## EXECUTIVE SUMMARY — WAEMU AML/CFT Technical Note (1wauea2023003) ## Source details **Canonical URL:** [EXECUTIVE SUMMARY — WAEMU AML/CFT Technical Note (1wauea2023003)](https://www.imf.org/-/media/files/publications/cr/2023/english/1wauea2023003.pdf) ## Other formats - [Markdown version](/-/media/files/publications/cr/2023/english/1wauea2023003.pdf.md) - [Structured JSON version](/-/media/files/publications/cr/2023/english/1wauea2023003.pdf.json) --- ### Background and scope - Technical note analyzes AML/CFT supervision of the West African Economic and Monetary Union (WAEMU) banking sector; prepared by Jay Purcell, Tanjit Sandhu, and André Kahn under supervision of Nadine Schwarz; virtual consultations in November 2021. - Focus on regional AML/CFT supervisory authorities: Banking Commission (BC), General Secretariat of the BC (GSBC), and Central Bank of West African States (BCEAO). - Assessment considered aspects of FATF Recommendation 26, Recommendation 27, Immediate Outcome 2, Immediate Outcome 3, and Immediate Outcome 4; not a mutual evaluation against full FATF Standards. - Scope limitations: - Focused on AML/CFT supervision under BCEAO/BC/GSBC; did not analyze AML/CFT supervision of other sectors (money remitters, mobile money, microfinance, real estate). - Targeted exercise, not exhaustive against full FATF Standards. ### Constraints on the analysis - Confidential documents available only in hard copy at BCEAO’s offices in Paris; pandemic-related travel restrictions prevented authors from reviewing them in person. - Certain sensitive information reviewed electronically but not authorized for reproduction. - Result: observations and recommendations focus on BC/GSBC supervisory methodology and procedures; noted where key documents were unavailable. ### Major developments already taken by BC/GSBC (since 2017) - Ensured relevant staff received at least basic training on AML/CFT supervision (ongoing). - Introduced a new institutional risk assessment model in 2017. - Administered AML/CFT-specific questionnaire to banks in 2019 and 2021; integrated responses into institutional risk assessment and on-site inspection planning. - Procured software tool SCAN-R in 2019 to automate aspects of on- and off-site supervision; SCAN-R operational since end-2019 and used for virtual on-site inspections since April 2020. - Issued an on-site inspection manual and updated on-site inspection checklists in 2020. - Began more forceful approach to addressing AML/CFT deficiencies in 2021. ### Key findings — substantive deficiencies - Critical deficiencies persist across off-site supervision, institutional risk assessment model, on-site inspections, and domestic/international cooperation. - Off-site Supervision Program: - Off-site program feeds into risk-rating process but is not itself risk-based: frequency and intensity almost entirely rule-based and not adapted to ML/TF risks of individual banks or banks in different member-states. - Feedback to banks is too narrow in scope and distribution (shared mainly with banks’ senior management on an annual basis). - Off-site information primarily used internally to generate institutional risk-ratings and to plan on-site inspections. - Risk Assessment Model: - AML/CFT-specific inputs are unduly limited: derived from banks’ annual AML/CFT reports, reports on implementation of internal controls, responses to 2019 and November/December 2021 AML/CFT questionnaires, and past inspections. - Key indicators not collected or integrated: key statistics maintained by banks, views of national FIUs, and relevant public-domain analysis are not collected or integrated. - Within the model, the AML/CFT risk factor is weighted at 5.6 percent; this weighting has not yet been reviewed since 2017. - On-Site Inspection Program: - Program is active but not fully RBA-compliant and contains methodological deficiencies. - All “specific inspections” include an AML/CFT component regardless of identified ML/TF risk; AML/CFT “thematic inspections” are comprehensive rather than risk-targeted. - Methodology for assessing PEPs, STRs, and TFS is lacking in specific areas. - No enforcement policy for addressing deficiencies/violations observed on inspections. - Domestic and International Cooperation: - Cooperation with national FIUs is infrequent and informal; impediments affect direct exchange of confidential information. - Cooperation with extra-regional counterparts is nearly non-existent in practice despite a conducive legal framework and conclusion of ten (10) bilateral memoranda of understanding (MOUs). ### Conclusions on overall approach - BC/GSBC established useful baseline systems and taken significant steps since 2017, but supervisory program is not yet fully risk-based. - Limitations driven by insufficient inputs, weak feedback mechanisms, methodological gaps in on-site inspections, and weak cooperation frameworks. - Addressing deficiencies requires substantial reform over short-, medium-, and longer-terms and continual reinforcement of BC/GSBC AML/CFT capacity, including establishing an internal pool of AML/CFT expertise and providing more in-depth training. ### Reform recommendations — overview and timeframes - General timeframes: “Short-term” = within one year; “Medium-term” = within two years; “Long-term” = within 3-5 years. - Reviews of ML/TF risk factor composition/weighting should be conducted at least every 3-5 years, beginning in 2022. - Off-Site Supervision Program (responsible: GSBC/BC) - Vary the intensity of the off-site supervisory program based on ML/TF risks posed by individual banks. (GSBC; Medium-Term; High) - Continually update the AML/CFT questionnaire (2019 and 2021) and reissue it at least biannually. (GSBC; Medium-Term; Medium) - Follow-up on reports and questionnaire responses more systematically (not only when serious deficiencies are found). (GSBC; Medium-Term; High) - Periodically issue guidelines/best practices for meeting AML/CFT obligations and completing annual reports. (BC/GSBC; Long-Term; Medium) - Strengthen partnership with the banking industry via open and regular dialogue. (BC/GSBC; Short-Term; Medium) - Risk Assessment Model (responsible: BC/GSBC; National FIUs) - Require banks to submit, at least annually, a set of basic statistics to function as additional ML/TF risk indicators. (BC/GSBC; Short-Term; High) - Ask WAEMU member states’ national FIUs to share, in real-time, indicators of changes in institution-level ML/TF risks. (BC/GSBC, National FIUs; Medium-Term; Low) - Conduct periodic reviews of the composition and weighting of the ML/TF risk factor and adjust as necessary; reviews at least every 3-5 years beginning in 2022. (BC/GSBC; Long-Term; Medium) - On-Site Inspection Program (responsible: BC/GSBC) - Further develop AML/CFT capacity within and outside the on-site inspection function (DCPECEME). (BC/GSBC; Medium-Term; High) - Where practical, include one or more branches selected in line with the RBA in AML/CFT on-site inspections. (GSBC; Short-Term; Medium) - Down-select broader topics for specific inspections and sub-topics for AML/CFT thematic inspections based on relative risks. (GSBC; Short-Term; High) - Sharpen methodology for assessing PEPs, STRs, and TFS. (GSBC; Medium-Term; Medium) - Continue to impose stronger, proportionate sanctions for AML/CFT deficiencies to ensure they are effective and dissuasive. (BC; Short-Term; Medium) - Produce and adopt an enforcement policy to foster predictability and consistency. (BC/GSBC; Long-Term; Low) - Provide anonymized information to all WAEMU bank AML/CFT compliance functions on deficiencies found and sanctions levied. (BC/GSBC; Short-Term; Medium) - Domestic and International Cooperation (responsible: BC, BCEAO, National FIUs; BC/GSBC) - Remove key impediments to effective exchange of information between national FIUs and supervisory authorities, including signature of the MOU between FIUs and the BC. (BC, BCEAO, National FIUs; Short-Term; High) - Cooperate effectively with foreign counterparts that have shared responsibility for banks, including exchange of information. (BC/GSBC; Medium-Term; Medium) --- ### Status of AML/CFT mutual evaluations and regional risks - As of end-2021, completed mutual evaluation reports (MERs) for WAEMU member-states disclosed important weaknesses in AML/CFT supervision. - All countries except for Cote d’Ivoire (assessment initiated by the IMF in 2021 and underway at time of drafting) received on-site missions led by GIABA. - Three countries under increased monitoring by the FATF: Burkina Faso, Mali, and Senegal. - All MERs adopted show a “low effectiveness” rating in AML/CFT supervisory regimes under Immediate Outcome 3. - Consequences of FATF enhanced monitoring include increased reputational risk, potential difficulty/expense for correspondent relationships, need for banks to enhance compliance to maintain access to global payment systems, and potential reduced appetite of global companies and investors. - WAEMU: Member-States’ MER Status as of December 2021 (selected entries preserved) - Benin — On-Site Visit: February 2019; Report Adoption: May 2021 - Burkina Faso — On-Site Visit: July 2018; Report Adoption: May 2019; Under Increased Monitoring by the FATF: Yes - Côte d’Ivoire — On-Site Visit: March 2022; Report Adoption: November 2022 - Guinea-Bissau — On-Site Visit: January 2021; Report Adoption: February 2022 - Mali — On-Site Visit: March 2019; Report Adoption: November 2019; Under Increased Monitoring by the FATF: Yes - Niger — On-Site Visit: January 2020; Report Adoption: August 2021 - Senegal — On-Site Visit: September 2017; Report Adoption: November 2018; Under Increased Monitoring by the FATF: Yes - Togo — On-Site Visit: January 2021; Report Adoption: February 2022 ### Key recent legal/regulatory reforms - Adoption of new Uniform Law: Decision n°26 02/07/2015/CM/UMOA of July 2, 2015; transposed into national legal frameworks. - Four implementing regulations issued by the BCEAO (all dated September 25, 2017): - Instruction 007-09-2017 — application by financial institutions of the Uniform Law on AML/CFT. - Instruction 008-09-2017 — threshold for declaration of physical cross-border transport of cash and negotiable bearer instruments. - Instruction 009-09-2017 — threshold for payment of a receivable in cash or by negotiable bearer instruments. - Instruction 010-09-2017 — threshold for declaration of cash transactions to national FIUs. - Remaining legal and supervisory gaps: - Uniform Law not fully aligned with FATF Standards (e.g., lacks requirement to identify/verify beneficial owners of legal person customers). - No legal requirement for BC/GSBC to review ML/TF risk profile of an FI or group upon major events (per Recommendation 26). - MERs note frequency/intensity of supervision not fully risk-based; sanctions not strong enough; cooperation with FIUs too low. ### Institutional framework and staffing (as of end-2021) - GSBC organization: - GSBC headed by a Secretary General assisted by two Deputy Secretaries General appointed by BCEAO Governor. - GSBC composed of seven directorates; Directorate of Permanent Supervision (DSP) and Directorate of On-Site Inspection of Credit Institutions and Electronic Money Institutions (DCPECEME) responsible for off-site and on-site AML/CFT supervision. - BCEAO provides operational resources. - Staffing counts and shares: - DSP and DCPECEME staff comprised forty-five (45) staff members, representing about 33 percent of GSBC’s total of 138 staff members. - Overall, 14 percent of GSBC’s staff worked on the on-site supervision of credit and electronic money institutions. - DSP comprised 25 staff members; DCPECEME comprised 20 staff members. - AML/CFT training: - Fewer than half of total GSBC staff have received specialized AML/CFT training. - Since 2017, at least one AML/CFT training session organized each year for officers in charge of supervision. ### Banking sector landscape — key statistics (as of November 2021 and related dates) - Total banks operating in WAEMU region as of November 2021: 152 banks. - 111 foreign banks. - 41 domestic banks. - Customer counts as of November 2021: - more than 14 million retail customers, - about 220,000 of whom are foreign, - and 1 million legal person customers, about 12,000 of which are foreign. - The GSBC does not maintain statistics on number of customers identified as PEPs by supervised banks. - Table totals (preserved as presented): - Total banks under GSBC supervision: 111 foreign, 41 domestic. - Individual Account Holders: 226 702 foreign, 14 083 759 domestic. - Legal Person Account Holders: 12 327 foreign, 1 091 405 domestic. - Country examples (selected entries preserved): - Benin — 13 foreign, 2 domestic; Individual Account Holders: 43 190 foreign, 2 126 473 domestic; Legal Person Account Holders: 1 677 foreign, 101 754 domestic - Côte d’Ivoire — 23 foreign, 7 domestic; Individual Account Holders: 38 524 foreign, 4 376 287 domestic; Legal Person Account Holders: 429 184 foreign, 595 domestic - Senegal — 22 foreign, 9 domestic; Individual Account Holders: 60 015 foreign, 1 871 095 domestic; Legal Person Account Holders: 1 943 foreign, 234 576 domestic ### Off-site supervision — inputs, practices, and shortcomings - Off-site staffing and tools: - GSBC has a total of 25 staff dedicated to off-site supervision; none specializes exclusively in AML/CFT but all have received relevant training. - GSBC acquired SCAN-R in 2019 with an AML/CFT module; used since April 2020 for virtual on-site inspections. - Primary off-site inputs: - Annual AML/CFT reports required by Articles 12 and 13 of Instruction n° 007-09-2017; banks submit within two months after year-end. - Supplementary questionnaires issued in 2019 and repeated in late 2021. - Internal control reports submitted biannually; statutory auditor reports submitted annually. - Weaknesses in off-site inputs and use: - Annual reports’ format/content inconsistent across banks; Article 12 does not require banks to provide risk information or their institutional risk assessments. - 2019/2021 questionnaires largely omit risk-related inputs; only one question asks whether banks have procedures for institutional risk assessments. - GSBC does not request or integrate key statistics reflecting institutional risk profiles nor does it systematically solicit FIU analysis or public-domain ML/TF statistics. - Feedback from DSP provided only when serious deficiencies identified. - Outcomes and follow-up: - Over the past 3 years, GSBC issued more than 57 notification letters for significant ML/TF deficiencies: twelve (12) in 2019, twenty-five (25) in 2020, and twenty (20) in 2021. - Banking compliance officers report statutory auditors mainly provide follow-up on annual reports; sector-wide guidance and best practice papers absent. ### Risk assessment model — structure, weights, and results - Model characteristics: - GSBC’s risk model introduced in 2017 comprises 70 datapoints and generates global and ML/TF-specific risk ratings at least annually. - ML/TF risk is one (1) of nine (9) factors used to generate a bank’s overall/“global” risk rating. - ML/TF is one of the four (4) factors with the lowest possible weighting; ML/TF risk factor specifically weighted at 5.6 percent in the model. - GSBC has not yet conducted a periodic review of factor weights; intends to undertake reviews. - Inputs feeding ML/TF sub-rating: - Primary reliance: AML/CFT annual reports (Article 12). - Complementary inputs: SCAN-R statistics, internal control reports, statutory auditor reports, questionnaires (2019, 2021), past inspections, validated public information. - Gaps: - GSBC does not request banks’ institutional risk assessments systematically; does not solicit FIU indicators of changes in bank-level risk; insufficient TF indicators collected. - ML/TF risk-rating results (2018–2021) — percentages by risk category: - Medium risk: 51 percent in 2018, 48 percent in 2019, 49 percent in 2020, and 60 percent in 2021. - ML/TF risk-rating results (raw counts) — Table reproduced exactly: - 2018: Acceptable Risk 18; Medium Risk 56; High Risk 27; Very High Risk 9; Total 110 - 2019: Acceptable Risk 21; Medium Risk 55; High Risk 30; Very High Risk 9; Total 115 - 2020: Acceptable Risk 16; Medium Risk 60; High Risk 35; Very High Risk 12; Total 123 - 2021: Acceptable Risk 6; Medium Risk 74; High Risk 37; Very High Risk 7; Total 124 - Definitions (reproduced exactly): - “Acceptable Risk” means that the bank has a solid ML/TF risk mitigation system. - “Medium Risk” means that the bank has a generally satisfactory ML/TF risk mitigation system, which nevertheless presents minor weaknesses. - “High Risk” means that the bank has an ML/TF risk mitigation system that presents numerous weaknesses. - “Very High Risk” denotes a critical situation in which the bank’s ML/TF risk mitigation system is failing, thereby creating significant ML/TF risks which warrant specific responses by the supervisory authorities. - Geographic concentration: - 2018 and 2019: six of the nine banks assessed each year as “very high” were operating in just two member-states. - 2020: eight of the twelve “very high” risk banks were operating in three member-states. - 2021: five of the seven “very high” risk banks were operating in just two member-states. - One member-state consistently ranks among the top two in number of “very high” risk banks hosted. ### On-site inspection program — activity, methodology, deficiencies, and enforcement - Inspection types and activity (January 2018–December 2021) — raw counts preserved: - 2018: Total Number of On-Site Inspections 68; Number of Specific On-Site Inspections 3; Number of AML/CFT Thematic On-Site Inspections 14 - 2019: Total Number of On-Site Inspections 40; Number of Specific On-Site Inspections 18; Number of AML/CFT Thematic On-Site Inspections 2 - 2020: Total Number of On-Site Inspections 23; Number of Specific On-Site Inspections 21; Number of AML/CFT Thematic On-Site Inspections 0 - 2021: Total Number of On-Site Inspections 48; Number of Specific On-Site Inspections 38; Number of AML/CFT Thematic On-Site Inspections 10 - From 2018-2021 GSBC carried out a total of 80 specific inspections and 26 AML/CFT thematic inspections. - Inspection modalities: - Specific inspections typically involve three to four inspectors and last two to three weeks. - AML/CFT thematic inspections typically involve three inspectors and last one to one-and-a-half weeks; they cover CDD, monitoring of higher-risk accounts, STR identification/reporting, TFS application, and record-keeping. - Specific inspections typically include an AML/CFT component regardless of ML/TF sub-rating. - On-site inspections are almost always announced; pre-inspection questionnaire sent one or two weeks in advance; unannounced inspections are extremely rare and never used in AML/CFT context. - Branches not systematically included; visited when credible information suggests non-compliance. - Pandemic adjustments: - Unable to conduct on-site inspections from March–October 2020; GSBC developed remote inspection methodology. - Remote inspections performed: eight (8) in 2020 and three (3) in 2021. - Remote inspections limited because supervisors cannot directly access banks’ IT systems for testing/review. - Methodology strengths and shortcomings: - GSBC has inspection manual and eight (8) thematic checklists covering governance, procedures, CDD, risk mapping, operations, IT systems, training, and asset freezing. - RBA not fully applied: thematic inspections cover full sub-topics regardless of relative risks; specific inspections include AML/CFT component irrespective of ML/TF sub-rating. - Suggested refinements include distinguishing between lower- and higher-risk domestic PEPs, consulting national FIUs on STR quality, random transaction sampling to detect missed suspicious transactions, ensuring WMD proliferation-related TFS names are included in screening, and requiring ostensible-transaction tests of screening systems. - Observed deficiencies (2018–2021): - Failure to complete/update customer profiles (including level and source(s) of income). - Poor/inconsistent handling of alerts generated by monitoring software. - Failure to conduct (at least) annual independent audits of AML/CFT systems and procedures. - Sanctions and enforcement: - BC has measures under Articles 29-31 of the Annex including warnings, reprimands, corrective orders, heightened surveillance, fines, mandatory publication, suspension/prohibition of transactions, and license withdrawal. - Fines levied according to regulation formula but no sanctions/enforcement policy to ensure predictability/consistency. - Follow-up procedures: banks receiving recommendations/corrective orders must follow-up monthly with signed letter; items removed from follow-up once BC satisfied; BC may escalate to monetary penalty/fine if insufficient progress. - Enforcement trend: - 2018: warnings and reprimands most frequently used. - 2019 and 2020: reprimands and corrective orders. - 2021: no fewer than four (4) fines of XOF 151M or approximately $262K each were levied against banks for violations (including AML/CFT-related). Prior to 2021, only one such fine had been levied. - Inspection reports provided only to inspected bank’s board, BCEAO, and relevant national finance ministry/ministries. - Communication gap: information on commonly observed AML/CFT deficiencies and related sanctions not reaching banks’ AML/CFT compliance functions. ### Communication and cooperation — domestic and international - GSBC communication to banks: - GSBC should provide anonymized information to all WAEMU bank AML/CFT compliance functions on AML/CFT deficiencies found and related sanctions levied; GSBC reports it maintains contact information for bank AML/CFT officers. - Cooperation with national FIUs: - By law, cooperation with national FIUs is responsibility of BCEAO; Article 18 provides for BCEAO representative to FIUs. - National FIUs periodically provide quarterly reports to BCEAO containing aggregate STR statistics and other activities; these reports disseminated to BC/GSBC. - FIUs may request information from BCEAO regarding existence of accounts of persons under investigation; FIUs tend to prefer requesting directly from banks for timeliness. - Cooperation between BCEAO and national FIUs must be reinforced; a draft MOU between national FIUs and BCEAO prepared and should be signed after completion of current FSAP exercise. - Legal gaps: Annex to Convention Governing BC indicates BC can only perform cooperation with other supervisory bodies; FIUs are not supervisory bodies — legal changes needed to enable confidential information sharing directly between BC and FIUs. - BC and FIUs may share aggregate/non-sensitive data on STR reporting and compliance levels. - Exchange with extra-regional counterparts: - BC authorized to establish international cooperation; cooperation subject to reciprocity and confidentiality under Article 60 of the Annex. - In practice, information sharing on AML/CFT matters nearly inexistent. - As of January 1, 2002, ten (10) MOUs had been signed between BC and foreign counterparts (note: not all counterparts appear to have AML/CFT supervisory competences). - No cases of exchange of information related to AML/CFT issues; only cooperation observed in routine fit and proper checks and one joint inspection that did not cover AML/CFT agenda. - Key cooperation recommendations: - Remove impediments to effective exchange of information between national FIUs and supervisory authorities; prioritize signature of MOU between national FIUs and BC and BCEAO. - Remedy legal gaps to ensure by law that BC can cooperate with national FIUs, enabling regular exchange including STR quality, inspection results, typologies, and information impacting reputational risk. - BC should cooperate effectively with foreign counterparts that share responsibility for banks, including joint inspections, sharing weaknesses and sanctions, AML/CFT procedures and policies, CDD information, and transaction information. - Establishing MOUs with foreign AML/CFT supervisors could facilitate effective exchange of information. *Source: EXECUTIVE SUMMARY — 1wauea2023003 (WAEMU AML/CFT Technical Note, IMF/World Bank).* ### EXECUTIVE SUMMARY __________________________________________________________________________ 5 ### EXECUTIVE SUMMARY ### Background - This technical note (TN) analyzes AML/CFT supervision of the West African Economic and Monetary Union (WAEMU) banking sector and was prepared by Jay Purcell (IMF Short-Term Expert), Tanjit Sandhu (World Bank), and André Kahn (IMF) under the supervision of Nadine Schwarz (IMF). Virtual consultations took place in November 2021. - The analysis focused on the regional AML/CFT supervisory authorities: the Banking Commission (BC), the General Secretariat of the BC (GSBC), and the Central Bank of West African States (BCEAO). - The assessment considered aspects of FATF Recommendation 26, Recommendation 27, Immediate Outcome 2, Immediate Outcome 3, and Immediate Outcome 4, but did not constitute an AML/CFT mutual evaluation against the full FATF Standards. ### Constraints on the analysis - The analysis was constrained by authorities’ confidentiality concerns and by the COVID-19 pandemic: - Documents considered “confidential” were made available in hard copy at the BCEAO’s offices in Paris, France; pandemic-related restrictions prevented the (U.S.-based) authors from traveling overseas to review them. - Certain “sensitive” documents were reviewed electronically but could not be revealed or reproduced. - As a result, observations and recommendations focus on the BC/GSBC’s supervisory methodology and procedures; instances where key documents could not be reviewed or specific views could not be formed are noted in the TN. ### Major developments already taken by the BC/GSBC - Following the 2015 adoption of a new, Uniform Law (and BCEAO issuance, in 2017, of instructions on the application of the Law, including to banks), the BC/GSBC has taken steps to develop AML/CFT supervision: - Ensured relevant staff received at least basic training on AML/CFT supervision (ongoing). - Introduced a new institutional risk assessment model in 2017. - Administered an AML/CFT-specific questionnaire to banks in 2019 and 2021 and integrated responses into institutional risk assessment and on-site inspection planning. - Procured a software tool in 2019 to automate key aspects of on- and off-site supervision. - Issued an on-site inspection manual and updated on-site inspection checklists in 2020. - Began to take a somewhat more forceful approach to addressing observed AML/CFT deficiencies in 2021. ### Key findings — substantive deficiencies - Critical deficiencies persist across all key areas analyzed: off-site supervision, institutional risk assessment model, on-site inspections, and domestic and international cooperation. - Off-Site Supervision Program: - The off-site program feeds into the risk-rating process but is not itself risk-based: frequency and intensity of activities are almost entirely rule-based and not adapted to the ML/TF risks of individual banks or banks in different member-states. - Feedback to banks is too narrow in scope and distribution (shared mainly with banks’ senior management on an annual basis). - Off-site information is primarily used internally to generate institutional risk-ratings and to plan on-site inspections. - Risk Assessment Model: - AML/CFT-specific inputs are unduly limited: derived from banks’ annual AML/CFT reports, reports on implementation of internal controls, responses to the 2019 and November/December 2021 AML/CFT questionnaires, and past inspections. - Key indicators are not collected or integrated: key statistics maintained by banks, views of national FIUs, and relevant public-domain analysis are not collected or integrated into the institutional risk assessment model. - Within the model, the AML/CFT risk factor is weighted at 5.6 percent; this weighting has not yet been reviewed in light of experience since 2017. - On-Site Inspection Program: - The on-site program is reasonably active but not fully RBA-compliant and contains methodological deficiencies. - All “specific inspections” include an AML/CFT component regardless of identified risk; AML/CFT “thematic inspections” are comprehensive rather than risk-targeted. - Methodology for assessing PEPs, STRs, and TFS is lacking in specific areas. - An enforcement policy for addressing deficiencies/violations observed on inspections has not been developed. - Domestic and International Cooperation: - Cooperation with national FIUs is infrequent and informal; impediments affect direct exchange of confidential information. - Cooperation with extra-regional counterparts is nearly non-existent in practice despite a conducive legal framework and the conclusion of ten bilateral memoranda of understanding (MOUs). ### Conclusions on overall approach - The BC/GSBC has established useful baseline systems and taken significant steps since 2017, but the AML/CFT supervisory program is not yet fully risk-based and is limited by insufficient inputs, weak feedback mechanisms, methodological gaps in on-site inspections, and weak cooperation frameworks. - Addressing deficiencies requires substantial reform over short-, medium-, and longer-terms and the continual reinforcement of BC/GSBC AML/CFT capacity, including establishing an internal pool of AML/CFT expertise and providing more in-depth training. ### Reform recommendations (summary of Table 1) - General timeframes: “Short-term” means within one year; “medium-term” means within two years; “long-term” means within 3-5 years. Reviews of ML/TF risk factor composition/weighting should be conducted at least every 3-5 years, beginning in 2022. - Off-Site Supervision Program (responsible: GSBC/BC) - Vary the intensity of the off-site supervisory program based on the ML/TF risks posed by individual banks. (GSBC; Medium-Term; High) - Continually update the AML/CFT questionnaire (2019 and 2021) and reissue it at least biannually. (GSBC; Medium-Term; Medium) - Follow-up on reports and questionnaire responses more systematically (not only when serious deficiencies are found). (GSBC; Medium-Term; High) - Periodically issue guidelines/best practices for meeting AML/CFT obligations and completing annual reports. (BC/GSBC; Long-Term; Medium) - Strengthen partnership with the banking industry via open and regular dialogue. (BC/GSBC; Short-Term; Medium) - Risk Assessment Model (responsible: BC/GSBC; National FIUs) - Require banks to submit, at least annually, a set of basic statistics to function as additional ML/TF risk indicators. (BC/GSBC; Short-Term; High) - Ask WAEMU member states’ national FIUs to share, in real-time, indicators of changes in institution-level ML/TF risks. (BC/GSBC, National FIUs; Medium-Term; Low) - Conduct periodic reviews of the composition and weighting of the ML/TF risk factor and adjust as necessary; such reviews at least every 3-5 years beginning in 2022. (BC/GSBC; Long-Term; Medium) - On-Site Inspection Program (responsible: BC/GSBC) - Further develop AML/CFT capacity within and outside the on-site inspection function (DCPECEME). (BC/GSBC; Medium-Term; High) - Where practical, include one or more branches selected in line with the RBA in AML/CFT on-site inspections. (GSBC; Short-Term; Medium) - Down-select broader topics for specific inspections and sub-topics for AML/CFT thematic inspections based on relative risks. (GSBC; Short-Term; High) - Sharpen methodology for assessing PEPs, STRs, and TFS. (GSBC; Medium-Term; Medium) - Continue to impose stronger, proportionate sanctions for AML/CFT deficiencies to ensure they are effective and dissuasive. (BC; Short-Term; Medium) - Produce and adopt an enforcement policy to foster predictability and consistency in addressing AML/CFT deficiencies. (BC/GSBC; Long-Term; Low) - Provide anonymized information to all WAEMU bank AML/CFT compliance functions on deficiencies found and sanctions levied. (BC/GSBC; Short-Term; Medium) - Domestic and International Cooperation (responsible: BC, BCEAO, National FIUs; BC/GSBC) - Remove key impediments to effective exchange of information between national FIUs and supervisory authorities, including signature of the MOU between FIUs and the BC. (BC, BCEAO, National FIUs; Short-Term; High) - Cooperate effectively with foreign counterparts that have shared responsibility for banks, including exchange of information. (BC/GSBC; Medium-Term; Medium) ### Scope limitations of this TN - Focus is on AML/CFT supervision in the WAEMU banking sector under regional authorities’ purview (BCEAO, BC, GSBC). - AML/CFT supervisory frameworks of other sectors (e.g., money remitters, mobile money operators, microfinance institutions, real estate) were not analyzed. - This was a targeted exercise and did not involve an exhaustive analysis of WAEMU’s AML/CFT framework against the full FATF Standards. *Source: EXECUTIVE SUMMARY — 1wauea2023003 (WAEMU AML/CFT Technical Note, IMF/World Bank).* ### 3. Where noted, the breadth and/or depth of the authors’ analysis was constrained by the ### 3. Where noted, the breadth and/or depth of the authors’ analysis was constrained by the ### Constraints on the authors’ analysis - Pandemic-related travel restrictions prevented the authors, who are based in the United States, from consulting hard copies of confidential documents made available at the BCEAO’s office in Paris, France (e.g., bank-completed questionnaires, the spreadsheets that constitute the institutional risk assessment model, and final inspection reports). - Certain sensitive information (e.g., a list of the non-AML/CFT-related factors in the institutional risk assessment model along with their respective weights) was made available electronically but was not authorized for revelation or reproduction in this report. - Result: observations and recommendations are focused on the BC/GSBC’s supervisory methodology and procedures; instances where key documents were unavailable or specific views could not be formed are noted throughout the text. ### Status of AML/CFT mutual evaluations in the region - As of the end of 2021, completed mutual evaluation reports (MERs) for WAEMU member-states disclosed important weaknesses in AML/CFT supervision. - All countries except for Cote d’Ivoire (assessment initiated by the IMF in 2021 and underway at time of drafting) received on-site missions led by GIABA. - Three countries were under increased monitoring by the FATF (FATF “Grey List”): Burkina Faso, Mali, and Senegal. - All MERs adopted show a “low effectiveness” rating in AML/CFT supervisory regimes under Immediate Outcome 3 of the FATF assessment methodology. - Deficiencies affect supervision of all FIs and DNFBPs; deficiencies in banking supervision have a relatively important impact given sectoral risks. - The BC actively participates in GIABA Working Group and Plenary Meetings. The WAEMU holds observer status at GIABA. - Table 2 (as presented): WAEMU: Member-States’ MER Status as of December 2021 - Benin — On-Site Visit: February 2019; Report Adoption: May 2021 - Burkina Faso — On-Site Visit: July 2018; Report Adoption: May 2019; Under Increased Monitoring by the FATF: Yes - Côte d’Ivoire — On-Site Visit: March 2022; Report Adoption: November 2022 - Guinea-Bissau — On-Site Visit: January 2021; Report Adoption: February 2022 - Mali — On-Site Visit: March 2019; Report Adoption: November 2019; Under Increased Monitoring by the FATF: Yes - Niger — On-Site Visit: January 2020; Report Adoption: August 2021 - Senegal — On-Site Visit: September 2017; Report Adoption: November 2018; Under Increased Monitoring by the FATF: Yes - Togo — On-Site Visit: January 2021; Report Adoption: February 2022 - Consequences of FATF enhanced monitoring: - Increased reputational risk for listed countries and the region. - Correspondent relationships may become more difficult/expensive; transactions may be subject to enhanced customer due diligence by banks in other countries. - Banks in listed countries may need to enhance compliance to maintain access to the global payment system and global banking networks. - Domestic and international trade payments requirements may become more difficult to fulfil, potentially raising costs and presenting other challenges for companies in listed countries. - Potential decreased appetite of global companies, investors, and individuals to conduct business in the listed country’s financial market. ### Key, recent reforms to the regional AML/CFT framework - Adoption of a new Uniform Law: - Decision n°26 02/07/2015/CM/UMOA of July 2, 2015; transposed into national legal frameworks of all Member States. - Aimed to integrate the FATF Recommendations adopted in 2012. - Four implementing regulations issued by the BCEAO (all dated September 25, 2017): - Instruction 007-09-2017 — on the terms of application by financial institutions of the Uniform Law on AML/CFT. - Instruction 008-09-2017 — setting the threshold for the declaration of physical cross-border transport of cash and negotiable bearer instruments. - Instruction 009-09-2017 — setting the threshold for the payment of a receivable in cash or by negotiable bearer instruments. - Instruction 010-09-2017 — setting the threshold for the declaration of cash transactions to the national FIUs. - Remaining legal and supervisory gaps: - The Law is not fully in line with the FATF Standards, limiting the BC’s ability to monitor and enforce FATF-prescribed preventive measures. - Current-round MERs completed and published as of January 1, 2022 indicate the Uniform Law contains deficiencies with respect to FATF-prescribed preventive measures (e.g., Recommendation 10 on customer due diligence). - Example: Uniform Law lacks a requirement for FIs to identify and take reasonable measures to verify beneficial owners of legal person customers (noted in the 2018 MER of Senegal); domestic steps taken in some countries do not change the Uniform Law responsibilities of the BC/GSBC. - No legal requirement for the BC/GSBC to review the ML/TF risk profile of an FI or financial group when there are major events or developments in management/operations (per Recommendation 26). - Effectiveness weaknesses observed in MERs (as of January 1, 2022): - Frequency and intensity of off- and on-site supervision of banks were not fully risk-based. - Analysis of preventive measures during on-site visits lacked sufficient depth. - Sanctions implemented by the BC were not strong enough to achieve remedial action in many cases. - Cooperation between regional supervisory authorities and national FIUs was too low to enable development and sharing of AML/CFT good practices. - Larger banks in international groups had relatively strong understanding of ML/TF risks; smaller banks showed significant shortcomings in internal controls, often linked to inadequate human resources. - In many cases, existing business relationships were continued despite incomplete or outdated customer profiles. - The level of STR reporting was generally low, especially regarding TF. ### Institutional framework and banking sector landscape - Mandate and responsibilities of the Banking Commission (BC): - BC has primary responsibility for AML/CFT supervision of credit institutions (a sub-category of FIs that includes banks). - Article 1 of the Convention of 2007: BC created as an independent entity “responsible for overseeing the organization and supervision of credit institutions,” including AML/CFT matters. - Article 21 of the Annex to the Convention (revised in 2017): BC “shall perform or arrange for the performance, in particular by the Central Bank, of off-site and on-site controls of regulated institutions, on a corporate or consolidated basis…” - BC has broad autonomy to define frequency and scope of controls, taking into account size, corporate structure, risk profile, nature and complexity of operations, and systemic importance. - BC can implement administrative measures and sanctions—including financial penalties—for infringements. - BCEAO role: - Article 23 of the Annex: BCEAO may conduct supervision of banks directly, including on-site visits, but must inform the BC and report findings. - In practice, BCEAO does not have a separate supervision team and has never exercised this prerogative. - Legal framework: - Uniform Law of 2 July 2015 and four implementing instructions issued by BCEAO in 2017. - Article 12 of Instruction 007-09-2017 (25 September 2017): BC and BCEAO receive a mandatory annual report on implementation of banks’ internal AML/CFT measures; this report is the main basis for BC’s AML/CFT off-site inspection program and is complemented by ad hoc questionnaires (last completed in 2021). - Article 11 of Instruction 007-09-2017 provides for banks’ production of documents/information necessary for evaluating internal AML/CFT preventive measures in on-site inspections. - GSBC organizational structure and staffing: - GSBC (organ within BC responsible for banking supervision) is headed by a Secretary General assisted by two Deputy Secretaries General appointed by the BCEAO Governor. - BCEAO provides operational resources. GSBC composed of seven directorates; Directorate of Permanent Supervision (DSP) and Directorate of On-Site Inspection of Credit Institutions and Electronic Money Institutions (DCPECEME) are directly responsible for off-site and on-site AML/CFT supervision, respectively. - Other directorates involved: Directorate of Crisis Resolution and Legal Affairs (DRCAJ), Directorate of International Relations and Studies (DERI), Directorate of On-Site Inspection of Decentralized Financial Systems (DCPSFD). - As of the end of 2021: - DSP and DCPECEME staff comprised forty-five (45) staff members, representing about 33 percent of the GSBC’s total of 138 staff members. - Overall, 14 percent of the GSBC’s staff worked on the on-site supervision of credit and electronic money institutions, including, when necessary and appropriate, for compliance with AML/CFT-related obligations. - More specifically, the DSP and DCPECEME comprised 25 and 20 staff members, respectively, including their directors. - AML/CFT training: - Fewer than half of the total GSBC staff have received specialized AML/CFT training. - GSBC reports many staff reinforced AML/CFT knowledge through on-site inspections. - AML/CFT sometimes covered in stand-alone thematic inspections and sometimes within broader higher-risk inspections. ### Banking sector landscape — key statistics (as of November 2021 and related dates) - Banks under BC supervision: - Total banks operating in WAEMU region as of November 2021: 152 banks. - 111 foreign banks. - 41 domestic banks. - As of November 2021, the 152 banks had: - more than 14 million retail customers (exact entry: "more than 14 million retail customers"), - about 220,000 of whom are foreign, - and 1 million legal person customers, about 12,000 of which are foreign. - The GSBC does not maintain statistics on the number of customers identified as PEPs by supervised banks. - Table 3 (WAEMU: Banks Under BC Supervision, by Country) — key entries preserved as presented: - Benin — Number of Banks under GSBC’s AML/CFT Supervision: 13 foreign, 2 domestic; Number of Individual Account Holders: 43 190 foreign, 2 126 473 domestic; Number of Legal Person Account Holders: 1 677 foreign, 101 754 domestic - Burkina Faso — 12 foreign, 7 domestic; Individual Account Holders: 33 388 foreign, 2 062 487 domestic; Legal Person Account Holders: 1 597 foreign, 159 137 domestic - Côte d’Ivoire — 23 foreign, 7 domestic; Individual Account Holders: 38 524 foreign, 4 376 287 domestic; Legal Person Account Holders: 429 184 foreign, 595 domestic - Guinea-Bissau — 4 foreign, 1 domestic; Individual Account Holders: 3 182 foreign, 164 698 domestic; Legal Person Account Holders: 96 foreign, 10 100 domestic - Mali — 13 foreign, 4 domestic; Individual Account Holders: 9 963 foreign, 1 681 797 domestic; Legal Person Account Holders: 4 490 foreign, 246 008 domestic - Niger — 11 foreign, 7 domestic; Individual Account Holders: 5686 foreign, 726246 domestic; Legal Person Account Holders: 735 foreign, 85 438 domestic - Senegal — 22 foreign, 9 domestic; Individual Account Holders: 60 015 foreign, 1 871 095 domestic; Legal Person Account Holders: 1 943 foreign, 234 576 domestic - Togo — 13 foreign, 4 domestic; Individual Account Holders: 32 754 foreign, 1 074 676 domestic; Legal Person Account Holders: 1360 foreign, 69 797 domestic - Total — 111 foreign, 41 domestic; Individual Account Holders: 226 702 foreign, 14 083 759 domestic; Legal Person Account Holders: 12 327 foreign, 1 091 405 domestic ### Off-site supervision program - Staffing and training: - GSBC has a total of 25 staff dedicated to off-site supervision; none specializes in AML/CFT matters, but all have received relevant training. - Staff under DSP are mainly in charge of off-site supervision, including AML/CFT and prudential. - All DSP staff, including Heads of Units, have received at least basic AML/CFT training. - Since 2017, at least one AML/CFT training session has been organized each year for officers in charge of supervision. - Tools and practices: - GSBC acquired software tool SCAN-R in 2019 to perform analysis of on-site and off-site supervision, including AML/CFT; SCAN-R comprises several modules, including one dedicated to AML/CFT, with a qualitative AML/CFT questionnaire and a quantitative section dealing with suspicious transactions. - Since April 2020, SCAN-R has been used to conduct virtual on-site inspections as a consequence of COVID-19-related travel restrictions. - Functions of the off-site supervisory regime: - Generating risk-ratings of banks to set the annual on-site inspection program and inform conduct of on-site inspections. - Identifying and following up on deficiencies presented in AML/CFT annual reports submitted by banks or those found during on-site inspections. ### Understanding of ML/TF risks - National assessments and NRAs: - All WAEMU member states have conducted national assessments of ML/TF risks and drafted National Action Plans. - Some countries are considering updating NRAs to include sectoral assessments omitted originally (e.g., TF risks posed by non-profit organizations, ML/TF risks of legal persons, arrangements and risks of virtual assets and virtual asset service providers). - BCEAO played an active role in all NRAs, leading banking sector assessments in each member state; GSBC was not actively involved in the NRA process. - Main predicate offenses and TF threat: - Main predicate offenses generating proceeds of crime: drug trafficking, corruption, and human trafficking. - TF risk in the region is considered elevated (noted in NRAs and MERs). - Country-specific TF contexts: - High threat of domestic terrorism and financing of terrorism: Burkina Faso and Mali. - Geographical/contextual TF risk: Côte d’Ivoire, Niger, and Senegal. - Use of NRA findings by supervisors: - BCEAO and GSBC have a fair knowledge of ML risks in the region; better use of NRA findings could strengthen supervision. - NRA information did not appear to add impactful value to regional supervisory authorities’ understanding of risk, potentially because GSBC did not directly participate in assessments. - No guidance has been provided by supervisors to banks on tailoring CDD and internal policies/procedures in line with NRA results. - TF-specific supervision gaps: - GSBC demonstrated fair knowledge of TF risks and some on-site initiatives (e.g., monitoring implementation of targeted financial sanctions). - Little follow-up action on TF in off-site supervision: no specific requirements in annual reports or questionnaires regarding TF monitoring. - Recommendation noted: in line with the risk-based approach (RBA), special attention should be paid to banks in countries with higher TF risk. *Source: Excerpt from the IMF WAEMU technical note (content unit provided).* ### 22. Off-site AML/CFT supervision is informed by three types of inputs: (i) annual reports; ### 22. Off-site AML/CFT supervision is informed by three types of inputs: (i) annual reports; ### Annual Reports — design and practice - Banks are required by Articles 12 and 13 of Instruction n° 007-09-2017 of September 25, 2017, to submit an annual report on the implementation of their internal AML/CFT system to the BCEAO and the BC within two months after the end of every calendar year. - The analysis of these reports is conducted by the GSBC, although the reports are formally transmitted to the BCEAO and the BC. - Article 12 requires annual reports to contain: description of the organization and resources in terms of AML/CFT; training and awareness-raising carried out; mapping of the most common suspicious transactions; statistics relating to the implementation of the STR system; controls over customer identification, record keeping, and suspicious transaction reporting. - The format, content, and level of detail of annual reports are highly inconsistent across banks because GSBC has not yet issued preparation guidelines; GSBC is taking steps to issue guidelines in upcoming months. - Article 12 does not require banks to provide information on risks; annual reports therefore neither require nor include risk information, and banks are not required to submit their most recent ML/TF institutional risk assessment. - Annual reports are analyzed by the DSP. The DSP checks: compliance with the transmission deadline; content compliance with Article 12; AML/CFT training and awareness actions; AML/CFT controls performed; number of suspicious transaction reports made; major shortcomings; outlook and action plan; overall assessment and GSBC recommendations. Feedback is provided only if notable important deficiencies are found. ### Supplementary Questionnaire (2019 and 2021) - GSBC distributed a questionnaire in 2019 and repeated in late 2021 to understand banks’ basic AML/CFT controls and procedures; it was elaborated in the context of a multilateral technical assistance program. - Main aspects covered: (i) designation of a compliance officer; (ii) client identification when opening an account; (iii) identification of occasional clients; (iv) measures when the client is a PEP; (v) communication of internal policies; (vi) instructing training staff; (vii) information systems (IT and databases); (viii) ongoing monitoring and mechanisms to detect suspicious transactions; (ix) external oversight of the AML/CFT system. - The questionnaire largely omits risk-related inputs: only one question asks whether banks have procedures for conducting institutional risk assessments, but neither the assessments nor their outcomes are collected. - Analysis of questionnaires is limited to qualitative internal control information; there is no analysis of inherent and business risks. ### Internal Audits - Banks must submit internal control reports to the BC biannually: by February 28 (covering July 1–December 31 of the previous year) and by August 31 (covering January 1–June 30 of the current year). - Statutory auditors submit reports to the BC once a year, by the end of June. - Internal control reports include AML/CFT-relevant information and can be used for GSBC ongoing monitoring. - GSBC relies on internal audit functions and statutory auditors; statutory auditors review internal control reports, share findings/recommendations with the BC, and follow up with DSP on corrective actions. Authorities generally agree with statutory auditor recommendations on AML/CFT matters. ### Outcomes from current off-site inputs - The information collected provides an important baseline but does not differentiate banks based on existing ML/TF risks; all banks provide the same information regardless of risk profile. - No systematic additional information is requested from banks presenting elevated or unusual ML/TF risks, despite country-specific ML/TF risks identified in National Risk Assessments. - The lack of risk-specific data collection can cascade and weaken the supervisory system’s effectiveness. ### Results and Feedback Provided - The DSP provides feedback to banks only when serious deficiencies are found. - Over the past 3 years GSBC has issued more than 57 notification letters to banks presenting significant ML/TF deficiencies: twelve (12) in 2019, twenty-five (25) in 2020 and twenty (20) in 2021. - Banking compliance officers report that follow-up on annual reports is mainly provided by the statutory auditor, who also receives a copy of the annual reports. - At the BC level, an annual conference with CEOs covers topics including AML/CFT; compliance officers report that feedback from these conferences is not always passed on to them. - No GSBC-issued guidelines or best practice papers currently exist to clarify AML/CFT obligations or evolving risks; banks would benefit from periodic guidance and best practice papers. ### Recommendations: Off-Site Supervision (summary) - GSBC should proactively participate in future ML/TF national and sectoral risk assessments and request copies of banks’ own ML/TF risk assessments on an annual basis; use national, sectoral, and institutional risk assessments to design a risk-based off-site supervisory program. - Vary the intensity of the off-site supervisory program based on institutional ML/TF risks; request supplementary information from higher-risk banks or issue a more detailed questionnaire the following year. - Collect additional information on TF risks and corresponding mitigating measures, especially in countries with higher TF risks. - Continually update the AML/CFT Questionnaire (2019 and 2021) and reissue it at least biannually; request information on banks’ risk appetites, results of their ML/TF risk assessments (in line with Article 11 of the Uniform Law), high-risk clients, and application of enhanced and simplified CDD measures. - DSP should follow-up systematically on reports and questionnaire responses in all cases upon completion of the review to promote better understanding of risks, communicate supervisory expectations and best practices, and improve quality of reporting. - GSBC should periodically issue guidelines and/or best practices for fulfilling AML/CFT obligations and completing AML/CFT annual reports to ensure consistency and comparability across banks. - Strengthen engagement with the banking industry via open, regular dialogue; communicate feedback provided to CEOs and industry associations directly to banks’ AML/CFT compliance functions; circulate names and contact information for GSBC staff available to clarify legal requirements and regulatory expectations. ### Risk Assessment Model — structure and inputs - GSBC’s risk model generates global and ML/TF-specific risk ratings for every bank at least annually; the current model comprises 70 datapoints and was introduced in 2017. - GSBC generates a global risk rating at a minimum once, but generally twice, per calendar year for every supervised bank. ML/TF risk is both a component of the global rating and a stand-alone sub-rating. ### On-site inspection types and linkage to risk ratings - GSBC conducts three types of on-site inspections: general/"global," "specific," and "thematic." - Global inspections cover totality of a bank’s operations and are increasingly rare. - Specific inspections cover multiple elevated-risk areas as determined by the DSP and have often included AML/CFT components. - Thematic inspections focus on a single area of concern (e.g., AML/CFT); GSBC uses “thematic inspections” for single-entity inspections focused on one broader topic/set of obligations. - Inspection selection scenarios: - If a bank is high- or very high-risk globally, GSBC would likely conduct a specific inspection, which would include AML/CFT whether or not ML/TF is separately identified as high-risk. - If a bank is low- or moderate-risk globally but ML/TF is identified as high-risk, GSBC would likely conduct an AML/CFT thematic inspection. ### Inputs feeding the ML/TF-specific risk ratings - Primary reliance is on AML/CFT annual reports (per Article 12) which must cover implementation of internal controls, organizational structure, training, compliance procedures, STR statistics, and a “map” of recent suspicious transactions. - Complementary inputs: statistics from the SCAN-R application. - Secondary sources: banks’ internal control reports submitted biannually and statutory auditor reports submitted annually. - Tertiary inputs: responses to AML/CFT questionnaires (2019 and 2021), results of past inspections, and validated public information. - GSBC may follow up on public information and, upon confirmation/validation, include it in the risk rating process. ### Gaps and limitations in the GSBC’s risk-information sources - GSBC does not request or integrate certain basic statistics reflecting institutional risk profiles (customer base, geographic reach, product/service range) nor systematically request copies of banks’ institutional risk assessments. - GSBC does not actively gather publicly available country- or sector-specific ML/TF statistics (e.g., individual financial crime convictions or aggregate financial crime statistics). - GSBC does not solicit information or analysis from WAEMU member-states’ FIUs that could indicate changes in country-level ML/TF risks or shifts in institutional risk tolerances. - Insufficient collection of TF risk indicators is noteworthy given that several WAEMU member-state national risk assessments point to elevated terrorism and related TF risks in the region. *Source: IMF staff report section on off-site AML/CFT supervision and GSBC risk assessment model.* ### 49. Although all banks’ risk ratings are typically updated based on the internal control ### 1wauea2023003 - 49 ### Risk rating updates - All banks’ risk ratings are typically updated based on internal control reports received three times a year; some may be updated more frequently. - Any bank’s risk rating can be adjusted at any point in the calendar year based on off-site supervision results or other pertinent information (for example, from an on-site inspection). - These periodic updates reflect the GSBC’s current practice rather than any specific legal requirement. ### Weighting of risk factors - ML/TF risk is one (1) of the nine (9) factors used to generate a bank’s overall/“global” risk rating. - The ML/TF risk factor primarily reflects: - the risk of non-compliance with applicable regulatory requirements, and - any lack of effective AML/CFT tools. - ML/TF is one of the four (4) factors with the lowest possible weighting, although the GSBC indicates certain ML/TF risks are captured by other, more heavily weighted factors. - The full list of risk factors and their respective weightings was provided to the authors but is considered sensitive and not presented here. - Given elevated ML/TF risk in the WAEMU region (see paragraphs 1, 19, and 48 referenced in the source), the weighting of the ML/TF risk factor may need to be revisited over the near-term. - The GSBC intends to undertake periodic reviews of the risk model, but none has yet been conducted; future reviews should: - consider results of on-site inspections and other relevant information, - assess whether the nine (9) factor weights remain appropriate given new developments/changing conditions in the regional banking sector. ### Results: ML/TF risk-ratings 2018–2021 - In each requested year, the largest number of banks were assessed as presenting “medium” risk. - Percentages by risk category (2018, 2019, 2020, 2021): - Medium risk: 51 percent in 2018, 48 percent in 2019, 49 percent in 2020, and 60 percent in 2021. - Movement to the middle: decline in “acceptable” and “very high” categories with increases in “medium” or “high.” - Table 4. WAEMU: ML/TF Risk-Ratings of Region Banks from 2018–2021 (raw counts) - 2018: Acceptable Risk 18; Medium Risk 56; High Risk 27; Very High Risk 9; Total 110 - 2019: Acceptable Risk 21; Medium Risk 55; High Risk 30; Very High Risk 9; Total 115 - 2020: Acceptable Risk 16; Medium Risk 60; High Risk 35; Very High Risk 12; Total 123 - 2021: Acceptable Risk 6; Medium Risk 74; High Risk 37; Very High Risk 7; Total 124 - Definitions reproduced exactly: - “Acceptable Risk” means that the bank has a solid ML/TF risk mitigation system. - “Medium Risk” means that the bank has a generally satisfactory ML/TF risk mitigation system, which nevertheless presents minor weaknesses. - “High Risk” means that the bank has an ML/TF risk mitigation system that presents numerous weaknesses. - “Very High Risk” denotes a critical situation in which the bank’s ML/TF risk mitigation system is failing, thereby creating significant ML/TF risks which warrant specific responses by the supervisory authorities. - Geographic concentration of “very high” risk banks: - 2018 and 2019: six of the nine banks assessed each year as “very high” were operating in just two of the WAEMU member-states. - 2020: eight of the twelve “very high” risk banks were operating in three member-states. - 2021: five of the seven “very high” risk banks were operating in just two member-states. - One member-state consistently ranks among the top two in number of “very high” risk banks hosted. ### Recommendations: Risk Rating - Require banks to submit, on at least an annual basis, a set of basic statistics as additional ML/TF risk indicators, including: - numbers of customers who are: (i) foreign and high-risk domestic PEPs; and (ii) resident in specific, potentially higher-risk regions or countries. - Guidance on submission: - These supplementary statistics should complement existing GSBC data-collection efforts and avoid duplication to limit burden on WAEMU banks. - GSBC should systematically request copies of banks’ institutional risk assessments and compare them to BC risk model outputs. - Request national FIUs to share, in real-time, any indicators of change in institution-level ML/TF risks, including: - operational and strategic analysis of STRs that may indicate shifting bank risk profiles, - proactive, timely communication of such indicators, - flagging of suspicious transaction reporting outliers (banks submitting substantially more or fewer STRs than expected given their risk profiles). - Note: GSBC does not currently maintain direct bilateral contacts with national FIUs; regulatory changes will be required to enable confidential information sharing (see paragraph 97 referenced in the source). - Conduct periodic reviews of the composition and weighting of the ML/TF risk factor: - Start with a five-year review of the ML/TF risk factor (the current model introduced in 2017). - Consider responses to AML/CFT questionnaires administered in 2019 and 2021, results of on-site inspections completed since model introduction, and new developments/changing conditions in the WAEMU region. - Expand the ML/TF factor composition to: - ensure all relevant information already collected by the GSBC (such as information in Table 3) is incorporated, - account for additional statistics collected per the recommendation above. ### On-site inspection program: resources and activity - Staffing and specialization: - The GSBC has a total of 20 staff dedicated to on-site inspections of credit and electronic money institutions. - None specializes exclusively in AML/CFT, although all have received at least basic AML/CFT training. - One (1) inspector was hired in 2021 as GSBC works to increase human resources. - There is no AML/CFT-focused unit, team, or permanent working group. - Inspectors have participated in trainings by FATF, GIABA, other technical assistance providers, and private sector partners. - Inspection activity 2018–2021: - From 2018-2021, GSBC carried out a total of 80 specific inspections of banks and 26 AML/CFT thematic inspections of banks. - Table 5. WAEMU: GSBC On-Site Inspections of Banks from January 2018–December 2021 (raw counts) - 2018: Total Number of On-Site Inspections 68; Number of Specific On-Site Inspections 3; Number of AML/CFT Thematic On-Site Inspections 14 - 2019: Total Number of On-Site Inspections 40; Number of Specific On-Site Inspections 18; Number of AML/CFT Thematic On-Site Inspections 2 - 2020: Total Number of On-Site Inspections 23; Number of Specific On-Site Inspections 21; Number of AML/CFT Thematic On-Site Inspections 0 - 2021: Total Number of On-Site Inspections 48; Number of Specific On-Site Inspections 38; Number of AML/CFT Thematic On-Site Inspections 10 - Per the GSBC, all specific inspections have an AML/CFT component. - Remote inspections and pandemic adjustments: - Unable to conduct on-site inspections from March-October 2020 due to the pandemic, GSBC developed and deployed a remote inspection methodology. - Using the SCAN-R system, eight (8) remote inspections were carried out in 2020 and three (3) remote inspections were carried out in 2021. - Remote inspections are functional but limited because supervisors cannot directly access banks’ IT systems for testing/review. - Bank selection criteria for inspections: - Three (3) criteria generate the annual on-site inspection plan: - (i) risk, - (ii) systemic importance at the national level, and - (iii) length of the supervisory cycle. - Risk: - Banks rated high- or very high-risk are prioritized for specific inspections, which systematically include an AML/CFT component, regardless of the ML/TF sub-rating. - Global inspections for newly established banks are increasingly rare. - Banks with global and ML/TF-specific low or moderate risk are rarely selected for inspection, though GSBC selects a modest number of low-to-moderate risk banks. - Systemic importance: - GSBC considers national-level systemic importance to foster geographic diversity and to ensure at least one bank in every WAEMU member-state is inspected each year. - Length of supervisory cycle: - GSBC considers dates of banks’ most recent previous on-site inspections; from 2019-2021, GSBC inspected an average of ten (10) low-to-moderate risk banks each year that would not otherwise have been prioritized. - GSBC estimates it would theoretically take approximately 3 years to conduct at least one on-site inspection of every bank in the WAEMU region, but higher-risk banks may be inspected multiple times while lower-risk banks may not be inspected in that timeframe. - Methodology and tools: - On-site inspections are almost always announced; a pre-inspection questionnaire is sent one or two weeks in advance. - GSBC is permitted to conduct unannounced inspections but they are extremely rare and never used in the AML/CFT context. - GSBC’s on-site inspections do not systematically include bank branches; branches are visited when credible information suggests non-compliance. - GSBC uses the SCAN-R IT system (operational since end-2019) to manage on-site inspections and follow-up; SCAN-R has been used since April 2020 to perform virtual AML/CFT inspections. - The AML/CFT on-site inspection methodology is laid out in an inspection manual and reflected in eight (8) thematic checklists. - Thematic checklists cover: (i) governance; (ii) procedures; (iii) CDD; (iv) risk mapping; (v) operations; (vi) IT systems; (vii) training; and (viii) asset freezing. - Pre-inspection questionnaire, inspection manual, and thematic checklists were developed over the past two years with support of a technical assistance provider; they list inspection items, specify whether items relate to national or uniform law, regulatory requirement, or good practice, and often note how necessary information may be obtained (e.g., sampling customer files). *Source: Excerpt from the WAEMU IMF report chapter/section provided in the content unit.* ### 71. According to statistics provided by the GSBC, specific inspections typically involve ### 1wauea2023003 - 71. According to statistics provided by the GSBC, specific inspections typically involve ### Inspection modalities, staffing, and duration - Specific inspections typically involve three to four inspectors and last two to three weeks. - The number of inspectors and total length of the inspection depend primarily on the size of the inspected bank and the number of components (i.e., risk areas) to be covered. - AML/CFT thematic inspections typically involve three inspectors and last one to one-and-a-half weeks; they cover the full range of banks’ AML/CFT-related obligations. - GSBC AML/CFT thematic inspections cover, at a minimum: - (i) the conduct of CDD for both natural and legal persons (and both regular and occasional customers); - (ii) the monitoring of the accounts and transactions of customers categorized by the bank as higher-risk; - (iii) the identification and reporting of suspicious transactions; - (iv) the application of TFS; and - (v) the implementation of record-keeping requirements. ### Application of the risk-based approach (RBA) and cooperation - The RBA is not fully applied to the content of either specific inspections or AML/CFT thematic inspections: specific inspections include an AML/CFT component regardless of the ML/TF sub-rating and thematic inspections cover the full range of sub-topics regardless of relative risks. - GSBC on-site inspections benefit from cooperation with banks’ AML/CFT compliance functions and communication with senior managers: - GSBC meets with senior bank managers/management committees at both the beginning and end of every on-site inspection; the Chairman of the Board is invited to the debriefing as necessary. - Main objectives in meeting senior management include: (i) noting major changes since the last inspection (including IT infrastructure); (ii) following-up on implementation of prior supervisory recommendations; (iii) determining management involvement in AML/CFT; (iv) understanding bank group organization; and (v) emphasizing need to correct deficiencies. ### Methodology strengths and suggested refinements - The GSBC has a roster of trained inspectors and a comprehensive AML/CFT on-site inspection methodology but should refine it via modest improvements including: - Distinguishing between lower- and higher-risk domestic PEPs, in line with the FATF Standard, because currently all domestic PEPs (and foreign PEPs) are considered high-risk by default. - Consulting with the relevant national FIU to obtain its view of the quality of a bank’s STRs and associated cooperation; the GSBC currently analyzes bank-provided copies of STRs and correspondence but should also obtain FIU views and identify suspicious transaction reporting outliers. - Taking a random sample of transactions to determine whether any should have been, but were not, identified and reported as suspicious, complementing current analyses of large and/or potentially higher-risk transactions and submitted or prepared-but-not-submitted STRs. - Ensuring that names of persons and entities subject to TFS related to the proliferation of weapons of mass destruction (WMDs) are integrated into banks’ screening systems; GSBC inspectors currently focus mainly on terrorism-related TFS. - Requiring tests of banks’ automated or manual screening systems that involve fictitious occasional transactions conducted by (or on behalf of) persons or entities subject to TFS; demonstrations or tests are currently neither required nor specifically intended to confirm timely and comprehensive implementation of terrorism- and WMD proliferation-related TFS. ### Results: observed deficiencies (2018-2021) - The most frequently observed deficiencies in inspected banks were: - (i) failure to complete and to update customer profiles, including as regards the level and source(s) of income (leading to lack of economic justification for legitimate transactions, failure to require managerial approval of certain higher-risk transactions, or non-application of enhanced due diligence); - (ii) poor or inconsistent handling of the alerts generated by monitoring software; - (iii) failure to conduct (at least) annual independent audits of AML/CFT systems and procedures. ### Sanctions, corrective measures, and follow-up procedures - The BC has a sufficient range of measures available, set out in Articles 29-31 of the Annex to the Convention Governing the WAMU Banking Commission, including warnings, reprimands, corrective orders, heightened surveillance, fines, mandatory publication by the bank of the violation committed, suspension or prohibition of transactions, and license withdrawal. - Fines are levied according to a formula established in regulation, but there is no sanctions or enforcement policy to promote predictable and consistent use of measures. - BC follow-up procedures: - BC issues recommendations, warnings, reprimands, and formal corrective orders; corrective orders are most likely to be time-bound. - A bank receiving recommendations or corrective orders must follow-up monthly with a signed letter detailing actions taken; items are removed from follow-up once BC is satisfied. - BC may escalate, including possible monetary penalty/fine, if efforts are insufficient or stalled. - Recent trend in enforcement: - In 2018, warnings and reprimands were the most frequently employed measures. - In 2019 and 2020, warnings gave way to a combination of reprimands and corrective orders. - In 2021, no fewer than four (4) fines (of XOF 151M or approximately $262K each) were levied against banks for violations of banking regulations, including AML/CFT-related obligations. - Prior to 2021, only one such fine had been levied. - By law, inspection reports are provided only to the inspected bank’s board of directors, the BCEAO, and the relevant national finance ministry/ministries. - The BC relays commonly observed deficiencies to the banking sector at an annual conference (now in its seventh year) that is not dedicated specifically to AML/CFT but addresses broader regional banking trends and commonly observed deficiencies. - Communication gap: information on commonly observed AML/CFT deficiencies and related sanctions does not appear to be reaching banks’ AML/CFT compliance functions, hampering corrective action design and implementation. ### Recommendations: on-site inspections and enforcement - GSBC should further develop its AML/CFT capacity within and outside the on-site inspection function (DCPECEME) by establishing a unit or team of dedicated AML/CFT inspectors and/or a permanent AML/CFT “working group” to: - lead AML/CFT thematic inspections; - prepare less experienced colleagues to execute AML/CFT components of inspections; - facilitate AML/CFT cooperation with extra-regional counterparts; and - support the BCEAO in drafting relevant community legislation. - AML/CFT on-site inspections should include one or more branches selected in line with the RBA, to test implementation of group-level policies outside headquarters and in more remote areas; implementation can be phased out if not revealing additional risks. - Inspection scope should be tailored based on relative risks: - Specific inspections should include an AML/CFT component only to the extent justified by ML/TF sub-ratings of subject banks. - Thematic inspections should address the full range of sub-topics only when the DSP considers them to pose elevated risks; otherwise thematic inspections should be limited in scope. - GSBC should sharpen methodology for assessing PEPs, STRs, and TFS implementation by: - (i) distinguishing lower- and higher-risk domestic PEPs, in line with the FATF Standard; - (ii) consulting with the relevant national FIU on STR quality and cooperation; - (iii) using random sampling to detect missed suspicious transactions; - (iv) ensuring WMD proliferation-related TFS names are integrated into screening systems; and - (v) requiring ostensible-transaction tests of screening systems involving persons or entities subject to TFS. - BC should continue to impose stronger sanctions for AML/CFT-related deficiencies to ensure they are effective, dissuasive, and proportionate, particularly for repeated or persistent violations. - BC should adopt an enforcement policy to foster predictability and consistency; at minimum, the policy should: - specify the range of measures for common categories of AML/CFT deficiencies (considering regulated entity resources and management engagement); - anticipate escalatory steps in response to repeated or persistent violations. *Source: 1wauea2023003 - 71. According to statistics provided by the GSBC, specific inspections typically involve (PDF chapter/section).* ### 89. The GSBC should provide to all WAEMU bank AML/CFT compliance functions ### 89. The GSBC should provide to all WAEMU bank AML/CFT compliance functions ### GSBC communication with WAEMU bank AML/CFT compliance functions - The GSBC should provide to all WAEMU bank AML/CFT compliance functions anonymized information on AML/CFT deficiencies found and related sanctions levied. - The GSBC reports that it already maintains contact information for the AML/CFT compliance functions/officers of WAEMU banks. - Communicating with them directly and in real-time regarding all AML/CFT deficiencies found and related sanctions levied throughout the regional banking sector would help individual institutions to learn from others’ mistakes rather than inadvertently reproducing them. ### Cooperation with National Financial Intelligence Units (FIUs) - According to the Law, cooperation with the national FIUs is the responsibility of the BCEAO. - As per the Article 18 of the Uniform law, FIUs are composed, amongst other members, by a representative of the BCEAO, who facilitates exchange of information (usually from national FIUs to the BCEAO). - This representative is designated for a limited period of time to the respective FIUs with the aim to be the person of contact between the FIU and the BCEAO. - National FIUs can also cooperate with the BC/GSBC in practice, although there are some legal gaps. - National FIUs periodically provide quarterly reports to the BCEAO. These reports contain aggregate statistical data on STRs, and information related to other activities, such as trainings. - These reports are further disseminated to the BC/GSBC to exercise its supervisory functions. - When necessary, BCEAO and FIUs can exchange other type of non-confidential information, such as: typologies, new trends, and ML/TF risks identified. - When information is disseminated, the BCEAO further disseminates the information to the BC/GSBC. - FIUs can also request information from the BCEAO regarding existence of accounts of persons under investigation; however, FIUs in general prefer to send such request directly to the banks to ensure accurate and updated information can be provided on a timely basis. - Cooperation between the BCEAO and national FIUs must be reinforced; authorities acknowledge that the level of cooperation needs to be strengthened and measures are being taken to enable the exchange of a broader range of information. - A draft Memorandum of Understanding between national FIUs and the BCEAO has been prepared and according to the BCEAO should be signed after the completion of the current Financial Sector Assessment Program (FSAP) exercise. - Legal gaps that could hinder effective cooperation between national FIUs and the BC need to be addressed. According to the Annex to the Convention Governing the Banking Commission, the BC can only perform cooperation with other supervisory bodies. Although the FIUs are not supervisory bodies, the authorities explained that certain cooperation that does not involve the sharing of confidential data is possible. - The BC and the FIUs may share aggregate data on STR reporting, level of compliance, and any other non-sensitive information. ### Exchange of information with extra-regional counterparts - The BC has the authority to establish international cooperation with foreign counterparts. - International cooperation between the BC and other supervisory authorities is subject to reciprocity and confidentiality as stated under Article 60 of the Annex to the Convention Governing the WAMU Banking Commission. - According to the Law, cooperation with national FIUs relies on the BCEAO, while for foreign supervisors it is the BC; this lack of uniformity creates confusion as to who is the primary AML/CFT supervisory authority. - In practice, information sharing with counterparts on AML/CFT matters is nearly inexistent. - As of January 1, 2002, 10 MOUs had been signed between the BC and foreign counterparts. It should be noted that not all these supervisory authorities appear to have AML/CFT supervisory competences. - There has been an instance where foreign counterparts were invited for a joint inspection; however, it did not cover the AML/CFT agenda. - There have been no cases of exchange of information related to AML/CFT issues. The only instances of cooperation with foreign counterparts were in the context of routine fit and proper checks. ### Key recommendations: Domestic and International Cooperation - Key impediments to the effective exchange of information between national FIUs and the supervisory authorities should be removed: - Ideally, the MOU should be signed between the national FIUs and the BC and the BECAO. The signing of the MOU should be prioritized to ensure an effective and meaningful cooperation between the authorities, including sharing information on quality of STRs of individual banks, results of inspections conducted, typologies and any other information that could impact reputational risk of the financial market of the region. - Although, in practice, information can be shared between the BC and national FIUs, steps must be taken to remedy the legal gaps and ensure by law that the BC can cooperate with national FIUs. This would enable a fluent, operative, and ongoing exchange of information that would ideally include periodic (virtual or in-person) meetings. - The BC should cooperate effectively with foreign counterparts that have shared responsibility for banks, including through exchange of information especially in terms of: - (i) joint inspections; - (ii) weaknesses and sanctions imposed to banking institutions when relevant; - (iii) AML/CFT procedures and policies of financial institutions; - (iv) CDD information; and - (v) transaction information. - Establishing MOU with foreign AML/CFT supervisors could facilitate effective exchange of information. *Source: 1wauea2023003 - 89. The GSBC should provide to all WAEMU bank AML/CFT compliance functions* --- _Source: https://www.imf.org/-/media/files/publications/cr/2023/english/1wauea2023003.pdf_