1–5. Risk Assessment Fundamentals
1. Risk Assessment
1001148579 ONTARIO CORPORATION . is committed to preventing, detecting, and deterring money laundering and terrorist financing and has a zero-tolerance policy regarding such activities. This document forms part of our anti-money laundering (AML) and counter terrorist financing (CTF) compliance program, in conjunction with our training program, policy and procedural documentation.
The aim of the Risk Assessment is to diagnose and document the risk that our business may be used to launder money or finance terrorism. We consider the controls that we have in place to prevent money laundering and terrorist financing, and assess the effectiveness of our controls.
2. Money Laundering Risk
Money Laundering is any act intended to hide the fact that funds were obtained through criminal activity. Money laundering risk is the risk that our business could be used to disguise or move criminal proceeds.
3. Terrorist Financing Risk
Terrorist Financing is funding any act of terrorism or committing any act or omission that facilitates the funding of terrorism. Terrorist financing risk is the risk that our business could be used to facilitate or disguise terrorist financing.
4. What is Considered Risk?
Risk is the likelihood of a negative occurrence or event happening and its consequences. In the context of ML/TF, risk means:
- At the national level: Threats and vulnerabilities presented by ML/TF that put the integrity of Canada's financial system at risk
- At the Reporting Entity level: Internal and external threats and vulnerabilities that could open us up to possibility of being used to facilitate ML/TF activities
- Threats: A person, group or object that could cause harm (criminals, third-parties facilitating ML/TF, terrorists or terrorist groups)
- Vulnerabilities: Elements of a business or its processes that are susceptible to harm (weak business controls or high-risk products)
5. How Do We Assess Risk?
We follow six steps to complete a risk assessment as per the risk-based approach (RBA) cycle. As part of this assessment, we must consider distinct factors:
- Products, Services and Delivery Channels: the specific goods or services that we buy and sell
- Geography: the areas in which we operate, including our suppliers and customer locations
- Our Customers and Business Relationships: the individuals or organizations that engage in transactional activity
- New Developments & Technologies: changes to technology or other aspects of our business
- Other Factors: employees, suppliers and agents
Our methodology assesses the risk in each of these categories as "High-risk" "Medium-risk" and "Low-risk":
- • High = 3
- • Medium = 2
- • Low = 1
Overall score: Low = 5–7 | Medium = 8–10 | High = 11+
Inherent risk is the intrinsic risk before controls have been applied. Residual risk is the level of risk that remains after the implementation of mitigation measures and controls. While high-risk before controls is acceptable, it is expected that our controls will reduce the risk "after controls" to Low levels in all categories.
6. Executive Summary
6.1 Our Business
1001148579 ONTARIO CORPORATION is a Foreign MSB under Canadian legislation, headquartered in Richmond Hill, Ontario, Canada. Our business operates through an online platform that enables customers to purchase virtual currencies using EUR via SEPA and SEPA Instant bank transfers. Purchased virtual currencies are sent directly to the customer’s provided wallet address.
ONTARIO is owned by Augustas Rasimavicius. The Compliance Officer is Zineb El Moustaooui. ONTARIO does not carry out business in the province of Québec and does not use agents to conduct transactions.
6.2 Our Risk: Business Based Risk Assessment Summary
Based on the Risk Assessment, our overall money laundering and terrorist financing risk, before controls are applied, is High (13). Our controls effectively mitigate the risks; the residual risk is Low (5).
| Category | Before Controls (Inherent) | Rating | After Controls (Residual) | Rating |
|---|---|---|---|---|
| Products, Services & Delivery Channels | High | 3 | Low | 1 |
| Geography | Low | 1 | Low | 1 |
| Customers & Business Relationships | High | 3 | Low | 1 |
| New Developments & Technologies | High | 3 | Low | 1 |
| Other Factors | High | 3 | Low | 1 |
| Total | High | 13 | Low | 5 |
7. Our Products, Services & Delivery Channels
| Factor | Inherent Risk | Rating |
|---|---|---|
| Services – Purchase of Virtual Currency | High | 3 |
| Payment Methods – Virtual Currency | High | 3 |
| Delivery Channels – Non-Face-to-Face | High | 3 |
| Total (Average) | High | 3 |
7.1.1 Purchase of Virtual Currency
Virtual currencies mimic cash with exchange rates and person-to-person transfers. ONTARIO allows buying of virtual currency. While KYC measures are conducted, virtual currency can be transferred with some degree of anonymity. 100% of our customers conduct virtual currency transactions with an average transaction value of EUR 5000.
Inherent Risk: High (3)
7.2.1 Virtual Currency
Virtual currencies can be used to transfer value electronically with some degree of anonymity. Virtual currency transactions account for about 100% of all payments with an average value of EUR 5000.
Inherent Risk: High (3)
7.3.1 Non-Face-to-Face Transactions
ONTARIO's business is solely conducted non-face-to-face through our website. Non-face-to-face transactions allow for less interaction with customers, which means less ability to observe typical customer behaviours. 100% of business activity is conducted non-face-to-face.
Inherent Risk: High (3)
8. Geography
We consider materials published by the Financial Action Task Force (FATF) and KnowYourCountry.com that describe money laundering and terrorist financing risk related to particular countries.
Country Risk Rating Scale:
- • Low: 75 – 100
- • Medium: 50 – 74.99
- • High: <50
Non-Cooperative Countries (No transactions permitted):
- Iran
- Democratic People's Republic of Korea (DPRK)
FATF High-Risk Countries:
Albania, Barbados, Burkina Faso, Cayman Islands, Haiti, Jamaica, Malta, Nicaragua, Panama, Philippines, Senegal, South Sudan, Syria, Turkey, Uganda
| Factor | Inherent Risk | Rating |
|---|---|---|
| Destination & Origin of Funds – Canada | Low | 1 |
| Destination & Origin of Funds – Estonia | Low | 1 |
| Destination & Origin of Funds – Singapore | Low | 1 |
| Location of Offices | Low | 1 |
| Customer's Locations Within Canada | Low | 1 |
| Total (Average) | Low | 1 |
8.1.1 Canada (Rating: 75.72/Low)
Canada's FATF evaluations have been positive overall with no strategic deficiencies. Canada is not considered a high crime area (ranked 82nd of 135 countries globally). Expected 30% of transactions will involve Canada.
8.1.2 Estonia (Rating: 77.57/Low)
Estonia's FATF evaluations have been positive with no strategic deficiencies. Approximately 40% of transactions will involve Estonia.
8.1.3 Singapore (Rating: 76.83/Low)
Singapore's FATF evaluations have been positive with no strategic deficiencies. Singapore is considered a low-risk crime area (ranked 114th of 137 countries). Approximately 5% of transactions will involve Singapore.
8.2 Office Locations
ONTARIO's head office is located at 30 Wertheim Court, Unit 12, Suite 201, Richmond Hill, Ontario L4B 1B9, Canada. The current location is not known to be a high crime area. Location Risk: Low (1)
9. Customers & Business Relationships
| Factor | Inherent Risk | Rating |
|---|---|---|
| Sporadic Customers & Business Relationships | Low | 1 |
| Routine Customers & Business Relationships | Low | 1 |
| High-risk Customers & Business Relationships | High | 3 |
| Prohibited Customers | High | 3 |
| Total (Average) | High | 3 |
9.1 Sporadic Customers (~2.5%)
New customers expected to complete less than two transactions per year. Generally low-risk. KYC information collected at onboarding. Inherent Risk: Low (1)
9.2 Routine Customers (~95%)
Customers conducting more than two transactions per year. KYC information collected at onboarding. Inherent Risk: Low (1)
9.3 High-risk Customers (<3%)
Customers deemed high-risk due to unusual volume/velocity of transactions. Most transactions are not suspicious but unusual given our business model. Inherent Risk: High (3)
9.4 Prohibited Customers
Customers outside our risk tolerance. We will not do business with:
- Weapons, arms dealing or defense companies
- Entities associated with atomic energy
- Drug dealers
- Human trafficking entities
- Pornography entities
- Unlicensed Gambling
- Unlicensed fiat money service businesses
- Non-licensed Bitcoin ATMs
- Customers performing third-party transactions
- Entities involved in ML/TF activities
- UN and/or Canadian government sanctioned entities
Inherent Risk: High (3)
10–11. New Developments, Technologies & Other Factors
10. New Developments & Technologies
As an existing business launching into Canada, all related technologies and compliance recordkeeping systems are previously tested and known to be effective. The Compliance Officer is involved in day-to-day operations.
Inherent Risk: Medium (2)
11. Other Factors
| Factor | Inherent Risk | Rating |
|---|---|---|
| Relevant Operational Processes | High | 3 |
| Employees (~60 full-time, 15 focused on Canadian business) | High | 3 |
| Financial Services Suppliers | High | 3 |
| Non-Financial Suppliers | Low | 1 |
| Total (Average) | High | 3 |
12–17. Controls
We take our duty to prevent, detect, and deter money laundering and terrorist financing seriously, and have developed controls to ensure that our business is not used to launder money or finance terrorism.
13. Products, Services & Delivery Channels Controls
- All facilities have security systems (secure entry, video surveillance, alarm systems)
- IT devices and data access points have secure access, authentication and monitoring
- AML/CTF related reports restricted to Compliance Officer and designates
- No transactions with countries listed as non-cooperative by FATF
- Transaction limits apply to each transaction
- Staff trained to recognize suspicious transactions/customer behaviour
- All virtual currency payments checked by Chainalysis platform
Residual Risk: Low (1)
14. Geography Controls
- No transactions with countries listed as non-cooperative by FATF
- Transactions with UN Security Council sanctioned countries require additional processes
- High-risk FATF jurisdictions subject to additional controls and verification
- Each customer's location considered as part of risk ranking
Residual Risk: Low (1)
15. Customers & Business Relationships Controls
- All customers and business relationships required to complete full KYC process
- All customers subject to transaction monitoring
- All customers screened against publicly available lists
- Records of all customer transactions maintained electronically
- Enhanced transaction monitoring for high-risk customers
- Enhanced due diligence (EDD) for high-risk customers
- Prohibited customers prevented from conducting transactions
Residual Risk: Low (1)
16–17. Technology & Other Factor Controls
- Compliance Officer involved in day-to-day business
- All new systems thoroughly tested before implementation
- AML Compliance program subject to external review at least every two years
- All staff receive AML/CTF training within 30 days of employment, then annually
- All new staff screened with interviews, reference checks, and criminal background checks
- Only reputable financial services suppliers used with effective AML/CTF controls
Residual Risk: Low (1)
18. Customer & Business Relationship Risk Ranking
Certain customers may pose a higher risk based on unique characteristics. We divide customers into High, Medium, and Low risk buckets. High-risk customers are flagged in our IT platform based on:
- Products, services and delivery channels used
- Geographical location of customer and transactions
- Customer characteristics (residency, industry/occupation, income vs activity)
- Transaction type, volume, frequency, and channel
- Technology factors (mobile, desktop, IP addresses)
High-risk Customer Criteria
The following customers are always deemed high-risk:
- Customers under investigation by a regulator
- Non-individual customers without completed beneficial ownership determination
- Individual customers in "gatekeeper" occupations (Accountant, Lawyer, Real Estate Agent, etc.)
- Non-individual customers in cash intensive businesses (MSBs, Pawn Shops, Jewellery Stores, etc.)
- Customers that triggered STR/ASTR within the past year or 3+ in total
- Customers with financial ties to FATF non-cooperative jurisdictions
- Customers refusing identification requirements
- Politically exposed persons (PEPs)
- Customers performing undisclosed third-party transactions
- Organizations with obscured ownership structures
- Companies issuing bearer shares
Customer Review Schedule
- High-Risk: Daily to every 6 months
- Medium-Risk: 9 months
- Low-Risk: At least every 12 months
19–20. Transaction Monitoring & Enhanced Due Diligence
19. Transaction Monitoring
The Compliance Officer or designate monitors transactions for potentially suspicious transactions. For high-risk customers, enhanced transaction monitoring is conducted with review of customer information and activity for the past two years.
High-risk customer accounts are reviewed at least every 6 months, and more frequently when triggered by customer activity. All notes are maintained in IT systems for at least five years.
20. Enhanced Due Diligence
High-risk customers require a level of due diligence beyond regular customers. Enhanced due diligence activities may include:
- Analysis of IP address changes vs previous transactions
- Unusual transaction sizes or frequency
- Change in redemption patterns
- Email address change requests
Appendices
Compliance Officer References
- FATF: www.fatf-gafi.org/ – Lists of high-risk and non-cooperative countries
- FINTRAC: www.fintrac-canafe.gc.ca – Canadian AML/CTF legislation and guidance
- Know Your Country: http://knowyourcountry.com/ – Country risk metrics
- OSFI: www.osfi-bsif.gc.ca – Best practices guidelines
Country Risk Rating Methodology
KnowYourCountry.com risk-ranking tool provides ML/TF risk measures based on data from international and government agencies with the following weightings:
- Money laundering/terrorist financing risks: 56%
- International sanctions: 15%
- Corruption risks: 10%
- World Governance Indicators: 3%
- Narcotics Major List: 3%
- Human Trafficking: 3%
- EU Tax Blacklist: 5%
- Offshore Finance Centre: 5%
Selected Country Risk Ratings
| Country | Score | Risk |
|---|---|---|
| Sweden | 87.56 | Low |
| Estonia | 84.35 | Low |
| Singapore | 76.83 | Low |
| Canada | 75.72 | Low |
| United Kingdom | 74.38 | Medium |
| United States | 74.64 | Medium |
| Malta | 63.73 | Medium |
| Turkey | 40.98 | High |
| North Korea | 20.93 | High |
| Iran | 17.83 | High |
Contact
For any questions regarding this risk assessment, please contact the Compliance Officer: compliance@altivest.io
This document forms part of the compliance programme of 1001148579 Ontario Corporation, trading as Altivest, FINTRAC registration C10001709. Questions may be directed to compliance@altivest.io.