Internal control rules: how to develop and what you need to know about them from 2022

Who are the changes for?

Decree of the Government of the Russian Federation of July 14, 2021 No. 1188 (hereinafter referred to as Decree No. 1188) approved certain requirements for internal control rules that develop:

• lawyers;
• notaries;
• persons providing legal or accounting services;
• audit companies and individual auditors.

These requirements were adopted to comply with the provisions of the Federal Law of August 7, 2001 No. 115-FZ “On combating the legalization (laundering) of proceeds from crime and the financing of terrorism” (hereinafter referred to as Law No. 115-FZ). Namely, according to paragraph 1 of its Art. 7.1, the requirements of this Federal Law regarding the organization of internal control apply to the listed persons.

List of internal control rules from January to December 2021

In this review, we will consider the most important changes in the Federal Law of August 7, 2001 No. 115-FZ “On Combating the Legalization (Laundering) of Proceeds from Crime and the Financing of Terrorism” and in the regulations of the Bank of Russia in the field of AML/CFT. Let us explain the importance of these changes. The changes under consideration deserve special attention due to the fact that they need to be reflected in the internal control rules of a non-bank financial organization.

Let us recall that paragraphs 3 and 4 of clause 1.10 of the Bank of Russia Regulation No. 445-P dated December 15, 2014 “On the requirements for internal control rules of non-bank financial organizations in order to combat the legalization (laundering) of proceeds from crime and the financing of terrorism” ( hereinafter referred to as Regulation No. 445-P) provide for a “three month” rule for approval of the IAC:

“The ICR for AML/CFT must be brought by a non-credit financial institution into compliance with the requirements of the legislation of the Russian Federation in the field of AML/CFT no later than three months after the date of entry into force of the federal law amending the Federal Law, unless otherwise expressly provided by the relevant federal law .

The AML/CFT rules of internal regulations must be brought into compliance by the non-bank financial institution no later than three months after the date of its entry into force, unless otherwise expressly established by the relevant regulatory act.”

Taking into account this rule, let’s consider what changes occurred in 2021 and during what period of time it was necessary to approve the new edition of the internal control rules of a non-bank financial organization:

As you have probably already noticed, some periods overlap each other. In such cases, it is permissible to approve a new version of the internal control rules for two or more regulations in the field of AML/CFT listed in the table.

Abbreviations and abbreviations used in the review:

AML/CFT – combating the legalization (laundering) of proceeds from crime and the financing of terrorism.

Non-credit financial organization - professional participants in the securities market, insurance organizations, insurance brokers, management companies of investment funds, mutual funds and non-state pension funds, non-state pension funds, credit consumer cooperatives, including agricultural credit consumer cooperatives, microfinance organizations, mutual societies insurance and pawn shops.

The ICR for AML/CFT is the rules of internal control in order to combat the legalization (laundering) of proceeds from crime and the financing of terrorism.

Author: Kharisov Igor Fanzilovich, head of the Financial Monitoring Center of U-Piter Consulting, e-mail

What changes to consider

The internal control rules regulate the procedures for the actions of the above-listed persons for anti-money laundering purposes. They are prepared in paper or electronic form. In the latter case, the listed persons certify them with their enhanced qualified electronic signature (for example, the head of a law firm, lawyer or notary). Until January 13, 2022, these rules are drawn up on paper.

Internal control rules drawn up on paper can be stored as an electronic image of the document.

There are fewer mandatory programs that need to be included in the internal control rules. This applies to:

• documenting information;
• suspension of operations;
• actions in case of refusal to execute the client’s order to perform a transaction.

Which operations are subject to the new requirements?

The new requirements are related to the development of internal control rules for the following transactions with funds or other property carried out by these persons:

• real estate transactions;
• management of funds, securities or other property of the client;
• management of bank or securities accounts;
• raising money to create organizations, ensure their activities or manage them;
• creation of legal entities and foreign structures without forming a legal entity, ensuring their activities or managing them, as well as the purchase and sale of legal entities and foreign structures without forming a legal entity.

But we’ll talk about how tax authorities control your company and what to do if they call you to talk about problematic counterparties in a free webinar tomorrow. Sign up.

Contents of internal control rules

Internal control rules from 2022 must contain 9 mandatory programs:

• organizational basis of the internal control system;
• identification of clients, client representatives and/or beneficiaries, as well as beneficial owners;
• client research;
• risk assessment and risk management of money laundering and terrorist financing;
• identifying transactions and financial transactions with signs of laundering or terrorist financing and submitting information about them to Rosfinmonitoring;
• procedure for freezing (blocking) funds or other property;
• training and education of personnel in the field of combating money laundering, the financing of terrorism and the proliferation of weapons of mass destruction;
• audit of the internal control system;
• storage of information and documents obtained as a result of fulfilling obligations to combat money laundering, financing of terrorism and the proliferation of weapons of mass destruction.

Decree No. 1188 defines in detail the content of each program.

Control algorithm

The control procedure, including detailed statistics on violations, is not published by Rosfinmonitoring due to the nature of its activities. After all, the regulator is not considered an agency involved in organizing control in accordance with Federal Law No. 294-FZ dated December 26, 2008.

No inspections were carried out over the past year. the moratorium was ; as a result, this year any legal entities and individual entrepreneurs under the supervision of the department can be inspected, regardless of their type of activity. This is what Rosfinmonitoring reports.

Control is carried out to determine compliance with AML/CFT provisions by the organization. The main criteria that the regulator most carefully considers should be indicated:

• registration of the enterprise with Rosfinmonitoring
• establishment of internal control rules in the organization
• appointment of a special employee or official
• frequency of reconciliation of the client base with the register of terrorists and extremists, weapons distributors
• quality of maintaining client questionnaires and storing them
• sending FES about procedures subject to the necessary control

Responsibility for violations in the field of AML/CFT is described in Art. 15.27 Code of Administrative Offences . An enterprise can receive a penalty in the amount of 30 thousand to 1 million rubles. , operation may be suspended for a period of up to 60 days , moreover, the organization may lose its license.