By Melisenda Gottlinde Puttin

The primary regulatory framework for anti-money laundering and combating the financing of terrorism finds specific regulatory implementation by the Supervisory Authority, including for the insurance sector.

In fact, IVASS Regulation no. 44/2019, containing “Implementing provisions aimed at preventing the use of insurance companies and insurance intermediaries for the purposes of money laundering and terrorist financing in relation to organization, procedures, internal controls, and customer due diligence, pursuant to Article 7, paragraph 1, letter a) of Legislative Decree No. 231 of November 21, 2007.”, as amended by Legislative Decree 90/2017 transposing into Italy the so-called Fourth European Anti-Money Laundering Directive and by Legislative Decree 125/2019, following the transposition into Italy of the Fifth European Anti-Money Laundering Directive, regulates the organizational rules, procedures, internal controls with a view to preventing money laundering, as well as the rules on due diligence for companies, insurance intermediaries and other entities listed in the respective art. 3.

The organizational controls are thus designed to enable recipients to periodically self-assess the money laundering and terrorist financing risk to which they are actually exposed, i.e., to identify the level of vulnerability of the organization and its internal controls, and therefore to choose and adopt all appropriate measures to mitigate and counteract it.

The Regulation is based on the principle of proportionality and the core principle that guides anti-money laundering, namely the risk-based approach: each obligated entity must assess the varying degrees of risk to which its business is exposed and adopt anti-money laundering safeguards, controls, and procedures of varying degrees of complexity depending on the level of risk encountered.

For the sake of completeness, it should be noted that IVASS Provision 111/2021 was published in the Official Journal of 24 July 2021. This Provision, implementing Articles 15-16 of Legislative Decree 231/07 and subsequent amendments, defines the criteria and methodologies for analyzing and assessing money laundering risk and establishes the size and organizational requirements for Insurance Intermediaries, including Agents, to establish an anti-money laundering and internal audit function, identifying its owners, and appointing a person responsible for reporting suspicious transactions.

It therefore appears evident that, even for the insurance sector, "Only through secondary legislation, addressed to more homogeneous subjects than the vast audience of recipients of the primary legislation, is it possible to provide concrete indications for the implementation of controls based on the actual exposure to risk.” (cf. IVASS, Report on the Presentation of Provision 111/2021). On the other hand, “Failure to comply with the legislation in question (beyond the obvious sanctioning impact) impacts the intermediary's governance; and this is all the more true the more it is argued […] that exposure to the risk in question brings with it equally "legal" and "reputational" risks, which inevitably reverberate on the company's profit and loss account."(R. Razzante, Some “meta-legal” reflections on anti-money laundering regulations for insurance companies, in Insurance Economics Dir. (from 2012 Insurance Economics Dir. and Taxation Dir.), issue 2, 2002, 295).

Having examined the secondary regulatory framework, it is preliminary noted that the risk of money laundering in the insurance sector lies exclusively in the distribution of life insurance products, which by their nature and financial content lend themselves to the logic underlying the money laundering process.

Going into greater detail, it becomes clear that risk exposure varies depending on the product's characteristics and peculiarities. In this regard, we recall the Secretary General of IVASS, Stefano De Polis, in his speech at the May 3, 2017, Forum held with IVASS by AICOM (Italian Compliance Association), which divided the analysis of money laundering risk into "pure risk" and "non-pure risk" life insurance products, the latter in turn divided into "whole life" life insurance policies and those with a fixed term (see Speech by IVASS Secretary General Stefano De Polis, "Due Diligence in the Insurance Sector: Customer, Beneficiary and Beneficiary," delivered at the Anti-Money Laundering Forum: The "New 231/07" held in Milan on May 3, 2017.).

For the former, so-called "pure risk" policies (e.g., temporary life insurance, PPI for mortgage and personal loan protection), the results of the Inspectorate's analyses led to their being deemed to pose a lower risk of money laundering due to the fact that, among other features, the benefit is paid only upon the occurrence of pre-established events (the death of the insured) and only the surviving policyholder is entitled to request early redemption of the contract. The typical contractual models for these products, therefore, “… they do not lend themselves easily to being used – within the context of a classic money laundering scheme – as instruments for transferring wealth <>> a <>> that they are not linked by emotional ties (of kinship, marriage, civil union, cohabitation more uxorio)” (cf. Speech by IVASS Secretary General Stefano De Polis, "Duty Verification in the Insurance Sector: Customer, Beneficiary, and Beneficiary," 6, ult. cit..

For "whole life" products, the increased risk is associated with cases in which there is no emotional relationship between the policyholder and the beneficiaries, who are entitled to receive the benefit only upon the insured's death. This risk, for fixed-term policies, is compounded by the possibility of finding oneself faced with multiple beneficiaries other than the policyholder at the time of payment of the benefit.These products, therefore, could be used – within the context of a classic money laundering scheme – as tools for transferring wealth. <>> to beneficiaries who are not linked by emotional ties” (cf. Speech by IVASS Secretary General Stefano De Polis, "Duty Verification in the Insurance Sector: Customer, Beneficiary, and Beneficiary," 7, ult. cit..

It is therefore essential for the intermediary to acquire all information relating to the relationship between the policyholder and the designated beneficiary(ies), and to carry out a thorough assessment, especially where there is no emotional bond, together with appropriate knowledge of the origin of the funds paid into the policy.

In this context, the action of prevention and contrast of the use of the system for illicit purposes is developed "…through the introduction of measures aimed at ensuring full customer knowledge, the traceability of financial transactions, and the identification of suspicious transactions” (cf. R. Razzante, Handbook of Anti-Money Laundering Legislation and Practice, G. Giappichelli Editore, 2020, 198). In other words, the three fundamental pillars on which the anti-money laundering framework rests remain in place: 1) customer due diligence; 2) retention of transaction and relationship data; 3) reporting of suspicious transactions.

Pursuant to Article 32 of Regulation 44/2019, customer due diligence is performed on new customers as well as on existing customers in the presence of factors that increase the associated money laundering risk, as well as "at least" (as the law states) at the following times during the policy's life: when the ongoing relationship is established (i.e., in the case of issuing life insurance, whether retail or group); when the beneficiary is designated, including the possibility of a change of beneficiary where applicable; when the benefit is paid; for an occasional benefit of an amount equal to or greater than €15.000; when the operator suspects money laundering; “… independent of any applicable derogation, exemption or threshold, also making use of the anomaly indicators and representative patterns of anomalous behavior issued by the UIF on the basis of the anti-money laundering decree”; when mere doubts arise regarding the completeness, reliability or veracity of the information or documentation previously acquired from the customer.

Clearly, due diligence is followed by obligations to retain data and information regarding the relationship and the transaction, such as information on the means of payment used to pay premiums, copies of acquired identification documents, documentation acquired to identify the payer other than the policyholder, as well as the relationship with the latter and the relationship between the policyholder and the beneficiaries. Pursuant to Articles 40-41 of IVASS Regulation 44/2019, retention obligations last for ten years from the date of execution of the transaction in question or from the date of termination of the ongoing relationship.

Finally, insurance intermediaries are also required to submit a report to the UIF.when they know, suspect, or have reasonable grounds to suspect that money laundering or terrorist financing is being committed, or has been committed or attempted” (see art. 35 Legislative Decree 231/07), taking into account the size, nature of the transaction or any other circumstances known by virtue of the functions performed, considering the economic capacity and professional activity specifically carried out by the person to whom the transaction refers (see art. 41 Legislative Decree 231/07).

The reports are thus based on a real judgement by the operator based on the subjective (referring to the customer) and objective (referring to the transaction) characteristics of the customer known to him, which becomes relevant for this purpose where unjustified misalignments emerge with respect to current practice for similar cases (see. Cass. 30/10/2009, no. 23017, in Dir. Banca merc. fin., 2010, I, 99 ff. with note by Pistritto, The responsibility of those involved in reporting suspicious money laundering transactions).

It is clear that in order to correctly fulfill this obligation, the previous safeguard systems must be effectively implemented: "There can be no reporting of suspicious transactions, we repeat this here too, without a suitable and adequate verification of the customer's identity” (cf. R. Razzante, Handbook of anti-money laundering legislation and practice, G. Giappichelli Editore, 2020, 201).

The Bank of Italy, with the aim of supporting the assessment by intermediaries and insurance companies of any suspected profiles of money laundering or terrorist financing, on the proposal of the Financial Intelligence Unit, after consulting the Financial Security Committee, issued the Provision of 24 August 2010 containing the anomaly indicators which, with a merely exemplary function and in continuous evolution, "They are aimed at reducing the margins of uncertainty associated with subjective assessments or discretionary behaviors and intend to contribute to the containment of burdens and the correct and homogeneous fulfillment of the obligations to report suspicious transactions.” (cf. art. 3 Bank of Italy, Provision of 24 August 2010 containing the Anomaly Indicators for intermediaries). In this context, specific anomaly indicators for insurance contracts can also be found.

In this regard, it should also be noted that the FATF has also published guidance on the risk-based approach for life insurance (see FAFT, Risk-based Approach Guidance for the Life Insurance Sector, 25 October 2018, available on the organization’s website www.fatf-gafi.org.

By Melisenda Gottlinde Puttin

The primary regulatory framework for anti-money laundering and combating the financing of terrorism finds specific regulatory implementation by the Supervisory Authority, including for the insurance sector.

In fact, IVASS Regulation no. 44/2019, containing “Implementing provisions aimed at preventing the use of insurance companies and insurance intermediaries for the purposes of money laundering and terrorist financing in relation to organization, procedures, internal controls, and customer due diligence, pursuant to Article 7, paragraph 1, letter a) of Legislative Decree No. 231 of November 21, 2007.”, as amended by Legislative Decree 90/2017 transposing into Italy the so-called Fourth European Anti-Money Laundering Directive and by Legislative Decree 125/2019, following the transposition into Italy of the Fifth European Anti-Money Laundering Directive, regulates the organizational rules, procedures, internal controls with a view to preventing money laundering, as well as the rules on due diligence for companies, insurance intermediaries and other entities listed in the respective art. 3.

The organizational controls are thus designed to enable recipients to periodically self-assess the money laundering and terrorist financing risk to which they are actually exposed, i.e., to identify the level of vulnerability of the organization and its internal controls, and therefore to choose and adopt all appropriate measures to mitigate and counteract it.

The Regulation is based on the principle of proportionality and the core principle that guides anti-money laundering, namely the risk-based approach: each obligated entity must assess the varying degrees of risk to which its business is exposed and adopt anti-money laundering safeguards, controls, and procedures of varying degrees of complexity depending on the level of risk encountered.

For the sake of completeness, it should be noted that IVASS Provision 111/2021 was published in the Official Journal of 24 July 2021. This Provision, implementing Articles 15-16 of Legislative Decree 231/07 and subsequent amendments, defines the criteria and methodologies for analyzing and assessing money laundering risk and establishes the size and organizational requirements for Insurance Intermediaries, including Agents, to establish an anti-money laundering and internal audit function, identifying its owners, and appointing a person responsible for reporting suspicious transactions.

It therefore appears evident that, even for the insurance sector, "Only through secondary legislation, addressed to more homogeneous subjects than the vast audience of recipients of the primary legislation, is it possible to provide concrete indications for the implementation of controls based on the actual exposure to risk.” (cf. IVASS, Report on the Presentation of Provision 111/2021). On the other hand, “Failure to comply with the legislation in question (beyond the obvious sanctioning impact) impacts the intermediary's governance; and this is all the more true the more it is argued […] that exposure to the risk in question brings with it equally "legal" and "reputational" risks, which inevitably reverberate on the company's profit and loss account."(R. Razzante, Some “meta-legal” reflections on anti-money laundering regulations for insurance companies, in Insurance Economics Dir. (from 2012 Insurance Economics Dir. and Taxation Dir.), issue 2, 2002, 295).

Having examined the secondary regulatory framework, it is preliminary noted that the risk of money laundering in the insurance sector lies exclusively in the distribution of life insurance products, which by their nature and financial content lend themselves to the logic underlying the money laundering process.

Going into greater detail, it becomes clear that risk exposure varies depending on the product's characteristics and peculiarities. In this regard, we recall the Secretary General of IVASS, Stefano De Polis, in his speech at the May 3, 2017, Forum held with IVASS by AICOM (Italian Compliance Association), which divided the analysis of money laundering risk into "pure risk" and "non-pure risk" life insurance products, the latter in turn divided into "whole life" life insurance policies and those with a fixed term (see Speech by IVASS Secretary General Stefano De Polis, "Due Diligence in the Insurance Sector: Customer, Beneficiary and Beneficiary," delivered at the Anti-Money Laundering Forum: The "New 231/07" held in Milan on May 3, 2017.).

For the former, so-called "pure risk" policies (e.g., temporary life insurance, PPI for mortgage and personal loan protection), the results of the Inspectorate's analyses led to their being deemed to pose a lower risk of money laundering due to the fact that, among other features, the benefit is paid only upon the occurrence of pre-established events (the death of the insured) and only the surviving policyholder is entitled to request early redemption of the contract. The typical contractual models for these products, therefore, “… they do not lend themselves easily to being used – within the context of a classic money laundering scheme – as instruments for transferring wealth <>> a <>> that they are not linked by emotional ties (of kinship, marriage, civil union, cohabitation more uxorio)” (cf. Speech by IVASS Secretary General Stefano De Polis, "Duty Verification in the Insurance Sector: Customer, Beneficiary, and Beneficiary," 6, ult. cit..

For "whole life" products, the increased risk is associated with cases in which there is no emotional relationship between the policyholder and the beneficiaries, who are entitled to receive the benefit only upon the insured's death. This risk, for fixed-term policies, is compounded by the possibility of finding oneself faced with multiple beneficiaries other than the policyholder at the time of payment of the benefit.These products, therefore, could be used – within the context of a classic money laundering scheme – as tools for transferring wealth. <>> to beneficiaries who are not linked by emotional ties” (cf. Speech by IVASS Secretary General Stefano De Polis, "Duty Verification in the Insurance Sector: Customer, Beneficiary, and Beneficiary," 7, ult. cit..

It is therefore essential for the intermediary to acquire all information relating to the relationship between the policyholder and the designated beneficiary(ies), and to carry out a thorough assessment, especially where there is no emotional bond, together with appropriate knowledge of the origin of the funds paid into the policy.

In this context, the action of prevention and contrast of the use of the system for illicit purposes is developed "…through the introduction of measures aimed at ensuring full customer knowledge, the traceability of financial transactions, and the identification of suspicious transactions” (cf. R. Razzante, Handbook of Anti-Money Laundering Legislation and Practice, G. Giappichelli Editore, 2020, 198). In other words, the three fundamental pillars on which the anti-money laundering framework rests remain in place: 1) customer due diligence; 2) retention of transaction and relationship data; 3) reporting of suspicious transactions.

Pursuant to Article 32 of Regulation 44/2019, customer due diligence is performed on new customers as well as on existing customers in the presence of factors that increase the associated money laundering risk, as well as "at least" (as the law states) at the following times during the policy's life: when the ongoing relationship is established (i.e., in the case of issuing life insurance, whether retail or group); when the beneficiary is designated, including the possibility of a change of beneficiary where applicable; when the benefit is paid; for an occasional benefit of an amount equal to or greater than €15.000; when the operator suspects money laundering; “… independent of any applicable derogation, exemption or threshold, also making use of the anomaly indicators and representative patterns of anomalous behavior issued by the UIF on the basis of the anti-money laundering decree”; when mere doubts arise regarding the completeness, reliability or veracity of the information or documentation previously acquired from the customer.

Clearly, due diligence is followed by obligations to retain data and information regarding the relationship and the transaction, such as information on the means of payment used to pay premiums, copies of acquired identification documents, documentation acquired to identify the payer other than the policyholder, as well as the relationship with the latter and the relationship between the policyholder and the beneficiaries. Pursuant to Articles 40-41 of IVASS Regulation 44/2019, retention obligations last for ten years from the date of execution of the transaction in question or from the date of termination of the ongoing relationship.

Finally, insurance intermediaries are also required to submit a report to the UIF.when they know, suspect, or have reasonable grounds to suspect that money laundering or terrorist financing is being committed, or has been committed or attempted” (see art. 35 Legislative Decree 231/07), taking into account the size, nature of the transaction or any other circumstances known by virtue of the functions performed, considering the economic capacity and professional activity specifically carried out by the person to whom the transaction refers (see art. 41 Legislative Decree 231/07).

The reports are thus based on a real judgement by the operator based on the subjective (referring to the customer) and objective (referring to the transaction) characteristics of the customer known to him, which becomes relevant for this purpose where unjustified misalignments emerge with respect to current practice for similar cases (see. Cass. 30/10/2009, no. 23017, in Dir. Banca merc. fin., 2010, I, 99 ff. with note by Pistritto, The responsibility of those involved in reporting suspicious money laundering transactions).

It is clear that in order to correctly fulfill this obligation, the previous safeguard systems must be effectively implemented: "There can be no reporting of suspicious transactions, we repeat this here too, without a suitable and adequate verification of the customer's identity” (cf. R. Razzante, Handbook of anti-money laundering legislation and practice, G. Giappichelli Editore, 2020, 201).

The Bank of Italy, with the aim of supporting the assessment by intermediaries and insurance companies of any suspected profiles of money laundering or terrorist financing, on the proposal of the Financial Intelligence Unit, after consulting the Financial Security Committee, issued the Provision of 24 August 2010 containing the anomaly indicators which, with a merely exemplary function and in continuous evolution, "They are aimed at reducing the margins of uncertainty associated with subjective assessments or discretionary behaviors and intend to contribute to the containment of burdens and the correct and homogeneous fulfillment of the obligations to report suspicious transactions.” (cf. art. 3 Bank of Italy, Provision of 24 August 2010 containing the Anomaly Indicators for intermediaries). In this context, specific anomaly indicators for insurance contracts can also be found.

In this regard, it should also be noted that the FATF has also published guidance on the risk-based approach for life insurance (see FAFT, Risk-based Approach Guidance for the Life Insurance Sector, 25 October 2018, available on the organization's website www.fatf-gafi.org.