Compliance Old - Myanmar Citizens Bank (MCB)

Compliance

The Compliance Department of MCB operates independently, consisting of three units: Internal Compliance Unit, the Regulatory Compliance Unit, and the AML/CFT Unit. The bank has implemented a “Zero Tolerance Policy” in matters of Compliance and Governance.

Internal Compliance Unit

The Internal Compliance Unit of MCB is a responsible unit for verifying whether employees comply with the bank’s established procedures and regulations set by the bank and reports to the BIRCC. In addition to compliance verification, the unit recommends additional procedures or regulations as necessary. A key function of this unit is to assess compliance within departments and branches, evaluate the Compliance Rating of staff within the Key Performance Indicators, and report the findings to the BIRCC.

Regulatory Compliance Unit

The Regulatory Compliance Unit of MCB is a reporting unit to both the Management Team and the BIRCC on the bank’s adherence to critical instructions issued by the CBM and other law enforcement agencies (LEAs).

AML/CFT Unit

The AML/CFT Unit of MCB is dedicated to protecting the financial system from being used for illegal activities such as money laundering and financing terrorism. Their main purpose is to detect, prevent, and report suspicious financial transactions potentially linked to criminal or terrorist activities. This unit achieves its goals by monitoring transactions, conducting thorough Customer Due Diligence (CDD), and ensuring compliance with national and international regulations. These efforts help banks maintain trust, avoid significant penalties, and contribute to a safer financial environment for all stakeholders.

Compliance Department Reporting Structure

Compliance Department Structure

General Principles

Myanmar Citizens Bank has adopted the following general principles:

Adhere to applicable Laws, Regulations, Rules, and the bank’s Code of Conduct; managing conflicts of interest and risk, preventing involvement in money laundering and terrorist financing, and investigating suspected behaviors.
Ensure constitutional compliance, which includes the bank’s reputation, governance, internal structure and decision-making processes, principles of procurement, public information disclosure, sustainability reporting, and adherence to internal instructions.
Practice operational compliance included the assessment of risks related to the bank’s transactions, in particular by following certain principles, such as Know Your Customer (KYC) and conducting Customer Due Diligence (CDD) checks, including assessing risks relating to Money Laundering (ML), Terrorist Financing (TF) and other compliance issues, concerning the development of new products or business practices.
Refrain from engaging in Transactions or establishing relationships with individuals or entities convicted of money laundering, Terrorists, or any Person convicted of a serious criminal offense related to ML/FT.
Take appropriate steps to avoid engaging in transactions and relationships with persons under investigation for a serious criminal offense linked to ML/FT.

Monitor Sanctions Lists, conduct risk assessments, and refrain from engaging in transactions and relationships with any Person or Entity appearing on Sanction Lists, including those from the UN, OFAC, EU, and those debarred by Myanmar Authorities.
Avoid transactions or relationships with any Person/Entity convicted of tax evasion and illegal tax practices related to ML/FT.
Pay special attention to Politically Exposed Persons (PEPs) and their associates with whom the Bank engages, taking measures to ensure PEPs do not exercise any form of effective control over any privately owned Counterparties.
Obtain approval from senior management before establishing or continuing a business relationship with the international politically exposed person.
Avoid conducting business with any anonymous Counterparty or any person and a Counterparty using a fictitious name.
Take proactive steps to avoid engaging in transactions that can reasonably be believed to be regarded as Suspicious Transactions.
Avoid conducting Transactions with or on behalf of Shell Banks and their Affiliates.

Control Structure

MCB bank is committed to maintaining robust governance through transparent policies, clear accountability, and defined responsibilities. The Board of Directors (BOD) oversees compliance and integrity risks, approving policies that guide the bank’s operations. Day-to-day management of these risks is entrusted to Senior Management and other Management teams, who ensure any breaches are reported to the Compliance Department. This department plays a critical role in identifying, addressing, and mitigating compliance risks, particularly through customer due diligence and staff training. Additionally, it investigates non-compliance cases and works closely with the Integrated Risk Management Department and Internal Audit to align control measures. Our governance structure employs a three-line defense system: operational departments as the first line, Compliance, and Integrated Risk Management as the second, and Internal Audit as the third, ensuring comprehensive risk management and operational integrity.

Risk-Based Approach

MCB adopts a risk-based approach in its Know Your Customer (KYC) and Customer Due Diligence (CDD) procedures, gathering comprehensive information about the purpose, nature, and scope of customer relationships. Customers are classified based on risk levels, considering factors such as business type, geographic location, product and service usage, and delivery channels. This classification enables the bank to identify potential risks and implement effective controls to mitigate them.

In compliance with Article 6(c) of the CBM Directive (2015) and AML/CFT guidelines, MCB assesses risks related to customers, geographic regions, products, services, and delivery channels. These risk assessments, along with supporting documentation, are maintained at all branches and business units and are regularly updated for regulatory reviews and compliance investigations. The Compliance Department establishes risk assessment measures in line with CBM’s Directive (2019) and periodically reviews these measures to address emerging money laundering or terrorist financing risks.

When assessing customers, MCB considers offenses outlined in AML law, such as organized crime, terrorism, tax evasion, intellectual property crimes, environmental crimes, and other punishable offenses. By maintaining robust AML/CFT measures, MCB ensures adherence to regulatory requirements and safeguards the integrity of its operations.

Know Your Customer

To safeguard against potential misuse for money laundering and terrorist financing, MCB implements robust Know Your Customer (KYC) procedures. These measures enable the bank to better understand its customers and their financial activities, ensuring prudent risk management. MCB’s KYC framework is outlined in Annex (A) and includes four key components:

Onboarding: During client or counterparty onboarding, MCB collects and verifies customer information using original documents and supported proofs.

Screening: Customer details such as names, countries, shareholders, directors, beneficiaries, and affiliates are screened against sanctions lists, Politically Exposed Persons (PEPs) lists, and regulators’ blacklists.

Ongoing Monitoring: Transactions are continuously monitored, and customer information is rescreened based on risk assessments.

Reviewing and Rescreening: Periodic reviews and rescreening of clients or counterparties are conducted to maintain compliance with updated risk assessments.

These comprehensive KYC measures reinforce MCB’s commitment to regulatory compliance and secure banking practices.

Customer Due Diligence (CDD)

In compliance with Section 19 of the AML Law, our bank adheres to robust customer due diligence (CDD) measures to prevent money laundering (ML) and terrorist financing (TF). Enhanced Due Diligence (EDD) is applied for high-risk customers or suspicious transactions, while simplified CDD measures may be implemented for low-risk customers, subject to revocation if suspicious activities are identified. The CDD process involves verifying customer identity, understanding the business relationship’s purpose, and identifying beneficial owners and control structures. Additional steps include confirming authorizations for representatives, verifying legal statuses, and identifying politically exposed persons. Our processes align with the Central Bank’s directives and FATF standards, guided by General Indicators from the Financial Intelligence Unit (FIU). The Compliance Department regularly reviews and updates these indicators to ensure effectiveness. These measures reflect our commitment to “Know Your Customer” principles, utilizing reliable documentation and independent information to safeguard against ML/TF risks.

Identification and verification of Political Exposed Persons

As outlined in Section 3 of the AML Law, Politically Exposed Persons (PEPs) include individuals entrusted with prominent public functions domestically or internationally. This definition encompasses family members and close associates of such individuals. Specifically, domestic and foreign PEPs refer to those holding or having held significant public roles within their home country or abroad, while international PEPs include senior officials, directors, and members of international organizations or those in equivalent positions. In compliance with Articles 20 and 21 of the CBM’s CDD Directive, the bank is required to identify and verify PEPs by utilizing relevant customer information, reference checks, and commercial electronic PEP databases to ensure robust customer due diligence.

Sanctions and Screening

At MCB, we prioritize compliance with international sanctions and regulatory measures imposed by entities such as the UN, EU, and US. Sanctions serve as both restrictive actions against nations violating international laws and as tools to encourage behavioral changes in specific states or individuals. To ensure compliance, MCB screens all customers, beneficial owners, business associates, and countries against global sanction lists, including the OFAC SDN List, UN Sanction List, EU Sanction List, and PEPs List. The bank conducts real-time transaction and customer screening, including checks on cross-border payments, SWIFT transactions, and cheques. Additionally, MCB identifies Politically Exposed Persons (PEPs) through a periodic screening process. Transactions and customer relationships will not be processed until all screening procedures are completed. If any partial or full matches are found with sanction lists, the Branch/Unit Compliance Officer will seek further information from the customer and report the match to the Compliance Officer for further action. The bank may also limit or terminate services for individuals or entities identified on sanctions lists. All screening results must be documented in the customer’s file for transparency and accountability.

Third Parties Services

The bank may engage third-party intermediaries, including individuals or entities other than the bank or financial institutions, to carry out customer due diligence (CDD) in accordance with the Anti-Money Laundering (AML) Law and the Central Bank of Myanmar’s (CBM) CDD Directive, provided these third parties meet the necessary CDD requirements outlined in Section 24 of the AML Law. Additionally, any third-party providers involved in offering services related to the bank’s products will be fully subject to the bank’s MCB Compliance Procedures and will undergo regular reviews to ensure adherence to compliance standards.

Beneficial Ownership

Beneficial ownership, as defined under Anti-Money Laundering (AML) Law and the Central Bank of Myanmar’s Customer Due Diligence (CDD) Directive, refers to individuals who own or control a customer, or who delegate authority to act on their behalf. In the case of legal entities, it is necessary to identify any natural person who directly or indirectly owns or controls more than 20% of the entity, or who exercises control through other means. Additionally, identification should include individuals responsible for the entity’s management. For legal arrangements, it involves identifying key roles such as the settlor, trustee, protector, beneficiary, and any other person with ultimate control, including those in a chain of control or ownership.

Transaction Monitoring

MCB has established robust procedures for continuous verification and monitoring of customer account activity throughout the duration of the business relationship, in compliance with relevant laws and directives. In line with Section 20 of the AML Law, the bank employs a risk-based approach to transaction monitoring to assess whether a customer’s activities align with the information provided in their KYC form, including the use of products and services and overall behavior. This process includes both manual monitoring, with plans for automation after the implementation of a AML System. The bank also investigates any activities deemed unusual or inconsistent with the customer’s stated profile. Manual transaction monitoring, which involves reporting unusual activities to the Compliance Officer and Financial Intelligence Unit (FIU), is supported by ongoing training and awareness initiatives. The AML system is fully in place at MCB. It automatically monitors transactions across all business units, customers, and products, ensuring full coverage with risk-based scenarios.

Record Keeping

MCB is committed to gathering and maintaining accurate customer and beneficial owner information throughout the business relationship. It ensures that all relevant documents and data collected during the customer due diligence process are kept up-to-date and reviewed when significant transactions occur, there are material changes in account operations, or when existing customer information is insufficient. For cross-border wire transfers, the bank retains detailed records of wire transfer information, including originator and beneficiary details. In accordance with AML Law, the bank maintains transaction and due diligence records for at least five years after the termination of a business relationship or completion of a transaction. These records include documentation obtained during due diligence, transaction reports, and risk assessments. All customer profiles are confidential and not used for purposes like cross-selling. The bank also adheres to strict record-keeping requirements when acting as an intermediary or beneficiary bank for wire transfers, ensuring all information is retained for at least five years. Additionally, records related to mobile banking transactions are maintained for a minimum of five years.

Training

MCB is committed to implementing regular training and awareness programs in accordance with Sub-section (a) iii, Section 28 of the AML Law. These programs will focus on enhancing employees’ understanding of Know Your Customer (KYC) procedures, anti-money laundering (AML), countering the financing of terrorism (CFT), Countering the Financing of Proliferation (WMD) and transaction reporting requirements outlined in Chapter VIII of the law. The Compliance Department will ensure that all staff, including management, receive this essential training to promote awareness and ensure the policy’s effectiveness. Additionally, MCB staff are required to attend AML/CFT training to fulfill their obligations under applicable laws, regulations, and instructions from regulatory authorities. Records of attendance and completion of all training will be maintained.

Independent Auditing

MCB is committed to complying with Section 28(a)(4) of the Anti-Money Laundering (AML) Law, ensuring the implementation of independent audits across its Bank-wide compliance functions. In alignment with Section 28(a), the bank has developed and will continually monitor internal programs, policies, procedures, and controls aimed at effectively managing and mitigating risks associated with AML compliance. The independent audit function will assess the adherence to AML/CFT policies and procedures, verify compliance with applicable laws and regulations, and evaluate the overall effectiveness of these measures. Regular independent audit reports will be submitted to the Audit Committee and the Board of Directors for review.