– xx

• Policy owner: Group Head of Financial Crime Last RISKCO approval: 19 July 2016 Last Policy owner review: 20 June 2017 Location: Risk Document Library

Sanctions Policy August 2017

Sanctions Policy 2

Table of contents

1. Overview................................................................................................................................. 3

2. Purpose .................................................................................................................................. 3

3. Westpac Board and Group Executive commitment ............................................................... 3

4. Roles and responsibilities....................................................................................................... 3

5. Scope ..................................................................................................................................... 3

6. Legislative requirements ........................................................................................................ 4

7. What are sanctions? ............................................................................................................... 5

8. Westpac’s approach to sanctions .......................................................................................... 6

9. Risk appetite ........................................................................................................................... 8

10. Risk management and compliance reporting ......................................................................... 8

11. Record keeping ...................................................................................................................... 8

12. Training requirements ............................................................................................................ 8

13. Policy governance .................................................................................................................. 8

3 Sanctions Policy

1. Overview The Westpac Group (Westpac) is committed to complying with relevant economic and trade sanctions (sanctions) laws in all jurisdictions in which it operates through identifying, mitigating and managing the risk, not simply because it is required to, but it is the right thing to do. Westpac recognises that failure to comply with relevant sanctions laws or to prevent or manage this risk would not only constitute a breach of legal and/or regulatory requirements, but would also represent a failure to abide by broader community expectations and could carry significant reputational damage, legal and regulatory action and financial loss for the bank.

2. Purpose This Policy establishes the minimum Group expectations of Westpac’s risk management and compliance with its sanctions obligations and sets out Westpac’s approach including: � Principles and measures that Westpac follows to comply with sanctions legislation and to identify,

mitigate and manage sanctions risk in the jurisdictions where it operates; � Guidance about the meaning of sanctions and how to comply; and � Consequences of failing to comply with this Policy.

3. Westpac Board and Group Executive commitment

Westpac’s Board and Group Executives are committed to Westpac’s compliance with all relevant sanctions laws and sanctions risk management. They expect all employees to be accountable and responsible for their own actions, not to be involved in activities of non-compliance with sanctions requirements. This includes assisting customers to circumvent or avoid sanctions laws.

4. Roles and responsibilities Westpac clearly documents roles and responsibilities and governance structure to ensure the ongoing development, maintenance, monitoring and oversight of financial crime, including sanctions, risk management and compliance across the Group. The Framework follows the Three Lines of Defence principle.

5. Scope This Policy applies to all countries and/or jurisdictions in which Westpac operates and extends to any additional countries and/or jurisdictions where Westpac commences operations and/or has an active registration or licence. This Policy applies to all Westpac employees acting in any capacity, Directors, Officers, secondees, people on work experience, contractors, authorised representatives and consultants in all Westpac businesses and subsidiaries (including all offshore locations) of Westpac. In this Policy, “Westpac” means the Westpac Group and includes Westpac Banking Corporation (ACN: 007 457 141) and its related companies and subsidiaries. “Division” means a discrete area of the Westpac Group which reports to a Group Executive and “Business Unit” means a discrete area of the Westpac Group which reports to a General Manager or Head of Business. “Customer” includes individuals as well as legal entities such as companies and trusts. It also includes correspondent banking relationships. “Countries” in which Westpac operates include, but are not limited to, Australia, China (including Hong Kong), India, New Zealand, Pacific Islands, Singapore, the United Kingdom and the United States.

Sanctions Policy 4

Business Unit policies (including supporting documents) This Group Policy applies globally and must be complied with by all Australian and non-Australian based Business Units.

International application This Policy sets out Westpac’s minimum Group-wide requirements.

Policy exceptions Policy exceptions may be required where there are unique characteristics or legal requirements facing individual subsidiaries, Business Units or Country offices. Exceptions to this Policy may occur with the prior approval of the Policy owner, the Group Head of Financial Crime. Policy exceptions must be requested in writing.

6. Legislative requirements Westpac must comply with sanctions laws of all jurisdictions in which it does, or seeks to do, business. Westpac also has regard to international best practice standards and guidance.

Global sanctions obligations All of the jurisdictions in which Westpac operates are obliged to give effect to United Nations Security Council (UNSC) sanctions. In addition, some jurisdictions also impose autonomous sanctions (such as the United States and the European Union). The sanctions laws of multiple jurisdictions may apply to a single transaction facilitated by Westpac. For example, a payment initiated by Westpac in New Zealand in US Dollars for the benefit of a payee in Somalia must comply with UNSC sanctions and autonomous sanctions in Australia, New Zealand and the United States.

Australian sanctions Australia implements both UNSC sanctions and autonomous sanctions: � In situations where the UNSC determines the existence of a threat to the peace, a breach of the peace,

or an act of aggression, the Charter of the United Nations authorises the UNSC to decide on measures to be taken to maintain or restore international peace and security.

1 Members of the United Nations are

legally bound to accept and carry out these measures as a matter of international law.2

� Autonomous sanctions are punitive measures not involving the use of armed force that the Australian Government chooses to take (as opposed to measures it is obliged to take by virtue of UNSC resolution) as a foreign policy response to situations of international concern. These measures seek to apply pressure on regimes to desist in the repression of human rights and democratic freedoms, or the pursuit of internationally or regionally destabilising policies (such as Weapons of Mass Destruction proliferation), or to prevent regime leaders using Australia as a haven for misappropriated state or other funds. In some instances, autonomous sanctions may be used to supplement UNSC sanctions. In other instances they are imposed by the Australian Government independently of any UNSC action.

Sanctions-related resolutions of the UNSC are given effect in Australia by regulations under the Charter of the United Nations Act 1945 (Cth) and through other Commonwealth legislation such as the Customs Act 1901 (Cth) and the Migration Act 1958 (Cth). Autonomous sanctions imposing financial restrictions and travel

1 Charter of the United Nations, Article 39

2 Charter of the United Nations, Article 25

5 Sanctions Policy

bans on designated entities and controls in trade in goods and services are given effect through regulations under the Autonomous Sanctions Act 2011 (Cth) and through other Commonwealth legislation such as the Customs Act and the Migration Act. In Australia, regulations imposing UNSC sanctions and autonomous sanctions are administered and enforced by the Department of Foreign Affairs and Trade (DFAT) in concert with other Federal Government agencies, such as the Department of Defence and the Department of Immigration and Citizenship.

Sanctions implemented by other jurisdictions Other jurisdictions give effect to sanctions in different ways. For example: � In the US, sanctions can be the result of Executive Orders issued by the President declaring or

reaffirming an emergency under the International Emergency Economic Powers Act.3 UNSC sanctions

are given effect under the United Nations Participation Act.4 The principal US sanctions authority is the

Office of Foreign Assets Control (OFAC). � In the United Kingdom, there are two types of legislative instruments that impose sanctions: Statutory

Instruments and European Union Regulations. UNSC sanctions are given effect under the United Nations Act.

5 European Union Regulations are given effect under the European Communities Act.

6 The

principal UK financial sanctions authority is Her Majesty’s Treasury.

7. What are sanctions? Sanctions are tools used by governments, international organisations (such as the United Nations) and supranational bodies (such as the European Union) to: � Limit the adverse consequences of a situation of international concern (for example, by denying access

to military or paramilitary goods, or to goods, technologies or funding that enable the pursuit of programs such as the proliferation of weapons of mass destruction);

� Seek to influence those responsible for giving rise to a situation of international concern to modify their behaviour (by motivating them to adopt different policies); and

� Penalise those responsible for or involved with the matters of concern that give rise to sanctions (for example, by denying access to international travel or to the international financial system).

7

Sanctions affect the business operations of financial institutions and their customers by placing restrictions and controls on the movement of goods, services and funds. Restrictions can include: � Export bans, import bans and prohibitions on the provision of certain specified services; � Prohibiting certain commercial activities (such as joint ventures and other investment); � The transfer of funds to or from a sanctioned country; � Targeted financial sanctions, which include freezing the assets of and prohibiting any dealings with, a

government, as well as corporate entities and individuals associated with situations of international concern;

� Travel bans; � Other financial restrictions. Sanctions regimes may be subject to frequent and sometimes sudden change. They can also be imposed at any time by any country, international organisation or supranational body. Generally the effect is immediate. Financial institutions must ensure that their business operations comply with applicable sanctions regimes. If Westpac fails to execute its responsibilities under applicable sanctions regimes, it could be subject to

3 50 USC 1701 et seq.

4 22 USC 287c.

5 1946 Chapter 45 9 and 10 Geo 6

6 1972 c.68

7 DFAT, About Sanctions https://www.dfat.gov.au/sanctions/about-sanctions.html at 11 August 2015

Sanctions Policy 6

significant regulatory enforcement action, fines, serious reputation damage and criminal charges in Australia or elsewhere. Key sanctions related terms used in this Policy include: � Designated entities: Governments, international organisations and supranational bodies publish lists of

individuals, groups and entities that are subject to sanctions, such as targeted financial sanctions and travel restrictions. An example of such a list is Australia’s Consolidated List issued by DFAT which sets out all persons and entities to which the Charter of the United Nations Act 1945 and the Autonomous Sanctions Act 2011 applies. In this Policy, designated entities include all persons and entities included on such lists.

� SDN: As part of its enforcement efforts, OFAC publishes a list of individuals and companies owned or controlled by, or acting for or on behalf of, US sanctioned countries. The OFAC list also includes individuals, groups, and entities, such as terrorists and narcotics traffickers designated under programs that are not country-specific. Collectively, such individuals, groups and companies are called SDNs. SDNs are generally subject to targeted financial sanctions. SDNs are designated entities for the purposes of this Policy.

8

8. Westpac’s approach to sanctions

The principles The following key principles govern Westpac’s Group approach to sanctions. All other requirements in this document are to be read in the context of these principles. In the event of a conflict between principles and requirements, the principles will prevail. 1. Westpac maintains a sanctions policy to meet obligations under sanctions regimes of the jurisdictions in

which Westpac operates, is registered and/or licensed (Westpac Jurisdiction). 2. Westpac complies with the requirements of the Australian sanctions regimes both within Australia and

abroad. Westpac foregoes any business that would breach any Australian sanctions regime. 3. In addition to complying with the requirements of the Australian sanctions regimes, Westpac complies

with non-Australian sanctions regimes whenever they apply (such as Westpac’s operations overseas), and foregoes any business that would breach these sanctions regimes.

4. In addition to the requirements of the Australian sanctions regimes, the local sanctions regimes applicable to all overseas operations, registration or license, Westpac takes into account sanctions regimes imposed by other jurisdictions where non-adherence may impact Westpac’s ability to access overseas markets or where the facts of the transaction make it appropriate to do so.

5. Westpac may decide not to provide products or services even where it is permitted by law. These decisions may be guided by risk appetite, corporate social responsibility, business efficacy or reputational risk.

6. In carrying out its compliance obligations, Westpac relies on information provided to it by its customers and business partners unless it is aware or suspects that those customers and business partners, or the information provided, is unreliable or dishonest.

7. Westpac reports any breach of a sanctions regime to the appropriate authority in a timely manner and in accordance with law.

8. Where the laws in those jurisdictions in which Westpac operates permit activity that is prohibited under Australian sanctions, the Australian sanctions must be followed. Westpac will immediately forgo any business that would be non-compliant with any relevant Australian sanctions regime. Where Westpac is unsure as to whether or not a conflict exists it may seek advice from the relevant Australian Government agency prior to commencing or continuing the business activity. Westpac will also refrain from any business that would violate the relevant local sanctions regime of the respective jurisdiction in which it is conducting business.

9. Westpac exercises due care in designing and refining business rules and processes to ensure that no individual transaction involves a knowing breach of applicable sanctions obligations. The operational

8 OFAC, https://www.treasury.gov/resource-center/sanctions/SDN-List/Pages/default.aspx at 30 June 2014

7 Sanctions Policy

approach occurs within the context of industry practice, the level of information ordinarily available in financial transactions, and the generality of the language detailing sanctions obligations.

The requirements 1. Westpac screens for designated entities and sanctioned activities in accordance with applicable

sanctions regimes both in Australia and overseas. 2. Westpac provides sanctions training to relevant employees and contractors. The Group Sanctions

Officer9 determines the content and criteria for the training. Divisions and business units of the Westpac

Group ensure that employees matching the criteria complete relevant sanctions training. 3. Westpac acts in accordance with industry guidelines for sanctions. Where a conflict exists between the

industry guidelines and the principles and requirements in this Policy, this Policy will prevail. 4. The Group Sanctions Officer provides guidance and practice standards

10 to ensure compliance with

applicable sanctions regimes and this Policy with oversight by the Group Head of Financial Crime. The Group Sanctions Officer is a central escalation point. The Group Sanctions Officer is obliged to raise potential systemic breaches with the Group Head of Financial Crime and MLRO and ABC Officer who will escalate to the General Manager of Operational Risk, Financial Crime & Assurance, as necessary. The Chief Risk Officer (CRO) retains the authority to order a stop to potential systemic breach activity.

5. Westpac utilises the SWIFT11

payment system for all international payments, except in the case of specific exemptions which are granted by the Group Sanctions Officer. Exemptions are documented and subject to annual review.

6. Westpac requires that its counterparties do not engage in or facilitate any business activity that would lead Westpac to breach any applicable sanctions obligations.

7. Westpac requires that its agents and third parties do not engage in or facilitate any business activity that would lead Westpac to breach any applicable sanctions obligations. For the purpose of this Policy, agents and third parties are defined as parties that are acting for or on behalf of, or providing services to Westpac.

8. Westpac communicates its sanctions policy to customers. 9. Given the higher risks associated with third-party remittance services, in the ordinary course of business

Westpac does not provide foreign exchange or international transfer services to remittance providers except where Westpac determines that exceptional circumstances apply.

10. Westpac does not maintain bank accounts for individuals or entities that are designated entities in any Westpac Jurisdiction. If an existing customer of Westpac becomes designated in any Westpac Jurisdiction and relevant laws require Westpac to freeze the assets of that customer then Westpac will do so. If Westpac is not required to freeze the assets of such a customer then Westpac will terminate its relationship with the relevant customer.

Employee and contractor obligations This section sets out obligations of the Westpac Group’s employees and contractors. 1. Employees and contractors must read and apply this Policy. 2. Employees and contractors must remain vigilant to ensure compliance with this Policy. If an employee or

contractor suspects a potential breach of Westpac’s obligations under this Policy, they must report that potential breach to the relevant Business Unit General Manager and Group Sanctions Officer.

3. Under no circumstances may an employee or contractor act to avoid sanctions obligations or detection of a transaction in breach of this Policy. Westpac and its employees and contractors cannot advise customers on how transactions should be structured or presented to evade applicable sanctions. This includes, but is not limited to, advising customers and counterparties to amend their instructions to include details that may be false or misleading, or changing, removing or omitting information from a transaction that would otherwise lead to detection.

4. As a citizen or visa holder of a particular country, employees and contractors may be subject to both the laws of their country of citizenship and the country where they may be working. Also mere presence in a country can make an employee or contractor subject to the laws of a country. It is the responsibility of

9 The Group Sanctions Officer reports to the Group MLRO and ABC Officer.

10 For example, due diligence guidelines and customer screening guidelines.

11 Society for Worldwide Interbank Financial Telecommunication.

Sanctions Policy 8

each employee and contractor to understand and meet their sanctions obligations as a citizen of a particular country or as a result of their presence in a particular country.

5. In circumstances where sanctions laws impose obligations on employees in their personal capacity, Westpac may develop practise guides designed to ensure that both Westpac and its employees comply with their obligations.

9. Risk appetite Risk appetite is the maximum level of risk that Westpac is prepared to accept in the normal course of business. Westpac takes sanctions risk, to both the bank and the wider community, very seriously and seeks to take all reasonable steps to minimise the risk of sanctions breaches within our network. Consistent with the Group Risk Appetite Statement, we ensure that appropriate remedial action is taken to address instances of non-compliance with our sanctions obligations. Policy decisions in relation to classes of customers, country, product/service or channel should be supported by the Westpac Group Operational Risk and Financial Crime Committee (OFCO) and approved by the Westpac Group Executive Risk Committee (RISKCO) as part of the policy review and approval process.

10. Risk management and compliance reporting

OFCO has oversight of this Policy within the context of the risk appetite determined by the Board. OFCO operates under the oversight of RISKCO and is chaired by the General Manager of Operational Risk, Financial Crime & Assurance. At a minimum, financial crime reporting, including sanctions, forms part of OFCO’s quarterly reporting to RISKCO and to the Board Risk and Compliance Committee (BRCC).

11. Record keeping At a minimum, all relevant records must be retained in accordance with the Westpac Group Records Management Policy and the Westpac Group Information Security Policy.

12. Training requirements Westpac provides sanctions training to relevant employees based on the nature, scale and complexity of their role. The Group Sanctions Officer determines the frequency, content and criteria for sanctions training. Business Units ensure that employees matching the criteria complete relevant sanctions training. Ongoing training on sanctions must be provided to employees as appropriate.

13. Policy governance

Policy review This Policy is reviewed annually by the Policy owner to ensure it is up to date and aligned to Westpac’s risk appetite. Material proposed amendments are submitted to OFCO for support, RISKCO for approval and the BRCC for noting. Non-material amendments are approved by the Group Head of Financial Crime, with appropriate oversight from the General Manager, Operational Risk, Financial Crime and Assurance. In addition, this Policy is reviewed following any substantive changes to sanctions legislation or internal and external factors, including regulatory feedback.

9 Sanctions Policy

Policy breaches All Policy incidents and breaches must be reported to the Group Head of Financial Crime and Group Sanctions Officer. Westpac staff may also report anonymously in accordance with the Westpac Group Whistleblower Protection Policy.

Policy implementation The Group Sanctions Officer is responsible for developing a suitable communication plan to publicise the Policy, and its key features, to all employees.