BankID AML

Is BankID accepted as legitimization according to the Money Laundering Act?

Ja. Legitimering ved bruk av BankID er likestilt med personlig fremmøte og fremvisning av gyldig legitimasjonsdokument.

Companies needing to report should as a basis collect and confirm the customers identity with personal attendance and proof of valid identification. Digital identification is considered equal with personal attendance and proof of original, valid identification when establishing a customer relationship, according to the Money Laundering Act § 4-3.

"As per 1st of June 2019, BankID is the only company managing to address these demands from the Money Laundering Act § 4-3", according to the Financial Supervision Authority 31.05.2019.

BankID satisfy the demands for digital signatures as valid identification. The demands are given in the regulation of 21st of November 2005 number 1296 regarding voluntary self decleration for certificate providers § 3, and demands of entry on pulished list according to § 11 first section.
Can BankID AML contribute to our internal risk assessment?

No. BankID AML delivers data and access to lists for usage in customer related measures and data that can be used as a supplement to determine risk profiles on customer level.

However, customers of BankID AML has access to relevant national and sector specific risk analyses which is expected to know and refer to in internal work on risk assessment.
Does the service provide any "proof" of performed screenings?

Yes. In addition to a response delivered as JSON you are able to request a PDF report that shows who performed the search, when the search was conducted and which data that was used to complete the search. The report shows what data that was collected and which lists that were screened against and the results of these screenings.

If there are no results against any lists the report will document which lists that was screened against at the given time. The report will be "stamped" by BankID and can be used to demonstrate performed screenings and their consequent results.
Which countries are included in the PEP screening?

Norway, Sweeden, Finland and Denmark. We currently work on including international PEP lists as well.
How many nodes of the company's ownership structure does the service show?

The service shows direct owners (both companies and persons) in addition to subsidiarys. It provides one node up and one down.

Work is currently being done to be able to demonstrate even more complete structures, or to tell whether a structure is complex.
Can we get the social security number (11 digits) for right holders and other relevant roles?

No, Brønnøysund does not allow sharing social security numbers to us or our clients. Normally, only public organisations and credit .. receives this kind of information. Datatilsynet is highly sceptical of using social security numbers freely.

RRH considers name, date of birth and address as adequate identification. This data is delivered through the service.
Is it possible to collect a firm certificate through the service?

Yes. As a part of the organization search one can collect firm certificates.
Fuzzy searches sometimes provide a lot of hits - why?

Any search in BankID AML demands a hit on name to provide a match. Fuzzy search is an option that can be selected to account for potential grammar mistakes, or missing knowledge in terms of how to write the respective person's name.

BankID AML presents all "hits" where ..

BankID AML leverer alle "treff" hvor navnelikhetsverdien er >0.6 (på en skala fra 0 - 1,0). Verdiene 0.6-0.7 slipper igjennom navn med betydelige ulikheter fra navnet benyttet i søket, spesielt dersom navnet kun består av to navn (man bør ikke benytte fuzzysøk om man kun har et navn). Funksjonaliteten bør alltid benyttes sammen med vurdering av treff på f.dato og man må selv vurdere hvor man setter en "cut off" på navnelikhetsverdiene. Se forøvrig eget veiledingsdokument om hvordan tolke matchverdiene som leveres i tjenesten.
What rights and limits do we have in terms of treating sensitive customer information?

Treatment of personal information is necessary for those required to report to be able to fulfill their duties according to the Money Laundering Act.

The Money Laundering Act presents certain separate, extended and detailed rules regarding treatment of personal information. For instance, the act provides the legal foundation to treat this kind of information. It also provides the foundation for storing information about customers and transactions up to five yeras after the transaction occurred. Furthermore, the act states that it is necessary to have "systems that enable swift and complete responses to requests from Økokrim and other governmental departments.."

Note that the Money Laundering Act does not entail any general exception from GDPR. It will still be strict demands in terms of minimising data and strong relevance of stored information.

Also bear in mind that stored information should both be relevant, up to date and correct.
Why are we presented with a RHH having "percentageControl" = 100% without any shareholders being present?

"Control" is not only a matter of how many shares one owns. For instance, in sole proprietorships there are no shares, and thus no one owning shares in the company.

That is the reason there may be no shareholders but still a RHH that controls the company.

Remember that RHH is defined as a physical person that ultimately owns or controls the customer.
How can one tell whether a RHH is a direct or indirect owner?

The service provides direct owners under "shareholders".

If the RHH represented under "ownership / beneficial" is not listed in the "shareholders" section, the person is an indirect owner and the percentage shown is then the control going backwards in the chain.
We are not able to find a RRH for the company we searched for. However, we do believe that there is a RRH present - what may be the problem?

The service makes its calculations based on information that is present in the shareholder register, the role register and notes from accounting etc.

A number of the main sources are not updated on a daily basis, and there will be situations where the ownership may have changed since the last update. We therefore recommend to always have the customer as main source when identifying RHH.

Many of our customers choose different strategies to deal with this risk. The most usual strategy is to not accept all information "as it is", but rather ask the customer directly. This can be done through a pre-filled document from BankID AML which allows the customer to correct RHH. This involves less work for the customer compared to a statical and empty document.
RRH is dead. How can it be that the service still shows the person as RHH?

Amongst other sources, the RHH service uses the shareholder register to calculate RHHs. This register is only updated yearly, and although the relevant person is removed from the business register, the name may still appear as a RHH.

If you have access to the national population register you will receive a notification of the persons death in addition to the death date. This assumes that a 1:1 search is used.
Why are not all shareholders in the requested company presented?

The report builds on the shareholder list collected from the annual report (which the company reports to the shareholder register).

When developing the annual report the company usually needs to report the 20 largest shareholders. However, shareholders with less than 1% ownership may be omitted. This is the case for Equnior for instance, and as they have few shareholders with more than 1% the list will be shorter.

Shareholders with less than 1% will be presented if they are among the 20 largest and are reported by the company.
Screening results from the OFAC list are missing?

Since Norway is committed to pursue sanctions decided by the UN and restrictive measures from the EU, these sanction lists are chosen "by default". If you desire OFAC, this list kan by chosen as an addition. Please see technical documentation for access, or contact us directly.
Which sanction lists are available in the service?

The EU and UN lists are included "by default". OFAC can be chosen as an addition. HM treasury is also available on request - contact us in that case.
Will misspelled names on persons lead to no hits on the search?

This depends on the settings you are using. There are two modes for search on names; "Exact" and "fuzzy".

In exact mode all names must be written exactly like how the persons name says on the list. "Ola Nordman" will match towards "Per Ola Nordman", as both names used in the search are in the list. Furthermore, the order of the names does not impact the results. However, "Ola Norman" will not provide any matches, as "Norman" and "Nordman" are unequal.

If the fuzzy mode is used, the latter search will still provide results. Guidance on how to use these two modes and interpret the results are available. The use of fuzzy mode will lead to more fake positives.
Do we need to OFAC sanction list?

OFAC is a sanction list not yet "included" in Norwegian law. However, the list is often a business related demand for companies trading with or in USA. The list contains companies and persons not allowed to do business in USA. If you were to buy a property in USA and use a Norwegian realtor, the realtor may have demands to screen towards OFAC. This is obviously more usual for banks that assists transactions to and from USA.
How good coverage is it on PEP in the used lists?

It is approximately 100% coverage. The roles that are defined as PEP in the laws are close to 100% covered with date of birth and/or SSN (Sweden). However, in cases with substantial changes (e.g., parliamentary elections) there may be some delay before lists are updated as this is done manually by a specific administration.
How good is the coverage on close family members of PEP, so called RCA?

Very good. Lists are updated daily and for Trapets to put family members on the list established and confirmed links between the PEP and the respective person are demanded. Public sources are used to gather this information, however, Trapets do not have access to the national population register for this task. To avoid several fake hits, only persons Trapets have enough information on to decide whether or not they belong to the same family are listed. This is done in accordance with the Money Laundering Act.

Meget god. Listene oppdateres daglig og for at Trapets skal oppføre familiemedlemmer i listen kreves etablerte og bekreftede linker mellom PEP-en og den aktuelle personen. Til dette benytter man offentlig tilgjengelige kilder, men Trapets har ikke tilgang til DSF (folkeregisteret) for å kunne utføre denne oppgaven. For å unngå for mange falske treff oppføres med andre ord kun de personer som Trapets bedømmer at de har nok informasjon om til å kunne bekrefte en familiær sammenheng ihht. Hvitvaskingsloven.
How confident can you be that a match on a PEP is real and not a fake positive?

Very confident!

As the PEP list used in BankID AML has close to 100% coverage with date of birth (or SSN for Swedish PEP's) you can be fairly certain of a real match if you include the persons date of birth in the search. Additional information in the service, such as address etc. will help determine cases of doubt.
In Denmark they have their own public PEP list. Is this available in the service?

Yes, this list is included.

In addition, Trapets has included foreign ambassadors in Denmark and family members and close co-workers.
For how long will a PEP appear in the list after the person has departed its position?

For 20 years. The date when the person departed its role will also appear as an "expired" date in the service.

Thus, you are able to change risk profile on the customer 12 months after the expired date if the superior risk assessment supports it, according to the Financial Supervisory Authority guide.
Will it be sent out a warning if a person is removed from the PEP / sanction lists?

When a person departs its role the date of departing will be given as an "expired date" and appear in the field called "comment" (both in the JSON and the PDF reports).

It is up to the customer to use this date with logic.

Note that there may be persons being considered PEP in the period 2010-2012 that are not part of the list. However, all being considered PEP and that are in the list today will be part of it for 20 years after their "expired date".
Does Norwegian authorities maintain their own Norwegian PEP list?

No. Finance Norway has challenged the Financial Supervisory Authority to consider establishing such a list.

EU's fifth directive impose its member countries to establish national PEP registers. So far, Norway has not decided whether or not to implement this.
Will the service provide a warning then owners from high risk countries are present or part of the ownership structure?

No.

For now we have been careful to establish data deliveries with flagging because one required to report need an active picture of its own risk profile. Customers of BankID AML have access to product literature where we have linked to relevant lists of risk countries, indicators of corruption and tax havens, as defined by the Financial Supervisory Authority.
How are we able to offer valid identification for legal persons (i.e., companies)?
According to the Money Laundering Act § 7, valid identification amongst other things consist of the following:
- Firm certificate no older than 3 months
- BankID AML offers firm certificates as part of the organizational search
- The identity of a company under establishement occurs when firm certificate is provided
In the PDF report with "Norwegian language" I can stil find English text. Why?

The intelligence information found in the sanction lists are often in English. We have chosen to not translate this information to avoid potential bad translations and to make sure the data is reproduced as they are in the primary source.
In the PDF report with "English language" I can still find Norwegian text. Why?

We have chosen to not translate Norwegian specific information to avoid potential bad translations and to make sure the data is reproduced as they are in the primary source.
What does the numerical values in the "match indicator" and "nameMatchValue" in the personal search mean?

They represent the strength of the search. More detailed information of these values can be gained from choosing "add attachment to report". Then you will receive an attachment describing these values in detail with the PDF report.
In what languages will the firm sertificate be available?

Norwegian and English.
What does it cost to collect the firm certificate with BankID AML?

The firm certificate is included in the organizational search (no additional costs).
What information does the firm certificate contain?

The firm certificate in BankID AML covers information required by law in addition to other relevant data and is a standardized print from the Business Register's database.