Anti-Money Laundering & Office of Foreign Assets Control Training

1. Anti-Money Laundering & Office of Foreign Assets Control Training

2. Welcome to Anti-Money Laundering (AML) and Office of Foreign Assets Control (OFAC) Training The topics covered are: Welcome Introduction AML and OFAC Overview AML and OFAC Compliance Summary Conclusion

3. Welcome Course Description Welcome to the Anti-Money Laundering and Office of Foreign Assets Control course. This course was designed to provide you with an understanding of the Anti-Money Laundering (AML) and Office of Foreign Assets Control (OFAC) requirements that are applicable to CIGNA.

4. Introduction Course Learning Objectives After completing this course, you will be able to: Identify and appreciate the importance of AML and OFAC compliance List common activities money-laundering criminals use to carry out their illegal schemes Use effective techniques to prevent, detect, and report potential money laundering Identify the appropriate contact for business unit-specific AML and OFAC guidance Access additional AML and OFAC resources, information, and assistance

5. Introduction Overview Today, the activities of criminals, terrorists, and terrorist organizations are increasingly more creative, complex, and intense. The insurance industry has become a target for money-laundering schemes because of the variety of products offered that can be used to hide monies related to criminal activity. Companies in the insurance industry, such as CIGNA, are obligated to aid in the prevention, detection, and reporting of: Potential money-laundering activity Transactions with those individuals, entities, and countries that are prohibited by OFAC requirements

6. AML and OFAC Overview Lesson Learning Objectives After completing this lesson, you will be able to: Define money laundering Identify your responsibilities for recognizing and reporting suspicious money-laundering activities Describe CIGNA processes to assure CIGNA does not conduct business with OFAC prohibited parties Identify the appropriate communications process when a customer is confirmed to be on the Specially Designated Nationals (SDN) and Blocked Persons List Identify and appreciate the importance of AML and OFAC compliance

7. AML and OFAC Overview AML Overview Money laundering is a process by which money, resulting from or related to illegal activity, is filtered through a series of transactions that eventually make the money appear to be obtained from “clean” legal activities. The goal of the criminal is to make the money obtained illegally (such as through drug trafficking, terrorism, and/or bribery) appear to be from a legitimate source, such as an insurance company like CIGNA. Activity of this type is purposely designed to be extremely complex so as to avoid detection. Therefore, identification of money laundering tends to be very challenging.

8. AML and OFAC Overview AML Overview, Continued Many countries around the world are engaged in an intensive and concerted effort to combat money laundering and other financial crimes. For example, in response to mounting concern over money laundering, the Financial Action Task Force on Money Laundering (FATF) was established in 1989. The FATF is an inter-governmental body that has the purpose of development and promotion of national and international level policies, to combat money laundering and terrorist financing.

9. AML and OFAC Overview • AML Overview, Continued • Since its creation, the FATF has spearheaded the effort to adopt and implement measures designed to counter the use of the financial system by criminals. In order to meet its objective, the FATF published 40 Recommendations that outline actions that countries should consider as they continue their commitment to combat money laundering. A review of these recommendations provides helpful insights regarding how various AML initiatives are approached throughout the world. 9

10. AML and OFAC Overview AML Overview, Continued Money laundering and conducting business with terrorists is an illegal criminal activity in almost every country. Preventing and detecting money laundering is a world-wide priority—one in which CIGNA must play a key role! Effective employee awareness is a critical component of a successful AML compliance program.

11. AML and OFAC Overview Applicability to CIGNA In the past, AML requirements within the United States primarily applied to banks and brokers under the U.S. Bank Secrecy Act. This act was amended after the attacks of September 11, 2001. In October 2005, the Financial Crimes Enforcement Network, known as FinCEN, announced that insurance companies are required to comply with AML regulations. FinCEN is an organization within the U.S. Department of the Treasury (U.S. Treasury) responsible for, among other things, analyzing information about financial transactions in order to combat money laundering, terrorist financing, and other financial crimes.

12. AML and OFAC Overview Applicability to CIGNA, Continued The following covered products are within the scope of AML requirements: Permanent life insurance policies, other than group life insurance policies Annuity contracts, other than group annuity contracts Other insurance plans with cash value or investment features While AML risk may vary depending on the product portfolio and geographical territory within CIGNA businesses, it is critical that employees and those working on behalf of CIGNA have a heightened AML awareness and participate in the prevention, detection, and reporting of potential money-laundering activity.

13. AML and OFAC Overview Red Flags Employee awareness and a solid understanding of specific red flag transactions are critical components of a successful AML compliance program. Red flags are suspicious activities that indicate a particular situation warrants caution, care, and consideration. While some AML red flags might appear to be common sense, others require more attention and diligence. After reviewing the list of suspicious activities that are considered red flag indicators for money laundering, take a moment to identify which scenarios you may be likely to encounter in carrying out your job, or think about other scenarios specific to your business that would raise an AML red flag for you.

14. AML and OFAC Overview Red Flags, Continued A customer with a history of purchasing and then canceling policies A customer who is reluctant to provide identifying information when purchasing a policy, or who provides minimal or seemingly fictitious information A customer who shows little concern for the investment performance of a policy, but a great deal of concern about the early cancellation features A customer with a history of overpaying premiums A customer who conducts business under other unusual circumstances or during irregular hours of operation

15. AML and OFAC Overview Red Flags, Continued Purchase of an insurance policy that is inconsistent with the customer’s needs Unusual payment methods, such as cash or cash equivalents Proposals to purchase a policy using a check drawn from an account other than that of the customer Early cancellation of an insurance policy (including cancellation during a trial period), especially at a cost to the customer or where payment is made by, or the refund check is directed to, an apparently unrelated third party

16. AML and OFAC Overview Red Flags, Continued Substantial overpayment of a premium and a request that a company check be issued back to the customer for the difference (e.g., a $10,000 check for a $1,000 premium) Refunds requested in a currency that is different from that used in the original premium payment Beneficiaries outside of the country where a policy is issued Change of beneficiary to an apparently unrelated third party

17. AML and OFAC Overview Basics of CIGNA’s Approach Because CIGNA is a global enterprise, there is potential exposure to money laundering. Therefore, it is important that we have solid money-laundering detection and reporting procedures. As an employee, you must comply with AML regulations and CIGNA’s policies regardless of where you conduct business.

18. AML and OFAC Overview Basics of CIGNA’s Approach, Continued CIGNA is required to implement an effective AML compliance program that includes: A compliance officer responsible for developing and maintaining an effective compliance program Policies and procedures that include standardized reporting and internal controls Ongoing training of employees and others working on behalf of CIGNA to raise awareness regarding everyone’s responsibilities under the program Independent testing to monitor the program’s effectiveness Through this training course and other current AML-related activities, we want to enhance our detection capabilities and streamline our reporting processes.

19. AML and OFAC Overview Detection of Suspicious Activity This training program is designed to increase CIGNA’s overall awareness of potential money-laundering activity. In addition, it will assist those working for, or on behalf of, CIGNA (including brokers and agents) to increase the chance of identifying transactions that may appear suspicious. In accordance with CIGNA’s Know Your Customer strategy, you must keep complete documentation of transactions and the identities of the account holder and/or purchaser of a policy. It is critical to obtain evidence of the customer’s identity and to know their “typical” activity. By knowing your customer’s identity and their typical activity, if a suspicious activity were to occur, identification of potential money laundering would be more easily facilitated.

20. AML and OFAC Overview Report Potential Suspicious Activity Criminals rely on communication breakdowns to safely launder their illegally obtained money. Therefore, it is important that you know the reporting requirements related to possible money-laundering activity. Law enforcement agencies expect our full cooperation in collecting, centralizing, and evaluating the many pieces of information that are essential in the fight against money laundering. CIGNA is committed to cooperating with these agencies.

21. AML and OFAC Overview Report Potential Suspicious Activity, Continued Suspicious activity (red flags) must be reported to your business unit Compliance Officer or AML lead. If the activity or transaction is suspected to be potential money laundering, your business unit Compliance Officer or AML lead notifies the Global AML and OFAC Compliance Officer of the suspicious transaction. He or she completes a Suspicious Transaction Memorandum and submits the form electronically to the AML Mailbox. The Global AML and OFAC Compliance Officer is responsible for reviewing the Suspicious Transaction Memorandum and notifying the business unit’s Compliance Officer regarding whether to continue processing the transaction. The Global AML and OFAC Compliance Officer, in consultation with the Chief Compliance, Ethics and Privacy Officer as appropriate or necessary, is authorized to file a Suspicious Activity Report (SAR) to FinCEN within 30 days.

22. AML and OFAC Overview Report Potential Suspicious Activity, Continued Note: Insurance companies are required to file Form 8300 (report of cash payments over $10,000) by the 15th day after a cash transaction occurs for all transactions of cash greater than $10,000, regardless of whether the transaction is suspicious. However, because CIGNA prohibits cash transactions in general, there should not be a need to initiate a Form 8300.

23. AML and OFAC Overview AML Scenario Susan:Michael, how are you? It’s been a while since we’ve spoken. Michael:Everything’s just fine and pretty much the same as when we last talked. Same job, same family—you know… Susan:What can I do for you today? Michael: I just realized that I overpaid my annual premium. Could you please check to see if a refund has been issued? Susan:Certainly, just one minute. I see you are due a refund of $40,654. It looks like you overpaid by $3,000 last year as well, but I see that you did receive last year’s refund. I can begin the paperwork for this year’s refund right away.

24. AML and OFAC Overview AML Scenario, Continued If you were Susan, would you be concerned? You should be. Some money launderers can be long-time customers, like Michael, with whom you have an ongoing (and even friendly) professional relationship. Do not just assume all money launderers will be new customers.

25. Check Your Understanding Remember Susan’s scenario? Which red flags should she have identified? A customer who is reluctant to provide identifying information when purchasing coverage, or who provides limited or potentially false information A customer with a history of overpaying premium Beneficiaries outside of the country where the policy is issued Large overpayment of premium where a company check is issued back to the customer for the difference Make a note of all that apply. See the next page for the correct response.

26. Check Your Understanding Remember Susan’s scenario? Which red flags should she have identified? A customer who is reluctant to provide identifying information when purchasing coverage, or who provides limited or potentially false information A customer with a history of overpaying premium Beneficiaries outside of the country where the policy is issued Large overpayment of premium where a company check is issued back to the customer for the difference Correct answer: The overpayment and refund of premium is one way to “wash” illegally obtained money, making it appear “clean” because it is from a reputable company like CIGNA. There also was a previous refund requested. While the refund Michael requested last year was not a significant amount of money, multiple refunds in any monetary amount should alert you to a potential money-laundering red flag.

27. AML and OFAC Overview Your Responsibility Now that Susan has detected a money-laundering red flag, and using your additional AML reporting knowledge, what would you advise she do about this potential money-laundering activity? Let’s look at the proper reporting steps for this situation.

28. AML and OFAC Overview Your Responsibility, Continued Report suspicious activity: Suspicious activity (red flags) must be reported to your business unit Compliance Officer or AML lead. Complete Suspicious Transaction Memorandum: If the transaction involves potential money laundering, your business unit Compliance Officer or AML lead notifies the Global AML and OFAC Compliance Officer through a Suspicious Transaction Memorandum. Review and notify: The Global AML and OFAC Compliance Officer is responsible for reviewing the Suspicious Transaction Memorandum and for notifying the business unit Compliance Officer whether to continue processing the transaction.

29. AML and OFAC Overview Your Responsibility, Continued Submit SAR: The Global AML and OFAC Compliance Officer, in consultation with the Chief Compliance, Ethics and Privacy Officer, is responsible for submitting a Suspicious Activity Report (SAR), if necessary, to FinCEN within 30 days. Do not notify the customer: U.S. federal law prohibits CIGNA from notifying a customer that a SAR was filed. Federal law (31 U.S.C.5318(g)(2)) provides that a financial institution, and its directors, officers, employees, and agents who, voluntarily or by means of a suspicious activity report, notify the government of suspicious transactions, may not notify any person involved in the transaction that the transaction has been reported. Complete the transaction: In order to avoid awareness of the company’s suspicions, the transaction should be completed.

30. AML and OFAC Overview Your Responsibility, Continued As in all of our compliance programs at CIGNA, business unit Compliance Officers, the Chief Compliance, Ethics and Privacy Officer, and other members of the Enterprise Compliance, as well as the Ethics Help Line (1-800-472-8348), are always available as resources for questions or concerns. Many countries around the globe are making concentrated efforts to combat money laundering. You can do your part by detecting and reporting all potential suspicious activity to your business unit Compliance Officer or AML lead. By doing so, CIGNA can be a key contributor to successful international efforts to prevent money-laundering activity.

31. AML and OFAC Overview International AML Requirements We have focused here on U.S. AML requirements; however, as mentioned previously, many countries around the world are also engaged in an intensive and coordinated effort to combat money laundering and other financial crimes. Below is a list of some of the countries/political entities in which CIGNA conducts its business and their applicable AML requirements: For employees working in or with CIGNA International, please check with your business unit Compliance Officer or AML lead for more information on local (non-U.S.) AML requirements.

32. Check Your Understanding You should inform a customer that a Suspicious Activity Report (SAR) has been filed alerting FinCEN of their suspicious activity. True False Which would you select? See the next page for the correct response.

33. Check Your Understanding You should inform a customer that a Suspicious Activity Report (SAR) has been filed alerting FinCEN of their suspicious activity. True False Correct answer: In accordance with U.S. federal law, you should never inform a customer that a Suspicious Activity Report (SAR) has been filed.

34. Check Your Understanding If you receive an overpayment of $20,000 for a life insurance policy and the customer requests a refund and states that it was an oversight on their part, you should: Immediately refund the money, as it was an obvious mistake on the policyholder’s part Contact the customer and inform him/her that the transaction appears to be suspicious Notify your business unit Compliance Officer or AML lead and wait for instructions whether or not to process the refund Submit SAR to FinCEN Which would you select? See the next page for the correct response.

35. Check Your Understanding If you receive an overpayment of $20,000 for a life insurance policy and the customer requests a refund and states that it was an oversight on their part, you should: Immediately refund the money, as it was an obvious mistake on the policyholder’s part Contact the customer and inform him/her that the transaction appears to be suspicious Notify your business unit Compliance Officer or AML lead and wait for instructions whether to process the refund Submit SAR to FinCEN Correct answer: You should notify your business unit Compliance Officer or AML lead and wait for instructions on whether to process the transaction.

36. AML and OFAC Overview Introduction to OFAC Now that you have a better understanding of AML, potential red flags of suspicious transactions, and reporting obligations, let’s begin our discussion about OFAC requirements. The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) maintains lists of terrorists, terrorist organizations, drug traffickers, diamond and weapons traders, and even countries, with which certain U.S. parties and their affiliates are not permitted to conduct business. Simply put, OFAC prohibits companies like CIGNA from conducting business with these parties.

37. AML and OFAC Overview Introduction to OFAC, Continued As you have learned, the detection of money laundering requires detailed attention to all transactions, and identification and reporting of those that appear to be suspicious. So, knowledge of OFAC also may help enhance our money-laundering detection activities since, given the inherently secretive nature of their criminal activities, these parties may be more likely to be involved in money laundering. Let’s learn more about OFAC so that we can ensure CIGNA does not do business with the wrong individuals and entities. .

38. AML and OFAC Overview Overview OFAC has long maintained lists of persons, entities and countries with prohibited export and import activity. As a result of the September 11, 2001, terrorist attacks on the United States, the USA PATRIOT Act of 2001 (Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001) expanded the scope of the OFAC lists to include a large number of suspected terrorists and terrorist organizations. The most comprehensive list maintained by OFAC is known as the Specially Designated Nationals (SDN) and Blocked Persons List (better known as the SDN List). Companies like CIGNA are not permitted to conduct business with persons or entities included on the SDN List. Additionally, OFAC maintains a list of countries with which companies like CIGNA cannot conduct business. These designated countries are listed in the OFAC Countries Sanction Program (also known as the Blocked Countries List).

39. AML and OFAC Overview Overview, Continued CIGNA and the whole insurance industry have been called upon to aid in the prevention, detection, and reporting of transactions with these parties. If we identify a party that is included on the SDN List, we are required to report the transaction to OFAC within 10 days and, if confirmed, block or reject the funds of that party (e.g., insurance policies, annuities). Both the SDN and the Blocked Countries Lists are updated as often as daily. The responsibility within CIGNA for checking these lists is assigned to specific persons already identified within each business unit. Regardless of this assignment of responsibilities, it is important for all of us to know the OFAC basics.

40. AML and OFAC Overview Basics to CIGNA’s Approach The USA PATRIOT Act mandates that insurance companies such as CIGNA be held responsible for preventing, detecting, and reporting potential money laundering and financing of terrorist activities. As a result and in addition to a solid enterprise AML compliance program, OFAC recommends implementing an OFAC compliance program.

41. AML and OFAC Overview Basics to CIGNA’s Approach, Continued OFAC Compliance Program An effective OFAC compliance program includes: A compliance officer who is responsible for developing and maintaining an effective program Policies and procedures that include standardized reporting and internal controls Ongoing training and communication of responsibilities to employees and those working on behalf of CIGNA Independent testing to monitor the program’s effectiveness

42. AML and OFAC Overview • Basics to CIGNA’s Approach, Continued • OFAC Enforcement • A strong OFAC compliance program not only helps to avoid violations, but also can be a major consideration in mitigating the consequences when a violation has occurred. While OFAC imposes strict liability for failure to comply with its requirements, if an organization is found to have committed an OFAC violation, its compliance efforts could be taken into consideration during OFAC’s penalty decision-making process. In past enforcement actions, OFAC has viewed the strength of the target company’s commitment to compliance as a major factor in assessing the appropriate severity of penalty to be imposed. 42

43. AML and OFAC Overview • Basics to CIGNA’s Approach, Continued • CIGNA Actions • If CIGNA discovers a U.S. Treasury-confirmed Specially Designated National (SDN) or Blocked Person, we must report the matter to OFAC and wait for confirmation and further instructions from the regulators, which could include blocking the assets for the SDN or Blocked Person. By September 30 of each year, CIGNA must file with OFAC an annual report of property that has been blocked as of June 30 of the same year. 43

44. AML and OFAC Overview Who Does CIGNA Check? Any stakeholder with whom CIGNA does business is checked against the SDN List. For our purposes, a stakeholder can include, but is not limited to, health care professionals and groups, vendors, producers/brokers, employers, dependents, beneficiaries, banks, employees, policyholders, intermediaries, charitable organizations, and any person, organization or group we issue payment to, receive payment from, or to which we provide services. How Does CIGNA Check? CIGNA uses software, known as i/Lytics, that automatically compares CIGNA stakeholders to OFAC’s current SDN List. When Does CIGNA Check? Before payments to stakeholders are issued Before entering into new business On a routine basis for our existing stakeholder population Basics to CIGNA’s Approach, Continued

45. AML and OFAC Overview Your Responsibility Under the best circumstances, CIGNA would never do business with a person, entity, or country that appears on the SDN or Blocked Countries Lists. However, criminals count on breakdowns in communication and information flow to conduct their illegal activity and this, unfortunately, could happen to us. CIGNA has a robust communication process to try to reduce our risk of violating OFAC requirements. In the event we do identify a potential SDN, this communication process is as follows on the next pages.

46. AML and OFAC Overview Your Responsibility, Continued Step 1 Immediately notify your business unit’s Compliance Officer or OFAC lead. (Some business units have designated OFAC leads to oversee OFAC compliance initiatives.) Step 2 The business unit’s Compliance Officer or OFAC lead reviews the potential “hit” and notifies the Global AML and OFAC Compliance Officer. Step 3 The Global AML and OFAC Compliance Officer, in consultation with the Chief Compliance, Ethics and Privacy Officer and with cooperation from the business unit, notifies OFAC. Step 4 Assets of the SDN are blocked by CIGNA if OFAC confirms the SDN.

47. AML and OFAC Overview • Your Responsibility, Continued • Step 5 • The Global AML and OFAC Compliance Officer notifies all business unit Compliance Officers and OFAC leads of the confirmed SDN. The business unit’s Compliance Officer or OFAC lead checks their respective information systems for the confirmed SDN and notifies the Global AML and OFAC Compliance Officer if the SDN is identified as having active assets maintained by CIGNA within their business unit. • Step 6 • The Global AML and OFAC Compliance Officer, in consultation with the Chief Compliance, Ethics and Privacy Officer, must file a Blocked Asset report with OFAC within 10 days of blocking assets. 47

48. AML and OFAC Overview • Your Responsibility, Continued • Step 7 • While CIGNA is permitted to inform the SDN of U.S. Treasury-confirmed SDN status, CIGNA’s policy requires all written notifications to an SDN regarding this status be approved by the Global AML and OFAC Compliance Officer, with additional guidance, if needed, from OFAC. 48

49. AML and OFAC Overview OFAC Scenario Let’s look at an example of what can happen when the basics of OFAC compliance are not in place. AZ Insurance has decided to outsource a portion of their claims processing work to ClaimIT, Inc., a company that specializes in claim processing services. Margo, manager of AZ Insurance vendor contracting, completed the required due diligence, including an OFAC SDN check, before the final vendor contract was signed with ClaimIT, Inc. The OFAC check did not identify ClaimIT, or any of its principals, as an SDN.

50. AML and OFAC Overview OFAC Scenario, Continued Everything seemed to go smoothly with this vendor relationship for the next 2 years until OFAC contacted George, Chief Compliance Officer of AZ Insurance. OFAC informed George that ClaimIT, Inc. is an identified SDN. George was further informed that his company, AZ Insurance, was now being investigated by OFAC regulators since they have been conducting business with the SDN (ClaimIT, Inc.). George immediately contacted Margo in vendor contracting to see how this could have happened. The impacts to AZ Insurance are significant, starting with the possibility of unfavorable coverage by the media and publication of the investigation of a potential violation by AZ Insurance on OFAC’s website. What do you think AZ Insurance should have done to prevent this OFAC violation?