PCC 22 – International privacy laws and CIV

financial intelligence centre

REPUBLIC OF SOUTH AFRICA

PUBLIC COMPLIANCE COMMUNICATION No. 22 (PCC 22) –

CLIENT IDENTIFICATION AND VERIFICATION REQUIREMENTS IN RELATION

TO INTERNATIONAL OR FOREIGN PRIVACY AND DATA PROTECTION LAWS

The Financial Intelligence Centre (the Centre) provides the guidance contained in this Public Compliance Communication (PCC) in terms of its statutory function under section 4(c) of the Financial Intelligence Centre Act No. 38 of 2001, as amended (the FIC Act) read together with Regulation 28 of the Money Laundering and Terrorist Financing Control Regulations (the Regulations) issued in terms of the FIC Act.

Section 4(c) of the FIC Act empowers the Centre to provide guidance in relation to a number of matters concerning compliance with the obligations of the FIC Act.

Guidance provided by the Centre is the only form of guidance formally recognised in terms of the FIC Act and the Regulations issued under the FIC Act. Guidance provided by the Centre is authoritative in nature. An accountable institution must comply with the FIC Act and Regulations read with guidance issued by the Centre, and where there is a departure explain the reasons for not adhering to the guidance provided by the Centre. It is important to note that enforcement action may emanate as a result of non-compliance with the FIC Act in areas where there have been non-compliance with the guidance provided by the Centre.

PCC Summary

It is a contravention of the FIC Act for an accountable institution to establish a business relationship or conclude a single transaction with a client where the client refuses to provide the required identification and verification documentation based on international or foreign privacy or data protection laws applicable within the country of residence of the client.

Disclaimer

The publication of a PCC concerning any particular issue, as with other forms of guidance which the Centre provides, does not relieve the user of the guidance from the responsibility to exercise their own skill and care in relation to the users' legal position. The Centre accepts no liability for any loss suffered as a result of reliance on this publication.

Copyright Notice

This PCC is copyright. The material in a PCC may be used and reproduced in an unaltered form only for personal, non-commercial, use or non-commercial use within your organisation.

Apart from any use permitted under the Copyright Act No. 98 of 1978, all other rights are reserved.

Objective

The objective of this PCC is to clarify the compliance obligations of accountable institutions when dealing with clients resident in a foreign country who refuse to provide the required identification and verification information in terms of the FIC Act based on international or foreign privacy or data protection laws.

PCC 22 – Client identification and verification requirements in relation to international or foreign privacy and data protection laws

1. Introduction

1.1 Section 21 of the FIC Act prohibits accountable institutions from establishing business relationships or entering into single transactions with their clients unless they have taken the prescribed steps to establish and verify the identities of their clients, or establish and verify the identities of persons representing their clients.

1.2 Reference to a foreign national in this PCC, refers to a natural person who is a citizen of another country and is not resident in the Republic of South Africa.

1.3 Regulation 5(1) of the Regulations to the FIC Act clearly states that an accountable institution must obtain the following particulars from a natural person who is a citizen of another country and is not resident in the Republic:

- full names;

- date of birth;

- nationality;

- passport number;

- South African income tax registration number, if such a number has been issued to that person; and

- residential address.

1.4 Regulation 5(2) of the Regulations to the FIC Act states that in the case where the accountable institution is aware or ought reasonably to be aware that the person referred to in regulation 5(1) does not have the legal capacity to establish a business relationship or conclude a single transaction without the assistance of another person the accountable institution must, in addition to obtaining the particulars referred to in regulation (5)(1), obtain from, or in respect of, of that other person—

- his or her full names;

- his or her date of birth;

- his or her nationality;

- his or her passport number;

- his or her residential address; and

- his or her contact particulars.

PCC 22 – Client identification and verification requirements in relation to international or foreign privacy and data protection laws

1.5 In terms of Regulation 6(1) of the Regulations an accountable institution must verify the full names, date of birth, nationality, passport number and the residential address of foreign national or the other person assisting the foreign national by comparing those particulars with an identification document of that person.

1.6 Exemption 6 of the Exemptions to the FIC Act exempts accountable institutions from obtaining and verifying South African income tax registration numbers.

1.7 Regulation 6(3) of the Regulations further states that an accountable institution must verify any of the particulars referred to in paragraph 1.3 and 1.4 above with information which is obtained from any other independent source, if it is believed to be reasonably necessary taking into account any guidance notes concerning the verification of identities which may apply to that institution.

2. Relying on international or foreign privacy or data protection laws not to provide the required information as stipulated in the FIC Act and Regulations

2.1 It has come to the attention of the Centre that some accountable institutions are currently experiencing challenges when attempting to identify and verify the requisite information concerning foreign nationals.

2.2 In some instances foreign nationals claim that data privacy legislation exists within the jurisdictions in which these persons reside or operate their businesses which exempt them from providing the necessary client identification and verification information when establishing a business relationship or transacting with an accountable institution in South Africa.

3. The Centre's View

3.1 An accountable institution may not establish a business relationship or conclude a single transaction with a client unless the accountable institution has taken the prescribed steps to establish and verify the identity of the client or the persons representing their clients.

PCC 22 – Client identification and verification requirements in relation to international or foreign privacy and data protection laws

3.2 The FIC Act specifically sets out the required information that an accountable institution must obtain and verify in relation to foreign nationals.

3.3 The Centre is of the view that should a foreign national refuse to provide an accountable institution with the necessary FIC Act required information, the accountable institution may not proceed to establish a business relationship or conclude a single transaction with such client.

3.4 It should be noted that the FIC Act supersedes any laws in or outside the Republic of South Africa, save for the Constitution.

4. Conclusion

4.1 An accountable institution must ensure that it complies with the identification and verification requirements in terms of the FIC Act with regard to clients who are foreign nationals.

4.2 The fact that privacy and protection of data legislation exists in the country where the client resides or conducts business does not excuse the client from providing an accountable institution with the necessary client identification and verification information when establishing a business relationship or transacting with an accountable institution in the Republic of South Africa.

4.3 An accountable institution may therefore not establish a business relationship or conclude a single transaction with a foreign national if the foreign national refuses to provide the required information and documentation that is necessary for identification and verification purposes in terms of the FIC Act.

Issued By:

The Director

Financial Intelligence Centre

18 July 2013

PCC 22 – Client identification and verification requirements in relation to international or foreign privacy and data protection laws