used by non-expert users. They can be connected to your information system via our APIs, or operate in hybrid mode with the simultaneous use of our APIs and our web portal.

Know Your Customer(KYC): Know Your Customer is the process of verifying the identity and integrity of customers. European regulations require this verification in order to prevent corruption, money laundering, tax fraud and the financing of terrorism (AML-CFT). Changes in the regulatory framework (EBA, Sapin 2, AML-CFT, etc.) require certain institutions to extend their knowledge of their suppliers: Know Your Suppliers(KYS). KYC remediation: KYC remediation involves updating, cleaning up and periodically reviewing the information you hold on your customers. You hold customer information in the form of documents such as IDs, KBis or any other required document. This data needs to be regularly updated in line with the regulations in force in your industry and the level of money laundering risk assigned to your customer based on his or her information. AP Solutions IO screening tools fully automate this process, filtering information across millions of records (see list quality). AML-CFTAnti-money launderingand anti-terrorist financing. With the constant evolution of regulations, this has become a major preoccupation for companies, which are subject to heavy fines in the event of strict non-compliance, and can engage the criminal liability of company directors.

• Before entering into a business relationship: obligation to identify the " Beneficial Owner"; even for an occasional customer, and to screen the lists of Global/Regional Sanctions, Assets Freeze, Politically Exposed Person, RCA Relatives and Close Associates, Unfavorable Media, identification of countries and currencies under embargo...
• Throughout the business relationship: the third-party repository must be constantly updated, and any change in information (such as an IBAN change, company closure or merger, PEP, RCA exposure, etc.) must lead to a new verification by the teams in charge, so daily screening is a must.
• At the end of the business relationship: once the Ultimate Beneficiary's account has been closed, all related documents and information must be archived for a period of 5 years.

AML (Anti-Money Landering): The term anti-money laundering, or AML, refers to laws, regulations and procedures designed to combat financial crime. Although anti-money laundering laws cover a limited range of transactions and criminal behavior, their implications are far-reaching, and today cover all types of business, well beyond financial services alone. AML : FightAnti-Corruption, Fight against corruption. The Sapin 2 law requires companies with at least 500 employees to implement preventive anti-corruption measures, yet 70% of companies claim to have set up preventive measures, according to a survey by the French Anti-CorruptionAgency(AFA). The AFA survey is one of the objectives of the multi-year national anti-corruption plan of January 9, 2020. Companies subject to the Sapin 2 law must put in place a procedure to evaluate third parties - customers or suppliers, possibly JV partners or acquisition targets - to ensure that they present probity guarantees in line with the company's requirements. Our tools are there to help you! Export Control: Manufacturers, exporters, financial institutions and insurance companies are all subject to exportcontrol rules, and can be held liable, at the very least, on the grounds of complicity and/or AML/CFT regulations.Export control, which involves checking for international sanctions and compliance with trade embargoes , is now a core concern for regulators and companies alike: transaction screening is an obligation AML-CFT aimed at verifying that a customer's transaction is not subject to international sanctions or trade embargo. Sapin II Act: With the Sapin 2 Act, France has introduced innovative tools to effectively detect, prevent and punish corruption and breaches of probity. The law aims to respond to the aspirations of the French people for transparency, ethics and justice in economic matters. "Ethics must be the compass of public and economic life", declared Michel Sapin, for whom "this text will contribute to making our country a modern democracy, based on solid values, and not a democracy of suspicion. It will help build an economy that serves everyone" and eliminate "unbridled finance at the service of corruption and speculation.

List quality: The nature and quality of the databases used to filter sensitive persons (individuals or legal entities) vary. It is necessary to consider the sources from which the information originates, and to question the intrinsic value attached to each piece of information collected. AP solutions IO uses national and global watch and sanction lists from national, international and intergovernmental organizations, as well as from the most reputable private companies. These lists are constantly updated by thousands of analysts worldwide. Assets Freeze Asset freeze The asset freeze is an economic and financial sanction in the fight against terrorism and money laundering. Asset freezes are designed to restrict access to the financial resources of any person committing a breach of the law AML-CFT. In concrete terms, any change in the volume, amount, location, ownership, possession, nature and destination or use of funds or economic resources will be blocked by these measures. The consequences of freezing assets are diverse:

• General or targeted import or export restrictions;
• Restrictions on access to financial markets, prohibitions on granting loans or credit, transferring funds or providing insurance or reinsurance services.

Sanctions Internationales & Embargo Le filtrage des transactions est une obligation LCB-FT visant à vérifier que la transaction du client n’est pas soumise à sanction internationale (contrepartie sous sanction) ou à embargo commercial (restriction d’activité pour certains pays). Naviguer au milieu des règlements, listes, annexes relevant des sanctions et embargos et des juridictions compétentes peut relever d’un vrai parcours du combattant ! L’ensemble des acteurs économiques a vite mesuré l’importance des enjeux associés au non-respect de ces principes. Les amendes, prononcées par les autorités de réglementation se sont en effet multipliées, jusqu’au triste record établi pour un établissement français de 8,9 milliards de dollars à verser au trésor américain pour contournement d’embargo ! L’analyse doit permettre en premier lieu de déterminer si l’opération ou la transaction est susceptible de tomber sous un ou plusieurs régimes de sanctions économiques (sanctions nationales, EU, US et internationales). Elle doit également présenter et évaluer les autres risques associés à la transaction, par exemple le risque réputationnel ou les risques opérationnels directement liés aux flux financiers ou le risque de LCB/FT lié au financement du commerce international. La documentation précise de l’ensemble de l’analyse, des éléments de contexte, et du cadre règlementaire doit absolument être tracée, datée et archivée. Nos solutions vous accompagnent méthodiquement pour gérer, analyser et tracer ces risques. PPE Les Personnes Politiquement Exposées (PPE) sont des personnes qui sont considérées, au niveau international, comme exposées à des « risques plus élevés » de blanchiment de capitaux ou de corruption. Les personnes concernées qui exercent, ou ont cessé d’exercer depuis moins d’un an (nos critères de détection permettent de modifier ce délai), des fonctions politiques, juridictionnelles ou administratives pour le compte de la France, d’un État étranger ou d’une organisation internationale. RCA Relatives and Close Associates. Il s’agit des proches des PPE comme les conjoints, enfants, parents. Les personnes étroitement associées aux PPE, notamment dans le cadre d’une société ou structure juridique (fiducie ou trust) ou entretenant un lien d’affaires (commercial ou économique) étroit. Au-delà de cette définition des régulateurs, et suivant votre appétence au risque, nous pouvons aller plus loin dans la granularité et la complétude de l’information à traiter grâce à la puissance de nos filtres portant sur les relations entre tiers. Adverse MEdia (AME) ou Media Défavorables ou Négative News Le large spectre des infractions liées au blanchiment d’argent oblige, depuis la 6^ème directive anti-blanchiment de l’Union Européenne (6AMDL entrée en vigueur fin 2020), d’ajuster le processus de filtrage sur la presse négative pour s’assurer d’une identification correcte des informations de dernière minute sur ses clients ou tiers. Compte tenu du travail important qu’impliquerait ce processus, l’automatisation de la filtration des médias défavorables est un outil indispensable qui permet de trier et hiérarchiser les nouvelles informations médiatiques et d’évaluer dans quelle mesure elles pourraient modifier le profil de risque d’un client ou porter atteinte à la réputation de votre établissement. Bénéficiaire Effectif Le tiers évalué ne se limite pas au tiers « apparent » ou tiers « facial ». La notion de bénéficiaire effectif résulte de la transposition de la 3ème directive LCB-FT et pose les critères de détention de plus de 25 % du capital ou des droits de vote d’une société cliente, et de l’exercice, par tout autre moyen, d’un pouvoir de contrôle sur la société au sens du code de commerce. Ainsi, les organismes assujettis sont tenus d’identifier et de vérifier l’identité du bénéficiaire effectif de leurs clients en relation d’affaires. Les documents recueillis à ce titre doivent être régulièrement actualisés, tout comme pour le client en relation d’affaires. La 4ème directive LCB-FT a permis de préciser la notion de bénéficiaire effectif. A cet égard, la mise en place du registre des bénéficiaires effectifs des sociétés – tenus par les tribunaux de commerce – constitue une aide pour les organismes assujettis sans pour autant exempter ces derniers de leurs obligations d’identification et de vérification de l’identité des bénéficiaires effectifs. Depuis la 5ème Directive il est indiqué qu’une preuve d’enregistrement ou un extrait du registre contenant les informations relatives aux bénéficiaires effectifs devra être recueilli par les organismes assujettis lors de l’entrée en relation avec une personne morale ou une entité concernée par l’obligation d’enregistrement. ORIAS : L’ORIAS immatricule les intermédiaires (personnes morales ou physiques en France) en assurance, opérations de banque et de services de paiement (IOBSP), conseillers en investissements financiers (CIF), agents liés de prestations de services d’investissement (ALPSI), conseillers en financements participatifs (CIP), des intermédiaires en financement participatif (IFP). Nos outils permettent en filtrant ces listes la vérification de la validité du numéro d’Orias, des accréditations obtenues et le contrôle des dates d’expiration de ces mêmes accréditations. INPI : Analyse financière, aide à la décision, statistiques… L’Institut national de la propriété industrielle (INPI) permet de consulter – sous forme de téléchargement – les informations non confidentielles issues des comptes annuels des entreprises commerciales françaises, compilées dans le registre national du commerce et des sociétés (RNCS).

Data INPI: what data is available?

company legal identity data from all commercial court registries, centralized by INPI in the National Trade and Companies Register (RN CS): e.g. date of creation, registration, legal form, share capital, company name, trade name, acronym, principal activity, representatives, Beneficial Owners, and addresses of establishments. These data can also be used to track the life of companies: modifications and deletions, data relating to articles of association and company deeds, as well as non-confidential annual accounts (data on balance sheets, income statements, fixed assets, depreciation and provisions). OPEN DATA: Open Data or "open sources" refers to all activities and methods for disseminating, collecting and analyzing information obtained from a public source, i.e. information available to anyone. These sources include newspapers, websites, books, scientific magazines, radio broadcasts, television programs and so on. In addition, there are many other public databases that have emerged from the general movement to open up public data. Open sources can contain reliable information, but they can also contain information that should be treated with caution: false information, information whose validity is outdated, or whose basis is subjective or biased. This is why AP Solutions IO does not include screening of unverified sources as standard, but can integrate any type of OPEN DATA list you wish, depending on your risk appetite.

An anti-corruption or AML-CFT includes a preventive procedure to assess the integrity of third parties. The aim of this assessment is to guard against the risks of a breach of probity to which an organization is exposed by its relationship with a third party, be they customers, suppliers and service providers, intermediaries, subcontractors, holders of public contracts, concessionaires, delegatees, beneficiaries of subsidies, users, partners, etc., i.e. any natural or legal person with whom the company has a relationship and who may expose it to potential risks of a breach of probity. APScan enables you to identify sensitive persons: people under sanctions/freezing of assets (national, EU & international sanctions, Assets Freeze), politically exposed persons (PEP) and their relatives (RCA - Relative & Close Associates), reputational risks / negative press (AME - Adverse MEdia), Country risks (EmbargoVigilance), other open data lists... This detection is based on fuzzy logiclogic imposed by regulations. Identity verification is carried out prior toAPScan, using an internal tool where you have collected information on the third party and supporting documents. The more qualitative input data we have: Last name, First name, Gender, Date of birth, Country of birth, Nationality, SIREN... the more our filtering limits false positives. AP Scan integrates more than 70 parameters to precisely define the alerts to be excluded during sanctions / PEP / Adverse Media screening . APScan performs data enrichment:

• Obtaining the Beneficial Ownersfor a legal entity: the Sapin II - Anti-corruption law, even requires that companies subject to the law check that the BEs declared by their Third Parties (customers, suppliers...) are the same as those referenced by the authorities,
• Possibility of obtaining additional information about the legal entity,
• Verification of the validity of the Orias number (Organisme pour le Registre unique des intermédiaires en assurance, banque et finance, an association under the law of 1901, under the supervision of the French Treasury).
• ...

• A report of suspicion must be made before a transaction is carried out, to enable Tracfin* to exercise its right of opposition. This report must also be made without delay in the event of suspicions arising after the transaction has been carried out. *Tracfin is an intelligence service under the authority of the French Ministry of the Economy, Finance and Industrial and Digital Sovereignty. It contributes to the development of a healthy economy by combating clandestine financial circuits, money laundering and the financing of terrorism. Professionals must therefore refrain from carrying out any transaction they suspect may be linked to money laundering or terrorist financing. There is no legal threshold for reporting suspicious transactions. Tracfin must be informed without delay of any new element that may invalidate, confirm or modify the content of the report. Professionals are obliged to keep all documents gathered as part of their due diligence for a period of 5 years. Without a powerful detection and filtering tool AML-CFT , it is virtually impossible to comply with reporting obligations, even though failure to do so can result in heavy fines and criminal liability for the manager! Measures can be implemented and monitored using our follow-up system. Depending on the due diligence carried out, APScan displays a list of actions to be taken. You can check off the action as it is taken. You now have all the information you need to analyze and make your mandatory declarations to TRACFIN.
•  

• A Black Box is any system, device or object capable of being observed in terms of its transfer characteristics (inputs and outputs), without clear knowledge of its intrinsic organization and operation. In contrast, the term Glass Box (transparency) allows for total explicability, as required by regulations. This is AP Solutions IO's choice: 100% compliance, everything is explicable and traceable!
•  

APScan has prepared the ground for risk classification by breaking down several key stages in the process and treatment of detecting sensitive persons:

1. Alert generation
2. Qualification of whether the alert is TRUE or FALSE (called a False Positive)
3. Third-party due diligence (generally results from the qualification of alerts) :
   1. Establishing a risk level
   2. Define the category of Third Party (SCT, PEP, AME...)
   3. Customer decision: ACCEPT (+ level of vigilance), REFUSE

These steps enable fine granularity in the processing carried out vis-à-vis a Third Party. APScan goes even further with a profiling system that enables you to automate part of the risk classification process, based on fully configurable scoring rules.

APScan traces all user and system actions, providing a complete audit trail. Actions are also explained. Where many service providers remain in Black box mode, which is impossible to explain, we have chosen to be totally transparent and explainable in "Glass Box" mode. Glass Box "mode, thanks to ourAugmented Intelligence. Users can export reports, or individual sheets, to prove that the required due diligence has been carried out.

APScan is an all-in-one tool that can operate in stand-alone mode, and be used by non-expert users. The solution can be fully connected to your Information System (IS) via our APIs, or operate in hybrid mode with simultaneous use of our APIs and our Web Portal.

APScan complies with all regulations GDPR (*), CyberSecurity is at the heart of our concerns. APScan carries out annual security/intrusion tests orchestrated by recognized independent companies. Today, no security constraint has stood in our way. Numerous security-requiring professions and companies of all sizes already place their trust in us, including major groups known for their zero-risk approach, such as BNPP, BPCE, BPI, Sodexo... Technologically, our API is designed using the latest market standards: Web Service in REST/JSON format, with a secure OAUTH2 authentication system (Bearer Token). The no-code feature enables you to evaluate the full power of our solutions simply and in real time. Our solutions feature an ultra-complete security system: Secure data transfers through https encryption with certificate, segregation of spaces by an application China wall, non-reversible password storage / Encryption of attached documents / Regular data backups (main and backup servers) / Data located and backed up in France / PCA / PRA ... We ensure the integrity, confidentiality and traceability of content throughout the process, from capture to long-term preservation of information. (*) GDPR The acronym GDPR stands for General Data Protection Regulation (GDPR). GDPR provides a framework for the processing of personal data within the European Union. The legal context is adapting to keep pace with changes in technology and our societies (increased use of digital technology, development of online commerce...).

Yes, list management is of course controlled by the supervisory authorities:

• In terms of the perimeter used,
• Update frequency,
• Time for re-screening relationship entries (EER) and customer portfolio.

In addition to the search engine, the entire compliance system is audited by the regulators. This must be fully aligned with the company's "theoretical" compliance policy, hence the need for a flexible, configurable tool... But above all, precise and complete traceability and explicability.

The more than 70 parameterization criteria of our tools enable a very fine granularity in the implementation of the Compliance Policy compared to the "theoretical" compliance policy. APScanis the tool that adapts to your policy, not the other way round! Supervisory authorities are very sensitive to the alignment of practice and theory. This setting also enables a large number of alerts to be reduced automatically, automating decisions. Fewer alerts to review =

• Fewer operators/users required (HR cost optimization)
• Business fluidity (less waiting for file validation = less prospect abandonment = more signatures)

The solution also automates the daily updating of the various lists, and screens the entire customer portfolio (database) at no extra cost. Of course, previous alerts that have already been reviewed do not need to be revised. Only new and/or updated alerts need to be reviewed by users/operators. So as not to oblige users/operators to connect to the application on a daily basis, APScan can inform them only when alerts are to be reviewed, by email notification.

The expertise of AP Solutions IO's teams is comprehensive, with employees who are long-standing experts in the market. Expertise :

• Compliance (obligations, regulations, etc.),
• Operational (review of alerts, etc.),
• Product (needs, functionalities...),
• Techniques

This expertise means we can meet any challenge without ever being caught out. This will reassure you in your choice during the Demo, Project and Consulting phases. Our expertise also enables us to keep a close watch on regulations , so as to anticipate future constraints and ensure that we have a firm grasp of current ones.

Our detection engine offers outstanding detection quality thanks to extremely precise parameterization, resulting in fewer "false positives". false positives ". Fewer alerts to review = Fewer suspicions to clear

• Fewer operators/users required (HR cost optimization)
• Business fluidity (less waiting for file validation = less prospect abandonment = more signatures)

APScan offers a high degree of customization:

• Intermediate workflow statuses * (for different review/escalation levels**, for example)
• Reasons for " False positives"*** (providing a repository of reasons for disqualification, rather than "free text" comments = better reporting)
• Follow-Up actions ****
• etc...

* A workflow is a series of steps linked to the processing of data, and is the modeling and management of business processes. In its simplest definition, workflow is the modeling and management of the tasks to be performed and the various actors involved in carrying out a business or operational process. ** An escalation procedure is the process of transferring a customer request to a specialized person who can help. Escalation procedures are generally implemented when the customer's problem is too complex and requires specific expertise. *** False positives occur when a system mistakenly considers an innocuous transaction to be suspicious and flags it for verification. If the compliance officer could identify false positives earlier, he or she could get on with more important tasks. AP Scan can drastically reduce false positives. **** Follow-up literally means "to follow" or "to pursue". In fact, when we speak of follow-up strategies, we imply that we have already obtained a contact. Consequently, follow-up involves maintaining contact over time. This lead will be educated and progressively qualified until it becomes a customer.

AP Solutions IO has defined a service level agreement. A Service Level Agreement (SLA) protocol provides you with maximum response times (in working days) for AP Solutions IO to respond to various requests or events that could arise and impact the proper use of our services.

In addition to APScan, APFilter enables you to comply with regulatory requirements concerning the detection of international sanctions and/or the identification of countries & currencies under embargo. It can be interconnected with AP Scan. Detection is instantaneous, thanks to a high-performance detection engine, as well asFull-API integration with core banking systems. Filtering adapted to data typologies (names, countries, currencies, BIC, IBAN, etc.) and an easily-configurable reduction engine minimize the number of suspicions, so that your various transfers run smoothly and without risk.

Thanks to over 90 parameter criteria, our tools can be configured according to your compliance policy and risk appetite. They are available from any location, in French, English and Spanish, with the possibility of adding other languages on request.