@1aboveio/skills 0.20.2 → 0.20.4

package/skills/document-utils/reg-parser/references/checklists/kyc-aml-checklist.md

@@ -0,0 +1,258 @@
+```yaml
+name: "KYC/AML Compliance Checklist"
+regulation: "EU Anti-Money Laundering Directive 2015/849 (AMLD4) as amended by 2018/843 (AMLD5)"
+version: "1.0"
+scope: "Customer due diligence, ongoing monitoring, record-keeping, and suspicious activity reporting obligations for obliged entities"
+date: "2026-03-30"
+summary:
+  categories: 5
+  total_items: 16
+  critical: 11
+  major: 5
+  minor: 0
+```
+
+## CAT-01: Customer Due Diligence
+
+### CAT-01-001: Verify customer identity — natural persons
+
+- **Requirement:** Collect and verify government-issued photo identification for all natural persons before establishing a business relationship.
+- **Source:** Art. 13(1)(a), Directive 2015/849
+- **Severity:** critical
+- **Verification:**
+  - [ ] Photo ID collected (passport, national ID card, or driver licence)
+  - [ ] ID verified against an independent, reliable source or database
+  - [ ] Verification date and method recorded in the customer file
+- **Evidence:**
+  - Copy of verified ID document
+  - Verification log entry with timestamp and officer name
+
+### CAT-01-002: Verify customer identity — legal entities
+
+- **Requirement:** Obtain proof of registration and verify the legal existence and structure of all legal entity customers.
+- **Source:** Art. 13(1)(a), Directive 2015/849
+- **Severity:** critical
+- **Verification:**
+  - [ ] Certificate of incorporation or equivalent obtained
+  - [ ] Company registry extract reviewed and dated within 3 months
+  - [ ] Articles of association or equivalent reviewed
+- **Evidence:**
+  - Certificate of incorporation
+  - Current company registry extract
+  - Articles of association
+
+### CAT-01-003: Identify beneficial owners
+
+- **Requirement:** Identify all beneficial owners holding more than 25% of ownership or control, and verify their identities.
+- **Source:** Art. 13(1)(b), Directive 2015/849
+- **Severity:** critical
+- **Verification:**
+  - [ ] Beneficial ownership declaration obtained from customer
+  - [ ] Ownership structure mapped to ultimate beneficial owners
+  - [ ] UBO identities verified per natural person verification procedures
+  - [ ] Ownership percentages documented
+- **Evidence:**
+  - Beneficial ownership declaration form
+  - Ownership structure chart
+  - UBO identity verification records
+
+### CAT-01-004: Understand purpose and nature of business relationship
+
+- **Requirement:** Obtain information on the purpose and intended nature of the business relationship at onboarding.
+- **Source:** Art. 13(1)(c), Directive 2015/849
+- **Severity:** major
+- **Verification:**
+  - [ ] Customer questionnaire completed covering business activities
+  - [ ] Expected transaction types and volumes documented
+  - [ ] Source of funds identified
+- **Evidence:**
+  - Completed customer questionnaire
+  - Onboarding notes with expected activity profile
+
+### CAT-01-005: Assess and document customer risk rating
+
+- **Requirement:** Assign a risk rating (high, medium, low) to each customer based on customer type, geography, products, and delivery channels.
+- **Source:** Art. 8(1)–(2), Directive 2015/849
+- **Severity:** critical
+- **Verification:**
+  - [ ] Risk assessment performed using approved methodology
+  - [ ] Risk factors documented (customer type, country, product, channel)
+  - [ ] Risk rating recorded in customer file
+  - [ ] Risk rating approved by authorised officer
+- **Evidence:**
+  - Completed risk assessment form
+  - Risk rating approval record
+
+## CAT-02: Enhanced Due Diligence
+
+### CAT-02-001: Apply EDD for high-risk customers
+
+- **Requirement:** Apply enhanced due diligence measures for all customers rated as high risk, including PEPs, customers from high-risk third countries, and complex ownership structures.
+- **Source:** Art. 18(1), Directive 2015/849
+- **Severity:** critical
+- **Verification:**
+  - [ ] EDD triggers identified and documented
+  - [ ] Additional identification documents obtained
+  - [ ] Source of wealth established and documented
+  - [ ] Senior management approval obtained for relationship
+- **Evidence:**
+  - EDD assessment report
+  - Source of wealth documentation
+  - Senior management approval record
+
+### CAT-02-002: Screen for Politically Exposed Persons
+
+- **Requirement:** Screen all customers and beneficial owners against PEP databases at onboarding and on an ongoing basis.
+- **Source:** Art. 20–23, Directive 2015/849
+- **Severity:** critical
+- **Verification:**
+  - [ ] PEP screening performed at onboarding
+  - [ ] Ongoing PEP screening scheduled (at least annually)
+  - [ ] PEP matches reviewed and dispositioned
+  - [ ] False positives documented with rationale
+- **Evidence:**
+  - PEP screening results with date
+  - Match disposition records
+  - Screening system audit log
+
+### CAT-02-003: Screen against sanctions lists
+
+- **Requirement:** Screen all customers, beneficial owners, and transaction parties against applicable sanctions lists before onboarding and on an ongoing basis.
+- **Source:** Art. 13(1)(a), Directive 2015/849; EU Regulation 2580/2001
+- **Severity:** critical
+- **Verification:**
+  - [ ] Sanctions screening performed at onboarding
+  - [ ] Real-time or daily batch screening configured for ongoing monitoring
+  - [ ] Matches escalated immediately per sanctions policy
+  - [ ] Screening coverage includes all applicable lists (EU, UN, OFAC if relevant)
+- **Evidence:**
+  - Sanctions screening results
+  - Match escalation records
+  - Screening system configuration documentation
+
+## CAT-03: Ongoing Monitoring
+
+### CAT-03-001: Monitor transactions for unusual activity
+
+- **Requirement:** Conduct ongoing monitoring of all business relationships, including scrutiny of transactions to ensure they are consistent with the customer's known profile.
+- **Source:** Art. 13(1)(d), Directive 2015/849
+- **Severity:** critical
+- **Verification:**
+  - [ ] Transaction monitoring rules defined and documented
+  - [ ] Monitoring system operational and generating alerts
+  - [ ] Alerts reviewed within defined SLA
+  - [ ] Alert dispositions documented with rationale
+- **Evidence:**
+  - Transaction monitoring rule set documentation
+  - Alert review records with disposition
+  - Monitoring system operational reports
+
+### CAT-03-002: Periodic customer review
+
+- **Requirement:** Review and update customer due diligence information on a risk-based periodic schedule (high risk: annually; medium: every 2 years; low: every 3 years).
+- **Source:** Art. 13(1)(d), Directive 2015/849
+- **Severity:** major
+- **Verification:**
+  - [ ] Review schedule defined by risk category
+  - [ ] Review triggers configured in CRM or compliance system
+  - [ ] Reviews completed within scheduled timeframe
+  - [ ] Updated information recorded in customer file
+- **Evidence:**
+  - Periodic review schedule
+  - Completed review records with dates
+  - Updated customer files
+
+### CAT-03-003: Reassess customer risk upon trigger events
+
+- **Requirement:** Reassess the customer risk rating when material changes occur (change in ownership, adverse media, unusual transactions, change in business activity).
+- **Source:** Art. 8(2), Directive 2015/849
+- **Severity:** major
+- **Verification:**
+  - [ ] Trigger events defined in policy
+  - [ ] Trigger event detection mechanisms in place
+  - [ ] Risk re-assessment performed and documented
+  - [ ] Updated risk rating approved by authorised officer
+- **Evidence:**
+  - Trigger event documentation
+  - Updated risk assessment
+  - Approval record
+
+## CAT-04: Record Keeping
+
+### CAT-04-001: Retain CDD records for minimum period
+
+- **Requirement:** Retain all customer due diligence records, including copies of identification documents and transaction records, for at least 5 years after the business relationship ends.
+- **Source:** Art. 40(1), Directive 2015/849
+- **Severity:** critical
+- **Verification:**
+  - [ ] Retention policy documented with 5-year minimum
+  - [ ] Retention period starts from end of business relationship
+  - [ ] Records stored securely with access controls
+  - [ ] Disposal procedures defined for post-retention records
+- **Evidence:**
+  - Records retention policy
+  - Records inventory with retention dates
+  - Access control documentation
+
+### CAT-04-002: Ensure records are available to authorities
+
+- **Requirement:** Make CDD and transaction records available promptly to competent authorities (FIU, supervisory authorities) upon request.
+- **Source:** Art. 40(1), Directive 2015/849
+- **Severity:** critical
+- **Verification:**
+  - [ ] Process defined for responding to authority requests
+  - [ ] Designated contact point identified for authority enquiries
+  - [ ] Records retrievable within required timeframe
+  - [ ] Response log maintained
+- **Evidence:**
+  - Authority request response procedure
+  - Designated contact point documentation
+  - Historical response log
+
+## CAT-05: Suspicious Activity Reporting
+
+### CAT-05-001: File Suspicious Activity Reports
+
+- **Requirement:** Report to the Financial Intelligence Unit (FIU) when there is knowledge, suspicion, or reasonable grounds to suspect money laundering or terrorist financing.
+- **Source:** Art. 33(1), Directive 2015/849
+- **Severity:** critical
+- **Verification:**
+  - [ ] SAR/STR filing procedures documented
+  - [ ] Reporting channel to national FIU established
+  - [ ] SARs filed within required timeframe
+  - [ ] Tipping-off prohibition understood and enforced
+- **Evidence:**
+  - SAR filing procedure documentation
+  - Filed SAR records (confidential)
+  - FIU acknowledgement receipts
+
+### CAT-05-002: Maintain internal escalation process
+
+- **Requirement:** Establish an internal process for employees to report suspicious activity to the MLRO/compliance function without delay.
+- **Source:** Art. 33(1), Directive 2015/849
+- **Severity:** major
+- **Verification:**
+  - [ ] Internal reporting channel established (hotline, form, or system)
+  - [ ] MLRO or nominated officer designated
+  - [ ] Escalation SLA defined
+  - [ ] Employee awareness confirmed (training records)
+- **Evidence:**
+  - Internal reporting procedure
+  - MLRO designation letter
+  - Training completion records
+
+### CAT-05-003: Provide AML training to staff
+
+- **Requirement:** Ensure employees receive regular training on AML/CFT obligations, customer due diligence procedures, and suspicious activity identification.
+- **Source:** Art. 46(1), Directive 2015/849
+- **Severity:** major
+- **Verification:**
+  - [ ] Training programme covers CDD, EDD, SAR filing, and sanctions
+  - [ ] Training delivered at onboarding and refreshed annually
+  - [ ] Training attendance tracked
+  - [ ] Training content reviewed and updated at least annually
+- **Evidence:**
+  - Training materials and curriculum
+  - Attendance records
+  - Training schedule
+  - Content review log