Implementing Regulation to the Anti-Money Laundering Law

Implementing Regulation to the AML Law October 2017-EN Draft translation of the Implementing Regulation to the Anti-Money Laundering Law 1/1 - The following terms and phrases – wherever mentioned in the Law and its Implementing Regulation – shall have the meanings assigned thereto unless the context requires otherwise: A. Person: Includes any natural or legal person. B. Transaction: Includes any disposition of funds, properties, cash or in kind proceeds including but not limited to depositing, withdrawing, transferring, selling, purchasing, loaning, committing, extending of credit, mortgaging, gifting, financing, or exchanging of funds in any currency, whether in cash or checks, payment orders, sticks, bonds or any other financial instruments; or using safe deposit boxes and any other disposition of funds. C. Economic resources: Are assets of any kind, whether tangible or intangible, movable or immovable, actual or potential, which may be used to obtain funds, goods or services, including but not limited to equipment, furniture, fittings and fixtures and other items of a fixed nature; vessels, aircraft and motor vehicles; inventories of goods; art; jewelry; gold; oil products, refined products, modular refineries and related material including chemicals and lubricants; minerals, or timber or other natural resources; arms and related materials, raw materials and components that can be used to manufacture improvised explosive devices or unconventional weapons, any types of proceeds of crime, including from the illicit cultivation, production or trafficking of narcotic drugs or their precursors; patents, trademarks, copyrights and other forms of intellectual property, internet hosting or related services. D. Correspondent Relationship: It is a relationship between a correspondent institution and a respondent institution through a current or other account or related services, such as cash management, international funds transfers, cheque clearing, foreign exchange services, trade finance, liquidity management, or short-term borrowing. The definition shall also cover correspondent relationships established for securities transactions or funds transfers. E. Financial Group: Is a group that consists of a company or of any other type of legal or natural persons that exercises control and coordinating functions over the rest of the group for application of group supervision, together with branches or subsidiaries that are subject to anti-money laundering policies and procedures at the group level. F. Legal Arrangements: The relationship established by a contract between two parties or more which not result legal person, such as trusts or other similar arrangement. G. False Declaration: Providing a fake information on the value of currency or bearer negotiable instruments which are being transferred, or providing other false information required by the declaration or by the General Directorate of Customs, including not providing the declaration as required. H. Controlled Delivery: A method whereby the competent authority, and under its observation, is

permitted to allow the illicit or suspicious fund or proceeds of crime to enter the Kingdome, pass it, or go outside the Kingdom for the purpose of identifying and detecting such crime and its perpetrators. 1/2 – All activities and financial transactions mentioned in Para (7) of this Article are as following: A. Acceptance of deposits and other repayable funds from the public, including private Banking; B. Lending, financial leasing or any other form of financing; C. Money or value transfer services; D. Issuance and managing means of payment (e.g. credit and debit cards, checks, traveler's checks, payment orders and bankers’ drafts, electronic money); E. Issuance Financial guarantees and commitments; F. Activities related to securities as set out in the Capital Markets Law or any trading in:

1. money market instruments including checks, bills of exchange, and certificates of deposit;
2. currencies;
3. exchange, interest rate and financial index instruments;
4. negotiable securities and financial derivatives;
5. commodity future trading; G. Foreign exchange transactions; H. Participation in securities issuing, and provision of financial services; I. Individual and collective portfolio management; J. Safekeeping and administration of cash or liquid securities on behalf of other persons; K. Concluding life insurance contracts and other types of investment related insurance as a provider or an agent or broker of the insurance contract or any other insurance products stipulated in the Law on Supervision of Cooperative Insurance Companies; or L. Investing, administering or managing funds on behalf of other persons. 1/3 - The Commercial and Profession activities mentioned in Para (8) of this Article are as following: a. Real estate brokerage when they are involved in transactions for their client concerning the buying and selling of real estate in all its forms; b. Dealing in gold, precious stones, or precious metals, when engaging in cash transactions with a customer equal to or above SAR 50.000, whether the transaction is carried out in a single operation or in several operations which appears to be linked, whether through individual firm or commercial Companies. c. Attorneys and any person providing legal or accounting type services in the exercise of professional activities, when they prepare, execute, or conduct a transaction for customers in relation to any of the following activities: i. Purchase or sale of real estate; ii. Management of a customer's funds, including securities, bank accounts, and other assets; iii. Establishment, operation, or management of legal persons or legal arrangements and the organization of related subscriptions; or iv. Sale or purchase of commercial companies. 1/4- The Supervisory Authority as stipulated in para (12) of this Article are: A. Saudi Arabian Monetary Authority. B. Capital Market Authority.

C. Ministry of Commerce and Investment. D. Ministry of Justice. E. Ministry of Labor and Social Development. F. Any other authority mandated by law to monitor or supervise financial institutions or designated non-financial businesses of professions or NPOs 1/5- All activities and works mentioned in Para (16) of this Article are as following: a) Arranging, or undertaking a transaction, business relationship or opening account; b) A signatory to a transaction, business relationship, or account; c) Assigning an account, transferring rights or obligations according to a transaction; d) who is authorized to conduct a transaction, or to control a business relationship or an account; or e) who attempts to take any of previous actions. 1/6- The competent Authority stipulated in para (13) of this Article are: a. Public Prosecution. b. Ministry of Interior. c. Presidency of State Security. d. Supervisory Authority. e. General Directorate of Customs. f. General Directorate of Financial Intelligence. g. Any other authority assigned to apply the provisions under this Law. 2/1 The money laundering offense under the law apply, according to the law, to the person who committed the predicate offense and participated in money laundering crime. 5/1 Financial institution or designated non-financial business and profession shall identify asses and document their money laundering risks in writing, and regularly update its money laundering risk assessment and any underlying information, and keep both the report and any underlying information readily available for the supervisory authority. The nature and extent of the risk assessment shall be appropriate to the nature and size of the financial institutions’ or designated non-financial businesses and professions’ business. 5/2 Financial institution or designated non-financial business and profession when assessing its money laundering risks, shall give consideration to the following: a. Customer risk factors and risk factors relating to the beneficial owner or beneficiary; b. Risk factors emanating from countries or geographic area in which customer operates or the place of origination or destination of a transaction; c. Risk arising from the nature of products, services and transactions offered and the delivery channels for products and services. 5/3

When carrying out a risk assessment, a financial institutions and designated non-financial businesses or professions shall take into account the any risks identified on the national level and any variables which may increase or decrease the money laundering risk in a specific situation, including: a. The purpose of an account or relationship; b. The size of deposits or transactions undertaken by a customer; c. The frequency of transactions or duration of the relationship. 5/4 Based on the outcome of the risk assessment, a financial institutions or designated non-financial businesses and professions shall develop and implement internal policies, controls and procedures against money laundering that set out the appropriate level and type of measures to manage and mitigate the risks that have been identified; to monitor the implementation of those policies, controls and procedures; and to enhance them as necessary. 5/5 For higher level of risks the financial institution or designated non-financial business and profession shall apply enhanced mitigation measures; for a lower level of risks a financial institution or designated non￾financial businesses and profession may apply simplified measures to manage and mitigate the risks. Simplified measures shall not be permitted if there is a suspicion of money laundering. 5/6 A financial institution or designated non-financial business and profession shall identify and assess the money laundering risks that may arise from the development of a new product, business practice or delivery mechanism, or from the use of a new or developing technology for new or pre-existing products. The risk assessment shall be carried out prior to the launch of the new product, business practice or delivery mechanism or prior to the use of the new technology. A financial institution or designated non-financial business and profession shall take appropriate measures to manage and mitigate the identified risk. 7/1 A financial institution or designated non-financial business and profession shall undertake due diligence measures at the following times: a. Before establishing a new business relationship or opening a new account; b. Before carrying out a transaction for a customer with whom the financial institution or designated non-financial business and profession is not in an established business relationship, whether the transaction was conducted for one time or several times where the transactions would appear linked to each other; c. Before carrying out a wire transfer as prescribed by Article 10 of the Law for a customer with whom the financial institution or designated non-financial business and profession ion are not in an established business relationship; d. Whenever there is a suspicion of money laundering, regardless of the amounts involved; or e. Whenever the financial institution or designated non-financial business and profession has doubts either about the veracity or adequacy of previously obtained customer information or identification

data. 7/2 Due diligence measures shall be based on risk and, at a minimum, comprise of the following: a. Identify the customer and verify the customer’s identity, using reliable, independent source documents, data or information: 1 . For a customer that is a natural person, the financial institution or designated non-financial business and profession shall obtain and verify the full legal name, residential or the national address, date and place of birth, and nationality; 2 .For a customer that is a legal person or a legal arrangement, the financial institution or designated non-financial business and profession shall, at a minimum, obtain and verify the name, legal form and proof of existence, the powers that regulate and bind the legal person or legal arrangement, the names of all directors, senior managers or trustees, and the address of the registered office and, if different, the principal place of business. 3 .Depending on the risk posed by a specific customer, the financial institution or designated non￾financial business and profession shall determine whether any additional information must be collected and verified. b. Verify that any person purporting to act on behalf of a customer is so authorized, and identify and verify the identity of that person in line with subsection (a); c. Identify the beneficial owner and take reasonable measures to verify the identity of the beneficial owners, using information and data obtained from a reliable source, such that the financial institution or designated non-financial business and profession is satisfied it knows who the beneficial owner is, as following:

1. For a customer that is a legal person, a financial institution or designated non-financial business and profession shall identify and take reasonable measures to verify the identity of the natural person who ultimately owns or controls 25% or more of the legal entity’s shares.
2. Where no controlling ownership interest exists as stipulated in the previous para (1), or there is doubt whether the controlling shareholder is not indeed the beneficial owner, the identity of the natural person exercising control of the legal person through other means; or, as a last means, the identity of the natural person who holds the position of senior managing official, and verify it.
3. For a customer that is a legal arrangement, a financial institution or designated non-financial business and profession shall identify and take reasonable measures to verify the identity of the endower, beholder, the beneficiaries or classes of beneficiaries, and any other natural person exercising ultimate effective control over the legal arrangement. d. Understand and obtain additional information on the purpose and intended nature of the business relationship, as appropriate. e. For the legal persons or legal arrangement, the ownership and control structure of the customer should be understood. 7/3 A financial institution or designated non-financial business and profession shall verify the identity of the customer and beneficial owners before or during the course of establishing a business relationship or opening an account; or before carrying out a transaction for a customer with whom the financial institution or

designated non-financial business and profession is not in an established business relationship. Where the money laundering risk is low, a financial institution or designated non-financial business and profession may complete verification of the customer’s identity as soon as practicable after the establishment of the business relationship if postponing the verification is essential not to interrupt the normal conduct of business and the financial institution or designated non-financial business and profession shall apply appropriate measures to manage the money laundering risk. The financial institution or designated nonfinancial business and profession shall take measures to managing the risk in the circumstances where the customer benefit from the business relationship before the verification is completed. 7/4 In addition to the measures under Section 7/2, a financial institution shall, in relation to a beneficiary of a saving and protection insurance or other investment related insurance policy, apply the following due diligence measures as soon as the beneficiary is identified or designated: a. For a beneficiary identified by name, take the name of that person whether it is natural or legal person; b. For a beneficiary designated by class or characteristics or any other means such as deeds , obtain sufficient information concerning the beneficiary to ensure that the financial institution will be able to identify the beneficiary prior to payout; In all cases, a financial institution shall verify the identity of the beneficiary prior to a payout under the insurance policy or prior to the exercising of any rights related to the policy. 7/5 A financial institution, when determining whether enhanced due diligence measures are required in relation to a specific policy, shall take into account risk factors relating to the beneficiary of the policy and, if the financial institution considers that a beneficiary poses a higher risk, shall in all cases identify and verify the identity of the beneficial owner of the beneficiary at the time of payout. 7/ 6 A financial institution or designated non-financial business and profession shall carry out ongoing due diligence on all business relationships in accordance with the risks posed, verify the transition throughout the business relationship to ensure the consistency with customer’s data, activities and risk posed by customer. Also It should be ensured that documents, data and information collected under the due diligence process is kept up-dates and relevant by undertaking reviews of existing records, in particular for higher risk customers. 7/ 7 A financial institution or designated non-financial business and profession shall apply due diligence measures to customers and business relationships that existed at the date of coming into force of the Law and this Implementing Regulations. A financial institution or designated non-financial business and profession shall apply due diligence measures to existing customers and business relationships based on materiality and risk and conduct ongoing due diligence on such existing customers and business relationships at appropriate times, taking into account whether and when due diligence measures have previously been undertaken, and the adequacy of data obtained. 7/ 8 A financial institution or designated non-financial business and profession that is unable to comply with the

due diligence obligations may not open the account, establish the business relationship or carry out the transaction; or in relation to existing customers or business relationships, shall terminate the business relationship; and shall in all cases consider submitting a suspicious transaction report to the Directorate. 7/ 9 Where a financial institution or designated non-financial business and profession has a suspicion of money laundering and it reasonably believes that performing due diligence may tip off the customer, it may opt to not carry out due diligence measures and shall submit a suspicious transaction report to the Directorate of financial intelligence , and stating the reasons as to why due diligence was not applied. 7/ 10 A financial institution or designated non-financial business and profession may rely on another financial institution or designated non-financial business and profession to perform identification and verification of the customer; identification and verification of the beneficial owner; and to take the necessary measures to understand the nature and intended purpose of the business relationship. 7/ 11 If financial institution or designated non-financial business and profession place reliance on another party as stated in 7/10, they shall do the following: a. immediately obtains all necessary information as required under Article 7 of the Law and this Implementing Regulation; b. take measures to satisfy that copies of identification data and other relevant documentation relating to the due diligence measures will be made available, and without delay; c. ensure that financial institution or designated non-financial business and profession relied upon is regulated, supervised for and has measures in place for compliance with due diligence and record keeping requirements in line with the requirements stipulated under the Law and this Implementing Regulation. d. Take into account information available with (AMLPC) and the Directorate of Financial intelligence with regard to high-risk countries identified. The ultimate responsibility of all requirements stipulated in this law and its implementing regulation relay on the requesting financial institution and designated non-financial business and profession. 7/12 when a financial institution is being relied upon by another domestic or foreign financial institution, confidentially requirements under Saudi law shall not preclude a financial institution from exchanging information as required for the reliant party to determine whether the relied upon financial institutions applies appropriate standards 7/13 A financial institution or designated non-financial business and profession that relies on a financial institution or designated non-financial business and profession that is part of the same financial group may consider that the financial institution or designated non-financial business and profession relied upon meets the requirements under Article 7/10 and 7/11 provided the group applies due diligence and record keeping requirements in line with the Law and this Implementing Regulation, the implementation of such policies is supervised at the group level by a competent authority and any higher country risk is adequately mitigated by

the group’s policies and controls. 7/14 A financial institution or designated non-financial business and profession shall determine the extent and depth of application of due diligence measures under Article 7 of the Law based on the types and levels of risk posed by a specific customer or business relationship. Where the risk of money laundering is higher, a financial institution or designated non-financial business and profession shall apply enhanced due diligence measures consistent with the risks identified. Where the risk of money laundering is lower, a financial institution or designated non-financial business and profession may conduct simplified due diligence measures provided there is no suspicion of money laundering, in which case simplified due diligence shall not be permitted. The simplified measures shall be commensurate with the lower risk. 8/1 The person is or has become assignee with a prominent public function in the Kingdom or a foreign country; or with a senior management position in an international organization is consider as “politically exposed person”, it shall comprise the following: a. Heads of State or of government, senior politicians, senior government, judicial or military officials, senior executives of state owned corporations, and important party officials b. Directors, deputy directors, and members of the board or equivalent function, of any international organization. 8/2 The obligations under Article 8 of the Law shall apply in relation to politically exposed persons, their close associates and family members. 8/3 A family member of a politically exposed person shall include any individual who is related to a politically exposed person by blood or marriage up to the second degree. 8/4 A close associate of a politically exposed person shall include any natural person who is known to have joint beneficial ownership of a legal entity or legal arrangement or who is in a close business relationship with the politically exposed person, or who has a beneficial ownership of a legal entity or legal arrangement which is known to have been set up for the benefit de facto of a politically exposed person. 8/5 A financial institution or designated non-financial business and profession shall in relation to politically exposed persons from a foreign country, obtain senior management approval before establishing or continuing such a business relationship; take reasonable measures to establish the source of wealth and the source of funds of the politically exposed person; and conduct enhanced ongoing monitoring on the business relationship; and the same applied in relation to politically exposed persons from the Kingdom, in case of a higher risk of money laundering.

8/6 A financial institution shall take the reasonable measures to determine whether the beneficiaries or the beneficial owner from the saving and protection policy or any other investment insurance policy, before the payout of the policy prior to the exercising of any rights related to the policy, are PEPs, if so, the FI shall inform the senior management before the payout or prior to the exercising of any rights related to the policy, and conduct enhanced scrutiny on the business relationship, and consider making a suspicious transaction report. 9/1 Before entering into a cross-border correspondent relationship, a financial institution shall apply the following risk mitigating measures: a. gather sufficient information about the respondent institution to understand fully the nature of the respondent’s business, and determine from publicly available information the reputation of the institution and the quality of supervision, and whether the respondent institution has been subject to a money laundering investigation or regulatory action; b. assess the respondent institution’s anti-money laundering controls; c. obtain approval from senior management before establishing new correspondent relationships; and d. clearly understand the respective anti-money laundering responsibilities of each institution. e. Reach satisfactory convention that a respondent financial institution does not allow the use of its account by shell banks. 9/2 Where a financial institution registered and licensed in the Kingdom enters into a correspondent relationship in order to receive services from a foreign correspondent financial institution, confidentially requirements under Saudi law shall not preclude the financial institution from providing to the foreign institution the information and documents required for the foreign institution to satisfy itself that the conditions under 9/1 (a) and (b) are met. 10/1 Article 10 of the Law shall apply to cross-border wire transfers and domestic wire transfers in any currency, including serial payments and cover payments, which are received, or sent or processed by a financial institution in the Kingdom, including credit or debit or prepaid card, mobile phone or other digital or IT prepaid or postpaid device that are used to effect a person-to-person transfer of funds. The scope of the Law does not extend to a transfer that a. flows from a transaction carried out using a credit or debit or prepaid card, a mobile phone or any other digital or IT prepaid or postpaid device with similar characteristics and exclusively for the purchase of goods or services, provided the credit or debit or prepaid card number accompanies the transfer flowing from the transaction; or b. constitutes a transfer or settlement between two financial institutions where both the originator and the beneficiary are a financial institution acting on their own behalf. 10/2 Originator information shall include: a) The full name of the originator;

b) The originator account number where such an account is used to process the transaction or in the absence of an account number, a unique transaction number that permits traceability of the transaction; and c) The originator’s address, or customer identification, or date and place of birth. Beneficiary information shall include: a) The full name of the beneficiary; and b) The beneficiary account number where such an account is used to process the transaction or in the absence of an account number, a unique transaction number that permits traceability of the transaction. 10/3 A financial institution that orders a wire transfer shall include required and verified originator information and required beneficiary information with each wire transfer. In case of a suspicion, an STR shall be submitted according to Article 15 of the Law. If a financial institution cannot comply with its obligations under this provision, it shall not order the wire transfer. 10/4 Where several individual cross-border wire transfers from a single originator are bundled in a batch file for transmission to several beneficiaries, the ordering financial institution shall include in the batch file the required and verified originator information; the required beneficiary information that is fully traceable within the beneficiary country; and the originator’s account number of unique transaction reference number. 10/5 For domestic wire transfers, the obligations set out in Article 10/3 shall apply unless the ordering financial institution is in a position to make all required originator and beneficiary information available to the financial institution ultimately receiving the wire transfer or competent authorities by other means, in which case the ordering financial institution may only include the account number or a unique transaction reference number that permits the transaction to be linked with the relevant originator or beneficiary information. The ordering institution shall make the required and verified originator and required beneficiary information available within three business days upon receiving a request for such information from the financial institution ultimately receiving the wire transfer or a competent authority. 10/6 A financial institution shall maintain all originator and beneficiary information in accordance with Article 12 of the Law. 10/7 For cross-border wire transfers, a financial institution processing an intermediary element of the payment chain shall ensure that all originator and beneficiary information that accompanies a wire transfer is retained with it, and shall keep all wire transfer information including originator and beneficiary information in accordance with Article 12 of the Law. 10/8 Where technical limitations prevent the required originator or beneficiary information accompanying a cross-

border wire transfer from remaining with a related domestic wire transfer, the intermediary financial institution shall keep a record for ten years of all the information received from the ordering or other intermediary financial institution. 10/ 9 A financial institution ultimately receiving or processing an intermediary element of a wire transfer shall have in place and apply procedures for: a) Identifying wire transfers that lack required originator or beneficiary information; b) Determining, on a risk basis, when to execute, reject, or suspend a wire transfer that lacks required originator or required beneficiary information; and c) Taking appropriate risk based follow-up action which may include restricting or terminating the business relationship. 10/ 10 A financial institution ultimately receiving a cross-border wire transfer shall take reasonable measures to identify cross-border wire transfers that lack required originator or beneficiary information. Such measures may include post-even monitoring or real-time monitoring where feasible. , if the identity has not been previously verified, a financial institution ultimately receiving the transfer shall verify the identity of wire￾transfer sender’s information and maintain this information in accordance with Article 12 of the Law. 10/11 Confidentially requirements under Saudi law shall not preclude a financial institution from exchanging information with other domestic or foreign institutions that are processing any part of the transaction as required to comply with the provisions under this Article. 14/1 The policies, procedures and internal controls shall be proportionate to the nature and size of the financial institution or designated non-financial business and profession’s business and shall address the following: a. Due diligence measures as required under this law and its Implementing Regulation, including risk management procedures for utilization of a business relationship prior to completion of the verification process; b. Transaction reporting procedures; c. Appropriate anti-money laundering compliance management arrangements, including appointment of an anti-money laundering compliance officer at the senior management level; d. Adequate screening procedures to ensure high standards when hiring employees; e. Ongoing employee training programs; and f. An independent audit function to test the effectiveness and adequacy of internal policies, controls and procedures. 14/2 A financial group shall implement a group-wide program against money laundering, apply the internal policies, controls, procedures to all of its branches and majority-owned subsidiaries and ensure effective implementation thereof by all branches and majority-owned subsidiaries. In addition to the issues set out in

subsection 14/1, a group level policy shall address also the sharing of information between all members of the group; the provision of customer, account and transaction information to group-level compliance, audit or anti-money laundering functions; and the safeguarding of confidentiality and use of the information exchanged. 14/3 Where the anti-money laundering requirements of a foreign country are less strict than those imposed under the Law and this Implementing Regulation, a financial institution or designated non-financial business and profession shall ensure that its branches and majority-owned subsidiaries operating in that foreign country apply measures consistent with the requirements under the Law and this Implementing Regulation. If the foreign country does not permit the proper implementation of such measures, the financial institution or designated non-financial business and profession shall inform the Saudi supervisory authority of this fact and take any additional measures necessary to appropriately manage and mitigate the money laundering risks associated with its operations abroad. The financial institution or designated non-financial business and profession shall comply with any instructions received from the supervisory authority in this regard. 15/1 Suspicious reporting requirement stipulated under this article shall include the following: a) A financial institution or designated non-financial business or profession or NPO that suspects or has reasonable grounds to suspect that funds or parts thereof, are proceeds of crime or are related to money laundering or that such funds will be used in acts of money laundering, including attempts to initiate such a transaction, b) A financial institution or designated non-financial business or profession or NPO that suspects or has reasonable grounds to suspect that any of the complicated, high-volume, or suspicious transaction that relates to money laundering, including the attempt to execute any of these transations. 15/2 The reporting obligation under Article 15 of the law applies regardless of the amounts involved. 15/3 A financial institutions, designated non-financial businesses and professions, or NPO shall implement indicators of suspected acts of money laundering. These indicators shall be updated on a continuous basis according to the development and diversity of methods used to carry out such acts, while complying with the publications of supervisory authorities in this regard. 15/4 The reporting shall be provided as per the form adopted by the Directorate, and as minimum shall include the following information: A. Names, addresses and phone numbers of those carrying out suspicious transactions; B. A statement of the suspicious transaction, its involved parties, circumstances surrounding its detection and its current status; C. Specifying the amount of the suspicious transaction and relevant bank or investment accounts; and D. The reasons and causes of suspicion on the basis of which the employee made such report.

The directorate of financial intelligence shall further specify the manner in which reports under this Article are to be made and the information that shall be transmitted as part of the report. 16/1 The protection under Article 16 of the Law shall include protection from any criminal, civil, contractual, disciplinary or administrative liability and applies also in situations where the financial institution or designated non-financial business and profession or its employees or directors did not know precisely what the underlying criminal activity of the reported transaction was and regardless of whether illegal activity actually occurred. 17/1 The General Directorate of Financial Intelligence shall be headquartered is located in Riyadh and it may open other branches in regions of the Kingdom, shall assume the following functions: a. Receive suspicious transaction reports, or other information or reports relating to money laundering, predicate offenses or proceeds of crime as provided for by the Law; b. Gather information that will enable the Directorate to perform its work effectively; c. Analyze the reports and information received; d. Disseminate the results of its analysis to competent authorities, either spontaneously or upon request; e. Establish a database including all reports and information received. The database shall be updated consecutively while maintaining the confidentiality of the information included therein; f. Request and exchange information with competent authorities; g. Request and exchange information with foreign counterparts; h. Prepare templates for use by reporting entities to report suspicious transactions; i. Issue and update guidance to financial institutions, designated non-financial business and profession, and NPOs on identifying and reporting suspicious transactions; j. Seek assistance, at its discretion, from experts and specialists from relevant agencies; k. Provide feedback to reporting entities on information and suspicious transaction reports received; l. Participate in the preparation of awareness programs on combatting money laundering in coordination with the Permanent Committee on Anti-Money Laundering; m. Enter into memoranda of understanding with other financial intelligence units according to applicable laws and procedures; n. Prepare annual reports; o. Prepare typology reports based on the outcome of its strategic analysis; p. Directorate of financial intelligence, as member of Egmont group, follow up with the Egmont group’s requirement, participate in its conference; ; q. Stop the suspicious transaction, if necessary, up to (72) hours from the time the suspicious transaction report is received. r. Request the Bureau of Public Prosecution to apply a seizing measure in relation to funds or instrumentalities s. Conduct research and inquiries, in coordination with the competent authorities, or request from the competent authorities to conduct field investigation. 17/2 The Directorate shall conduct the following:

a. Operational analysis: which is the use available and obtainable information to identify suspects, to trace particular activities or transactions, and to determine links between those suspects and possible proceeds of crime, or money laundering or predicate offenses. b. Strategic analysis: which is the use available and obtainable information, including data that may be provided by other competent authorities, to identify money laundering related trends or patterns. 17/3 The Directorate of financial intelligence shall protect the information it received or maintains by: a. Establishing rules governing the security and confidentiality of information, including procedures for handling, storage, dissemination, and protection of, and access to information; b. Ensuring that there is limited access to the Directorate’s facilities and information, and IT systems. 17/4 The Directorate of financial intelligence shall be operationally independent and autonomous by: a. Having the authority to carry out its functions freely, including the autonomous decision to analyze, request and/or forward or disseminate specific information; b. Having the capability to place arrangement or work independently with other local competent authorities, or foreign counterpart in relation to exchange of information, c. Having distinct functions to distinguish them in the performance of its work from other parties under the chairmanship of the State Security; d. Be able to obtain and deploy the resources needed to carry out its functions, on an individual or routine basis, free from undue political, government or industry influence or interference, which may compromise its operational independence. 17/5 All domestic and international obligations under the former name (Financial Investigation Unit) shall be referred to The Directorate of financial intelligence. 18/1 The Directorate of financial intelligence is authorized to request additional information directly from a financial institution if that financial institution has submitted a report under Article 15 of the Law and the Directorate’s request is in relation to a transaction or person mentioned in this report. In all other cases, the Directorate may request and the financial institution shall provide the requested information through the supervisory authority. 18/2 The Directorate of financial intelligence is authorized to request additional information directly from a designated non-financial business or profession in all cases, whether or not that designated non-financial business or profession has submitted a report under article 15 of the Law, or the Directorate’s request is in relation to such report. The Directorate does not have to consult or involve the supervisory authority. 19/1 When disseminating any information or the results of its analysis to competent authorities, the Directorate of financial intelligence shall use dedicated, secure and protected channels.

20/1 The Directorate of financial intelligence shall ensure that their staff members have the necessary security clearance. 20/2 The Directorate of financial intelligence shall take appropriate measures to ensure that their employees understand their responsibility in dealing with sensitive information, and its dissamination 22/1 Where the Directorate of financial intelligence receives information from a foreign counterpart, it shall use the information received only for the purpose for which it was sought, unless the foreign counterpart grants its approval that the Directorate may use the information obtained for another purpose. The Directorate provide the feedback for the foreign counterpart, if feasible and upon request it receives, on the information disseminated by the counterpart agency, or the outcome of the result based in the information provided. 23/1 The value threshold for declarations under Article of the Law shall be SAR 60.000 or its equivalent , which include currency, bearer negotiable instrument, precious metals or stones or jewelry that have to be declared when entering or exiting the kingdom Declarations under Article 23 of the Law shall be made in writing and in accordance with the approved template. 23/2 For the benefit of performing his functions under this Chapter, a customs official shall have the power to stop and search any person or vehicle, including cargo containers and postal deliveries exiting or entering the Kingdom and shall have available all powers provided for in the Common Customs Law. All powers shall be applied and searches be carried out in accordance with Common Customs Law, its Implementing Regulation and relevant Administrative Resolutions including how the inspection is preformed 23/3 The General Directorate of Customs may stop or seize, partially or in full, any currency, bearer negotiable instrument, gold bars, precious metals or stones or jewelry for up to (72) hours, in the following cases: a. The value or amount of currency, bearer negotiable instrument, gold bars, precious metals or stones or jewelry was not declared or not declared truthfully as required under the Law. b. If there is a suspicion that such currency, bearer negotiable instrument, gold bar or precious metal or stone or jewelry is proceeds of crime or instrumentalities, or is related to a money laundering or a predicate offense, including in cases where the threshold under Article 23/1 is not met; or The General Directorate of Customs shall immediately inform the Public Prosecution of the seizure, the General Directorate of Customs shall request and obtain additional information from the carrier about the origin and the intended use thereof. 23/4 The General Directorate of Customs shall prepare an incident report. In case the measure was taken by another security agency, the security agency shall prepare an incident report and refer the case to the General Directorate of Customs. Then the custom conduct preliminary investigation, and the reasons of declaration

failure, false declaration, or suspicions of money laundering or predicate offence. Seized items are deposited by customs in account designated for within the custom. 23/5 Prior to expiration of the provisional seizure, the General Directorate of Customs shall ask the Public Prosecution to extend the seizure, and the Public Prosecution may inform the Custom to extend the provisional seizure to a period not exceeding 60 days, according to the law. If there is a need to extend the provisional seizure, if there are reasonable grounds for the suspicion or that the continued detention of the seizure items is justified while its origin or derivation is further investigated or consideration is given to instituting a criminal investigation related to the predicate offense or ML crimes, the Public Prosecution may ask the competent court as per the provision stipulated in the Criminal Procedures law, and the Public Prosecution shall investigate on the origin of the funds and the intended use. 23/6 Any person who fails to or makes a false declaration, and the custom convinced on the reasons behind that, and provided that no suspicious related to the ML or predicated offences, the custom shall impose a fine for 25% of the seizure items if the first time, 50% for any repeating cases. 23/ 7 In all case, if there is suspicious related to predicted offences or ML, after completing the initial procedures, the case shall be refer to the Public Prosecution for further investigation, and notification shall be made to the Directorate of financial intelligence. 23/8 In case a departing traveler was carrying gold bar or precious metal or stone or jewelry of a value exceeding SAR 60,000 when departing or entering the Kingdom, he/she shall visit Customs offices at the port to declare them, and present a receipt of purchase to confirm their value. If it turned out that the goods are for commercial purposes, the ‘Common Customs Law and its Implementing Regulations’ shall apply. 23/9 Upon declaration, a customer officer shall ensure the validity of money not being forged or forfeited. 23/10 In the case of not notifying the Public Prosecution and Custom of the required procedures, the custom shall request the Public Prosecution to left the seizure on the currency, bearer negotiable instrument, precious metals and stones, gold bars, or jewelry. 23/11 These measures shall apply to companies, financial institutions, designated non-financial businesses and professions, non-profit organizations, gold vendors, Hajj and Umra missions and service providing companies concerned with transferring cash, postal and non-postal packages and shipments, while preserving their right to conduct business. 23/12 Saudi Customs shall establish a database including the information contained in decoration form, the incident reports; other related information, the suspicious cases of ML or predicted offences, while notifying the General Directorate of Financial intelligence immediately, and provide access to the Directorate, and the Directorate request more information.

23/13 Saudi Customs shall prepare and develop a declaration form as provided for in this Article in coordination with other authorities and distribute it to ports of entry/exit. 23/14 The General Directorate of Customs, in coordination with other competent authorities, shall take the necessary measures to inform the instructions with all possible means, and provide prominent warning sign in all boarder ports, illustrating procedure and sanctions to be applied against violators. 23/15 If within 60 days from the first seizure by the General Directorate of Customs no person has asserted a claim to the seized currency, bearer negotiable instrument, gold bar, or precious metal or stone or jewelry; or if the suspect has escaped or could not be caught, the currency, gold bar, bearer negotiable instrument, precious metal or stone or jewelry shall be considered to be unclaimed and shall be processed in accordance with the provisions of the Common Customs Law in dealing with unclaimed and relinquished goods. 23/16 The General Directorate of Customs may, acting on its own initiative or upon request, cooperate and exchange available and accessible information with or carry out inquiries for a foreign counterpart agency in relation to a money laundering or predicate offense investigation or inquiry, or for the purpose of identifying, tracing or seizing or confiscating proceeds of crime or instrumentalities. 24/1 A supervisory authority may exchange the following information with foreign counterparts where such information is requested by the foreign counterpart for anti-money laundering purposes: a. regulatory information and general information on the financial sector; b. prudential information such as information on a financial institution or designated non-financial business and profession ’s business activities, beneficial ownership, management and the fit and properness of any managers, directors, shareholders or beneficial owners; and c. Other relevant information such as on the internal policies, controls and procedures of a financial institution or designated non-financial business and profession, customer due diligence information, customer files, samples of accounts and transaction information. 24/2 Where a supervisory authority obtains information from a foreign counterpart, the supervisory authority shall obtain authorization from the foreign counterpart prior to any dissemination or use of the information received. And where a supervisory authority is obliged of declaration or reporting of information, then it shall inform the counterpart of this obligation. 24/3 A supervisory authority may apply supervisory measures on behalf of foreign counterparts and, as appropriate, facilitate the ability of the foreign counterpart to carry out consolidated group supervision. 24/4 A supervisory authority may exempt a specific category of reporting entities from the requirement in Article 5 of the Law to carry out an institutional risk assessment, if the supervisory authority has confirmed that the

identified risks of the sector are clear and understood, or that a specific activity carried out by the financial institution or designated non-financial business and profession is of a low risk. 24/5 A supervisory authority may instruct a financial institutions or designated non-financial business and professions to take certain measures in relation to foreign branches and majority-owned subsidiaries that pose a higher risk, including placing additional controls on the branch or majority-owned subsidiary or the financial group, or requesting the financial group to close down its operations in the host country. 24/ 6 A financial institution or designated non-financial business and profession shall comply with any instructions, rules, guidelines or any other instruments issued by a supervisory authority, including an order under Article 24 (b) of the Law to provide any information as specified by the supervisory authority. 28/1 A Ministry of interior is authorized to expel non-Saudi sentenced to prison on money laundering offences, and never return to the kingdom unless for Umra and Hajj. 36/1 In the implementation of this Article regarding funds, proceeds or instrumentalities subject to confiscation, the Council of Ministers’ Resolution no. 48, dated 18/2/1421H shall be taking into consideration. 37/1 The competent authority mentioned under this article that are competent to disposal of fund or confiscated instrumanlities is the authority that made the provisional seizure. 37/2 The competent authority mentioned under this article that are competent to share confiscated funds is the Permanent Committee on Mutual Legal Assistance. 38/1 The Public Prosecution may exchange domestically available or accessible information with foreign counterparts for intelligence or investigative purposes relating to money laundering and associated predicate offenses, including for purpose of identifying, tracing or securing proceeds of crime or instrumentalities. The Public Prosecution may use all of its powers available in a domestic case also to conduct inquiries and obtain information on behalf of a foreign counterpart. 38/2 Criminal investigating officers, each within their own purview, in coordination with competent authorities may exchange domestically available or accessible information with foreign counterparts for intelligence or investigative purposes relating to money laundering and associated predicate offenses, including for purpose of identifying, tracing or securing proceeds of crime or instrumentalities. Criminal investigating officers may use their powers available in a domestic case also to conduct inquiries and obtain information on behalf of a foreign counterpart; and may form joint intelligence teams to conduct cooperative intelligence, or establish bilateral or multilateral arrangements to enable such joint intelligence.

39/1 The competent authority, including the judicial authority, through the Permanent Committee on Mutual Legal Assistance, may provide mutual legal assistance to a foreign country in any investigation, prosecution or judicial proceeding relating to: a. a money laundering or predicate offence; b. the determination of whether funds are proceeds of crime or instrumentalities of crime and the tracing of such funds; c. a possible confiscation order, whether or not based on an underlying criminal conviction; or d. the freezing or seizure of proceeds of crime or instrumentalities. 39/2 The competent authorities provide all available power given to implement the following types of mutual legal assistance may be provided: A. Providing information, documents, or evidence, including the financial records from financial institutions, designated non-financial business profession, NPOs, or any other person. B. The hearing of statements of persons, including hearing statements of person present inside the KSA that could not be present on the territories of a requesting State, with utilization of live visual telecommunication. The hearing shall be agreed upon with a judicial authority of the requesting country in the presence of a judicial authority of the Kingdom. The costs shall be borne by the requesting country unless otherwise. C. The full range of powers and techniques, including controlled delivery, covert operations, communication interception and access to automated systems. D. Informing related person on the judicial papers and documents, including documents related to testimony. E. Inspecting, seizing, and arresting procedures. F. Examining objects and visiting sites. G. Providing information. H. Seeking the help of specialists. I. Locating sites, persons connected with the crime and their identities J. Providing the original of documents, records, and government papers received from financial institutions, any party, or other companies from the private sector or other ratified pictures of it. K. Identifying and tracing the funds subjected to confiscation or that might be confiscated. L. Seizing funds in the context of confiscating-based procedures with conviction or without conviction. M. Facilitating the voluntary appearance of persons in the requesting countries. N. Inform the relevant authority with judicial document. And any other forms of legal assistance that does not contradict with the internal laws of the Kingdom. 39/3 If a foreign country requests a form of assistance not specifically mentioned in this subsection but available under Saudi law for domestic criminal matters, the judicial authority may provide the assistance sought to the same extent and under the same conditions as would be available to competent authorities in a domestic

criminal matter. 39/4 Mutual legal assistance may not be refused solely on the grounds that the offense is considered to involve fiscal matters, or based on secrecy or confidentiality provisions. 39/5 Where a request for mutual legal assistance involves non-coercive measures, such assistance may be provided also in the absence of dual criminality. In all other instances, dual criminality is required for mutual legal assistance to be rendered. 39/6 The legal assistance application shall include as much information as possible to facilitate the implementation process, including:

1. The legal document based on which the application is submitted.
2. Determination of the authority responsible for investigations, prosecutions or proceedings related to the application, communication channels with all the persons able to respond to the inquiries related to the application and description of the criminal incident, its conditions and circumstances.
3. Description of the required assistance and the measures to be taken, as well as all the requirements that the applying State wishes to meet.
4. If the application is related to the inspection of a place, attachment or confiscation of assets, it shall include a precise description thereof, including providing the widest range of accurate information on the targeted funds, such as the type, amount, and location, as well as the owner of the funds, provide the available information, such as the account number, the securities number, or the real estate number and the car.
5. Determination of the required time for the application shall be implemented, if necessary.
6. A certified copy of the judicial order or judgment rendered by the competent Court shall be submitted when necessary.
7. Enclosing a written undertaking by the applying State to preserve the confidentiality of information or evidence provided upon implementation of the application, and that the submitted information or evidence will not be used for other than the purposes stated in the application, unless prior approval is obtained from the Committee.
8. The applying State shall submit any additional information or documents that the Committee deems necessary to implement the application or facilitate the implementation thereof. 39/7 The Competent authorities may undertake the following: A. Coordinating and understanding with the competent authorities of the country concerned to allow the proper use of the method of controlled delivery of funds across the Kingdom to expose persons involved in the commission of crimes and their contributors, subject to the provisions of the laws, regulations and instructions in force in the Kingdom.

B. Applications for the controlled delivery of funds must be in writing, and the competent authorities in the Kingdom shall take the decisions to respond to them on a case-by-case basis. The requesting country shall include the willingness to provide assistance to the Kingdom in such a request as may be required. C. It may be agreed with the interested parties of other States to inspect and verify the consignments agreed upon for the controlled delivery and then allow them to proceed. D. In the controlled delivery and after agreement with the parties concerned in other country, the agreed funds may be exchanged for similar materials for fear of leakage during transport. 40/1 Requests for the execution of foreign confiscation orders or rulings, issued by the competent authority or court in the requested country, shall be executed according to the competent law of the kingdom. Any ruling intended to be recognized and executed shall include the following document and information: a. An official copy of the ruling issued, and a copy of the law on which the confiscation order is based, and certificate on the ruling stating that the ruling is final , and issued by the competent judicial authority in the requesting country; b. The person involved in the case has been called to attend, and has been represented rightly, and able to defend himself; c. The ruling does not conflict with any ruling or order issued in the same subject from competent court in the kingdom, provided that no ongoing trail in the kingdom on the subject ruled by the requesting country; d. The ruling does not contain any provision not applicable to general law, and Sharia law in the kingdom; e. A statement that includes the procedures and measures taken by the requesting countries to protect the persons of good will. f. A description of the funds that the request is issued for in accordance to this article, estimation of their value, their possible location, and information about any person who keeps them or has them in his possession. However, the requesting countries shall provide a statement about the facts that the request is based on. g. The order of confiscation issued by the Kingdom determines how to preserve and manage confiscated funds. It is permissible to the competent court to request the hiring of a judicial guard, if needed, in which his expenses are deducted from the value of the funds he’s guarding. 40/2 In case of the received requests, where the perpetrator of the crime cannot be prosecuted because of death, escape, absence, or lack of identification, the Committee shall refer the request to the Public Prosecution to take the necessary procedures, provided that the request contains a statement which includes the merits and reasons it was based on, considering that such funds are linked to criminal conduct. 41/1 The extradition process is governed by the bilateral agreements signed between the kingdom and the requested country, or multilateral agreements ratified by the kingdom as per the applicable law.

41/2 The Kingdom may refuse to extradite Saudi nationals. Where a request for extradition is denied based on nationality of the accused or convict, the public prosecution shall, without delay, determine whether there are grounds for prosecution of the offense set forth in the request. 41/3 Extradition shall be subject to dual criminality. The dual criminality principal is available when the request country and the kingdom criminalized the act subject to the extradition, regardless the classification of the act as per the criminal laws. 41/4 The following requirements shall be included in the extradition: A. Received a written and through the official channels; B. Attached a certified copy, or request the original of the conviction, or the detention order related to the extradited person, C. A statement on the crimes the extradition sought, including the widest range of information available, such as the time and location of the crime. D. The legal text, or the statement of the legal ground, to allow for assessing the request, E. The necessary information to identify the wanted persons, F. Any other information seek by the competent authority deemed necessary to execute the request. 42/1 The Permanent Committee for Mutual Legal Assistance at the Ministry of Interior shall arrange for the execution of mutual legal assistance requests and for any arrangements deemed necessary to transmit the evidentiary material gathered in response to a request for assistance to the competent authority of the requesting State. Where a request for mutual legal assistance results, directly or indirectly, in the confiscation of funds, the Permanent Committee for Mutual Legal Assistance shall determine whether the confiscated funds shall be shared with the requesting country. 43/ 1 The supervisory authority, when receiving request from the public prosecution to provide records, documents, or information subject to confidentiality, shall, without delay and prior notice to the party concerned, forward the order to the financial institution, requesting it to produce the requested records, documents or information within the timeframe and in the manner and form as stipulated in the order. 43/2 Immediately upon receiving of the produced records, document or information, the supervisory authority shall notify the Public Prosecution of that fact and provide the produced records, documents or information, as and within the timeframe stipulated by the Public Prosecution. 43/3 The supervisory authority shall not have any power to review any orders issued by the Public Prosecution on

the merits, to refuse its assistance in the implementation of any particular order, or to filter or withhold any records, documents or information produced by the financial institution. 49/1 The investigating officer, may issue a reasoned order permitting an investigating officer to conduct an undercover operation for the purpose of gathering evidence of a money laundering or predicate offense. An undercover operation is an operation for intelligence conduct by the investigation officer to gain evidence or information related to the criminal behavior. 49/2 Investigating authorities may conduct or participate in a controlled delivery under the supervision of Ministry of interior. 49/3 Investigating authorities may take the necessary measure to reach the perpetrator.