1. Introduction
This Policy for the Prevention of Money Laundering and Terrorist Financing (PLD/FT — anti-money laundering and counter-terrorist financing, AML/CFT) is intended to establish the principles, guidelines and responsibilities adopted by Trio to ensure the integrity of its operations, preserve its reputation and contribute to the soundness and security of the national and international financial system.
This policy is based on Lei nº 9.613 (Law No. 9,613), of March 3, 1998, and the amendments made to it by Lei nº 12.683 (Law No. 12,683), of July 9, 2012, as well as on the other rules and regulations applicable to the institution's activities.
Trio reaffirms its commitment to implementing effective internal controls, adopting procedures aligned with market best practices and cooperating with the competent authorities, in particular the Council for Financial Activities Control (COAF), with a view to preventing, detecting and reporting situations related to money laundering and terrorist financing. In this context, it submits its AML/CFT process annually to assessment by an independent audit firm, ensuring an independent assessment of its effectiveness and of its adherence to regulatory requirements.
2. Terms and definitions
2.1. When referred to in this policy, these terms shall have the following meanings:
2.1.1. COAF: Conselho de Controle de Atividades Financeiras (Council for Financial Activities Control), Brazil's Financial Intelligence Unit (FIU), responsible for receiving, analyzing and disseminating financial information to prevent and combat money laundering and terrorist financing. It operates throughout the national territory, with technical and operational autonomy, and is administratively linked to the Central Bank of Brazil.
2.1.2. KYC: Know Your Customer (Conheça seu Cliente), a set of procedures for identifying, verifying and validating the customer's identity, as well as for analyzing the origin of their funds and the nature of their activities.
2.1.3. KYE: Know Your Employee (Conheça seu Colaborador), a due diligence process applied to employees, executives and service providers, involving the collection and analysis of information to identify integrity and reputational risks and conflicts of interest.
2.1.4. KYP: Know Your Partner (Conheça seu Parceiro), procedures for verifying and analyzing business partners, correspondents and outsourced service providers, with the aim of confirming their good standing and regulatory compliance. 2.1.5. KYS: Know Your Supplier (Conheça seu Fornecedor), procedures for verifying, qualifying and monitoring suppliers, with the aim of ensuring their good standing, operational capacity, tax compliance and compliance with legal, regulatory and internal requirements, mitigating operational, reputational and integrity risks in the supply chain.
2.1.6. KYT: Know Your Transaction (Conheça sua Transação), an ongoing process of monitoring and analyzing the financial transactions carried out by customers, intended to identify patterns, deviations or atypical transactions that may indicate suspected money laundering or terrorist financing.
2.1.7. Money laundering: under Law No. 9,613, of March 3, 1998, money laundering is the process of “concealing or disguising the nature, origin, location, disposition, movement or ownership of assets, rights or values derived, directly or indirectly, from a criminal offense.”
2.1.8. PLD/FT: Prevenção à Lavagem de Dinheiro e ao Financiamento do Terrorismo (Prevention of Money Laundering and Terrorist Financing; AML/CFT).
2.1.9. Policy: For the purposes of this document, the Policy for the Prevention and Combating of Money Laundering and Terrorist Financing established by Trio.
3. Scope
All of Trio's employees, agents, partners and executives must observe and fully comply with the provisions of this policy, and practices that contravene its principles or current legislation will not be tolerated. Ethics, transparency and regulatory compliance are essential pillars of Trio's activities.
4. Guidelines
4.1. Organizational culture
4.1.1. With the purpose of fostering an ethical, upright and transparent environment, Trio adopts an organizational culture program aimed at disseminating its institutional values and ensuring that all employees receive the knowledge and training needed to correctly apply its internal policies and guidelines.
4.1.2. At least once a year, Trio will provide training on how the anti-money laundering and counter-terrorist financing policies work, in order to keep all of its employees properly up to date on the operation of the AML/CFT mechanisms and on any changes to the reference regulations.
4.2. Organizational structure and responsibilities
4.2.1. The AML/CFT program is managed by the Governance Directorate and operated by the Compliance Department, which is responsible for establishing the guidelines and implementing the relevant processes.
4.2.2. The Compliance Department is responsible for ensuring that, where applicable, information indicating knowledge or suspicion of money laundering is duly reported to the competent authorities.
4.3. Independent Audit
4.3.1. Trio has an independent external audit, responsible for conducting an autonomous and objective assessment of the adequacy, effectiveness and compliance of the AML/CFT program through a systematic and disciplined approach.
4.3.2. The purpose of the independent audit is to assess the processes, internal controls and governance related to the prevention of money laundering and terrorist financing, including adherence to the regulatory provisions in force.
4.3.3. The scope of the independent audit includes, at a minimum:
- the assessment of the effectiveness of the AML/CFT Policy;
- the adherence of internal procedures and controls to the applicable rules;
- the consistency of the processes for monitoring, selecting and analyzing suspicious transactions and situations, including in light of the guidelines of Carta Circular nº 4.001/2020 (Central Bank of Brazil Circular Letter No. 4,001/2020);
- the quality of the reports submitted to the competent bodies.
4.3.4. The independent audit will issue periodic reports containing its conclusions, recommendations and any findings of deficiencies.
4.3.5. Where vulnerabilities or non-conformities are identified, the Compliance Department will be responsible for evaluating the findings and preparing an action plan to mitigate the risks identified, submitting it to senior management for review and follow-up.
4.3.6. Integration of Risk Assessment, Effectiveness and Audit The Internal Risk Assessment (AIR), the AML/CFT Policy Effectiveness Report and the independent audit work are complementary and interdependent elements of Trio's risk management process. The AIR supports the definition and improvement of internal controls, while the Effectiveness Report assesses how those controls perform in practice. The independent audit, in turn, carries out an autonomous verification of the adequacy and effectiveness of these structures, ensuring that any deficiencies and opportunities for improvement are identified. This set of mechanisms ensures a continuous, integrated and risk-based approach, aimed at the ongoing improvement of the AML/CFT program and adherence to current regulatory requirements.
4.4. Commitment of senior management
4.4.1. Trio's senior management must ensure continuous support for and commitment to the effectiveness of this Policy, fostering an organizational culture based on integrity, compliance and risk management at all levels of the institution.
4.4.2. This commitment is manifested as follows:
4.4.3. Allocation of adequate resources (human, technological and financial) for the implementation, maintenance and improvement of AML/CFT practices;
4.4.4. Support for and encouragement of the ongoing training of the teams responsible for carrying out this Policy;
4.4.5. Formal definition of organizational structures and assignment of clear responsibilities for the oversight, governance and effectiveness of the AML/CFT program.
4.5. Processing of Personal Data and Compliance with the LGPD
4.5.1. In accordance with the Lei Geral de Proteção de Dados Pessoais (LGPD — Brazil's General Data Protection Law, Law No. 13,709/2018), Trio ensures that the processing of personal data carried out within the scope of this policy is aimed at complying with legal and regulatory obligations related to the prevention of money laundering and terrorist financing.
4.5.2. Personal data will be processed based on the principles of purpose, necessity, security, transparency, minimization and accountability, as established in the LGPD.
4.5.3. The information collected in the KYC, KYP and KYE processes and in transaction monitoring (KYT) is used exclusively for identification, risk analysis, monitoring and reporting to the competent authorities (such as COAF and BACEN), where applicable.
4.6. Procedures and processes
4.6.1. Internal Audit
Trio may maintain an internal audit function, responsible for independently and objectively assessing the adequacy and effectiveness of the internal controls and processes related to the AML/CFT program.
Internal audit will act in a manner complementary to the independent audit and may carry out periodic tests and specific reviews and monitor the implementation of action plans arising from the findings identified.
4.6.2. Know Your Customer (KYC) Standard Operating Procedure A document that consolidates the rules and procedures adopted by Trio to prevent its use for the practice of unlawful or fraudulent acts, including money laundering, terrorist financing and corruption.
This process is conducted by the Compliance Department, and adequate records will be kept of all documentation obtained in the KYC processes and in the prior analysis of new products or services, for a minimum retention period of ten years.
4.6.3. “Know Your Employee” (KYE) Standard Operating Procedure A document that consolidates the rules and procedures adopted by Trio to ensure adequate knowledge of its employees, contributing to the identification of any involvement in unlawful or fraudulent practices, such as money laundering, terrorist financing and corruption, as well as to the mitigation of legal and reputational risks.
This process is conducted by the Compliance Department, and adequate records will be kept of all documentation obtained in the KYE processes and in the prior analysis of new products or services, for a minimum retention period of ten years.
4.6.4. “Know Your Partner” (KYP) and “Know Your Supplier” (KYS) Standard Operating Procedure A document that consolidates the rules and procedures adopted by Trio to prevent its use, whether intentional or not, for the practice of unlawful or fraudulent acts in its relationships with suppliers, including money laundering, terrorist financing, proliferation of weapons of mass destruction and corruption.
This process is conducted by the Compliance Department, and adequate records will be kept of all documentation obtained in the KYP and KYS processes, as well as in the prior analysis of new products or services, for a minimum retention period of ten years.
4.6.5. Reporting to the Council for Financial Activities Control (COAF) Reports are submitted in a timely manner, within the stipulated deadlines, through the official channels provided by COAF. Trio ensures the confidentiality of the information transmitted and the protection of the identity of those involved in the analysis and reporting process.
The process of reporting to COAF is conducted with the technical independence and autonomy of the Compliance Department, without the need for prior notice to the customer or to interested third parties, as provided for in current legislation.
4.6.6. Politically Exposed Persons
Transactions involving Politically Exposed Persons (PEP) must be monitored based on the risks they represent, according to the customer's registration record. Transactions involving PEPs will be duly monitored, and Trio is obliged to keep a record of these transactions.
4.6.7. Internal Risk Assessment (AIR) Report - AML/CFT Trio will periodically conduct an AML/CFT Internal Risk Assessment, as provided for in Art. 10 of Circular nº 3.978/2020 (Central Bank of Brazil Circular No. 3,978/2020). This assessment considers the risks inherent to the products and services offered, the customer profile, the geographic areas of operation, the distribution channels and the use of new technologies.
The Internal Risk Assessment will be formally documented and reviewed at least annually, or whenever there are relevant changes in operations, the organizational structure, the business model, products, services, the customer base or the regulatory environment.
Based on the results of the internal assessment, mitigation measures proportional to the degree of risk identified will be implemented, prioritizing the areas with the greatest exposure to AML/CFT risks. These measures may include adjustments to internal controls, improvement of monitoring processes, enhanced customer qualification (KYC), review of products or suspension of relationships considered high risk.
4.6.8. AML/CFT Policy Effectiveness Report
Trio will prepare the AML/CFT Policy Effectiveness Report annually, as provided for in Art. 62 of Central Bank of Brazil Circular No. 3,978/2020, with the aim of assessing the adequacy, effectiveness and efficiency of the procedures, internal controls and mechanisms adopted for the prevention of money laundering and terrorist financing.
The report must include, at a minimum, an analysis of the risks identified, the effectiveness of the monitoring processes and the quality of the reports submitted to the competent bodies, as well as adherence to internal rules and current regulations.
In addition, any deficiencies, opportunities for improvement and action plans will be identified, in order to ensure the continuous improvement of the policy and the strengthening of the Institution's governance and compliance culture.
4.7. Recording of transactions
4.7.1. A technology solution is used to record and identify the transactions carried out by customers.
4.7.2. To support the prevention and combating of money laundering and terrorist financing through technology, the computerized system records all transactions carried out.
4.7.3. The system will store in its records the greatest possible amount of information about the transaction, including but not limited to:
- The type of transaction;
- The amount involved;
- The origin of the funds;
- The ultimate beneficiary of the transaction.
4.7.4. The recorded data, even when personal, will be processed in accordance with the LGPD and used exclusively for the analysis and reporting of suspicious transactions, where applicable, with secure storage and for the regulatory retention period.
4.7.5. Within the limits of its responsibility and competence, Trio will act with the utmost rigor to comply with current legislation, including by reporting to the competent authority the occurrence of pre-specified transactions.
4.8. Expected conduct
4.8.1. Everyone has a duty to know and act in accordance with the principles and guidelines of this policy, seeking to prevent and detect atypical actions, operations or transactions that may arise from crimes.
4.8.2. Report with the utmost urgency any transaction or situation that shows signs of irregularity.
4.8.3. Commit to the effectiveness and continuous improvement of this policy and its related procedures.
4.8.4. Promote a culture of preventing and combating financial crimes.
4.9. Effects
4.9.1. Based on the results of the KYC, KYE, KYP and KYT procedures, the establishment of relationships with customers, employees and partners that do not have a good reputation or that show signs of irregularities will not be authorized.
4.9.2. The officers have the authority to order the termination of relationships with customers, employees and partners that, even while still under investigation, are found to have any involvement in the practice of financial crimes.
5. General provisions
5.1. All or part of the procedures in this policy may be performed internally or outsourced.
5.2. This policy will be reassessed at least annually by the Compliance Department, taking into account the reports issued by internal audit and by the independent audit, or whenever there are relevant legal, regulatory and operational changes, where applicable.
5.3. If you have any questions about any item or the application of this policy, contact compliance@trio.com.br or use the website trio.com.br.
5.4. If you are aware of, or have any indication of, non-compliance with the terms of this policy, contact compliance@trio.com.br, anonymously or with identification, or use the website trio.com.br.
6. Related documents
6.1. Code of Ethics and Conduct.
6.2. KYC, KYE, KYT and KYP/KYS procedures.
7. Regulatory references
7.1. Circular Bacen nº 3.978 (Central Bank of Brazil Circular No. 3,978), of January 23, 2020: Provides for the policy, procedures and internal controls to be adopted by institutions regulated by the Central Bank of Brazil for the prevention of money laundering and terrorist financing (AML/CFT).
7.2. Resolução BCB nº 119 (Central Bank of Brazil Resolution No. 119), of November 25, 2021: Provides for the policy, procedures and internal controls to be adopted by institutions authorized to operate by the Central Bank of Brazil with regard to AML/CFT, consolidating and updating rules previously set forth in Circular No. 3,978/2020.
7.3. Carta Circular nº 4.001 (Central Bank of Brazil Circular Letter No. 4,001), of January 29, 2020: Establishes guidance on the procedures and controls to be adopted by institutions authorized to operate by the Central Bank of Brazil for the prevention of money laundering and terrorist financing (AML/CFT).
7.4. Resolução CVM nº 50 (Resolution No. 50 of the CVM, Brazil's Securities and Exchange Commission), of August 31, 2021: Establishes the mechanisms, procedures and internal controls for the prevention of money laundering and terrorist financing in the securities market.
7.5. Resolução Coaf nº 40 (COAF Resolution No. 40), of November 22, 2021: Provides for the procedures for the identification and treatment of Politically Exposed Persons (PEPs) by persons subject to the supervision of the Council for Financial Activities Control (Coaf).
7.6. Lei Geral de Proteção de Dados Pessoais (LGPD — General Data Protection Law), Law No. 13,709, of August 14, 2018: Provides for the processing of personal data, including in digital media, by natural persons or legal entities governed by public or private law.
7.7. Lei nº 9.613 (Law No. 9,613), of March 3, 1998, as amended by Lei nº 12.683 (Law No. 12,683), of July 9, 2012: Provides for the crimes of money laundering or concealment of assets, rights and values, and establishes measures to prevent the use of the national financial system for such crimes.
7.8. Resolução CMN nº 4.595 (National Monetary Council Resolution No. 4,595), of August 28, 2017: Provides for the compliance policy of financial institutions and other institutions authorized to operate by the Central Bank of Brazil.