Case Documents

File No. CT 2005-006 COMPETmON TRIBUNAL IN THE MATIER OF the Competition Act, R.S.C. 1985, c. C-34, as amended;

IN THE MATTER OF an application by B-Filer Inc, B. Filer Inc. doing business as GPAY GuaranteedPaymentand NPay Inc. for an o~eursuant to section 103.1 granting leave to make application under se ~ons.75 •'· ·: ..... ;:.-:-;·-~~:-:~-:·- .~.~ 77 of the Competition Act; AND IN THE MATIER OF an application by B-Filer Inc.,jB-Filer Inc. doing business as GPA Y GuaranteedPayment and NPay Inc. fot:an interim t; ~' :~ ~:: 5 2006 onler pwsuant to sectioo I 04 oft he Compotllioa Act BETWEEN: B-FILER INC., B-FILER INC. doing business as GPAY GUARANTEEDPAY MENT and NPAY INC.

Applicants -and-THE BANK OF NOVA SCOTIA Respondent REPLY AFFIDAVIT OF CHRISTOPHER MATHERS (Sworn August 24, 2006)

I, CHRISTOPHER MATHERS, of the City Of Toronto, in the Province of Ontario, MAKE OATH AND SAY: 1. I have lectured and provided training in anti-money laundering ("AML") to both private and public sector organ.iz:ations in more than IS countries. I have provided advice and assistance on money laundering compliance and organized criminal activities to various public sector organi2:ations, including the Canadian Bar Association, the Investment Dealers Association, the Ontario Securities Commission, the Toronto Stock Exchange, as well as advice to organiz.ations in numerous foreign jurisdictions.

. f r~:-:. . :; ;,:.. .. .; ·,· .· .... : · "·"1:' i -- .. •.·, ...... ,,., .... ;,·-.,. .... : F P ~ u l '_ _" _ ::~ :-~ • , -: .c :-.:.:_C;' . l} ! ! Li Ii ;..:v; !~, O:'iT. 1O L3 l---..L<'".,..,~ ...............~ ......-...·

~2-2. For 20 years, between 1975 and 1995, I was a member of the Royal Canadian Mounted Police (the RCMP). During most of my career with the RCMP, I worked undercover with the RCMP, and also with the U.S. Drug Enforcement Administration and the U.S. Customs Service. I was a senior undercover operator with the RCMP Proceeds of Crime Section, where I established and operated a number of "store front" money laundering businesses in Canada and the U.S., targeting Columbian, Russian and Asian organized crime groups. 3. I retired from the RCMP in 1995 and joined the Forensic Division of the International accounting firm KPMG. In 1999, I was appointed to the position of President ofKPMG Corporate Intelligence Inc. I was responsible for international due diligence, asset recovery operations, and the investigation and prevention of organized crime and money laundering. I reported directly to the Chairman of KPMG. In this position, I provided advice to corporations, governments and individuals in the areas of foreign due diligence and threat assessment, corruption, money laundering compliance, fraud prevention and foreign and domestic information gathering. 4. I have written and lectured extensively on issues relating to money laundering. I also authored a non-fiction book in 2004 entitled "Crime School: Money Laundering" which has been published in both the United States and Canada and will be published in China and Estonia in 2006. 5. I have been qualified as an expert witness in money laundering in the Ontario Provincial Superior Courts. 6. I have reviewed the Affidavit of Jack Bensimon. The purpose of this affidavit is to reply to the issues raised in Mr. Bensimon's Affidavit insofar as they relate to Scotiabank's business justification for terminating the Applicants' accounts that is within my particular area of expertise,

namely, Scotiabank' s concerns about Anti-Money Laundering issues with respect to the Applicants' business. 7. I have organized my report by paraphrasing or quoting from Mr. Bensimon's affidavit on issues to which I wish to respond, followed immediately thereafter by my response in relation to the particular assertion. Mr. Bensimon's Assertion 8. The Respondent has failed to conduct an appropriate risk assessment. An appropriate risk assessment would include, while is not limited to, AML risk assessment, account risk assessment, and account risk profiling. These are consistent with using the well established risk-based industry standard approach for evaluating the relative risk of conducting business with MSBs. They form the basis for the overall risk assessment of the Applicants AML risk to the Bank of Nova Scotia. My Response 9. It is apparent from the documentation that the Applicants were not forthcoming with respect to information. For example, when the AML group (Mr. Kosek) asked Mr. Woodrow (the Branch Small Business Officer) before a decision was made to terminate the Applicants' accounts to request the Joint Venture Agreement between the Applicants and UseMyBank, this information was not forthcoming. It is also apparent from the transcripts of Mr. Grace's various examinations, especially in the Alberta proceeding and during cross-examinations in December 2005 in this matter, that he has been unwilling to produce information that would be necessary for Scotiabank to undertake an AML risk assessment. 10. Because of the lack of information supplied to Scotiabank, Scotiabank was not in a position to perform an AML risk assessment of the Applicants' business prior to termination of the banking relationship. It is noteworthy that there numerous reasons for the termination of the banking

-4-relationship, only one of which was a concern about AML issues. Although BNS did not perform an AML risk assessment, that is essentially what I have done for them in my original affidavit. Mr. Bensimon's Assertion 11. The Respondent's expectations as they relate to meeting specific AML regulatory thresholds go far beyond what is reasonably mandated by FINTRAC, and impose an unnecessary regulatory burden that places the Respondent as an implicit de facto regulator ofMSBs, rather than a facilitator to the MSB customer. My Response 12. I stand by the information in my original Affidavit with respect to Scotiabank' s obligations in providing banking services to this Money Services Business. All AML legislation, it could be argued, places a financial institution in the role of de facto regulator, in the manner by which an FI is obligated under statute to "Know Their Customer", perform due diligence and surveil and report transactions for suspicious activity. Mr. Bensimon's Assertion 13. The Applicants are operating an MSB. They are a customer of the bank and not an agent of the bank. The Respondent by no means has regulatory jurisdiction over the supervision of MSBs. The Respondent is required, however, to perform reasonable due diligence procedures to ensure that MSB customers meet minimum acceptable FINTRAC requirements. My Response 14. Although Scotiabank does not have "regulatory jurisdiction" over an MSB, it certainly has a requirement by statute to ensure that it is not participating in transactions that place the financial institution at risk. In order to reduce risk, the institution needs to take the necessary steps to avoid becoming involved in transactions that could potentially be associated to illegal activity. It must also

be wary of the danger of co-mingling funds of an unknown ultimate source (and possibly an illegal source or for an illegal purpose) with those of their legitimate customers. Mr. Bensimon's Assertion 15. The Respondent's position that the UseMyBank MSB does not comply with FINTRAC requirements, sufficient to warrant account maintenance, does not stand up to the scrutiny of established AML guidelines. The Respondent appears to be using AML regulatory arguments to justify the closing of MSB accounts on the basis that they failed to generate sufficient revenues. There is limited Canadian based empirical MSB research. However, recent research published by the American Bankers' Association (ABA) in June 2006 can be used as a point ofreference. The ABA indicates that legitimate MSBs generate relatively marginal revenue (relative to other types of businesses) for banks, and consequently, do not make for a favorable cost-benefit tradeoff. The independent risk assessment conducted as part of this opinion sheds light on the overall low risk exposure of the UseMyBank MSB. My Response 16. I disagree with Mr. Bensimon. The Applicants' activities are high risk to Scotiabank, and to the other financial institutions who have provided banking services to the Applicants. I am not aware of any evidence in the record that suggests that Scotiabank terminated the Applicants for the collateral reason that they only generated "marginal revenue". Mr. Bensimon's Assertion 17 . While the Applicants have several AML regulatory compliance gaps, the conducted and attached independent risk assessment shows that these are considered to be low inherent risk in the aggregate. It is strongly recommended that remedial efforts be made to close such gaps. This should further reduce the risk exposure to the Respondent, comply with all FINTRAC requirements, and impose internal controls to mitigate further risks.

My Response 18. The applicants don't have gaps. They have no AML compliance framework whatsoever. To consider this situation as "low inherent risk" is reckless and certainly does not subscribe to accepted international AML practices. Mr. Bensimon's Assertion 19. The method for transacting online payments is through securing the customer's bank card information and online password, and entering into the customer's account online to effectuate any transfers to finance customer service purchases. Although this method of effectuating money transfers has privacy compliance implications, it does not violate the requirements set out by FINTRAC for MSBs. My Response 20. Mr. Bensimon admits that the manner in which the Applicants conduct business has privacy compliance implications. From all of the information produced as part of the record, this was a significant issue for Scotiabank, and, in addition to AML concerns, a central reason why the Applicants' banking services were terminated by Scotiabank. Mr. Bensimon's Assertion 21. This MSB model is aimed at serving a segment of the population that either does not have or may not be able to secure a credit card (e.g., high credit risk, poor or damaged credit history). While many MSBs are legitimate businesses and serve credible market segments, banks are required under FINTRAC and OSFI regulations to take extra precautions and conduct additional testing to evaluate account risks. My Response 22. The argument that this MSB is targeting customers that have "high credit risk, poor or damaged credit history" is simply not true, in my opinion. Although players at sports books and

online casinos may, in fact, have all of those personal financial issues due to their gambling activities, U seMyBank is targeting customers who wager at online casinos. That is the main thrust of their business. Mr. Bensimon's Assertion 23. Given the method of processing transactions, the low volume oft ransactions, and the purpose for effectuating money remittances, it is my professional view that the Applicants are operating a business on behalfo f third parties rather than by third parties. Given the Applicants business model, it is a processor of online transactions in which the Applicants do not have any influence nor contribution to its bill payees' operations. The Applicants are not an agent of the bank, but rather a customer of the bank. Agents of banks have different AML standards and tests than an MSB who is a customer of the bank. My Response 24. This same argument could be put forward by a correspondent bank. A financial institution that is in a correspondent relationship with another financial institution has customers that it serves. The onus rests upon both banks to be aware of the nature oft he activities of those customers and can not be precluded by the correspondent institution declaring itself, "a customer of the bank". It is not appropriate, legal or ethical for a bank or an MSB to attempt to avoid regulatory and legal responsibilities through creative interpretation of legislation and regulatory guidelines. Mr. Bensimon's Assertion 25. This subtle but important distinction can often be lost in both interpretive FINTRAC guidance or in banks applying high risk due diligence criteria as a minimum standard in servings MSBs.

- 8 -My Response 26. As an AML consultant, I am frequently called upon to provide advice as to the risks associated with a financial institution providing banking services to an MSB. There are inherent risks associated with providing banking services to an MSB. At a minimum, I strongly recommend to banks that, if they choose to provide banking services to an MSB, they must apply high risk due diligence criteria as a minimum standard. The Applicants' business layers on significant additional risks. My advice to Scotiabank would be to refuse to provide banking services or bill status to the Applicants for all of the reasons in my first report. Mr. Bensimon's Assertion 27. This issue needs to be addressed from a risk-based perspective; that is, the issue is one of relative magnitude of the inherent risk given the Applicants MSB, its processes for effectuating money transfers, and its existing state of AML compliance policies and procedures. My Response 28. It is preposterous to address the Applicants' money laundering potential using a risk-based perspective because the Applicants have absolutely no AML program in place. As such, they are an extremely high risk. Mr. Bensimon's Assertion 29. The Applicants average transaction value has recently been in the $82 area, representing a nominal amount of transfer flows to finance customer purchases of gambling services. A suspected terrorist would have to effectuate thousands of purchases at this level to provide for even a small amount of terrorist financing. Terrorist financing often requires larger aggregate sums to finance its illegal activities. Therefore, there is a possibility that through repeat use and manipulation of the Applicant's UseMyBank system, a suspected terrorist can conceivably launder funds to finance terrorist activity.

- 9 -My Response 30. The amounts involved in terrorist financing are relatively low in comparison to the proceeds of criminal activities such as narcotics trafficking. Financing terrorist activity requires significantly less than the "thousands" of the $82 transactions that are referred to in the affidavit. Moreover, despite the relatively low "average", the Applicants have the capacity to transfer much greater amounts of money. The record indicates that banking customers that bank at Royal Bank can transfer $100, 000. 00 per transaction using the Applicants' services. The Applicants seek Scotiabank biller status, and, if granted, Bank of Nova Scotia customers can transfer up to $49,999.00 per transaction using the services of the Applicants. 31. By way of example of the relatively small amount of money that can be transferred at a given time in order to support a massive terrorist strike, the following is a list of wire transfers that were sent to, and by, the terrorist "pilots" and an associate who were responsible for the attack on the World Trade Center on September 11, 2001. , Date To Amount ' Jul. 19, 2000 USA $9,985.00 .... ....... ,. ........... . • Aug. 7, 2000 USA $9,485.00 : Aug. 30, 2000 • United Arab Emirates ' Sept. 18, 2000 : Sept. 8, 2001 •USA $2,860.00 , Sept. 8, 2001 USA ' $5,000.00 , Sept. 9, 2001 USA . $5,215.00 . Sept. 10, 2001 •usA United Arab Emirates $5,400.00 Mr. Bensimon's Assertion 32. Terrorist financiers come from all walks oflife, varied professions, and diversified types of businesses. Certain businesses, such as online casinos, may attract more suspected terrorists due to

-10-the ease of effectuating online transfers and perception of a limited verifiable audit trail. However, the Applicants have no control over its payee's AML internal compliance controls. My Response 3 3. Although it may be true that the Applicants have no control over the AML compliance levels of their payees (the casinos or their management companies), they should still be aware of the level of their compliance as part of their Know-Your-Customer procedures. If the level of AML compliance is unacceptable then the appropriate action would be to suspend business until there is an acceptable level. Again this is no different from the responsibilities of an FI in a correspondent banking relationship. If"the Applicants have no control over its payee's AML internal compliance controls", then all the more reason for Scotiabank to be concerned. Mr. Bensimon's Assertion 34. Furthermore, their respective jurisdictions would be responsible for providing AML regulation and guidance. Mr. Response 35. Online casinos are established in certain offshore jurisdictions because of their illegality in the United States and due to the inherent lack of regulatory and enforcement infrastructure in those jurisdictions. Mr. Bensimon's Assertion 36. Although there may be some reputational risk exposure from being perceived as allowing the facilitation of money transfers to online gambling casinos through an MSB channel, the Applicants history with the bank has not demonstrated evidence of conducting other suspicious business activity or 'restricted businesses' so as to generate regulatory scrutiny or internal policy breaches of bank code of acceptable customer conduct.

- 11 -My Response 37. I have conducted approximately 50 due diligence assignments on the owners, operators and employees of online casinos in a number ofj urisdictions. I have attended on the premises of online casino operations and sports books and I am familiar with their function, structure and the logistics of their operations. In my experience, the gaming industry, whether land-based or online, is attractive to the criminal element because of its anonymity, use of multiple jurisdictions and loose regulatory structure in offshore financial centres. Conducting financial transactions with online casinos is a high-risk business and requires very significant AML controls in order to avoid becoming associated with criminal activity. 38. Off-shore on-line internet casinos, while generating many millions of dollars in revenue annually, are in fact low-budget businesses, that run on a shoestring. The office premises generally consist of a desk or two, and a few computer servers. Attached hereto and marked as Exhibit "A" are coloured photographs taken by me during my attendance at the premises of an off-shore on-line casino in Antigua. 39. It is very easy to place money with an offshore casino using the Applicants' and UseMyBank's services. 40. On Aug 24, 2006, I visited the Internet website for an online casino known as Europa Casino, located at http://www.europacasino.com (Exhibit "B"). I downloaded casino gaming software from this site that would allow me to play a variety of casino games. I then visited pages on this same site that provided me with a list of payment options (Exhibits "C" and "D"), including the service offered of UseMyBank.

- 12 -41. I visited the Cashier pages (Exhibits "E", "F", "G" and "H") and registered as a player, providing my personal details. In addition, I created a personal password in order to access the gaming areas of the website. I was subsequently accepted as a player and provided with a username (Exhibits "I" and "J"). 42. Upon entering the online casino "lobby", I received a pop-up screen (Exhibit "K") that advised me that I had insufficient funds to continue. I was then directed to the cashier in order to make a deposit. 43. I proceeded to the cashier page (Exhibit "L") where I selected UseMyBank from a menu of various payment systems. A subsequent cashier screen appeared (Exhibit "M") and I was invited to make a deposit with the casino using U seMyBank as a payment method. I indicated that I wished to deposit USD $100. 00 and I was transferred to another screen that required me to indicate my online banking provider (Exhibit "N") which I did. 44. I was taken to a page (Exhibit "O") that allowed me to confirm Bank of Montreal as my online banking provider and prompted me to provide my bank card number and password (PIN). 45. I was then taken to a subsequent page (Exhibit "P") that indicated my various personal accounts and their respective balances and prompted to select an account from which the payment would be made. I did so and I was taken to another page (Exhibit "Q") where I was provided a transaction and receipt number. A pop-up screen indicated that my UseMyBank deposit had been approved. 46. I then signed on to the Bank of Montreal Internet banking site (Exhibit "R") and observed that $116.00 had been debited from my chequing account. The description of the transaction

- 13 ­identified GPay and classified the transaction as "online/telephone banking" from a list of transaction codes (Exhibit "S"). 4 7. Several minutes after the transaction, I received confirmation by email (Exhibit "T") from Europa casino indicating that USD $100.00 had been credited to my casino account. 48. I then received confirmation by email (Exhibit "U") from UseMyBank that I had made a payment to Interpay Processing Limited in the amount of CAD $116.00 as well as an email from UseMyBank (Exhibit "V") welcoming me to their service. Mr. Bensimon's Assertion 49. Were the account to be maintained by the Respondent for the Applicants, the Bank ofN ova Scotia would be expected to conduct a risk assessment of the account and the due diligence on the nature of the MSB. Some oft he elements of such a risk assessment may include items covered in the independent risk assessment included in the Appendix. The Bank ofNova Scotia does not appear to have conducted and documented a thorough risk assessment and AML risk ranking methodology of the account that would yield to established FINTRAC due diligence procedures and tests to determine if the account was low, medium or high risk My Response 50. See my earlier comments with respect to the Applicants' failure to provide information requested by Scotiabank's AML group, including the Joint Venture agreement, as well as the Applicants' refusal to provide information about the identity of their customers and the jurisdictions in which they operate, especially in the Alberta proceeding and early in this proceeding. The Bank ofN ova Scotia did not have the necessary information to conduct the risk assessment Provided that the necessary information is forthcoming, the use of risk ranking methodology is one of several steps that a FI should take in assessing a potential customer. In each case, it is equally, if not more,

- 14 ­important to examine the individual customer's commercial activity. In this manner, a financial institution can ensure that the use of risk ranking methodology, which is general in nature, has not overlooked specifics of a customer's business that may be high risk, such as gaming. Mr. Bensimon's Assertion 51. The Applicants business does not maintain the same or comparable level of transparency as the banks as they relate to AML controls required under FINTRAC. The independent risk assessment discovered in Phase I Test Results (Appendix B) indicates that the Applicants have several important gaps with respect to the development, implementation and monitoring of a compliance regime. The following weaknesses were identified and considered material and require remediation in order to reduce the inherent account risk level for an MSB customer:

(i) The appointment of a designated Compliance Officer; (ii) Compliance Policies and Procedures; (iii) Testing of Policies and Procedure; and (iv) Compliance training programs. My Response 52. These are not simply "weaknesses" or "gaps". GPay did not subscribe to even the most basic tenets of anti-money laundering compliance. They had no significant AML procedures in place. The 4 basic tenets of AML compliance, as listed above, have been completely ignored. This would render any subsequent risk-based analysis irrelevant. Mr. Bensimon's Assertion 53. Remediating these deficiencies and reguh;rrly monitoring their implementation would further reduce the residual risk of the MSB account for the Bank of Nova Scotia.