Amended Anti-Money Laundering and Counter-Terrorist Financing Instructions for Insurance Activities No. 2 of 2018

Amended Anti-Money Laundering and Counter-Terrorist Financing Instructions for Insurance Activities / Insurance No. 2 of 2018 Published on page 4520 of Official Gazette No. 5524 dated 2018/7/16

Article 1 Issued by His Excellency the Minister of Industry, Trade and Supply, based on the letter from the Office of the Prime Minister No. 83/11/1/19838 dated 8/6/2014, which includes the Cabinet's decision to approve, effective from 30/4/2014, the transfer of all powers of the Insurance Board of Directors stipulated under the Insurance Activities Regulation Law No. (33) of 1999 and its amendments, and the systems, instructions, and decisions issued pursuant to it, to His Excellency the Minister of Industry, Trade and Supply. This is pursuant to the provisions of paragraph (k) of Article (23) of the Insurance Activities Regulation Law No. (33) of 1999 and its amendments, and item (4) of paragraph (a) of Article (14) and paragraph (b) of Article (18) of the Anti-Money Laundering and Counter-Terrorist Financing Law No. (46) of 2007 in force.

These instructions are titled (Amended Instructions for Anti-Money Laundering and Counter-Terrorist Financing in Insurance Activities for the year 2018) and are read together with Instructions No. (2) of 2016 referred to hereinafter as the Original Instructions as a single set of instructions. They come into effect from the date of their issuance and are published in the Official Gazette.

Article 2 Article (2) of the Original Instructions is amended as follows: First: By adding the following definitions to the end thereof as follows: Control: The direct or indirect ability to exercise effective influence on the activities and decisions of another person. Group: A group consisting of a parent company or any other legal person who holds control shares and coordinate functions with other group members to apply or implement control over the group in accordance with the Basel Core Principles, along with branches and/or subsidiaries subject to group-wide anti-money laundering and counter-terrorist financing policies and procedures. Financial Institution: A legal person that exercises one or more financial activities under its founding document in accordance with relevant legislation. Legal Arrangements: The relationship arising under a contract between two or more parties that does not result in the creation of a legal personality, such as direct investment funds or similar legal arrangements. Trusts: Legal relationships arising inter vivos or upon death by a person or trustee, where assets have been placed under the control of the person or trustee for the benefit of a beneficiary or for a specific purpose, such that the assets are independent funds and not part of the trustee's property, and the right to the trustee's assets remains in the name of the settlor or in the name of another person on behalf of the settlor. Non-Profit Entity: Any legal person, legal arrangement, or institution established in accordance with relevant laws to collect or spend funds for charitable, religious, cultural, educational, social, or other similar purposes, without its activity targeting profit generation, distribution, or personal benefit, including foreign branches of international non-profit organizations and entities.

Second: By deleting the phrase (or casual) contained in paragraph (d) thereof.

Article 3 Article (3) of the Original Instructions is amended as follows: First: By adding the word (identity) after the phrase (knowing) contained in item (2) of paragraph (a) thereof. Second: By deleting the text of paragraph (c) thereof and replacing it with the following: c. The company is prohibited from dealing with anonymous accounts or accounts under fictitious or digital names, including dealing or entering into relationships with persons of unknown identity or under pseudonyms or fictitious names, or with phantom companies or banks. Third: By adding paragraph (d) thereto with the following text: d. The company shall apply all due diligence measures towards customers stipulated in this article, determining the scope of such measures using the risk-based approach referred to in Article (13) of these instructions.

Article 4 Article (8) of the Original Instructions is amended as follows: First: By adding the phrase (or legal arrangement) after the phrase (legal person) wherever it appears in paragraph (d) thereof. Second: By adding item (4) to paragraph (e) thereof as follows: 4. In identifying the beneficial owner if the customer is a legal arrangement, the following shall be considered:

• Trusts; identifying the identity of the settlor or trustee or guardian, as applicable, and the beneficiaries or class of beneficiaries for each other natural person exercising effective and actual control over the fund.
• Other types of legal arrangements; identifying the identity of persons holding positions equivalent to those mentioned above or similar.

Third: By deleting the text of paragraph (t) thereof and replacing it with the following: t. The following shall also be considered in the identity verification procedures for legal arrangements:

1. The company must be aware of the nature of the customer, ownership structure, and board of trustees.
2. The necessity of identifying authorized signatories and controlling persons in accordance with the customer identity verification procedures stipulated in paragraph (c) of this article. Fourth: By adding paragraph (y) thereto as follows: y. The following shall be considered in the identity verification procedures for non-profit entities:
3. Identity verification data shall include: the name of the non-profit entity, legal form, national ID of the entity (if available), headquarters address, type of activity, date of establishment, names of authorized account handlers and their nationalities, phone numbers, purpose of dealing, income or funding sources, names of persons holding senior management positions in the non-profit entity, and any other information the company deems necessary to obtain.
4. Obtaining documents evidencing authorization from the non-profit entity for the natural persons authorized to deal, in addition to the necessity of identifying the identity of the authorized handler in accordance with the customer identity verification procedures stipulated in paragraph (c) of Article (8) of these instructions.
5. Verifying the validity of the identity and legal entity of the non-profit entity through official documents and the information they contain, such as certificates issued by the Ministry of Social Development or any other competent authority, and whether it is authorized to operate in the Kingdom and/or accept donations and grants from local or external sources, and referring to the electronic website of the associations register, including verifying the address of the non-profit entity by obtaining a copy of the lease agreement, utility bills, visiting the customer's premises, or professional licenses.

Article 5 Paragraph (b) of Article (9) of the Original Instructions is amended by adding the phrase (and informing the Insurance Administration of the results) to the end thereof.

Article 6 Article (13) of the Original Instructions is amended as follows: First: By adding the phrase (and that the classification of the degree of such risks is reviewed and updated every two years at most, or in the event of changes necessitating it, and that the last update is documented) to the end of item (2) of paragraph (a) thereof.

Second: By adding paragraph (b) thereto with the following text, and renumbering the paragraph (b) contained therein to become paragraph (c): b. The company shall provide internal control and monitoring systems capable of managing risks, and it must examine the effectiveness of the internal control and monitoring systems established to manage specific risks.

Third: By adding paragraph (d) thereto as follows: d. Providing the Insurance Administration with a report on the assessment of money laundering and terrorist financing risks annually or in the event of a need to conduct this assessment due to a fundamental change in the nature of risks, and according to a decision issued by the Secretary-General on this matter.

Article 7 Article (14) of the Original Instructions is amended by deleting what is contained therein and replacing it with the following: a. The company may rely on financial institutions that are members of the group to which it belongs or a third party from outside the financial group, in accordance with the provisions of these instructions, in applying due diligence procedures, enhanced due diligence procedures towards politically exposed persons representing risks, and anti-money laundering and counter-terrorist financing programs. The third party must be subject to regulation and supervision by competent authorities and have procedures to comply with customer due diligence requirements, record keeping, and anti-money laundering and counter-terrorist financing programs stipulated in these instructions. b. The company shall take into account the risk assessment degree of the country where the member financial institution or the third party from outside the group is located, such that enhanced due diligence measures are taken if the country is high-risk, and any high risks specific to countries are sufficiently mitigated by the group's policies related to anti-money laundering and counter-terrorist financing. c. The ultimate responsibility for applying customer due diligence procedures remains with the company, which must comply with the following:

1. Immediately obtaining the necessary information on insurance operations.
2. Taking necessary measures so that the company is convinced that copies of customer identification data and documents and other related documents regarding customer due diligence requirements will be provided by the member financial institution or the third party from outside the financial group upon request and without delay.

Article 8 Item (2) of paragraph (a) of Article (17) of the Original Instructions is amended by adding the phrase (and account files and business correspondence) after the phrase (records and local and international insurance relationship documents) contained therein.

Article 9 Article (18) of the Original Instructions is amended as follows: First: By adding the phrase (based on risk and business volume) before the phrase (which shall include the following) contained in its opening. Second: By adding the phrase (and the policies, procedures, and internal controls adopted by the company to combat money laundering and terrorist financing according to the risk degree) to the end of paragraph (z) thereof.

Article 10 Paragraph (a) of Article (20) of the Original Instructions is amended by adding item (7) thereto as follows: 7. Establishing an independent audit unit to test its anti-money laundering and counter-terrorist financing system.

Article 11 The Original Instructions are amended as follows: First: By adding the following Articles (21) and (22) thereto with the following text:

Article 21: a. If the company is part of a financial group, the group should be required to apply anti-money laundering and counter-terrorist financing programs at the group level, which should apply, as appropriate, to all branches and subsidiaries in which the group holds a majority stake. The group must take into account money laundering and terrorist financing risks and business volume, and the programs must include the following measures:

1. Preparing policies, procedures, internal controls, and appropriate arrangements regarding compliance management and appropriate screening procedures to ensure high competency standards when appointing employees.
2. Establishing a continuous employee training program.
3. Creating an independent audit unit to test the system.
4. Establishing policies and procedures for exchanging required information for customer due diligence and managing money laundering and terrorist financing risks.
5. Providing information related to customers and insurance operations from branches and subsidiaries to compliance, audit, and/or anti-money laundering and counter-terrorist financing functions at the group level. This may include analysis information on unusual operations or activities, and may also include notification to the unit regarding the operation when necessary for anti-money laundering and counter-terrorist financing purposes in line with risk management.
6. Providing sufficient guarantees regarding confidentiality and the use of exchanged information, including guarantees of non-disclosure (tipping off). b. If the host country does not allow the appropriate implementation of measures specific to combating money laundering and terrorist financing that are consistent with the Kingdom's procedures, the financial group should apply additional appropriate measures to manage money laundering and terrorist financing risks and inform the Insurance Administration thereof.

Article 22: The company shall implement the obligations contained in relevant international decisions that are binding, including all decisions issued under Chapter VII of the UN Charter, which are notified to it by the Insurance Administration or the competent authorities on this matter.

Second: By renumbering Articles (21 - 25) to become (23 - 27) respectively.

D. Tariq Al-Hamouri Minister of Industry, Trade and Supply