Rules of Due Diligence for Securities Customers

In accordance with the provisions of paragraph (12) of Section (12) of the Interim Securities Law No (74) in 2004, based on the provisions of paragraph (ii) of Article (26) Of the AML / CFT Law No. (39) for the year 2015: We have issued the following instructions: No. ( (2017 Regulations of Rules of Due Diligence for Securities Customers Article (1) the following terms for the purposes of these Instructions shall have the following meanings: I.Law: AML / CFT Law No. (39) For the year 2015. II.Office: AML / CFT Office. III.Third: The Commission: The Iraqi Securities Commission. IV.Iraqi Stock Exchange: Iraqi Stock Exchange is licensed by the Authority. V.Funds: Assets or property obtained by any means, such as the national currency, foreign currency, securities, trade, deposits, current accounts, financial investments, instruments and editors of whatever form, including electronic or digital, precious metals, precious stones and commodities and any financial value of property or movable Related rights and the benefits and profits derived from such funds, whether inside or outside Iraq. And any other type of money determined by the Money Laundering Council for the purposes of this Law, shall be published in the Official Gazette. VI.FINANCING OF TERRORISM Any act by any person, whether directly or indirectly, of his or her will to provide, collect or attempt to obtain funds from a legitimate or illegal source for the purpose of their use, knowing that

such funds will be used wholly or In part in the execution of a terrorist act, a terrorist or a terrorist organization, whether or not the crime took place regardless of the State in which the act occurred or where the terrorist or terrorist organization was located. VII.The real beneficiary: The natural person who owns or exercises ultimate control directly or indirectly on the customer. Or the natural person on whose behalf the transaction is performed, as well as the person exercising effective final control over a legal person or arrangement. VIII.Customer: Any person who initiates any of the following acts with one of the financial institutions which is licensed by the Commission. A-Arrange, open or execute a transaction, business relationship or account. B-Participate in signing a transaction or a business relationship or account. C-Allocation or transferring of an account, rights or obligations under a transaction. D-Permission to conduct a transaction or to control a business relationship or an account. IX- A business relationship: The relationship that arises between the financial institution or the specific non-financial business and occupations and its client that relate to the activities and services it provides to it when the enterprise expects to extend the relationship for a period of time. X- Deposit: The Iraqi Depository Center, which will be the central body that carries out the settlement and clearing of all transactions in securities. XI- Reporting Officer: The head of the administrative formation stipulated in Article (14) of the law, the person appointed by the senior management for the purpose of reporting the operations suspected of being linked to money laundering and / or financing terrorism. XII- Immediately: Within hours with no more than one day.

XIII- High - risk office holders: Are persons assigned to public functions in the Republic of Iraq or a foreign State, such as Heads of State , Government, high￾level politicians, high-ranking government officials, senior judges, senior military personnel, senior executives of state-owned enterprises, political party leaders, or entrusted with them Prominent functions in an international organization such as members of senior management, their deputies, members of the board of directors and similar or well-known public advisers, or any person working in a position to benefit greatly from the practical The political person is a representative of the risks of their direct relatives until the second degree. Article (2)- Scope of operation: The provisions of these instructions shall apply to: 1-Licensees licensed by the Commission and persons associated with them. 2-Stock Exchanges licensed by the Commission. 3-Deposit authorized by the Commission. 4-Securities Association licensed by the Commission. Article (3) - Entities which subject to the provisions of these Instructions shall have the following general rules of due diligence towards customers shall be applied. 1-A- It is not permissible to deal with anonymous accounts , digital , false , fictitious names or to maintain or provide any services to them, and to take due diligence measures towards the owners or beneficiaries of these accounts as soon as possible and in any case before and during their use. B-Identifying and verifying the identity of the client and the real beneficiary by using the original documents and reliable data or information from independent sources in accordance with the provisions stipulated in these instructions.

C-Understanding the purpose and nature of the work relationship and, where appropriate, requesting additional information in this regard. D-Using of automated systems to monitor the relationship with the customer on a continuous basis to identify the pattern of its transactions and to detect any transactions inconsistent with this pattern or with the institution's information about the client and its activity and risk profile, including knowledge of the source of funds and wealth to any client classified as high risk. E-Take due diligence actions themselves and not rely on a third party to take them. 2-The entities which subject to the provisions of this regulation shall carry out due diligence measures in the cases provided for in paragraph (1) of Article (10) of the Law. 3-If the financial institution is unable to fully comply with the customer due diligence measures provided for in the law or these instructions, it is not permissible to start the employment relationship or to execute the transaction or any transactions. 4-Due diligence procedures may not be completed if there is suspicion of money laundering or terrorist financing with the financial institution, if the execution of such procedures may alert the client, provided that the suspicious transaction is immediately reported to the office. 5-Applying due diligence procedures on the basis of the relative importance and risk to the relationships that existed with customers before the law came into force, and taking due diligence measures towards the current working relationships, taking into account whether due diligence procedures were taken before and when they were taken and the adequacy of the data Obtained. 6-Ensure that the customer is not included in the blocked lists of customers locally and internationally in accordance with the provisions of the law before

entering into a continuous relationship with him, and not to carry out any operation of a customer listed in the embargo lists and do not have a work relationship. 7-Relying on the identification papers to identify the customer, with confirmation of validity, and keep a copy signed by the competent official to the effect that it is a replica of the original, and the institution, when the doubt of the authenticity of the documents submitted to them, verify their authenticity in all possible ways, Including contacting those who have issued such documents or data. Article (4) - The entities subject to the provisions of these instructions shall be bound by the following: 1-Conducting a continuous follow-up on the existing relationship with the client and examine the transactions carried out through this relationship in order to verify that they correspond to the knowledge of the parties subject to the provisions of these instructions to the customer and the real beneficiary and the nature of the work or activity of any of them and their assessment of the risks of money laundering or financing terrorism. 2-Periodically review and update the customer data for high risk customers or when they have any doubt about the accuracy or appropriateness of the data obtained in advance. 3-To take due care of customers before the date of issuing these instructions on the basis of relative importance and risk, and to take due diligence measures towards its relations with those customers at the following times: A-When trading on their account in large amounts. B-When realizing that enough information is not available for a customer. C-When there is a significant change in account management and transaction nature.

D-When there is a significant change in the client's authentication mechanism. 4-Registering any amounts paid by the customer in cash if the total amount exceeds (15) million dinars or the equivalent of other currencies or the payment of recurrent amounts or segmented less than (15) million dinars in a small amount in special records. 5-Not dealing with anonymous or fictitious persons or with banks or fictitious companies. Article (5)- 1- The procedures for identifying a person's natural identity and activity shall include the following: A-The full name, nationality, date and place of birth, passport number for non￾Iraqi persons, the current and permanent address of his or her actual place of residence, the purpose and nature of the employment relationship and any other information deemed necessary. B-The entities subject to the provisions of these Instructions shall, in the event of dealing with persons lacking or disqualified, obtain documents relating to them and their legal representative, as the case may be, in accordance with the provisions of paragraph (a) of this paragraph. C-In case the parties subject to the provisions of these instructions are dealt with by a person who is the client's client, the legal agencies required to appoint and retain such person must be obtained and the identity of the client and the agent must be identified and verified in accordance with the customer identification procedures stipulated in these instructions. 2- The procedures for identification of the legal person shall be taken into account: A-His /her Name its legal form and the address of his/her place and the type of activity exercised by its capital, and the date and number of registration with the competent authorities, including the number of tax settling accounts and numbers of his/her phones and the purpose of the work and nature of the relationship and

the names of the owners, as in (b) below and addresses and shares of ownership in the legal person and the names authorized to sign him and provisions regulating the binding moral authority for personal or legal arrangement so that the parties subject to the provisions of these regulations are aware of the structure of ownership and provisions governing the powers to take binding legal person and any other information deemed necessary to obtain that decisions The fact that these instructions updated until the date of assessment. B-Names and addresses of partners and shareholders whose contribution exceeds (5%) of the company's capital. C-The legal entity and the legal person and the names of the owners and the signatories must be verified by means of the required documents and the information included in them, such as the contract of incorporation approved by the company registration department and the internal regulations, in addition to the need to obtain an official certificate issued by a competent authority in case the company is registered abroad. D-Obtaining the documents indicating the existence of a delegation from the legal person to the natural persons who represents him and the nature of their relationship with him and to identify their identity and activity in accordance with the procedures of identifying the client's identity and activity stipulated in item (a) of paragraph (1) of this article and verifying the absence of legal impediment without dealing with them and getting samples of their signatures. 3- The procedures for identifying the real beneficiary shall include the following: A-Take appropriate measures to verify the identity of the real beneficiary, such as access to data or information obtained from official documents and data, so that the parties under the provisions of these instructions are convinced that they are aware of the identity of the real beneficiary.

B-Requesting from the customer to submit a written declaration specifying the identity of the real beneficiary and that the permit includes at least the customer identification information. C-Obtaining information about the provisions governing the work of the legal entity, including the structure of the property and the management that controls it. Article (6) -1- The entities which subject to the provisions of these instructions shall give special attention to identifying the customer's identity and activity in respect of the following: A-Large operations and operations that do not have a clear economic or legal objective, and the establishment of necessary procedures to identify the background of the circumstances surrounding these operations and their purposes, and to record the results thereof in their records. B-Operations carried out with persons who are or belong to States that do not have adequate systems to combat money-laundering or terrorist financing, or if they do not apply or do not adequately implement international anti-money￾laundering or terrorist financing regulations, Financial Action Group. C-In the event of suspected money laundering or terrorist financing, or if there are doubts as to the accuracy or adequacy of the data obtained in advance regarding the identification of the customers or in any process that the parties subject to the provisions of these instructions consider to constitute a high risk of operations money laundering. D-Operations that are not face-to-face or carried out through electronic means or tools. E-Operations performed through non-resident customers. F-High - risk office holders.

The entities which subject to the provisions of these instructions shall take the strict care procedures for senior high-risk officers as follows: 1-Take reasonable measures to determine whether the client or beneficiary is the real owner of high-risk positions. 2-Establish risk management rules for high-ranking position holders with real risks or beneficiaries to whom they belong, provided that such rules include determining whether the future customer is a risk holder. 3-Obtain the approval of senior management when establishing a relationship with high-risk position holders and when discovering one of the real customers or beneficiaries of this category. 4-Take adequate measures to ascertain the sources of the wealth of any client or the real beneficiary of high-risk positions. 5-Accurate and continuous monitoring of transactions of high risk customers with the financial institution. Article (7) -1- The entities which subject to the provisions of these instructions shall appoint the reporting officer, provide the Commission and the Office with the name of the reporting officer and his / her representative and a copy of the procedures taken by these entities to implement the provisions of the law and these instructions: A-Shall have a high functional level. B-To be available the experience and required competence. C-To be available the appropriate educational qualifications. D-To be fully qualified and to have a good conduct. 2- The entities subject to the provisions of these instructions shall also appoint a representative of the reporting officer in his absence, provided that he meets the same conditions as the reporting officer.

3- Enabling the reporting officer to exercise of his / her functions independently in such a way as to ensure the confidentiality of the received information and the actions which taken by him/her and to have access to the records and required data. 4-Reporting procedures: A-The Chairman, members of the Board of Directors, the Board of Directors, the General Manager and all employees in the entities which subject to the provisions of these instructions shall comply with these instructions and inform the reporting officer of any suspicious transaction related to money laundering or terrorist financing. B-The reporting officer shall comply with the provisions of the law, regulations and decisions issued hereunder, and immediately inform the Office of any transaction suspected of being linked to money laundering or financing of terrorism in accordance with the method or form adopted by the Office, together with all data and documents related to such operations and the reasons on which it is based. C-The entities which subject to the provisions of these instructions shall prepare the reporting officer to enable him to exercise his powers independently, in such a manner as to ensure the confidentiality of the received information and the procedures he performs. He shall have access to the records and data required for carrying out the examination and reviewing the systems and procedures established by the Commission which are subject to combating money laundering and financing of terrorism and the extent to which they are committed to their implementation and to propose what is necessary to complete the shortage, or the need for modernization and development, or to increase its effectiveness and efficiency.

D-It is prohibited to disclose, directly or indirectly, or by any means, any of the reporting procedures for suspected transactions of being linked to money laundering or terrorist financing or related data. Article (8) - The entities which subject to the provisions of these instructions shall establish appropriate internal regulations that include the policies, procedures and internal controls that must be provided to combat money laundering and the financing of terrorism, provided that the system shall include the following: A- Clear anti-money laundering and terrorist financing policy approved by the Board of Directors, as the case may be. B-Detailed written procedures to combat money-laundering and the financing of terrorism, taking into account the precise definition of duties and responsibilities in accordance with the approved policy and instructions issued by the Securities Commission in this regard. C-An appropriate mechanism to verify compliance with the system, policies and procedures established to combat money laundering and the financing of terrorism. D-Carrying out an assessment of the risks of money laundering and the financing of terrorism to which it is exposed, including the identification, assessment, documentation and understanding of the institution of these risks and effective measures to reduce them and provide such assessment to regulatory bodies. E-Assigning an independent and qualified staff within the internal audit body with adequate resources to test compliance with internal procedures, policies and controls to combat money laundering and terrorist financing. F-Training programs for different levels of employees and committing to attend training courses supervised by the Commission and / or the Office.

Article -(9)- The entities which subject to the provisions of these Instructions shall: A-Maintaining records, documents relating to its local or international operations to include sufficient data to identify such processes, including identification records of due diligence procedures on the identity of the customer and the true beneficiary for a period of at least 5 years from the date of completion of the transaction, As appropriate, and update such data periodically. B-Preparing files for suspected transactions of being linked to money laundering or terrorist financing in which copies of statements, documents of such operations shall be kept for a period not less than (5) years from the date of notification or pending a final decision by the competent court. C-The information should be updated periodically and continuously, or when doubts arise at any stage of the transaction, and an integrated information system for records and documents should be provided so that the request of the Bureau and the competent official authorities can be answered on time. D- The entities subject to the provisions of these instructions shall make available all the records and documents referred to in item (a) of this Article and the information related to the provisions of these instructions to the Office and the competent official authorities upon request thereof. Article (10) - The entities which subject to the provisions of these instructions shall do the following: A- Including in its contract with the auditor his commitment to ensure that he/she applies the provisions of the law and these instructions and decisions issued hereunder, and the adequacy of the policies and procedures related to this and including the results thereof in his/her report with the need to inform the Commission immediately upon discovery of any violation of these instructions.

B- Providing the Commission with its annual report including the opinion of the auditor regarding the extent to which the provisions of these instructions and the decisions issued hereunder, and the adequacy of the relevant policies and procedures are applied in conjunction with the final financial statements. Article (11) - In accordance with the provisions of the instructions issued on the basis of the provisions of the AML / CFT Law, persons or companies exercising any of the activities subject to the supervision and licensing of the Commission shall be required to implement the obligations contained in the relevant and relevant international resolutions communicated to them by the Commission or entities in this regard. Article (12) - Any person who knowingly or indirectly knows, by virtue of his or her job, any information provided or exchanged in accordance with the provisions of the Law and the regulations and instructions issued pursuant thereto, including these instructions, shall not disclose such information in any manner whatsoever. Article (13) - In case of violation of the provisions of these instructions, the parties subject to the penalties and procedures prescribed by the Securities Law No. (74) Of 2004 and / or the AML / CFT Act, whichever is stronger. Article (14) - The entities subject to the provisions of these Instructions shall inform their employees as follows: A- The provisions of the AML / CFT Law and the instructions issued pursuant thereto. B- Guidelines for identifying patterns suspected of being involved in money laundering and terrorist financing. C- Procedures for reporting suspected transactions of being linked to money laundering or terrorist financing.

Article 15 - These instructions shall be implemented from the date of approval by the Commission. Dr. Salah Noori Khalaf The Chairman of the Commission