Second Consultation on Amendments to the Financial Crime Module

Second Consultation: Amendments to Financial Crime Module Comments and Feedback December 2023 1 General Comments: Comments REF CBB Response A Licensee

1. Names of shareholders and authorized signatories should be screened before any account opening process is done as it will be a part of accepting or rejecting the account is mentioned in FC￾1.1.10C
2. Whether the capital injection amount could be credited in the initial account or the account used as a separate bank account for the formation expenses and whether the payment could be done in cash or through transfer.
3. Ensure a proper procedure is in place on what action is to be taken if the CDD requirements are not completed within 6 months as mentioned in FC-1.1.10E (For example- if the capital is already in the account, will it only be suspended until the amount is withdrawn or will another action be taken).
4. What are the arrangements in place if the six-month deadline has passed?
5. In relation to new arrivals, can accounts be opened for company owners with valid passports but have a tourist/expired visa .
6. Based on those amendments, the bank shall not require formal documents providing evidence that the company under-formation has applied for and is awaiting its final commercial registration? GR1
7. Agree.
8. The initial deposit of the capital injection should be in the account referred to in FC-1.1.10B and the remittance for meeting the formation expenses should be in the separate account for formation referred to in FC-1.1.10D. The initial deposit in both accounts should be from a bank account to allow return of funds to the same source in the event of closure at a later stage, see FC-1.1.11. FC-1.1.10E will be modified to cross refer to FC-1.1.11.
9. The funds should be returned as per FC-1.1.11.
10. See point 3 above.
11. They must comply with the non-resident account requirements in Module FC in this regard.
12. This would depend on the bank’s risk based procedures. The identity of the owners are available on the Sijilat website based on which certain procedures such as Worldcheck can also be performed. A Licensee

• To clarify treatment of court orders if received against shareholders of a company under formation. GR2 The treatment should be in conformity or compliance with the Court Order.

Second Consultation: Amendments to Financial Crime Module Comments and Feedback December 2023 2 Specific Comments: Reference to the draft Directive: Comments REF CBB Response FC-1.1.10 Conventional bank licensees must not commence a business relationship or undertake a transaction with a customer before completion of the relevant customer due diligence measures specified in Chapters 1, 2 and 3. Licensees must also adopt risk management procedures with respect to the conditions under which a customer may utilise the business relationship prior to verification. However, verification may be completed after receipt of funds in the case of: Bahrain companies under formation which are being registered with the Ministry of Industry and Commerce and Tourism; or newly arrived persons in Bahrain who are taking up employment or residence. ; or non-face-to-face business, or the subsequent submission of CDD documents by the customer after undertaking initial customer due diligence provided that no disbursement of funds takes place in any of the above cases until after the requirements of these Chapters have been fully met. A Licensee FC-1.1.10-“However, verification may be completed after receipt of funds” . The verification of initial documentation submitted by the customer should ideally be conducted before receiving any funds from the prospective client (i.e., before onboarding as the funds cannot be entertained before establishing the business relationship). SP1 It should be noted that the rule applies to Bahrain customers, and the MOIC has already provided the relevant customer with a provisional CR and has all the details of the owners of the company under formation. The bank may ask for copies of the passports/constitutional documents in the case of legal persons and relevant identity information of the owners of the company under formation. The rule change is consistent with the interpretation notes under FATF recommendation 10 relevant to CDD. A Licensee Verification may be completed after receipt of funds in the case of Bahrain companies under formation which are being registered with the Ministry of Industry and Commerce and Tourism or newly arrived persons in Bahrain who are taking up employment or residence. Reference to the highlighted part in FC-1.1.10G in the same update, the FI should not allow any transfers or disbursement of funds from such bank accounts until all the CDD requirements have been fully met. Hence, we need confirmation if both under formation accounts SP2 Legal persons: In the case of legal persons, funds may be transferred or paid out as stipulated in FC-1.1.10D. Only the account for purposes of capital referred to in FC￾1.1.10B is subject to but no transfers or disbursement of funds are allowed. Natural Persons: FC-1.1.10G applies only to newly arrived persons, in which case credits are allowed, but no transfers or disbursement of funds are allowed. There is no reference to Golden Visa holders, it

Second Consultation: Amendments to Financial Crime Module Comments and Feedback December 2023 3 and the individual accounts need be placed on PND (post no debits) only till the full KYC requirements are met (Credits will be allowed). Further, we will need further detail on the minimum requirements under the individual scenario being a residence, are we referring to the golden visa holders? refers to any person taking up residence or employment. FC-1.1.10A Islamic bank licensees must ensure they adopt adequate risk management procedures and perform risk assessments with respect to the conditions under which a customer may utilise the business relationship prior to verification. A Licensee CBB to clarify further on what risk assessment is required, as under the CBB regulation, opening prior to verification is permitted under 2 specified conditions only; mainly for under formation accounts and accounts for new arrivals; also, CBB regulation indicates no right for refusal except for AML concerns; and the need to restrict debits; hence accepting and operating such accounts are not at Bank’s discretion but rather managed in line with the stipulated requirements. CBB to clarify on whether such onboarding should be factored as a parameter in the annual AML/CFT risk assessment. SP3 The requirements of the Chapter on risk based approach in Chapter FC-C and risk management in general are overarching principles that every bank must follow in all cases. Under FC-C, the nature of the customer, and background/industry etc. may be factored in as a parameter in the annual AML/CFT risk assessment. The bank should, however, have procedures to ensure that the conditions governing the account opening as per FC-1.1.10B and FC-1.1.10D are adhered to in their annual assessments. A Licensee Reference is made to FC-1.1.10A. Considering that the companies being set up in Bahrain have already been approved and verified by the Ministry of Industry and Commerce (MOIC), we believe that the bank's risk assessment procedures in this aspect are unclear and could potentially place a heavy operational burden on banks where it is not in the specialization of the SP4 See SP3. The conditions referred to in FC￾1.1.10A could include the conditions to be agreed with the customer under FC-1.1.10B and FC-1.1.10D.

Second Consultation: Amendments to Financial Crime Module Comments and Feedback December 2023 4 bank especially that the proposed drafting does not specify the type of risk assessment. The MOIC would have better insights into the nature of these businesses and whether they necessitate setup disbursements. The banks, however, may consider implementing transaction limitations such as limiting transfers to EFTS and internal transfers to mitigate associated risks. Additionally, further clarification is needed on the following phrase “with respect to the conditions under which a customer may utilize the business relationship prior to verification”. FC-1.1.10B Islamic bank licensees may open a bank account for the purpose of injection of initial capital (bank account for depositing capital) for a company under formation. No transfers or disbursement of funds must take place from such bank account until all the CDD requirements have been fully met. A Licensee Does this apply to Transactions too? SP5 FC-1.1.10B applies to companies under formation in respect of which banks may open a separate bank account for capital injection, but on the basis that moneys shall not be disbursed or transferred from the account until the CDD is fully completed. A Licensee In order to minimize the associated AML risks, the following controls are suggested to be mandated: Injecting capital must be done through wire transfers from founders/owners’ accounts only. This will facilitate account closure and returning the outstanding balance in case of not completing the company’s registration. SP6 See GR1/2.

Second Consultation: Amendments to Financial Crime Module Comments and Feedback December 2023 5 A Licensee Shall the bank open an individual account (shareholder) or company account for depositing the initial capital. SP7 The amendment to requirements in FC Module allows the opening of a legal person’s account. FC-1.1.10C Conventional bank licensees should only deny a request for opening accounts due to serious reasons or in case of suspicions arising from AML/CFT risk assessments. An example of a serious reason includes the detection of the fact that one of the shareholders of the company under formation appears in local, regional or international sanction lists. A Licensee We suggest adding the text in blue: Conventional bank licensees should only deny a request for opening accounts due to serious reasons or in case of suspicions arising from AML/CFT risk assessments or in case of deviation to the licensee’s policies and procedures. An example of a serious reason includes the detection of the fact that one of the shareholders or authorized signatories of the company under formation appears in local, regional or international sanction lists or is associated with negative news on the public domain. SP8 The bank may have additional precautionary measures if needed, but they need to be justified. FC-1.1.10D Conventional bank licensees may open a separate bank account for the purpose of payment of formation expenses under conditions to be agreed with the customer. A Licensee The bank's view, opening a separate account will involve some risks challenges, such as:

• Transaction monitoring
• Consequences of non-compliance of these guidance points which might result in increased AML risk. We suggest to the CBB to consider the corporate customer is allowed to operate an account only post completion of CDD. Any payments to the authorities may be paid by the credit/debit cards of the individuals behind the formation of the company or the corporate SP9 Banks require systems and processes to manage the risks associated with dealing with companies under formation.

Second Consultation: Amendments to Financial Crime Module Comments and Feedback December 2023 6 products of the parent company & shall be subject to the usual transaction monitoring. A Licensee CBB to clarify if this account should be personal or under the corporate’s name. SP10 See SP7. A Licensee This requirement was discussed in a meeting between the CBB and all retail banks on 9th November 2023. below are our comments: -The requirements in our CDD Procedures (under 9.2.1 Deferrals) allow to conduct business prior to completing CDD in exceptional circumstance if the following conditions are met: (a) the Client must not have a risk rating of E. (b) name screening on all relevant parties must be completed and any matches or partial matches resolved. (c) no transaction (including any payment out of the Account to the Account holder) may be made except for inward remittances and cheque deposits. (d) cash or traveler’s cheques must not be accepted into the Account; and (e) the deficiency must be rectified as a matter of urgency within the thirty (30) day period. As per the above, SCB follows a more stringent approach, where a hard hold is placed on such accounts and only inward transactions for capital injection is allowed. SP11 The bank may consult its group compliance teams to check if the rules cannot be implemented. For the points raised, see response. (a) This point addresses the risk procedures required under FC-1.1.10A. (b) the bank may obtain additional data for the purposes of (b). (c) This point will not be consistent with the CBB requirements. (d) The bank may have additional conditions from a risk management perspective, but this must be documented and made known to the customer at the time of onboarding. (e) as (c) above. The amendments to the FC Module will not be consistent with the CBB requirements, however, the bank may discuss this further with the supervisory point of contact. However, if SCB parent rules prohibit such transactions in Bahrain, SCB Bahrain can follow the stricter rules.

Second Consultation: Amendments to Financial Crime Module Comments and Feedback December 2023 7 A Licensee If the mentioned account should be in retail (under the individual name) or commercial (under the entity name) segment? In addition, Islamic bank licensees may open a separate bank account for the purpose of payment of formation expenses under conditions to be agreed with the customer. At the time of initiating a relationship with the customer, the overall relationship is marked as either Corporate or Individual having different sets of internal and regulatory requirements. Accordingly, accounts are opened as per customer’s preference and eligibility. The Under Formation accounts are Corporate by type, as understood during the meeting conducted by the CBB, such separate accounts will be opened on Individual basis i.e. under the authorized person’s KYC, this will lead to Hybrid relationship comprising both Corporate and Individual and may have further implications on KYC maintenance and reporting. SP12 The rules are silent on where the account is opened, as it is not relevant from a CBB or FATF compliance perspective. The bank may follow an approach that addresses any business model/operating model issues but keeping in view the objectives of the amendments which is to ensure persons starting a business in Bahrain have a viable means of payment via a bank account in Bahrain. A Licensee We understand the need for under formation companies to make payments during their setup. However, it's not obvious how a second account would help monitor these transactions during the setup phase. Instead, banks may use the existing account, where initial funds are already SP13 The second account was recommended to ensure the account opened for the purpose of capital injection is undisturbed until all CDD measures are completed.

Second Consultation: Amendments to Financial Crime Module Comments and Feedback December 2023 8 blocked and agreed upon extra funds may be deposited to the same account to be utilized for setup disbursements. The bank then may limit the setup disbandment to EFTS and internal bank transfers. We believe that opening a new account just for the sake of disbursements will not add any value. However, this will impose unnecessary strain on the banking operations. A Licensee (a) We suggest mandating that the separate bank account be in the form of an internal suffix under the same basic account. (b) We suggest mandating that requests of debit transactions must be done through branches only (i.e. face to face). (c) We suggest specifying permissible debit transactions (i.e. salaries, rent, etc.). (d) We suggest prohibiting cross border transfers. (e) We suggest prohibiting cash withdrawals. SP14 (a) This is acceptable. (b) Some banks do not have digital onboarding yet. So, this should be left for the banks to decide on whether they implement face-to-face or digital. From the CBBs perspective, we will allow digital onboarding, but they can choose whether to implement it or not. (c) The proposed rule (FC-1.1.10D addresses this concern). (d) FC-1.1.10F states that all transactions are done only through EFTS if required to impose such restrictions. (e) See (d) above. FC-1.1.10E All bank accounts of the company under formation must be closed or suspended if the final CR is not received and the customer has not completed the customer due diligence requirements within a period of six A Licensee • If the Bank decides after a period of time to close the Under Formation Account, as stipulated in FC-1.1.10E, does the Bank have to inform MOIC or CBB? Further, does the reason have to be documented and SP15 • They should inform MOIC as per the rules.

Second Consultation: Amendments to Financial Crime Module Comments and Feedback December 2023 9 months from the date of opening the account. The six-month period may be extended subject to a bilateral arrangement between the licensee and the customer communicated to the customer, MOIC and/or CBB? • Not in favor to leave the agreement for extension open ended. Also, CBB to define suspension (locked status or restrict debits?). • This should be addressed in the risk assessment. A Licensee Regarding the regulation concerning the closure/suspension of accounts, we can close accounts if no capital was deposited. We cannot close the account if the account has credit balance/capital deposited. SP16 The customer must be made aware of the procedure so that the funds can be returned in accordance with FC-1.1.11, i.e. “return the funds to the counterparty in the same method as received.” A Licensee We suggest removing the text in red: All bank accounts of the company under formation must be closed or suspended if the final CR is not received and the customer has not completed the customer due diligence requirements within a period of six months from the date of opening the account. The six-month period may be extended subject to a bilateral arrangement between the licensee and the customer. SP17 This should be addressed in the risk assessment. FC-1.1.10F For the purposes of account mentioned in Paragraph FC-1.1.10D, conventional bank licensees should follow the guidance below: (a) Licensees should receive from the customer, information regarding the nature of transactions, volume and prospective vendors during the formation stages; A Licensee • Bank normally inquires about the purpose of account & the anticipated transactions, however it is challenging to set limits per account, and it is challenging to limit the channels to EFTS. Investors especially non resident investors should have the flexibility for SP18 This paragraph is guidance to assist the banks in managing the said account.

Second Consultation: Amendments to Financial Crime Module Comments and Feedback December 2023 10 (b) Licensees may agree with the customer a limit for maximum payments to be made out of this account; (c) Licensees should ensure that payments from such accounts are only through EFTS; and (d) Licensees should integrate their systems with Sijilat system of the Ministry of Industry and Commerce for real-time access to allow opening of accounts in a timely and efficient manner. the mode of transfers/payments, i.e. debit /credit cards issued by their bankers anywhere locally/abroad. • System integration with Sijilat requires a detailed assessment & a project to be delivered, this is more relevant to be linked with the corporate eKYC as & when it happens, and it is not recommended to make it part of the Rulebook at this point of time. This may also require a huge funding which may not be a priority of the bank due to the volume of such onboardings. A Licensee We recommend specifying integration requirements with Sijilat. SP19 See SP18. A Licensee Would appreciate sharing the technical specification as soon as same is ready. SP20 See SP18. A Licensee (b): CBB to clarify as the earlier requirement states No transfers or disbursement of funds must take place from such bank account until all the CDD requirements have been fully met (c): CBB to clarify as the earlier requirement states No transfers or disbursement of funds must take place from such bank account until all the CDD requirements have been fully met. Is this meant for the account used to pay expenses only? SP21 Point (b) - Earlier requirements have now been amended. Point (c) - Yes.

Second Consultation: Amendments to Financial Crime Module Comments and Feedback December 2023 11 (d): Is this required for all branches or for digital apps? For onboarding only or ongoing basis? CBB to share defined contact with MOIC please. Point (d) – All channels. A Licensee (a): During the account opening process, customers may be asked to provide information about their regular payments and vendors as a question for the customer to fill out in the KYC form. However, it's important to note that the bank may not have the means to verify the accuracy of these payments or confirm if they are being made to the same vendors as stated. Additionally, in many cases, the bank may not have knowledge of the vendors' identities. SP22 Banks must use normal processes for surveillance and the amended CBB requirements are not expecting banks to take on the role similar to that of an escrow account custodian bank. A Licensee Point (a) and (b): It would not be feasible to have a system functionality to capture the list of vendor names in system. Also, to customize the transaction limit customer wise. If any such control to be placed, it will be totally manual. This could be prone to errors. Point (d): Is it mandatory to integrate our core banking system with Sijilat system for timely opening of accounts? We can do it without integration as well by checking the Sijilat site manually. SP23 Banks should establish a reasonable process for the same. Currently, it is recommended practice and not mandatory. A Licensee We would appreciate further clarification on FC-1.1.10D and FC-1.1.10F(b). As in many cases, the bank may not have sufficient information to determine what would be SP24

Second Consultation: Amendments to Financial Crime Module Comments and Feedback December 2023 12 considered a reasonable amount for a company to spend during the setup phase. It is important to note that some companies may have limited capital but require significant expenditures for their setup. As a suggestion, we believe that the MOIC may have more insight and clarity on the amounts to be spent. It could be beneficial if the Ministry could provide specific guidelines or set a certain amount that is deemed appropriate for setup purposes for each company. See SP23. A Licensee FC-1.1.10F (B) and (C) are considered a major requirement/modification to be accommodated in the Core Banking System which we can raised to the vendor in all cases. SP25 See SP23. A Licensee This requirement was discussed in a meeting between the CBB and all retail banks on 9th November 2023. below are our comments: -The requirements in our CDD Procedures (under 9.2.1 Deferrals) allow to conduct business prior to completing CDD in exceptional circumstance if the following conditions are met: (a) the Client must not have a risk rating of E; (b) name screening on all relevant parties must be completed and any matches or partial matches resolved; (c) no transaction (including any payment out of the Account to the Account holder) may be made except for inward remittances and cheque SP26 See SP11.

Second Consultation: Amendments to Financial Crime Module Comments and Feedback December 2023 13 deposits; (d) cash or travellers cheques must not be accepted into the Account; and (e) the deficiency must be rectified as a matter of urgency within the thirty (30) day period. As per the above, SCB follows a more stringent approach, where a hard hold is placed on such accounts and only inward transactions for capital injection is allowed. For point (d), we seek further clarity from the CBB on what is the requirement of integrating the Bank's system with Sijilat? See SP23. FC-1.1.10G In the case of newly arrived persons in Bahrain who are taking up employment or residence; or non-face￾to-face business, an account may be opened after undertaking initial customer due diligence after obtaining and verifying the identity information of the customer. However, no transfers or disbursement of funds must take place from such bank account until all the CDD requirements have been fully met. A Licensee FC-1.1.10G – “an account may be opened after undertaking initial customer due diligence” – it is recommended to outline what the initial due diligence requirements are for this category of customers considering that they would not have any applicable documents to their intended business within Bahrain. SP27 For this category of customers, passport details and the Sijilat details as above would be relevant. A Licensee Confirmation that notifying to MOIC for dormant accounts/capital withdrawn will no longer be required? SP28 The FC Module does not address any MOIC requirement that banks may be subject to, if any. FC-1.1.10H In complying with the requirements of Paragraph FC-1.1.10G, examples of serious reasons for denying the request for opening an account may include failure to provide a valid passport. It may also include instances where a potential customer’s conduct or activity appears A Licensee The guidance mentions serious reasons for which the Bank may deny opening accounts. However, the rule under FC-1.1.10G which is also referenced in the aforementioned guidance SP29 The guidance in FC-1.1.10H helps banks deny the customer to open an account.

Second Consultation: Amendments to Financial Crime Module Comments and Feedback December 2023 14 suspicious, or the customer’s name appears in one of the local, regional or international sanction lists. does not give the Bank the right to deny opening the account for serious reasons. FC-1.1.13F If the company under formation did not complete the license formalities nor submitted all required KYC documents to the subject Islamic bank within the agreed period and the company is not cooperating with the Islamic bank, the account of the company must be classified as dormant. A Licensee Since FC-1.1.13F is proposed to be deleted, we suggest clarifying the required action by the bank if the company under formation did not complete the license formalities nor submitted all required KYC documents to the subject bank within the agreed period and the company is not cooperating with the bank. For example, close the account and transfer the available balance to shareholders’ accounts (same way received). SP30 Closure of account is envisaged under the amended rules under FC-1.1.11 and FC￾1.1.10E. FC-1.1.13H Closure of the accounts thereafter shall be subject to the discretion of the bank. A Licensee We recommend keeping regulation FC-1.1.13H, which states that “Closure of the accounts thereafter shall be subject to the discretion of the bank”. SP31 See FC-1.1.11.