In recent years, many people have become familiar with the phrase “anti-money laundering” and have encountered it in practice when they have had to fill in a customer questionnaire (‘KYC’) or submit contracts and other documents to a fintech company in support of a payment transaction. Even honest fintech customers have been faced with situations where their payments have been suspended for several weeks and they have not been adequately informed of the reasons for this nor of the timeframe for resuming payments.

In this article, I will look at what rights fintech companies have and where the limits of their rights are set by the law and the Bank of Lithuania’s interpretations.

Rights and Duties of Fintech Companies

Fintech companies, which usually operate on the basis of an electronic money institution licence issued by the Bank of Lithuania, provide the services of opening accounts (also known as wallets), making payments from/to them and issuing payment instruments (usually VISA or MasterCard payment cards).

An e-money institution licence is an authorisation granted by a supervisory authority (in Lithuania, the Bank of Lithuania) that allows an undertaking to provide financial services, including issuing e-money and providing payment services.

The Law on Prevention of Money Laundering and Terrorist Financing of the Republic of Lithuania obliges fintech companies to get to know their customers and monitor their transactions, namely:

1. Identify the customer. It is obligatory to collect certain information and documents that allow the identification of the person (e.g. a document confirming the person’s identity, the company’s articles of association (if the client is a legal entity), a power of attorney, etc.);
2. Establish the identity of the beneficial owner. If the client uses the services of a fintech company for the benefit of another person (‘beneficial owner‘), the identity of that person must also be established. In the case of legal persons, which are merely a legal fiction, the identity of the beneficial owners must always be established. Individuals, as a rule, act for their own benefit and therefore the identity of the beneficial owner is rarely established in addition;
3. Monitor customer transactions and arrangements. Customer payments and arrangements must be monitored for any criminal activity (fraud, money laundering, etc.). To this end, fintech companies need to put in place monitoring systems and employ staff capable of identifying suspicious transactions;
4. Report suspicious transactions and arrangements. The Financial Crimes Investigation Authority of Lithuania (‘FNTT’) must be notified of any suspicious transactions or transactions that have or may have links to criminal offences no later than 1 working day after the suspicion arises;
5. Suspension of transactions. Suspicious transactions must be suspended until the circumstances of the transaction have been clarified and it has been established whether it is related to a criminal offence;
6. Retention of information. Fintech companies must keep information on transactions made by customers, including information on suspicious transactions and transactions.

These duties are detailed in the acts approved by the Financial Crime Investigation Service and the Bank of Lithuania, as well as in other documents (recommendations, interpretations, etc.).

In performing their duties in the field of prevention of money laundering and terrorist financing, fintech companies have the right to obtain information and documents from clients. These are requested for the purpose of establishing identity and gathering evidence to confirm or deny suspicions of a customer’s links to criminal activities.

Fintech companies have the right to request and receive contracts entered into by clients, statements from clients’ accounts, explanations from clients about their relationships with other persons, etc.

Limits On The Rights Of Fintech Companies

Right to information and documents. Fintech companies may request documents and information, but only to the extent that it relates to suspicions that a client’s activities are criminal and only to the extent that it relates to the client’s transactions that he has carried out or was about to carry out with the fintech company.

Fintech is not a subject of pre-trial investigation and therefore cannot organise and conduct criminal investigations. Fintech’s rights are limited to obtaining information and documents from the customer, evaluating them and informing law enforcement authorities that the information available suggests that the customer may be committing or planning to commit a crime.

Right to stop payment transactions. Laws (such as the Law on Payments of Lithuania) set deadlines within which a payment or other financial service must be completed. Failure to comply with these deadlines is an offence for which the Bank of Lithuania may impose a fine on the fintech company.

Failure to respect the deadlines is only allowed in exceptional cases. Force majeure circumstances or public and security interests are among them.

Fintech companies have the right to suspend a transaction if they have reasonable suspicion that the transaction may be related to money laundering or other crimes. However, the suspension period must be as short as possible.

The Bank of Lithuania has publicly recommended that the typical period for checking suspended payments should not exceed 3 working days. The period of suspension of payments may be longer if the customer is slow to provide information, does not communicate, the volume of documents submitted by the customer is large, the documents are in foreign languages or for other objective reasons. If the verification takes more than 3 working days, the fintech must inform the customer properly about the process and the timeframe for withholding payment.

If the FNTT is informed of a suspicious transaction, it must examine the report within 10 working days and inform the fintech company of the next steps. If the FNTT does not reply within the specified time limit, the fintech must resume the transaction.

The right to terminate the relationship with the client. The state restricts cash payments, which makes having an account a necessity not only for businesses but also for individuals. Without an account, the possibilities of doing business or getting a job are very limited.

Related to this is the Bank of Lithuania’s instruction to fintech companies and other financial institutions that account closure and the termination of business relations with a customer are only possible as a last resort.

If a fintech company determines that a client is engaged in risky activities or has complex transactions, the fintech firm must look for ways to manage the risks posed by the client. Only in cases where the monitoring and control measures in place do not adequately ensure the prevention of money laundering and terrorist financing, the fintech firm has the right to close the account and terminate the relationship with the customer.

It is important to note that the termination of the relationship must specify on what legal basis (specific law and its article, specific clause of the rules for the provision of payment services, etc.) and for what reasons the financial institution has taken the decision to terminate the relationship. The Bank of Lithuania strictly requires fair, transparent and proportionate treatment of customers.

The only exception to this is when disclosure is not required or even prohibited by law – an investigation by a law enforcement authority of a particular client. If the latter finds out that the fintech has tipped off law enforcement, the client may try to hide the clues, abscond, etc.

_{___________________}

^{Images from Pixabay.}