Business email compromise

Automated and manual transaction monitoring shall identify unusual or suspicious activity using risk-based scenarios and thresholds.

Financial institutions may not keep anonymous accounts or accounts in obviously fictitious names and must, by a principle set out in law, undertake customer due diligence when establishing a business relationship, carrying out an occasional transaction above USD or EUR 15,000 or a payment or value transfer covered by INR.16, when money laundering or terrorist financing is suspected, or when they doubt previously obtained identification data: identify and verify the customer from reliable independent sources; identify the beneficial owner and take reasonable measures to verify that identity, understanding the ownership and control structure of legal persons and arrangements; understand and where appropriate obtain information on the purpose and intended nature of the relationship; and conduct ongoing due diligence and transaction scrutiny consistent with the customer's profile including, where necessary, the source of funds. The extent of each measure follows a risk-based approach; verification takes place before or during establishment of the relationship, or as soon as reasonably practicable after it where risks are managed and business would otherwise be interrupted; an institution that cannot complete CDD does not open the account or perform the transaction, or terminates the relationship, and considers a suspicious transaction report; the requirements apply to new customers and, on materiality and risk, to existing ones. The Interpretive Note sets the risk-based approach, enhanced and simplified measures, the specific measures for legal persons, arrangements and beneficiaries of life insurance, reliance on prior verification and the timing rules.

For cross-border transfers above the threshold the information received on the intended beneficiary informs the beneficiary institution's monitoring, aimed at detecting misdirected payments from possible laundering, fraud or error, and it mitigates the risk of transfers reaching an unintended beneficiary through at least one of: a per-transaction check of the extent to which the beneficiary name and account number in the message align with its own records (alignment need not be an exact match and may vary with risk and context); holistic ongoing risk-based monitoring for anomalous accounts, transactions and activity including misaligned beneficiary information; or, where both institutions participate in a pre-validation mechanism such as confirmation or verification of payee, that pre-validation in place of the other two.

Systems and controls for monitoring customer transactions for unusual or suspicious activity.