Anti-Money Laundering and Counter-Terrorism Financing Instructions in Insurance Activities No. 2 of 2016

Page 1 of 20

Anti-Money Laundering and Counter-Terrorism Financing Instructions in Insurance Activities and their Amendments No. 2 of 2016 Published on page 3974 of Official Gazette No. 5410 dated 2016/7/17

Article 1 Issued by His Excellency the Minister of Industry, Trade and Supply, based on the letter from the Prime Minister's Office No. 83/11/1/19838 dated 8/6/2014, which includes the Cabinet's decision to approve, effective from 30/4/2014, the transfer of all powers of the Insurance Board of Directors stipulated under the Insurance Business Regulation Law No. (33) of 1999 and its amendments, and the systems, instructions, and decisions issued pursuant thereto, to His Excellency the Minister of Industry, Trade and Supply. This is pursuant to the provisions of paragraph (k) of Article (23) of the Insurance Business Regulation Law No. (33) of 1999 and its amendments, and paragraph (4) of sub-paragraph (a) of Article (14) and paragraph (b) of Article (18) of the Anti-Money Laundering and Counter-Terrorism Financing Law No. (46) of 2007 and its amendments.

These Instructions shall be known as the "Anti-Money Laundering and Counter-Terrorism Financing Instructions in Insurance Activities for the Year 2015" and shall be effective from the date of their publication in the Official Gazette.

Article 2 a. The words and phrases contained in these Instructions shall have the meanings assigned to them in Article (2) of the Insurance Business Regulation Law No. (33) of 1999 and its amendments, and Article (2) of the Anti-Money Laundering and Counter-Terrorism Financing Law No. (46) of 2007 and its amendments, unless the context indicates otherwise. b. For the purposes of these Instructions, the following words and phrases shall have the meanings indicated below: The Ministry: The Ministry of Industry, Trade and Supply. The Insurance Department: The Insurance Department within the Ministry.

dhtmled4: 9/20/2021

---

Page 2 of 20

The Minister: The Minister of Industry, Trade and Supply. The Secretary General: The Secretary General of the Ministry. The Unit: The Anti-Money Laundering and Counter-Terrorism Financing Unit established in accordance with the provisions of the prevailing Anti-Money Laundering and Counter-Terrorism Financing Law. Insurance Relationship: The relationship arising between the company and the client pursuant to the insurance policy and related transactions. Beneficiary: The natural or legal person, legal arrangement, or group of persons to whom the policy proceeds shall be paid upon or in the event of the insured event covered by the insurance policy. Beneficial Owner: The natural person who ultimately owns or controls the customer and/or on whose behalf a transaction is being conducted. It also includes those persons who exercise ultimate effective control over a legal person or arrangement. Foreign Politically Exposed Persons: Persons who have or have held prominent public functions in a foreign country, such as head of state, head of government, senior politician, senior judge, military officer, senior executive of a state-owned corporation, or prominent figure in a political party, and includes their family members to the first degree at least or persons closely associated with them. Local Politically Exposed Persons: Persons who have or have held prominent public functions in the Kingdom, such as heads of government, senior government officials, prominent politicians, judges, military officers, prominent figures in a political party, or senior executives in state-owned companies, and includes their family members to the first degree at least or persons closely associated with them. Persons entrusted with or who have entrusted prominent functions by an international organization: Senior management members, i.e., directors, deputy directors, board members, or positions equivalent to them. Control: The ability, direct or indirect, to exercise effective influence over the actions and decisions of another person. Group: A group consisting of a parent company or any other legal person who hold controlling shares and coordinate functions with other group members to apply or implement group-level control.

dhtmled4: 9/20/2021

---

Page 3 of 20

Financial Group: The group together with branches and/or subsidiaries that are subject to group-level anti-money laundering and counter-terrorism financing policies and procedures. Financial Institution: A legal person that exercises one or more financial activities under its founding deed in accordance with relevant legislation. Legal Arrangements: The relationship arising pursuant to a contract between two or more parties that does not result in the creation of a legal person, such as bare trusts or similar legal arrangements. Trusts: Legal relationships arising between living persons or upon death, by a person or trustee, where assets have been placed under the control of the person or trustee for the benefit of a beneficiary or for a specific purpose, such that the assets are independent funds and not part of the trustee's estate, and the right to the trustee's assets remains in the name of the settlor or in the name of another person on behalf of the settlor. Non-Profit Entity: Any legal person, legal arrangement, or institution established in accordance with relevant laws to collect or spend funds for charitable, religious, cultural, educational, social, or other similar purposes, without its activity targeting profit generation, distribution, or personal benefit, including foreign branches of international non-profit organizations. c. For the purposes of these Instructions, the phrases (Money Laundering) and (Terrorism Financing) wherever mentioned in its provisions shall have the meaning specified in the prevailing Anti-Money Laundering and Counter-Terrorism Financing Law. d. For the purposes of these Instructions, the word (Client) refers to the permanent client, whether natural or legal person or legal arrangement. It also refers to the insured. In the case of insurance policies where the beneficiary is not the insured, the word (Client) refers to the insured and the beneficiary.

Amendments to the Article:

• This is how this article became after its amendment by Amendment Instructions No. 2 of 2018.

Article 3 a. The company shall apply customer due diligence in the cases specified in Article (4) of these Instructions in accordance with the procedures set forth in these Instructions. Customer due diligence shall include the following matters:

dhtmled4: 9/20/2021

---

Page 4 of 20

1. Identifying the client's identity and verifying it using original documents, data, or information from independent and reliable sources, and identifying their legal status, activity, purpose, and nature of the business relationship, and verifying them.
2. Identifying the beneficial owner's identity and taking reasonable measures to verify it using information or data obtained from an independent and reliable source, to the extent that the company is satisfied that it knows the beneficial owner.
3. Identifying the type of insurance policy, the nature and value of the related transaction, and its purpose.
4. In the case where another person deals with the company on behalf of the client, the company shall take reasonable measures to obtain sufficient data to identify that person. b. If the company is unable to fulfill customer due diligence procedures, it shall not contract with the client, and it must notify the Unit in accordance with the provisions of these Instructions in the event of suspicion of a transaction related to money laundering or terrorism financing. c. The company is prohibited from dealing with anonymous accounts or accounts under fictitious or digital names, including dealing or entering into relationships with persons of unknown identity, under pseudonyms or fictitious names, or with shell companies or banks. d. The company shall apply all customer due diligence measures stipulated in this Article, determining the scope of those measures using the risk-based approach referred to in Article (13) of these Instructions.

Amendments to the Article:

• This is how this article became after its amendment by Amendment Instructions No. 2 of 2018, where the text of paragraph (c) was as follows: c. The company shall not deal with persons of unknown identity, those with pseudonyms or fictitious names, or with shell banks or companies.

Article 4 The company shall take customer due diligence procedures in the following cases: a. Before and during the establishment of the insurance relationship. b. Suspicion of an insurance transaction related to money laundering or terrorism financing, regardless of its value. c. Doubt about the accuracy or sufficiency of data previously obtained regarding client identification. d. When making a fundamental change to the insurance policy.

dhtmled4: 9/20/2021

---

Page 5 of 20

Article 5 Notwithstanding the provisions of paragraph (b) of Article (3) of these Instructions, the company may postpone the verification procedures of the beneficiary's and/or beneficial owner's identity until after the conclusion of the insurance contract, provided that it adheres to the following: a. That this is necessary to avoid disrupting the normal course of business, and the company shall complete these procedures as soon as possible, and in any case, during or before the payment of claims or before the beneficiary exercises any rights granted to them under the insurance contract. b. The company shall take necessary measures to effectively control the risks of money laundering and terrorism financing in the case where verification procedures are postponed, including setting limits on the type and amounts of transactions that can be executed before completing verification procedures. c. If the company is unable to fulfill the beneficiary identity verification requirements, it shall terminate the insurance contract. In the event of suspicion of a transaction related to money laundering or terrorism financing, it shall notify the Unit thereof in accordance with the provisions of these Instructions. d. For the purposes of applying the provisions of paragraph (c) of this Article, the company shall include in insurance policy forms provisions that ensure its right to terminate the insurance contract during the period of postponement of the beneficiary's identity verification procedures.

Article 6 If the company has suspicion of a transaction related to money laundering or terrorism financing and believes for reasonable grounds that continuing customer due diligence procedures would alert the client, it may refrain from continuing these procedures, provided that it notifies the Unit in accordance with the provisions of these Instructions.

Article 7 The company shall adhere to the following: a. Conduct ongoing monitoring of the existing insurance relationship with the client and review transactions conducted through this relationship, such as changes to the insurance policy or the exercise of one of the rights contained therein, to verify that they are consistent with the company's knowledge of the client and beneficial owner, the nature of their work or activity, and the source of funds, if necessary, and to evaluate the risks of money laundering and terrorism financing arising from the relationship with them. b. Ensure that documents, data, or information obtained pursuant to customer due diligence procedures are continuously updated, particularly by reviewing existing records, especially for high-risk client categories.

dhtmled4: 9/20/2021

---

Page 6 of 20 c. Apply customer due diligence procedures for clients who have insurance relationships with the company prior to the enforcement of these Instructions, based on relative importance and risk and their association with money laundering or terrorism financing transactions. Take customer due diligence procedures for existing business relationships at appropriate times, taking into account whether customer due diligence procedures were previously taken, when they were taken, and the sufficiency of the data obtained.

Article 8 a. The company shall review official documents to identify the client's identity and nature of activity, obtaining a copy of these documents signed by the authorized employee in the company or whom the company authorizes for this purpose, certifying that it is a true copy. b. The company shall take appropriate measures to verify the validity of the data and information obtained from the client through independent and reliable sources, including contacting the competent authorities issuing the official documents confirming this data and referring to the website of the Companies Control Department. c. The following shall be considered in the procedures for identifying the identity of a natural person and their activity:

1. Identification data shall include the client's full name, nationality, date and place of birth, national ID number for Jordanian persons, passport number for non-Jordanian persons, current and permanent address of their actual residence, purpose and nature of the business relationship, and any other information the company deems necessary to obtain.
2. In the case of persons with partial or no legal capacity, the company must obtain documents related to them and their legal representatives, as appropriate, in accordance with the provisions of item (1) of this paragraph.
3. In the case where a person deals with the company on behalf of the client, it must be verified that there is a judicial power of attorney or authorization certified by a licensed bank in the Kingdom. It is necessary to retain the power of attorney or authorization or a certified copy thereof, in addition to the necessity of identifying and verifying the identity of the client and their representative and their activity in accordance with the provisions of item (1) of this paragraph.

d. The following shall be considered in the procedures for identifying the identity of a legal person or legal arrangement and their activity:

1. Identification data shall include their name, legal form, articles of association, headquarters address, type of activity practiced, capital, date and registration number with competent authorities, national number of the establishment including tax number, phone numbers, purpose and nature of the business relationship, names of owners and their addresses and ownership shares in the legal person or legal arrangement, names of authorized signatories, names of persons holding senior management positions in the legal person or legal arrangement, and provisions governing the binding authority of the legal person, such that the company is aware of the ownership and controlling management structure and provisions governing the authority to make binding decisions for the legal person or legal arrangement, and any other information the company deems necessary to obtain.

dhtmled4: 9/20/2021

---

Page 7 of 20 2. The existence of the legal person or legal arrangement, its legal entity, and the names of owners and authorized signatories shall be verified through necessary documents and the information they contain, such as the deed of establishment, articles of association, certificates issued by the Ministry of Industry, Trade and Supply, Industrial and Commercial Chambers, and the Companies Control Department. Additionally, it is necessary to obtain an official certificate issued by a competent authority if the company is registered abroad. 3. Obtain documents indicating authorization from the legal person or legal arrangement to the natural persons representing them, their relationship with them, identify their identity and activity according to the client identification and activity procedures stipulated in item (1) of paragraph (c) of this Article, verify that there is no legal impediment to dealing with them, and obtain samples of their signatures. 4. The following shall be considered in identifying the beneficial owner if the client is a legal arrangement:

• Trusts: Identify the identity of the settlor, trustee, or guardian, as appropriate, and the beneficiaries or class of beneficiaries for each other natural person exercising effective and actual control over the trust.
• Other types of legal arrangements: Identify the identity of persons holding positions equivalent to those mentioned above or similar.

e. The following shall be considered in procedures for identifying the beneficial owner:

1. Identify and take appropriate measures to verify the identity of the beneficial owner, such as reviewing the identity of natural persons (if any) who have actual ownership shares in the client within the legal person.
2. In case of doubts regarding item (1) of this paragraph concerning whether the person or persons with controlling ownership shares are the beneficial owners, or when no natural person exercises control through ownership shares, it is necessary to identify and take appropriate measures to verify the identity of natural persons (if any) who exercise control in legal persons through other means.
3. If no natural person is identified when applying the provisions of items (1) and (2) above, the company shall identify and take reasonable measures to verify the identity of the person holding a senior management position. f. In the case of insurance policies, the company may limit client identification and activity procedures to authorized signatories and main partners whose contribution percentage is not less than (10%) of its capital. g. The following shall be considered in procedures for identifying the beneficiary of life insurance policies and other investment insurance products once these beneficiaries are identified or named:
4. For beneficiaries who are natural persons or legal persons specifically named, the person's name shall be obtained.
5. For beneficiaries named through attributes or a class (such as spouse or children at the time of the insured event) or through other means such as a will, sufficient information about the beneficiary shall be obtained to satisfy the company that it will be able to identify the beneficiary's identity at the time of claim payment.
6. In the cases mentioned in items (1) and (2) of this paragraph, the identity of the beneficiaries shall be verified at the time of claim payment.

dhtmled4: 9/20/2021

---

Page 8 of 20 h. The company shall consider the beneficiary of a life insurance policy as a risk factor when determining the applicability of enhanced due diligence procedures. If the company determines that the insurance beneficiary is a legal person representing high risk, it shall apply enhanced measures, which shall include taking reasonable measures to identify and verify the beneficial owner of the insurance beneficiary at the time of claim payment. i. The following shall be considered in procedures for identifying the identity of legal arrangements:

1. The company must be aware of the nature of the client, ownership structure, and board of trustees.
2. It is necessary to identify authorized signatories and controlling persons according to the client identification procedures stipulated in paragraph (c) of this Article. j. The following shall be considered in procedures for identifying the identity of a non-profit entity:
3. Identification data shall include: the name of the non-profit entity, legal form, national number of the entity (if available), headquarters address, date of establishment, names of persons authorized to operate the account and their nationalities, phone numbers, purpose of dealing, income or funding sources, names of persons holding senior management positions in the non-profit entity, and any other information the company deems necessary to obtain.
4. Obtain documents indicating authorization from the non-profit entity to the natural persons authorized to deal, in addition to the necessity of identifying the identity of the authorized person according to the client identification procedures stipulated in paragraph (c) of Article (8) of these Instructions.
5. The identity and legal entity of the non-profit entity shall be verified through official documents and the information they contain, such as certificates issued by the Ministry of Social Development or any other competent authority, and whether it is authorized to operate in the Kingdom and/or accept donations and grants from local or external sources, referring to the website of the Associations Register. This includes verifying the address of the non-profit entity through a copy of the lease agreement, utility bills, visiting the client's headquarters, or professional license.

Amendments to the Article:

• This is how this article became after its amendment by Amendment Instructions No. 2 of 2018, where the text of paragraph (i) was as follows: i. The provisions of paragraphs (d), (e), (g), and (h) of this Article shall apply, as appropriate, to the legal arrangement, which refers to bare trusts or similar legal arrangements.

Article 9 a. The company shall establish and apply special policies and procedures to avoid risks related to the misuse of indirect customer transactions that are not face-to-face, especially those conducted using modern technologies such as internet insurance services where premiums are paid using electronic payment tools. It must ensure that the level of client identity and activity verification procedures in such cases is equal to the verification procedures for face-to-face transactions. b. The company shall conduct an assessment and determination of money laundering and terrorism financing risks before launching new products or previously existing ones, or practices or technologies referred to in paragraph (a) of this Article, and take appropriate measures to manage and mitigate those risks, and inform the Insurance Department of the results.

dhtmled4: 9/20/2021

---

Page 9 of 20

Amendments to the Article:

• This is how this article became after its amendment by Amendment Instructions No. 2 of 2018.

Article 10 The company shall take enhanced due diligence procedures to identify the client's identity and activity in the following cases: a. Large insurance transactions, insurance transactions that have no clear economic or legal purpose, and complex and unusual insurance transactions, and establish necessary procedures to ascertain the background circumstances and purposes of these transactions, and record the results in its records. b. Insurance transactions conducted with persons who are located in or belong to countries that do not have appropriate systems for combating money laundering and terrorism financing, or if these countries do not apply international controls for combating money laundering and terrorism financing, or do not apply them sufficiently, including the recommendations issued by the Financial Action Task Force. c. Any transaction that the Insurance Department considers, at its discretion, to pose a high risk of money laundering or terrorism financing. d. Transactions conducted through non-resident clients. e. Business relationships and transactions conducted with natural persons and legal persons (including financial institutions) from countries for which the Financial Action Task Force calls for such action.

Article 11 The following provisions shall apply: a. The company shall adhere to the following when dealing with foreign politically exposed persons:

1. Establish a risk management system to determine if the client, their representative, or the beneficial owner falls within this category. The Board of Directors shall establish a policy for accepting clients from this category, taking into account client classification according to their risk level.
2. Obtain approval from the company's General Manager or Authorized Director or their deputies before establishing a relationship with these persons.
3. Take adequate measures to verify the sources of wealth of the clients and beneficial owners of these persons.
4. Monitor the company's transactions with these persons closely and continuously.
5. Request additional documents beyond those normally requested by the company, or apply other additional procedures, if deemed appropriate. b. Regarding local politically exposed persons or persons who have previously held prominent functions by an international organization, in addition to customer due diligence procedures according to these Instructions, the company shall take the following:
6. Adequate measures to determine if the client or beneficial owner is one of these persons.
7. In the case of a high-risk relationship with these persons, apply the provisions of items (2-5) of paragraph (a) of this Article. c. The company shall apply the provisions of paragraphs (a) and (b) of this Article to the family members of politically exposed persons and persons closely associated with them. d. Regarding life insurance policies, the company shall take reasonable measures to determine if the beneficiaries and/or beneficial owner, if applicable, are politically exposed persons. This shall be done at the latest at the time of claim payment and when determining higher risks. The company's General Manager or Authorized Director or their deputies shall be informed before paying the insurance policy proceeds. A detailed review of the entire commercial relationship of policyholders shall be conducted, and consideration shall be given to notifying the Unit.

dhtmled4: 9/20/2021

---

Page 10 of 20

Article 12 a. The company may apply simplified due diligence procedures to identify and verify the client's identity and activity in the following cases:

1. Dealing with ministries, departments, and government institutions.
2. Retirement insurance policies that cannot be used as collateral and do not contain an early settlement clause.
3. Life insurance policies where the annual premium does not exceed 1,000 JOD or where the single premium does not exceed 2,000 JOD.
4. General insurance policies where the single premium or the sum of the annual premium does not exceed 3,000 JOD.
5. When it is determined that the risks of money laundering and terrorism financing are low, through appropriate risk analysis by the company. These procedures shall be commensurate with low-risk factors and shall not be acceptable when there is suspicion of money laundering or terrorism financing, or when high-risk scenarios materialize. b. For the purposes of applying the provisions of paragraph (a) of this Article, simplified procedures for identifying and verifying the client's identity and activity include the following:
6. The client submits a document containing the required data according to the provisions of paragraphs (c) and (d) of Article (8) of these Instructions, signed by the client or their representative in dealing, who must provide proof of their legal status as the client's representative.
7. The company is not obliged to obtain information about the purpose of the business relationship to be established between the client and the company and its nature.
8. The company is not obliged to take measures to verify the identity of the beneficial owner. c. The company shall not take simplified procedures for identifying and verifying the client's identity and activity in the following cases:
9. Suspicion of money laundering or terrorism financing or circumstances indicating high risks.
10. Conducting multiple insurance transactions that appear related to each other, even if they do not exceed the limits mentioned in items (6) and (7) of paragraph (a) of this Article.

Article 13 The company shall, for the purposes of applying the provisions of Articles (9-12) of these Instructions, take the following steps: a. Take appropriate steps to identify, assess, and understand money laundering and terrorism financing risks (as customer, country, geographic, product, service, transaction, and service delivery channel risks) consistent with the nature and size of the business. This includes:

1. Documenting risk assessment processes.
2. Considering all relevant risk factors before determining the overall risk level and the appropriate level of procedures to be applied in case of low risk. The classification of these risk levels shall be reviewed and updated every two years at most, or in the event of changes necessitating it, with the last update documented.
3. Updating assessment processes promptly.
4. Having mechanisms to convey risk assessment information to relevant parties.

dhtmled4: 9/20/2021

---

Page 11 of 20

b. The company shall provide internal control and monitoring systems capable of managing risks, and it shall examine the effectiveness of the internal control and monitoring systems established to manage identified risks. c. Establish policies and controls, approved by the company's Board of Directors or Authorized Director, enabling it to manage identified risks and mitigate them, supervise the application of these controls, and enhance them if necessary. Take enhanced measures to manage and mitigate risks when high risks are identified. d. Provide the Insurance Department with a report on the assessment of money laundering and terrorism financing risks annually, or in the event of a need to conduct this assessment due to a fundamental change in the nature of risks, according to a decision issued by the Secretary General on this matter.

Amendments to the Article:

• This is how this article became after its amendment by Amendment Instructions No. 2 of 2018.

Article 14 a. The company may rely on financial institutions that are members of the group to which it belongs or a third party outside the financial group to apply due diligence procedures, enhanced due diligence procedures regarding politically exposed persons, and anti-money laundering and counter-terrorism financing programs, in accordance with the provisions of these Instructions. The third party must be regulated and supervised by competent authorities and have procedures to comply with customer due diligence requirements, maintain records, and implement anti-money laundering and counter-terrorism financing programs stipulated in these Instructions. b. The company shall take into account the risk assessment level of the country where the member financial institution or the third party outside the group is located. Enhanced due diligence procedures shall be taken if the country is high-risk, and any high risks specific to countries shall be sufficiently mitigated by the group's anti-money laundering and counter-terrorism financing policies. c. The ultimate responsibility for applying customer due diligence procedures remains with the company, which shall adhere to the following:

1. Immediately obtain the necessary information regarding insurance transactions.
2. Take

dhtmled4: 9/20/2021

---

Page 12 of 20