Business Rules - AML/KYC Banking Compliance (EN)

Core business rules of the anti-money-laundering (AML) and know-your-customer (KYC) domain. Code BR-NNN, priority High/Medium/Low. The rules describe the compliance process and do NOT constitute operational AML instructions or due-diligence advice.

> Legal/financial disclaimer: This section is for descriptive and informational purposes only. It does not constitute legal advice, operational AML instructions or customer due-diligence guidance. Always consult a qualified professional (professionista abilitato) before making operational decisions. Reference legal framework: FATF Recommendations (2023); 6AMLD Dir. (EU) 2018/1673; D.Lgs. 231/2007 (IT) (2023).

---

BR-001 - Customer identification before establishing the relationship

Code: BR-001 Name: Customer Identification Programme Description: Every ClienteBancario (banking customer) must be identified and their identity verified before establishing the ongoing relationship or executing an above-threshold occasional transaction. The KYCProfile cannot be active without documentary or equivalent verification. Rationale: Identification is the prerequisite of every subsequent anti-money-laundering safeguard. Priority: High Actors: Onboarding System, Compliance Officer Traceability: FATF Rec. 10; D.Lgs. 231/2007 Art. 18-19; glossary Customer Identification Programme.

BR-002 - Risk-based approach to customer due diligence

Code: BR-002 Name: Risk-Based Approach Description: The due-diligence level (SDD, CDD, EDD) applied to a ClienteBancario must be proportionate to the computed RischioML (ML risk). A customer classified as high-risk always requires Enhanced Due Diligence. Rationale: Control resources concentrate where risk is greatest; the approach describes the process, not a single-case assessment. Priority: High Actors: Risk Scoring System, Compliance Officer Traceability: FATF Rec. 1; 6AMLD; glossary Risk-Based Approach, EDD.

BR-003 - Enhanced Due Diligence for PEPs and high-risk jurisdictions

Code: BR-003 Name: Mandatory EDD Description: For PEP (Politically Exposed Persons) customers or those linked to high-risk jurisdictions, Enhanced Due Diligence must be applied, with senior-management approval and enhanced ongoing monitoring of the relationship. Rationale: These categories carry inherently higher risk that the rule requires to be safeguarded in a reinforced manner. Priority: High Actors: Compliance Officer, MLRO Traceability: FATF Rec. 12; D.Lgs. 231/2007 Art. 24-25; glossary PEP, High-Risk Jurisdiction.

BR-004 - Beneficial owner identification

Code: BR-004 Name: Beneficial Owner Description: For legal-entity customers the BeneficialOwner must be identified and verified along the entire control chain. The relationship cannot be activated without an ascertained beneficial owner. Rationale: Beneficial-ownership transparency hinders the use of corporate shells for laundering. Priority: High Actors: Onboarding System, Compliance Officer Traceability: FATF Rec. 24-25; D.Lgs. 231/2007 Art. 20; glossary Beneficial Owner.

BR-005 - Ongoing transaction monitoring

Code: BR-005 Name: Transaction Monitoring Description: Every TransazioneMonitorata (monitored transaction) is screened against rules and thresholds (velocity, structuring, threshold). Anomalous transactions generate a ThresholdAlert for analyst assessment. Rationale: Ongoing monitoring detects suspicious patterns that the initial verification cannot capture. Priority: High Actors: Transaction Monitoring System, AML Analyst Traceability: FATF Rec. 20; glossary Transaction Monitoring, Velocity Rule.

BR-006 - Sanctions screening of customers and transactions

Code: BR-006 Name: Sanctions Screening Description: Customers and transactions must be compared against applicable sanctions lists (e.g. OFAC, EU/UN lists). A confirmed match triggers Blocking and escalation, not execution. Rationale: Sanctions screening is a safeguard distinct from AML, with immediate blocking effects. Priority: High Actors: Sanctions Screening System, Compliance Officer Traceability: OFAC; EU sanctions Reg.; glossary Sanctions Screening, Blocking (OFAC).

BR-007 - Suspicious activity reporting via SAR

Code: BR-007 Name: SAR Filing Description: When a well-founded suspicion arises, the MLRO assesses the report and, if confirmed, produces a SAR (Suspicious Activity Report) to the competent authority (e.g. FIU/FinCEN) within the prescribed timeframe. The decision and rationale are recorded. Rationale: Reporting is the link between the internal safeguard and the authority; timeliness is part of the process. Priority: High Actors: MLRO, Competent Authority Traceability: FATF Rec. 20; D.Lgs. 231/2007 Art. 35; glossary SAR, MLRO.

BR-008 - KYC and AML record retention

Code: BR-008 Name: Record Retention Description: Identification, due-diligence and monitoring records must be retained for the minimum period prescribed (typically at least 5 years from relationship termination or the transaction). Rationale: Retention enables reconstruction of operations for supervisory and investigative purposes. Priority: Medium Actors: Retention System, Compliance Officer Traceability: FATF Rec. 11; D.Lgs. 231/2007 Art. 31-32.