fICAB AND RISK BASED APPROACH IN THE GAMBLING INDUSTRY

1. fICAB AND RISK BASED APPROACH IN THE GAMBLING INDUSTRY PRESENTATION TO GRAF 2017 – MPUMALANGA BY EDWARD LALUMBE

2. CONTENTS • INTRODUCTION • CONSTITUTIONAL CONCERNS • GAMBLING REGULATORY OBJECTIVES • PROFILE GAMBLING ACCOUNTABLE INSTITUTIONS • WHY RISK BASED APPROACH? • CONTEXT OF RISK BASED APPROACH • REGULATORY PERSPECTIVE • RISK ASSESSMENT • GENERAL CRITERIA FOR DETERMINING SUITABILITY • REGULATORY RISK GROUPS • IDENTIFY RISKS • ASSESSING RISK • ADDRESSING RISK • OPERATOR PERSPECTIVE • RISK ASSESSMENT • GENERAL RISK • ASSESSMENT OF RISKS AND CONTROLS • SUPERVISOR’S RESPONSE TO DEFECTIVE RISK ASSESSMENT • CONCLUSION 2

3. introduction This presentation seeks to achieve the following: President’s Constitutional concerns. Highlight the implications of the proposed amendments of the FIC Act relating to risk based approach on the gambling industry. Context of risk based approach. Although the draft amendments places the duty of a risk based approach on licensees (accountable institutions) the FATF recommendation insists on proportionate supervisory actions to support a risk based approach. This implies what one may loosely term risk based regulatory/supervisory approach. 3

4. CONSTITUTIONAL CONCERNS • In 2015, the FICAB was tabled in Parliament and subsequently submitted to the President for assent. • In 2016, President referred the Bill back to Parliament citing concerns about s45B(1C) which deals with warrantless inspections. “(1C) An inspector otherwise required to obtain a warrant for entry and inspection of a private residence or unlicensed business premises in terms of subsection (1A), may enter and inspect that residence or those premises without a warrant- • With the consent of – • In the case of a private residence – • The person apparently in control of the business reasonably believed to be conducted at the private residence; and • The occupant of the part of the private residence to be entered and inspected; • In the case of unlicensed business premises, the person apparently in control of the business reasonably believed to be conducted at the premises, after informing him or her that he or she is under no obligation to admit the inspector in the absence of a warrant; or 4

5. CONSTITUTIONAL CONCERNS (Continued) • With the prior authority of the Director of the head of a supervisory body, or a senior staff member of the Centre or supervisory body delegated to perform the function, if the Director head or senior staff member on reasonable grounds believes that – • A warrant will be issued under subsection (1B) if applied for; • The delay in obtaining the warrant is likely to defeat the purpose of which entry and inspection of the private residence or unlicensed business is sought; and • It is necessary to enter and inspect that residence or those premises to perform any or all of the actions contemplated in section 45(B)(2)(a) to (f). • President’s referral of the Bill was triggered by objections from Black Business Council and Progressive Professional’s Forum (PPF) who argued inter alia that: • Banks already have far too much power and that it would be wrong to give finance sector inspectors the power to search homes without warrant or warning • The impact of the amendments to the Bill would be felt mainly by black business 5

6. CONSTITUTIONAL CONCERNS (Continued) • Treasury dismissed these objections on the basis that: • The prominent influential persons who would be subjected to enhanced monitoring were not racially profiled; and • Instead, the value of business conducted with or on behalf of any organ of state would be the target of enhanced vigilance. • Advocates J Gauntlett SC and I Semenya SC concurred with Senior Parliamentary Advisor Frank Jenkins that the Constitutional Court allowed warrantless searches in narrowly defined circumstances. They argued that: • The Presidents objection was not sound in law; • The case law citation on which the President based his objections was not appropriate as the legal provisions that were struck down by the Constitutional Court in those cases were much wider than those in section 45(B)(1)(c) and therefore deemed an impermissible infringement on privacy; 6

7. CONSTITUTIONAL CONCERNS (Continued) • In this case s45(B)(1)(c) allows inspectors to carry out searches where the delay in applying for warrant would frustrate the object of the search and they were persuaded that had they approached the court for a warrant, the court would grant it. • The mere fact that the may be a warrantless search does not mean there is a constitutional difficulty • Parliament has reconsidered the agreed section and send the Bill to the President for assent. • Bill currently awaiting President’s assent. 7

8. GAMBLING REGULATORY OBJECTIVES • Ensuring that gambling is conducted in a fair and open manner. • Protecting children and other vulnerable persons from being harmed or exploited by gambling. • Promotion of inclusive economy through transformation (BBBEE) policies. • Revenue generation. • Preventing gambling from being a source of crime, being associated with crime or being used to support crime. 8

9. PROFILE OF GAMBLING ACCOUNTABLE INSTITUTIONS • Casinos • Bingos • Totalizators • Limited payout machines • Bookmakers • Excluded • Manufacturers of gambling equipment • Amusement machine licence holders • Holders of certificate of suitability • Junket operators • Lottery - regulated by the Lotteries Board 9

10. Why risk based approach? • There is a hierarchy in the regulation of AML/CFT. The regulation includes United Nations resolutions, international policy initiatives and national legislation or framework. • FATF recommendation 28 provides: • Casinos must be licensed and supervised. • Other Designated Non-Financial Business and Professions (DNFBPs) must be subject to systems for monitoring and ensuring compliance with AML/CFT requirements. • Monitoring should be performed on a risk-sensitive basis. • The Financial Intelligence Centre issued two guidance notes dealing with risk based approach. Guidance note 1 and 3. • Financial Intelligence Centre Amendment Bill, was published on 09 October 2015 and provides for a risk based approach. 10

11. Context of risk based approach • Risk contextualised within a particular licensee (AI) • No more generic risks or rule based tick approach • Risk assessment to cover all aspects of the business • Risks assessment to include single transaction unless exemptions are retained 11

12. Risk assessment • The regulator’s approach to risk should underpin its: • Licensing • Compliance; and • Enforcement functions • The regulator’s risk methodology should be applied in order to establish a regulator risk assessment for its licensees. This informs the level and nature of engagement by the regulator with those operators. • The methodology is based upon assessing the likelihood of risk presented by the licensee/applicant and the potential impact that the risk, if realised, will have upon the licensing objectives. • Not expected to conduct an independent risk assessment of AI, but should not necessarily accept a risk assessment as correct. • A significant part of risk assessment in the gambling industry is based on the assessment of suitability. 12

13. GENERAL CRITERIA FOR DETERMINING SUITABILITY • Non-involvement in criminal activity Most statutes disqualify persons who have been found guilty and convicted of certain offences. • Financing of operations Applicants are required to prove access to funding of the operations. The intention is to ensure that: • Funding comes from a legitimate source and not a criminal enterprise. • The business is viable. An operator who is not viable is likely to cheat customers and not pay the taxes due to the state. • Business competency/management expertise The intention is to protect government revenue and customers. An operator needs to be sophisticated enough to deal with very skilled cheaters. Cheaters not only steal from the operators, but also rob the government of tax revenue. 13

14. General criteria for determining suitability (Continued) • Suitability of location Government does not want gaming operations near unsuitable activities eg churches or schools. Nearby unsuitable premises present a negative image of gambling especially to foreign visitors who are not used to such businesses being legal. • Tax compliance The intention is to determine the honesty and integrity of the person. A person evading payment of tax is likely to be dishonest. • Credit worthiness The purpose is to determine whether the person is likely to be susceptible to criminal activity. A person who does not honour his/her obligation and is in serious financial difficulties is likely to be unsuitable for licensing in gambling. • Participation profile In most jurisdictions all persons below the age of 18 are regarded as not suitable to participate in gambling as they do not have the requisite mental capacity to exercise the choice to participate in gambling. 14

15. REGULATORY RISK GROUPS • Key regulatory risk groups include: • Those related to the suitability of the licence holder • Those which relate to the gambling facilities • Those which relate to the manner in which gambling facilities are provided • The risk related to the suitability of the licence holder include: • Staff and management integrity and competence • Licensee’s integrity • Business integrity : this includes financial circumstances, governance, structure and resources. • The risk related to the type of gambling facility include: • Gambling product or facility • Market scope 15

16. REGULATORY RISK GROUPS (continued) • The risks presented through provision of gambling facilities include: • Location and operating environment • Consistency with the licensing objectives 16

17. Identification of risks • With regard to any aspect of regulatory engagement (licensing, enforcement, compliance) an initial identification of risk presented should be made. • An example in respect of a licence application, the consideration necessary will involve a wider range of risk(s) whereas a compliance visit may relate to a specific risk identified through previous engagement. • An example of risk related to employees integrity will be a risk posed by a key employee of the licence holder being convicted of a criminal offence indicating dishonesty. • An example of a risk related to the provision of gambling facility will be the manner in which a licence holder might seek to comply with the requirements of the gambling legislation or licence conditions. 17

18. ASSESSING RISK • The regulator’s focus should determine the risk categories and elements against which the information will be sought. • The elements assessed in respect of likelihood may include how compliant an operator is, or is likely to be with the legislation and licence conditions. Further, organisational considerations such as accountability and governance, competence and integrity of staff, and effectiveness of policies and procedures and minimising risk to the licensing objectives. • The significant part relates to the pre-licensing assessment of suitability. This assessment is key to the regulator’s licensing process and continues after the licence has been granted. 18

19. ASSESSING RISK (continued) • The regulator will assess the likely impact of the risk based primarily on the size and market scope of a licensee (actual or potential) and its previous regulatory history • That may include the size of the customer base, number of premises, gambling turnover and the extent of licensed gambling activity • The consideration of the extent of licence gambling activity not only covers those licensees which offer gambling across more than one sector but also those where the nature of a single licensed gambling activity extends across multiple sectors 19

20. ADDRESSING RISK • The impact and likelihood of a gambling risk(s) should be taken into account as part of overall risk assessment. This will determine the type and degree of regulatory engagement required. • Some licensees will always have high impact because of size, scale or nature of the operations. • Licensees who have extensive operations (in terms of impact) or significant market share should always receive a greater degree of regulatory oversight due to the market impact (actual or potential) in the event that a regulatory risk materialises or is identified. This explains for example why additional information is usually required during the licensing stage 20

21. ADDRESSING RISK (continued) • Once the risk assessment is completed the regulator should share with the licensee its considerations regarding the level of risk considered to exist. • Assessment of a particular licensee should not be shared with other licensees but may be shared with other regulators where appropriate. However, licensees may themselves share their assessments. • Licensees which demonstrate good governance and high level of compliance at all levels are less likely to present a risk to the licensing objective. • Once the regulatory action is completed the risk is re-assessed to determine whether the desired outcome has been met in addressing the risk(s) or further action is required. 21

22. OPERATOR’S RISK ASSESSMENT STEPS • Risk Identification – Analysing the operator’s business structure and practices in order to identify areas of potential ML/TF risk. • Risk Mitigation – Applying measures effectively to mitigate the identified risks. • Risk Monitoring – Putting in place management information systems and keeping up to date with changes to the risk profile through changes to the business or threats • Documentation – Having internal controls in the form of policies and procedures to cover the identified risks and deliver accountability from the Board and Senior Management down. • Risk Review – Monitoring and evaluating the risks identified in order to ensure the effective operation of internal controls is in place to mitigate the risk 22

23. GENERAL OPERATOR RISKS Although each licensee will have its own unique risks, the following are the minimum risks faced by licensees. • Customer Risk • Product/Services Risk • Transaction/Payment Risk • Geographical Risk • Behavioural Risk (Monitoring) 23

24. ASSESSMENT OF RISKS BY THE OPERATOR • Customer Risk • Types of customers and the style of business relationship. • Customer due diligence achieved through customer providing personal information and verification thereof. • ID proofing identity and age • Proof of address • Customer due diligence of business accounts. • Additional information to personal information of directors is required • Company name • Company address • Office bearers, shareholders and all beneficial owners • Evidence of the ownership of the account funding method • Consider what information operator holds about the customer and whether the information is up to date. • Customer verification is aimed at ensuring that customers who say they are not acting on behalf of someone or feature on the PEP (DPIP and FPPO) and sanction list. 24

25. ASSESSMENT OF OPERATOR RISKS • Obtain senior management approval in accepting PEP (DPIP and FPPO) as customer • Ensure proportionate monitoring of PEP (DPIP and FPPO) • Measures to establish source of wealth and funds • On going and enhanced due diligence • Third party verification • Validation of the customer documents • Address validation check • Reputable funding • Background and lifestyle check • Source of funds • Source of wealth • Internal corroboration of user ID 25

26. ASSESSMENT OF OPERATOR RISKS (continued) • Product / services risks • Some products should be considered higher risks for passing / movement of funds and others • Eg. Poker could be a higher risk game due to potential for collusion and chip dumping by customers while slots and bingo may be seen to be lower risk game requiring minimum mitigation • Some operators may offer facilities for their customers to transfer funds to another customer known as player to player transfers – this is risky • Some customers may have multiple accounts and payment methods to enable them to gamble across different platforms and interact with customers registered with another licensee. • Transactions / payment risks • The licensee should evaluate risk associated with different methods of payment • The licensee should avoid to simply act as banks. Customer accounts should be used for gambling purposes • Geographic risks • Some countries are deemed to present greater risks than others • Generally countries that do not have legislation which meets FATF standards • Mitigation could involve obtaining corruption and risks indexes through eg. Transparency International 26

27. SUPERVISOR’S RESPONSE TO DEFECTIVE RISK ASSESSMENT • Supervisors must have a range of proportionate and dissuasive sanctions (Recommendation 35) • Sanctions must include powers to impose a range of disciplinary and financial sanctions, including the power to withdraw, restrict or suspend the financial institution’s license (Recommendation 27) • Supervisors must be able to demonstrate the use of remedial actions and / or effective, proportionate and dissuasive sanctions in practice • Supervisors must be able to demonstrate that their actions have an effect on compliance 27

28. CONCLUSION Although most of the gambling regulatory activities are risk based, the amendments supplements the current framework. However, these amendments will have serious implications for the licensees (accountable institutions) which may not be easily implementable in practice. 28