TPRM & KYC Refresher Training

What is TPRM stands for?

• Third Party Residual Management

• Third Party Risk Management

• Third Part Rescue Management

• Third Poll Rescue Matter

Our TPRM programme consists of 3 main tools. What are they?

Select all correct answers.

• KYC Questionnaire (Know Your Counterparty Self-Declaration Questionnaire);

• Compliance Clauses

• Technical Review

• Online Screening System (i.e. KYC6 by Acuris)

What are the 5 Critical Legal Areas?

• Ethics & Integrity

• Export Control

• Sanction

• Competition & Trade

• Data Privacy

Who is the third party according to TPRM?

• Third parties are external parties that a company enters into contract with e.g business partners, contractors, vendors, suppliers, distributors, consultants, agents, sellers, customers etc

• All people dealing with us in daily activities.

• All family's members of the company employees.

Due diligence screening is Screening of third party to determine any potential risks (or ‘red flags’) involving legal, financial or reputational risks. When should we perform the due diligence screening?

• Before entering transaction with new and existing business partners/third parties.

• After completed transaction with new and existing business partners/third parties.

• During transaction with new and existing business partners/third parties.

Why should PETRONAS embed the due diligence screening in its processes? Select all correct answers.

• To safeguard project team responsible for engaging and managing business partner from any conflict and for the team to be able to rely on the defense of “adequate procedures”.

• Set the tone on business partner(s) of PETRONAS’ compliance expectations in the event of audit.

• Important because self-declaration on business and credit information to test the integrity of the business partner for any red-flags.

• To enable formulation of contractual safeguards as risks (if any) vary between business partners, locations and activities.

What information can I get from the Online Screening System?

• Politically exposed persons (or PEP)

• Sanctions

• Financial Background

• Legal Ownership

• Business Profile

Who should send the KYC Questionnaire to the third party?

• Risk Focal

• Legal Focal

• The person who acts as the focal in liaising with the third party

• Manager

What should I do immediately after a third party has answered the KYC Questionnaire?

• Handover KYC Questionnaire to PCG Risk Focal.

• Please check all the answers provided by the third party and identify whether there is any alarming status on their answers. Please consult OPU Risk Focal.

• Save in your respective local folder.

• Email completed KYC Questionnaire to Legal team.

How long is the validity of the answers/responses to the KYC Questionnaire? (provided that there are no adverse media/news in relation to the third party)

• 6 months

• 1 year

• 2 years

• 3 years