Due Diligence Renforcée (EDD) : Guide pour clients à haut risque

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

class="code-comment">// Exemple dclass="code-string">'intégration avec une API PEP tierce
async function checkPEPStatus(person: Person): Promise<PEPCheck> {
  class="code-comment">// 1. Vérifier dans Company Belgium si UBO
  const uboRecords = await companyBelgiumClient.companies.getUBO(
    person.companyNumber
  );
  
  class="code-comment">// 2. Vérifier via API World-Check ou similaire
  const pepCheck = await worldCheckClient.screen({
    firstName: person.firstName,
    lastName: person.lastName,
    dateOfBirth: person.dateOfBirth,
    nationality: person.nationality,
  });
  
  class="code-comment">// 3. Analyser les résultats
  if (pepCheck.matches.length > 0) {
    const highestRiskMatch = pepCheck.matches.reduce((max, match) => 
      match.riskScore > max.riskScore ? match : max
    );
    
    return {
      isPEP: true,
      pepType: highestRiskMatch.categories, class="code-comment">// ['GOVERNMENTclass="code-string">', 'FOREIGNclass="code-string">']
      riskLevel: highestRiskMatch.riskScore >= 80 ? 'HIGHclass="code-string">' : 'MEDIUM',
      source: highestRiskMatch.source,
      requiresEDD: true,
    };
  }
  
  return { isPEP: false, requiresEDD: false };
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

async function analyzeStructureComplexity(enterpriseNumber: string) {
  const company = await client.companies.get(enterpriseNumber);
  
  class="code-comment">// Indicateurs de complexité
  const riskIndicators = {
    multipleEstablishments: company.establishments.length > 5,
    foreignJurisdiction: company.juridicalForm?.includes(class="code-string">'foreign'),
    recentCreation: isWithinLastYear(company.startDate),
    addressMismatch: company.addresses.some(a => a.type === class="code-string">'CORRESPONDENCE' && 
                                               a.country !== class="code-string">'BE'),
    multipleActivities: company.activities.length > 10,
  };
  
  class="code-comment">// Analyse UBO
  const ubo = await client.companies.getUBO(enterpriseNumber);
  const uboRisks = {
    noUBODeclared: !ubo || ubo.beneficiaries.length === 0,
    foreignUBOs: ubo?.beneficiaries.filter(b => b.nationality !== class="code-string">'BE').length || 0,
    complexOwnership: ubo?.ownershipChain?.length > 2,
  };
  
  class="code-comment">// Calcul du score de complexité (0-100)
  const complexityScore = calculateComplexityScore(riskIndicators, uboRisks);
  
  return {
    complexityScore,
    requiresEDD: complexityScore >= 60,
    riskIndicators,
    uboRisks,
    recommendation: complexityScore >= 80 ? 
      class="code-string">'EDD obligatoire + approbation senior management' : 
      class="code-string">'EDD recommandée',
  };
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

async function performOSINTChecks(client: Client) {
  const searches = [
    class="code-comment">// 1. Moteurs de recherche
    class="code-string">`class="code-string">"${client.companyName}" + class="code-string">"scandal" + class="code-string">"fraud" + class="code-string">"investigation"`,
    class="code-string">`class="code-string">"${client.companyName}" + class="code-string">"sanctions" + class="code-string">"embargo"`,
    
    class="code-comment">// 2. Bases de données sanctions
    class="code-string">'OFAC SDN List', class="code-comment">// US Treasury
    class="code-string">'EU Consolidated Sanctions List',
    class="code-string">'UN Security Council Sanctions List',
    class="code-string">'HM Treasury Sanctions List', class="code-comment">// UK
    
    class="code-comment">// 3. Presse spécialisée
    class="code-string">'ICIJ Offshore Leaks Database',
    class="code-string">'Panama Papers',
    class="code-string">'Pandora Papers',
    
    class="code-comment">// 4. Registres de condamnations
    class="code-string">'Belgian Official Gazette (Moniteur belge)',
    class="code-string">'Commercial court judgments',
  ];
  
  const findings = [];
  
  for (const search of searches) {
    const results = await performSearch(search, client);
    if (results.adverseMediaCount > 0) {
      findings.push({
        source: search,
        count: results.adverseMediaCount,
        severity: results.maxSeverity,
        articles: results.topArticles.slice(0, 5),
      });
    }
  }
  
  return {
    adverseMediaDetected: findings.length > 0,
    findings,
    riskLevel: calculateAdverseMediaRisk(findings),
  };
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

interface EDDApproval {
  clientId: string;
  riskLevel: class="code-string">'HIGH' | class="code-string">'VERY_HIGH';
  eddReportId: string;
  approvers: {
    complianceOfficer: { name: string; email: string; approvedAt: Date };
    seniorManagement?: { name: string; email: string; approvedAt: Date };
  };
  decision: class="code-string">'APPROVED' | class="code-string">'REJECTED' | class="code-string">'CONDITIONAL';
  conditions?: string[]; class="code-comment">// ex: class="code-string">"Limit transactions to 50k EUR/month"
  reviewDate: Date; class="code-comment">// Next review (typically 6 months for PEP)
}

async function requestEDDApproval(client: Client, eddReport: EDDReport) {
  class="code-comment">// 1. Générer le dossier complet
  const approvalPackage = {
    clientSummary: generateClientSummary(client),
    riskAssessment: eddReport.riskAssessment,
    documents: eddReport.collectedDocuments,
    osintFindings: eddReport.osintFindings,
    recommendation: eddReport.recommendation,
  };
  
  class="code-comment">// 2. Soumettre au Compliance Officer
  await notifyComplianceOfficer({
    urgency: class="code-string">'HIGH',
    subject: class="code-string">`EDD Approval Required: ${client.companyName}`,
    package: approvalPackage,
    deadline: addDays(new Date(), 3), class="code-comment">// 3 jours pour décision
  });
  
  class="code-comment">// 3. Si PEP ou risque très élevé, également notifier direction
  if (client.isPEP || eddReport.riskLevel === class="code-string">'VERY_HIGH') {
    await notifySeniorManagement({
      urgency: class="code-string">'CRITICAL',
      subject: class="code-string">`PEP/High-Risk Client Approval Required`,
      package: approvalPackage,
    });
  }
  
  class="code-comment">// 4. Enregistrer dans le workflow dclass="code-string">'approbation
  await db.eddApprovals.create({
    clientId: client.id,
    status: 'PENDING',
    createdAt: new Date(),
    expiresAt: addDays(new Date(), 5),
  });
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

async function continuousMonitoring() {
  const eddClients = await db.clients.find({ requiresEDD: true, status: class="code-string">'ACTIVE' });
  
  for (const client of eddClients) {
    class="code-comment">// 1. Vérifier changements dans Company Belgium
    const companyChanges = await companyBelgiumClient.companies.getChanges(
      client.enterpriseNumber,
      { since: client.lastEDDReviewDate }
    );
    
    class="code-comment">// 2. Re-run sanctions screening
    const sanctionsCheck = await complyAdvantageClient.screen(client);
    
    class="code-comment">// 3. Surveiller médias négatifs
    const adverseMedia = await googleNewsClient.search(
      class="code-string">`class="code-string">"${client.companyName}" + (fraud OR corruption OR scandal)`,
      { since: client.lastEDDReviewDate }
    );
    
    class="code-comment">// 4. Analyser transactions (si accès)
    const unusualTransactions = await analyzeTransactionPatterns(client);
    
    class="code-comment">// 5. Déclencher alerte si nécessaire
    if (companyChanges.length > 0 || sanctionsCheck.newMatches || 
        adverseMedia.results.length > 0 || unusualTransactions.anomalies) {
      await triggerEDDReview({
        client,
        triggers: {
          companyChanges,
          sanctionsCheck,
          adverseMedia,
          unusualTransactions,
        },
        urgency: calculateUrgency(sanctionsCheck, adverseMedia),
      });
    }
  }
}

class="code-comment">// Cron job quotidien
schedule(class="code-string">'0 2 * * *', continuousMonitoring); class="code-comment">// 2h du matin

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

/clients/{clientId}/edd/
  /initial-assessment/
    - risk-score.pdf
    - pep-declaration.pdf
    - source-of-funds.pdf
    - source-of-wealth.pdf
    - osint-report.pdf
    - sanctions-screening.pdf
  /approvals/
    - compliance-officer-approval-2026-04-14.pdf
    - senior-management-approval-2026-04-14.pdf
  /ongoing-monitoring/
    - quarterly-review-2026-Q2.pdf
    - adverse-media-alert-2026-05-20.pdf
    - transaction-monitoring-summary-2026-Q2.pdf
  /audit-trail/
    - access-log.json
    - modification-log.json

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

interface EDDDocumentMetadata {
  clientId: string;
  documentType: string;
  uploadedBy: string;
  uploadedAt: Date;
  classification: class="code-string">'CONFIDENTIAL' | class="code-string">'STRICTLY_CONFIDENTIAL';
  encryptionKey: string; class="code-comment">// AES-256
  retentionUntil: Date; class="code-comment">// Date + 10 ans
  accessLog: Array<{
    userId: string;
    accessedAt: Date;
    action: class="code-string">'VIEW' | class="code-string">'DOWNLOAD' | class="code-string">'PRINT';
    ipAddress: string;
  }>;
}

async function storeEDDDocument(file: File, metadata: EDDDocumentMetadata) {
  class="code-comment">// 1. Chiffrement du fichier
  const encrypted = await encryptFile(file, metadata.encryptionKey);
  
  class="code-comment">// 2. Stockage sécurisé (S3 avec chiffrement côté serveur)
  await s3.putObject({
    Bucket: class="code-string">'kyc-edd-documents',
    Key: class="code-string">`${metadata.clientId}/edd/${metadata.documentType}-${Date.now()}.enc`,
    Body: encrypted,
    ServerSideEncryption: class="code-string">'AES256',
    Metadata: {
      classification: metadata.classification,
      retentionUntil: metadata.retentionUntil.toISOString(),
    },
  });
  
  class="code-comment">// 3. Enregistrement dans base de données
  await db.eddDocuments.create({
    ...metadata,
    storagePath: class="code-string">`s3:class="code-comment">//kyc-edd-documents/${metadata.clientId}/...`,
    checksum: calculateChecksum(file),
  });
  
  class="code-comment">// 4. Audit log
  await auditLog.record({
    event: class="code-string">'EDD_DOCUMENT_STORED',
    userId: metadata.uploadedBy,
    clientId: metadata.clientId,
    documentType: metadata.documentType,
    timestamp: new Date(),
  });
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

async function fileCTIFReport(client: Client, suspicionIndicators: string[]) {
  const report = {
    declaringEntity: {
      name: class="code-string">'Votre Centre de Domiciliation SRL',
      enterpriseNumber: class="code-string">'BE 0XXX.XXX.XXX',
      contactPerson: class="code-string">'Compliance Officer Name',
      email: class="code-string">'compliance@votrecentre.be',
    },
    suspectedEntity: {
      name: client.companyName,
      enterpriseNumber: client.enterpriseNumber,
      addresses: client.addresses,
      ubos: client.ubos,
    },
    suspicionGrounds: suspicionIndicators,
    amountInvolved: client.suspiciousTransactions.total,
    period: { from: client.relationshipStartDate, to: new Date() },
    documentsAttached: [
      class="code-string">'identification-documents.pdf',
      class="code-string">'edd-report.pdf',
      class="code-string">'transaction-history.pdf',
    ],
  };
  
  class="code-comment">// Soumission via goAML (plateforme CTIF)
  await ctifClient.submitReport(report);
  
  class="code-comment">// Enregistrement interne (SANS INFORMER LE CLIENT !)
  await db.ctifReports.create({
    clientId: client.id,
    reportId: report.id,
    submittedAt: new Date(),
    status: class="code-string">'SUBMITTED',
    class="code-comment">// IMPORTANT: Pas de notification au client !
    clientNotified: false,
  });
  
  class="code-comment">// Alerte Compliance Officer uniquement
  await notifyComplianceOfficer({
    urgency: class="code-string">'CRITICAL',
    subject: class="code-string">'CTIF Report Submitted - CONFIDENTIAL',
    clientName: client.companyName,
    reportId: report.id,
  });
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

async function getEDDDashboard() {
  const stats = await db.clients.aggregate([
    { $match: { requiresEDD: true, status: class="code-string">'ACTIVE' } },
    {
      $group: {
        _id: class="code-string">'$eddReason',
        count: { $sum: 1 },
        avgRiskScore: { $avg: class="code-string">'$riskScore' },
      },
    },
  ]);
  
  return {
    totalEDDClients: stats.reduce((sum, s) => sum + s.count, 0),
    byReason: {
      pep: stats.find(s => s._id === class="code-string">'PEP')?.count || 0,
      highRiskCountry: stats.find(s => s._id === class="code-string">'HIGH_RISK_COUNTRY')?.count || 0,
      complexStructure: stats.find(s => s._id === class="code-string">'COMPLEX_STRUCTURE')?.count || 0,
    },
    upcomingReviews: await getUpcomingEDDReviews(),
    pendingApprovals: await getPendingEDDApprovals(),
  };
}