This AML / KYC Policy ("Policy") of BTG Pactual Portugal – Empresa de Investimento, S.A. ("the Firm") implements all applicable European Union and Portuguese anti-money-laundering, countering-the-financing-of-terrorism, counter-proliferation-financing (AML/CFT/CPF) and customer-due-diligence legislation that apply to an investment firm authorised under MiFID II and supervised by the Comissão do Mercado de Valores Mobiliários (CMVM) under licence nº 414/21. It is binding on every director, officer, employee, contractor, agent, tied agent, outsourcing provider, distributor and branch of the Firm.
Primary Legislation
- Directive (EU) 2018/843 (5th AMLD) transposed by Lei 83/2017, of 18 August (Lei de Banca), as amended by Lei 74/2020 (6th AMLD transposition).
- Regulation (EU) 2018/1672 (TFSR1) on transfers of funds.
- Directive (EU) 2016/2258 / Lei 109/2021 — access to centralised bank & payment account registers.
- CMVM Instruction DSI 1/2021 – AML/CFT obligations of investment firms.
- Banco de Portugal Circular Letter 8/2021/DSB, updated.
- EU Sanctions (CFSP) Regulations and their national transpositions.
International Standards
- Financial Action Task Force on Money Laundering (FATF) Recommendations (2012+2023 update) – 40 Recs + 11 Immediate Outcomes.
- FATF Guidance on Digital ID, VASP & Travel Rule (FATF Rec. 16 – R.16bis).
- Wolfsberg Group CBDQ 2023 — Questionnaire for Correspondent & Institutional Onboarding.
- Basel Committee on Banking Supervision (BCBS) Sound management of risks related to money laundering and financing of terrorism (2020).
The overriding objective of this Policy is to ensure that the Firm, its clients, its technology infrastructure, its global network of correspondent banks and LPs and its group affiliates are never used, whether wittingly or unwittingly, to (a) launder proceeds of crime; (b) finance terrorism, proliferation of weapons of mass destruction, human trafficking, drug trafficking, organised crime, corruption, bribery, tax fraud (qualified under Art. 3 Lei 83/2017 as predicate offence); or (c) circumvent any United Nations, European Union or unilateral financial sanctions.
The Firm operates the standard "Three Lines of Defence" (3LoD) operating model for financial-crime risk management:
- First Line (Business) — Client-facing onboarding teams, relationship managers, private client advisors, operations (payments, settlements). Own the identification of red flags during day-to-day CDD. All first-line staff must be AML-certified (CAMS, ICA, or internal certified curriculum).
- Second Line (Risk, Compliance, Financial-Crime Prevention Unit) — Owns this Policy, designs controls, sets the Risk Appetite Statement for ML/TF/PF risk, performs independent quality assurance on escalations, and is the first review layer of alerts. The Money Laundering Reporting Officer (MLRO) and the Deputy MLRO sit in the 2nd Line, report directly to the Chief Compliance Officer & Board Risk Committee, and have free, unobstructed access to the CMVM, Banco de Portugal and the Serviço de Informações Estratégicas de Defesa (SIOE/FIU).
- Third Line (Internal Audit + External Supervisors) — Internal Audit performs, at minimum once every 18 months, a risk-based independent audit of the AML/CFT framework, including the CDD/EDD programme, the alert-generation rules, the STR drafting process, the staff training records and the governance & MI. The CMVM and BdP exercise on-site and thematic inspections ex officio.
MLRO Contact for Authorities Only
Name: Head of Financial Crime Prevention / MLRO, BTG Pactual Portugal
Secure email (TLS 1.3): mlro@btgmarket.com
Postal (courier registered): MLRO, Compliance Department, Av. da Liberdade 180, 1250-146 Lisboa, Portugal.
Any employee, officer, contractor or tied agent who suspects — on an objective basis and in good faith — that money laundering, terrorist financing or sanctions circumvention is occurring or has occurred, shall report immediately and without delay to the MLRO, under the protection of the whistleblowing framework of Art. 37 Lei 83/2017 and Lei 93/2021 (EU Whistleblower Directive transposition). No detriment, retaliation, demotion, termination or adverse employment consequence shall arise from such a report made in good faith.
CDD is performed 100% of the time, for every client, before the establishment of any business relationship, in accordance with Art. 8 Lei 83/2017 and FATF Rec. 10. There are no qualitative exemptions on the MiFID "occasional transaction below €15,000" for leveraged CFD products, because of the elevated risk profile and cross-border flows. Standard CDD comprises five concurrent steps:
- Identification of the Customer (natural person): full name (first/middle/last as per government ID), DOB, POB, nationality, NIF/NISS, residential address, e-mail, mobile phone (verified with OTP and international-valid E.164 format), government-issued ID (passport, national ID card, biometric residence permit) — verified via liveness + OCR + document-forgery detection vendor, supplemented by automated sanctions/PEP/adverse media screening.
- Verification of Legal Persons: trade registry extract (≤ 3 months old), articles of association, NIPC registration, evidence of shareholding structure chart down to UBO level, certificate of good standing for offshore companies, list of directors & authorised signatories (with specimen signatures), authorised powers-of-attorney and their scope.
- Identification of the Beneficial Owner(s) — per Art. 12 Lei 83/2017 (see §5).
- Understanding the Nature & Purpose of the Business Relationship — collection and documentation of: (i) investment objectives / time horizon / risk appetite; (ii) source of wealth (SoW) and source of funds (SoF); (iii) expected level & geography of activity, typical transaction types, values and volumes.
- Risk Classification (ML/TF Risk Scoring) — risk score assigned on a 0–100 numeric composite based on country/jurisdiction risk (FATF, Basel AML Index, Transparency Intl CPI), product/service risk (leverage, anonymity, cash-intensive, VASP interaction), client/industry risk, delivery-channel risk (digital vs in-person). Thresholds: Low (0–30) → Simplified CDD; Medium (31–60) → Standard CDD; High (61–100) → Mandatory Enhanced Due Diligence (EDD).
Where onboarding is performed remotely and not in person (our default channel), additional mitigating controls are applied in accordance with Art. 13 Lei 83/2017 & BdP CL 8/2021 Annex I: liveness check (AI + manual review), cross-check against public civil registries (IRN/RNPC), mandatory second identity document, geolocation IP match with declared country of residence, video interview if composite score ≥ 55, mandatory source-of-funds bank-statement upload + open-banking verification for first deposit ≥ €10,000.
Enhanced Due Diligence (Art. 15 Lei 83/2017, FATF Rec. 10 + 19 + 22) is mandatorily applied, without exception, in the following high-risk situations:
- PEPs, their Family Members or Close Associates (FCA) — domestic PEPs (any Portuguese public administration position listed in DRE Lists), European PEPs, international/UN PEPs, Heads of State/Gov, Members of Parliament, senior judiciary, armed-forces OF-5+, members of governing bodies of state-owned enterprises.
- Clients who are nationals, tax residents, passport-holders or have address, phone, IP, bank account in high-risk third countries identified under Art. 9 Directive (EU) 2016/1675 (EU AMLD list of high-risk third countries with strategic AML/CFT deficiencies — as updated by Delegated Regulations) and by FATF "Call for Action" (Black List) and "Jurisdictions under Increased Monitoring" (Grey List) — enhanced monitoring, 100% MLRO prior approval on relationship establishment.
- Cross-border correspondent / payable-through accounts with institutions domiciled outside the EU/EEA and without equivalent AML supervisory regimes — Wolfsberg CBDQ, internal onsite or desk-based audit, assessment of the home supervisor, documented rationale for the relationship.
- Cash or cash-equivalent transactions ≥ €10,000 or series/splitting/structuring below the threshold with same beneficiary / same payer / same IP within a rolling 30-day window — UBO, SoF, SoW documents requested and reviewed by senior Compliance analyst.
- First deposit or series of deposits / withdrawals from or to e-money wallets, VASPs, exchanges, casinos, gaming, lotteries — source of wealth, purpose of transactions, proof of activity (tax returns, pay slips, audited financials, contracts, property deeds).
- Clients active in high-risk sectors: defence, arms, mining, oil & gas upstream, gambling, crypto/DeFi, art & precious-metals cash-dealers, charities (NPOs/NGOs per FATF Rec. 8), offshore shell holding companies, bearer-share or nominee-share structures.
- Transactions involving virtual assets (VAs) or transfers to/from virtual asset service providers (VASPs) — full Travel Rule (FATF R.16/16bis) data required: originator + beneficiary VASPs, VA TXIDs, originator and beneficiary full names + geographic identifiers.
EDD output is documented on the "EDD Worksheet" with (a) senior Compliance / MLRO sign-off; (b) documented SoW/SoF narrative with corroborating documents; (c) enhanced ongoing monitoring thresholds (§7); (d) periodic re-KYC at least every 12 months (instead of the standard 24 / 36 months).
In line with Art. 12 Lei 83/2017, Art. 30 5th AMLD and Regulation (EU) 2015/849 of the 4th AMLD as regards central registries, the Firm identifies and verifies the identity of any and all natural persons who ultimately own or control the client ("Ultimate Beneficial Owners / UBOs") through one or more of the following criteria:
- Direct or indirect ownership of, or entitlement to, more than 25% + 1 share of the capital or voting rights of a corporate/legal person (single, aggregated or concert-party ownership, chains of ownership traced through every intermediate layer, trusts, foundations, limited partnerships, nominee/registered-agent arrangements).
- Any natural person who exercises control, directly or indirectly, over the senior management, administration or strategy of the entity (CEO, CFO, Chairman, majority of the Board, sole managing director with veto, protector or enforcer of a trust / foundation / fonds de commerce).
- When no natural person under the first two criteria can be identified with reasonable certainty, the identity of the natural person(s) who hold(s) the position of senior managing official(s) of the legal person (in Portuguese: Órgão de Administração presidente + director financeiro) shall be recorded, and the lack of UBO identification is documented, escalated and justified in writing, with re-verification every 6 months.
Data reported automatically, when available in the EU ESSIF/eIDAS cross-border federation, to the Central Beneficial Ownership Registry (Registo Central do Beneficiário Efetivo – RCBE) of the Portuguese Ministry of Justice, under the terms of Art. 45-D Lei 83/2017, as a mandatory counterparty filing obligation of an obliged entity.
PEP lifecycle: at onboarding (initial automated + manual screening), ongoing continuous screening (every 24 hours on delta lists, within 2 hours of a list update), change-of-circumstance trigger, and at re-KYC. Screening includes the PEP candidate, spouse, civil-union partner, children & step-children, parents & siblings, known close business associates (C suite of the same corporate group, joint ventures, foundations). Vendor providers: Dow Jones Risk & Compliance, LexisNexis® WorldCompliance™, Refinitiv World-Check One, with manual dual-review on every positive hit by two independent Compliance analysts and final approval by a PEP Committee. False-positive rate KPIs: ≤ 15% of alerts reviewed.
Sanctions screening is applied 24/7 to the following entities and data, with the same vendor stack + EU Council Consolidated List (real-time XML feed 4× daily), HM Treasury / OFAC / UN SC Consolidated Lists, and national lists published by the Autoridade de Segurança Alimentar e Económica (ASAE): names, aliases, transliterations, DOB, birthplace, nationality, passport number, NIF, tax IDs, street address, IBAN/BIC, telephone numbers, email addresses, IP Geolocation, corporate names, BIC/LEI, DUNS numbers, vessel IMO numbers, aircraft tail numbers, crypto wallet addresses, TXIDs. The sanctions matching algorithms apply Levenshtein edit distance ≤ 0.15 threshold + SOUNDEX/Metaphone phonetic + custom synonym dictionaries for Arabic / Cyrillic / Hanzi / Indic / Farsi scripts (diacritics stripped).
Sanctions hits are instantly escalated to the MLRO, the account and any pending transactions are frozen pending outcome of the investigation, and — where positive match is confirmed — all obligations under the sanctions regime (freeze, mandatory disclosure to the competent national authority, prohibition to make funds or economic resources available directly/indirectly, prohibition to circumvent by channelling through a third party) are executed in strict accordance with Art. 6+7 of the Council Regulations. No tipping off of the client or third party is permitted where such disclosure would prejudice a criminal investigation or FIU action — protected under Art. 36 Lei 83/2017.
The Firm does not, and cannot, rely on a one-time-only CDD snapshot. Ongoing monitoring is continuous and operates on three pillars:
- Continuous Transaction Monitoring (TM) engine — rules-based + machine-learning anomaly detection (unsupervised auto-encoders + supervised XGBoost on historical STR labels) covering the following scenario libraries with 200+ red-flag indicators (typologies from Europol FIU.NET, Egmont Group, FATF typologies reports): structuring / smurfing, rapid round-tripping, layering with UBO-obscuring jurisdictions, geo-risk unusual, micro-then-macro deposits, fan-in/fan-out, dormancy bursts, transactions without economic rationale, U-turn, back-to-back mirror trades, round-number clustering, VASP mixing service, chainalysis high-risk score, round-tripping via art/collectibles.
- KYC Refresh triggers — every 24 months (Low risk), every 18 months (Medium), every 12 months (High / PEP / High Risk jurisdiction). Re-KYC is also triggered by a material change of circumstances (change of address, name, passport, bank details, authorised signatories, beneficial owners, account type upgrade, substantial increase in trading size or frequency, material adverse media).
- Management Information (MI) produced monthly for the Risk Committee: total alerts generated, alert-to-STR conversion rate, FPR %, analyst backlog, average resolution time, top 10 scenario hits, top jurisdictions flagged, staff training coverage %, third-party KYC vendor performance, MLRO/Deputy absences.
All CDD/EDD evidence, screening reports, transaction monitoring alerts, underlying documentation of payments, correspondence (email, call recordings, chats), STR/SAR filings, training certificates, compliance reviews, audit reports and committee minutes are retained for a period of FIVE (5) years after the date of termination of the business relationship or after the date of the last occasional transaction, whichever is later — per Art. 30 Lei 83/2017 and Banco de Portugal CL 8/2021 Annex IV. An extended retention period of SEVEN (7) years is applied where a litigation, investigation, STR, FIU information request, regulatory request or enforcement action is open at the expiry of the 5-year window. Storage is in encrypted, WORM-compliant (Write-Once Read-Many) immutable cloud object repositories (S3 Glacier Compliant Mode) in EU/West region, with integrity hashes (SHA-256) timestamped via qualified electronic timestamp service (RFC 3161). Access is strictly 4-eyes principle, RBAC, full tamper-evident audit log.
Any suspicion — however partial, however preliminary — that funds derive, directly or indirectly, from criminal activity or that a transaction is linked to terrorist financing, proliferation financing, sanctions evasion, or any other ML predicate offence, shall be reported internally without delay, at the very latest within 24 hours of the suspicion arising, to the MLRO via the dedicated secure workflow on the Compliance Portal (or by encrypted email if the portal is unavailable).
The MLRO evaluates the report and the supporting investigation package and, where the suspicion is substantiated on an objective basis, submits a Suspicious Transaction Report (STR) — in Portugal denominated Comunicação de Operações Suspeitas (COS) — to the Portuguese Financial Intelligence Unit (UIF-Portugal, part of the PJ) via the UIF secure e-portal, within the statutory deadline of 2 business days from internal report receipt, or, for urgent cases with imminent terrorism-financing, within a few hours. Tipping off is prohibited. The Firm is fully indemnified under Art. 35+36 Lei 83/2017 for disclosures made honestly and in good faith, notwithstanding any obligations of professional secrecy or confidentiality.
Non-ML/CFT regulatory breaches (MiFID conduct, market abuse, best execution, IT security) are reported via the separate whistleblowing channel mandated by Lei 93/2021 (Proteção de Denunciantes). BTG Pactual Portugal maintains a confidential, anonymous, third-party hosted whistleblowing platform with secure case management accessible at whistleblower@btgmarket.com and the dedicated toll-free number listed on the intranet & investor disclosure page. Follow-ups, protection measures and disciplinary outcomes are implemented per Art. 17 and 19 Lei 93/2021.
- Induction AML training (minimum 8 contact hours, proctored exam ≥ 80% pass mark) is mandatory for every new joiner of the Firm on day-one before access to production systems or client information is granted.
- Refresher training is delivered at a minimum of once every 12 months for all staff, with role-based modules (front-office, onboarding, compliance, IT, product, finance, tax, legal, HR) and scenario-based case studies from recent EU FIUs. CPD hours are logged and reported annually to the Board and to the CMVM upon request.
- Targeted training on material legislative changes (e.g. travel rule for VASPs, new EU sanctions packages) is delivered within 30 calendar days of publication of the final text.
- Independent AML/CFT audit performed by an external big-four or specialised firm, approved by the Board Risk Committee, at least once every 18 months, or more frequently if required by a CMVM or BdP supervisory action plan. The final audit report is addressed to the Chairman of the Board, the Chairman of the Audit Committee, and, without redactions, to the CMVM & Banco de Portugal within 5 business days of its adoption by the Board.
Clients undertake at all times, as a condition precedent to the continuation of the business relationship, to: (a) provide true, accurate, complete and up-to-date identity, UBO, SoW/SoF information; (b) notify the Firm within 10 calendar days of any change to such information; (c) promptly respond to any Compliance request for supporting documentation within the deadline indicated on the request; (d) cooperate in good faith with any re-KYC / EDD exercise.
Consequences of non-cooperation (documentation not supplied after two reminders + 30 calendar days, repeated false or misleading information, provision of forged documents, refusal to complete EDD worksheet):
- Step 1: Restricted-function account — no new trading, no new deposits; only pending order management & withdrawals permitted
- Step 2: If non-cooperation continues beyond 60 calendar days, the Firm shall exercise its right under Art. 14(5) Lei 83/2017 to terminate the business relationship with immediate effect and report a "relationship-terminated-due-to-failure-to-comply-with-CDD" to the UIF and/or the CMVM as appropriate.
Sanctions & Penalties reminder: Under Portuguese legislation (Lei 83/2017), a breach of AML obligations by a member of the administrative, supervisory or management body of an obliged entity may result in personal administrative fines up to €5,000,000, and, for criminal offences of money-laundering under Arts. 368–371 of the Portuguese Criminal Code (Código Penal), imprisonment of up to 12 years. Breaches by obliged entities themselves are sanctioned under Art. 32 Lei 83/2017 with administrative fines up to 10% of annual worldwide consolidated turnover, public naming & shaming, temporary or permanent removal of licence, and CMVM-imposed business restrictions.