Step 2. Identify and Assess Supply Chain Risks

Location risk identification should include, but is not limited to:

Determination of the origin of the gold source:

• Mined Gold: The location of the mine (LSM and ASM).
• Recycled Gold: The point in the gold supply chain where the gold is returned to the Refiner or other downstream intermediate processor or recycler.
• Mining By-product: The point of separation of gold from the mineral base, as provided under the World Customs Organization’s Revised Kyoto Convention Annex K.⁹
• Grandfathered Stocks: The determination of origin is not required for stocks with a Verifiable Date prior to 1 January 2012, otherwise origin is the location of the gold-supplying counterparty.

Determination of the general transportation routing of the gold source from origin to refinery.

Verification that sourcing from the Country of Origin is not in breach of any international sanctions.

Verification that the mine site is not located in a World Heritage Site.

Location risk identification should include, but is not limited to:

This location-based risk identification process must include an integrated assessment of all risks outlined in Step 1.1.

Sources of such an integrated assessment must include, but are not limited to:

• Sanctions lists (US, UK, EU, UN, and relevant sanctions lists)
• Dodd Frank s. 1502
• EU CAHRA list
• Heidelberg Barometer
• Fragile States Index or equivalent
• UN Human Rights Office of the High Commissioner or equivalent
• Reports (including relevant country reports) by the Financial Action Task Force (FATF)
• Credible market intelligence on high-risk gold centres/transit hubs and on countries where there is a high risk of money laundering.

Refiners should also consider credible market intelligence to cover the risk factors included in Step 1.1, as relevant.

Supplier risk identification should include, but is not limited to:

Using the KYC Questionnaire in the Refiners Toolkit:

• Identification and verification of the gold-supplying counterparty’s name, physical address, corporate registration and licence information, using reliable, independent source documents, data or information.
• Identification and verification of Ultimate Beneficial Owners (UBOs) (defined as 10% or more ownership) and authorised signatories10 of the gold-supplying counterparty, using reliable and current government-issued photo identity documents.
• Confirmation that the gold-supplying counterparty and its UBOs are not named on any government lists as wanted money launderers, or as known fraudsters or terrorists.
• Obtaining the gold-supplying counterparty’s business and financial details, and information on the purpose and intended nature of the business relationship.

Risk identification for Mined Gold from LSM should include, but is not limited to:

Using the KYC Questionnaire for Mined Material in the Refiners Toolkit, identification of risks by obtaining, assessing and, where possible, verifying against publicly available information:

• Import/export gold licence for gold supplying counterparty, if applicable
• Mining practice, including processing and transportation method
• Production data and processing capacity, if available
• Sources of any third-party stock, including that from ASM, on the mine site and controls to appropriately manage these
• Anti-money laundering and terrorist financing policies and practices, where relevant
• Bribery and corruption policies and practices, including payment to government
• Human rights policies and practices
• Environmental policies and practices
• Health and safety policies and practices
• Labour policies and practices, if not already covered through other policies collected
• Community engagement programmes
• Ethics and business integrity policies and practices.

Risk identification for Mined Gold from ASM should include, but is not limited to:

Using the KYC Questionnaire in the Refiners Toolkit, identification of risks by obtaining, assessing and,
where possible, verifying against publicly available information:

• Suppliers of ASM gold sources, including:
  o local artisanal mining team, association or cooperatives (it is not necessary to identify individual diggers)
  o ore processing plant
  o aggregators and traders
  o local gold exporter
• Whether the mining project can be considered legitimate ASM (i.e., legally registered, cooperative-based and/or government-recognised, or central bank supported initiative)
• Mining practice, including extraction, processing and transportation method
• Use, storage and recovery of mercury, and if applicable, impact on the environment and the health of those involved in the production, handling and processing of gold
• Human rights practices and policies to the extent available
• Environmental practices and policies to the extent available
• Health and safety practices and policies to the extent available
• Labour practices and policies to the extent available
• Community engagement practices and policies to the extent available
• Payments to government practices and policies to the extent available.

Risk identification for Recycled Gold should include, but is not limited to:

Using the KYC Questionnaire for Recycled Material in the Refiners Toolkit, identification of risks by obtaining, assessing and, where possible, verifying against publicly available information:

• Main markets, products and customer segments of the counterparty
• Profiles of the counterparty’s gold and precious metals suppliers
• Types and forms of precious metals sourced by the counterparty
• Country of Origin of gold and precious metals processed by the facility
• Type and location of facilities operated by the counterparty (refining, manufacturing, jewellery production, pawn shops, etc.)
• Import/export licences, if applicable
• Anti-money laundering and terrorist financing policies and practices
• Anti-bribery and corruption policies and practices
• Responsible sourcing policies and processes.

Transactions monitoring should include, but is not limited to:

• Checking volumes, types and concentrations of gold-bearing material for consistency with previous shipments
• Monitoring the actual transportation routing for each shipment
• Verifying physical shipment against shipping/transportation documents (assays, weights, serial numbers)
• Confirming that documents and materials are consistent with each other (purchase order, goods receipt, invoice) and with the KYC information (mine capacity, origin, sources).

Where material inconsistencies or suspicions are identified:

• The gold should be physically segregated and secured (until the inconsistencies are resolved)
• An investigation should be undertaken and documented
• Findings should be reported to the Compliance Officer, Board and appropriate authorities, as applicable.

Zero-tolerance issues include, but are not limited to:

• The Mined Gold is known to originate from areas designated as World Heritage Sites
• The Mined or Recycled Gold is known to be sourced in breach of international sanctions (including but not limited to those of the UN, EU, UK and US)
• The Mined or Recycled Gold supplying counterparty, other known upstream companies or their UBOs are known money launderers, fraudsters or terrorists, or have been implicit in serious human rights abuses, or in direct or indirect support to illegitimate non-state armed groups.

High-risk issues for Mined Gold should include, but are not limited to:

For location-based high risks, the Mined Gold:

• Originates from, has transited or has been transported via a Conflict Affected and High-Risk Area (CAHRA)
• Is claimed to originate from a country through which gold from CAHRAs is known, or reasonably suspected, to transit
• Is claimed to have originated from a country that has limited known reserves, likely resources or expected production levels.

For supplier-based high risks, the gold-supplying counterparty or other known upstream companies:

• Have shareholders, or UBOs, or other gold supplying interests in one of the location-based high-risk criteria
• Have UBOs that are Politically Exposed Persons (PEPs)
• Have activities in a higher-risk business activity such as arms, gaming and casino industry, antiques and art, and sects and their leaders
• Have been known to have sourced gold from a high-risk country in the last 12 months
• Have material discrepancies/inconsistencies in the documentation provided or have refused to provide requested documentation.

For type of material-based high risks, the Mined Gold is:

• Sourced from ASM
• Produced with the use of mercury
• Contributing to catastrophic harm or highly adverse ESG factors, to the extent that the Refiner is able to identify this (e.g., through a record in the public domain or in the Refiner’s due diligence file).

High-risk issues for Recycled Gold should include, but are not limited to:

For location-based high risks, the Recycled Gold:

• Originates from, has transited or has been transported via a CAHRA as defined by the Refiner in Step 2.1
• Is claimed to originate from a country through which gold from CAHRAs is known, or reasonably suspected, to transit, and/or is unjustifiably claimed to have originated from a country that has limited exports of gold.

For supplier-based high risks, the gold-supplying counterparty or other known upstream companies:

• Operate in a money laundering high-risk country
• Have shareholders, or UBOs, or other gold-supplying interests in one of the location-based highrisk criteria
• Have UBOs who are Politically Exposed Persons (PEPs)
• Have activities in a higher-risk business activity such as arms, gaming and casino industry, antiques and art, and sects and their leaders
• Have been known to have sourced gold from a high-risk country in the last 12 months
• Have significant unexplained geographic routing from their supplier or counterparty in the supply chain.

For type of material-based high risks, the Recycled Gold is:

• From an Intermediate Refinery or trader with a high-risk supply chain or a trading counterparty sourcing from an Intermediate Refinery with a high-risk supply chain.

The on-site visit should be, at a minimum, but not limited to:

• Aimed at substantiating the documented KYC information
• Focused on investigating threat financing risks, as defined under Step 1.1, and the specific supply chain due diligence findings
• Conducted before any transactions occur or, at the least, within six months of the business relationship commencing
• Conducted by competent employees or independent third-party consultants, who are free of any conflict of interest with the supplier. Everyone conducting an on-site visit must commit to reporting truthfully and accurately
• Consult relevant internal and external stakeholders (for example, local or central authorities, upstream companies, international or civil society organisations, or affected third parties), where applicable
• Fully and accurately documented in the Site Visit Report templates included in the Refiners Toolkit. Refiners choosing to not use the template will be required to justify their position
• Followed up, depending on the number and severity of issues identified and documented in the improvement plans.

EDD measures for high-risk LSM gold supply chains should include, but are not limited to:

• Proportionate KYC on each company involved in the conflict location based high-risk supply chain from the mine to the refinery (including gold producers, intermediaries, gold traders and exporters, and transporters).
• Understanding the nature of public or private security services provided at the mine sites and through the supply chain (including the screening and training of security personnel in line with the Voluntary Principles on Security and Human Rights).
• Considering the risks of militarisation of mine sites and transportation routes, and direct or indirect support to illegitimate non-state armed group, or public or private security forces.
• Determination of the risk of any serious human rights abuses committed by any party at mine sites, transportation routes and points where gold is traded and/or exported.
• Estimating the number of Artisanal and Small-Scale Miners (if any) on the producer’s concession, and:
  
  o confirming their status as legitimate ASM
  o considering risks of gold from third-party sources unknowingly being introduced into the producer’s operations
  o considering the relationship between producer and ASM actors to identify instances of conflict or tension.
  
  
• Complete self-declaration of taxes and royalties compliance, as applicable.
• Understanding payments or compensation made to government agencies and officials, public or private security forces, or other armed groups at all points in the supply chain from extraction onwards, unless prohibited by law.
• Considering compliance with environmental, health, safety, labour, community, business integrity regulations, policies and good practices for issues identified in the initial due diligence.

EDD measures for high-risk ASM gold supply chains should include, but are not limited to:

• Proportionate KYC on each company involved in the location-based high-risk supply chain from the ore processing plant or gold aggregator to the Refiner (including cooperatives, gold traders and exporters, and transporters).
• Collecting information on the government, political or military affiliations of ASM suppliers, including any reported instances of affiliation with non-state armed group, or public or private security forces.
• Collecting evidence of any serious human rights abuses committed by any party at mine sites, transportation routes and points where gold is traded and/or exported
• Considering the militarisation of mine sites and transportation routes, and the risk of direct or indirect support to illegitimate non-state armed group, or public or private security forces.
• Considering any conflict or tensions in the relationship between LSM and ASM.
• Considering the risk, suspicions or reports that gold from other sources is being unknowingly introduced into the gold supply chain and/or fraudulently represented.
• Considering the storage, handling and usage of mercury, and the impacts on the environment and workers’ health.
• Evaluating the appropriateness of other ESG risk management practices pertaining to issues identified in the initial due diligence.
• Understanding payments or compensation made to government agencies and officials, public or private security forces, or other armed groups at all points in the supply chain from extraction onwards, unless prohibited by law.

EDD measures for high-risk Recycled Gold from Intermediate Refiners should include, but are not limited to:

• An independent Assurance Report on the Intermediate Refiners’ responsible sourcing practices on a comply or explain basis. The assurance should:
  
  o include conformance with an OECD aligned responsible sourcing scheme
  o be commissioned by the Intermediate Refiner
  o be completed before the start of a new business relationship or within a reasonable timeframe11 of the Refiner implementing this Guidance

• The identity of the UBOs of the Intermediate Refiners

EDD measures for high-risk Recycled Gold from other sources should include, but are not limited to:

• Checking government watchlist information for each company located in high-risk locations for Recycled Gold and involved in the supply chain from the counterparty to the refinery (including transporters).
• Interviews with select management and site personnel to determine and corroborate the supply chain due diligence practices, purchasing, and anti-money laundering and counter-terrorist financing procedures.
• Considering the counterparty’s competence and capacity for supply chain due diligence proportionate to risk.
• Considering the appropriateness of the counterparty’s risk classification methodology.
• Assessment of due diligence records to confirm that procedures are being undertaken as per the counterparty’s supply chain due diligence policy with due considerations for commercially sensitive information.
• Assessment of on-site visit methodology to the counterparty’s high-risk supply chains, with due consideration for commercially sensitive information.