Proliferation Financing Risk Assessment 2024 Executive Summary

Proliferation Financing Risk Assessment (PFRA) 2024 Proliferation Financing Risk Assessment (PFRA) 2024 Proliferation Financing Risk Assessment (PFRA) 2024

Proliferation Financing Risk Assessment 2024 1 Overview In October 2020, Financial Action Task Force (FATF) revised Recommendation 1 (R.1) and Interpretive Note 1 (INR.1) requiring countries and private sector entities to identify, assess, understand and mitigate their proliferation financing (PF) risks. PF risks refers to the risk of potential breach, non-implementation or evasion of the targeted financial sanctions (TFS) obligations referred in Recommendation 7 (R.7) that is the UNSCR 17181 and UNSCR 2231.2 Malaysia has introduced this requirement under its AML/CPF/CPF Policy Document, mandating reporting institutions to conduct institutional PF risk assessment. The Proliferation Financing Risk Assessment (PFRA) 2024, an update to PFRA 2021, has been aligned with FATF’s latest revisions3 in October 2020. At the national level, the overall net PF risk remained at medium low, with medium low inherent risk and an acceptable control measures. This risk assessment is conducted in collaboration with Strategic Trade Secretariat (STS) of Ministry of Investment, Trade and Industry (MITI). STS is led by the Strategic Trade Controller (STC), who chairs Strategic Trade Action Committee (STAC). STAC serves as the main platform to discuss matters in relation to the implementation of Strategic Trade Act (STA) 2010, including PF matters. Methodology The methodology applied is akin to PFRA 2021, with minor adjustments to align with the revised definition of PF risks. This assessment spans the period from 2019 to 2023. 1 UNSCR 1718 – A response to DPRK’s test of nuclear weapon on 9 October 2006. Comprises sanctions measures to prevent the proliferation of nuclear, chemical and biological weapon. (Source: Security Council Committee established pursuant to resolution 1718 (2006) | Security Council). 2 UNSCR 2231 – A resolution that endorsed Joint Comprehensive Plan of Action (JCPOA) to ensure Iran’s nuclear programme will be exclusively peaceful. (Source: Resolution 2231 (2015) on Iran Nuclear Issue | Security Council). In October 2023, this resolution has ceased to apply. FATF has confirmed that R.7 only apply for UNSCR 1718. 3 FATF’s latest revisions to Recommendation 1 (R.1) and its Interpretative Note (INR.1). Executive Summary

Proliferation Financing Risk Assessment 2024 2 Executive Summary a) No financial services provided to designated persons listed under UNSCR 1718 and 2231. b) Since the assassination of Kim Jong Nam in 2017 and the cessation of diplomatic relations in 2021,4 the following events have occurred: • Trading activity between Malaysia and Democratic People’s Republic of Korea (DPRK) has halted since 2018. • No visas have been issued to DPRK nationals, and long-term visas expiring thereafter have not been renewed. • DPRK nationals are not allowed to hold directorship or shareholding in Malaysian registered companies. • The presence of DPRK nationals in the financial system has continued to decline in line with the overall decrease of DPRK nationals in the country. c) Malaysia has small exposure from Iran resulting from: • Limited trading activity. • Minimal employment passes issued. • Small presence of directorship / shareholding by Iranian nationals in Malaysian registered companies. • Limited Iranian customers in the financial system. Structural factors a) Malaysia’s notable economic standing. b) Malaysia’s strategic geographical location, competitive port costs, and efficient handling operations. c) Swift company setup in both onshore and Labuan. d) Potential misuse of legal entities as front/shell companies remains a concern. i. Threats ii. Vulnerabilities Assessment of Inherent Risk 4 Link to official press statement by Ministry of Foreign Affairs Malaysia: Press Release from Malaysia’s MOFA. 5 Source: The Observatory of Economic Complexity (oec.world). 6 Source: OFAC on Hossein Hatefi Ardakani iii. Likelihood No reports of positive matches for designated persons listed in UNSCR 1718 and 2231. However, there are reports of positive matches on entities listed under unilateral sanctions. In December 2023, The Office of Foreign Assets Control (OFAC) sanctioned 10 entities and four individuals based in Iran, Malaysia, Hong Kong, and Indonesia for supporting Iran’s unmanned aerial vehicle (UAV) production.6 e) Risks associated with crimes that could be exploited by the designated persons, (e.g. corruption and organised crimes). At present, no reports of such exploitation. However, Malaysia has some exposure in relation to illegal money services businesses. Sectoral factors a) Similar to PFRA 2021, banks and MSBs, including onshore and Labuan, have increased vulnerability to DPRK and Iranian nationals as compared to other sectors. b) This is due to slightly higher DPRK and Iranian customers and the related transactions, and higher vulnerability of PF risk products/ services offered by these sectors. Case Study 2.0 1.6 2.6 3.7 0.11% 0.09% 0.12% 0.13% 0.00% 0.05% 0.10% 0.15% -1.0 1.0 3.0 5.0 2019 2020 2021 2022 Figure 1: Malaysia’s Total Trade with Iran5 RM billion Onshore and Labuan banks and money services businesses (MSBs)

Proliferation Financing Risk Assessment 2024 3 Executive Summary 7 Link to the circular: SSM Circular 1/2018: Restriction on business entities in relation to North Korea Assessment of Control Measures a) Malaysia has established an adequate legal framework to combat PF, which is supported by effective coordination and cooperation at the national and international level. Malaysia also has put in place a mechanism to assist reporting institutions in identifying subjects suspected to be involved in PF by establishing public-private partnership between Financial Intelligence Unit (FIU), Polis Diraja Malaysia (PDRM) and private sectors. b) Malaysia’s legal framework is bolstered by sufficient sectoral oversight, ensuring that the measures in place are effectively implemented and monitored across different sectors. Recommendations Regulatory and Supervisory Initiatives Implementation and Compliance Enforcement Actions • Continuous enhancement of judiciary, enforcement agencies, regulators and supervisors’ understanding of PF obligations, trends and dual-use items through training and awareness program. • Conduct strategic and targeted awareness on compliance issues for sectors with weaker controls. • Continuous monitoring to ensure robust AML/CFT/CPF compliance program for the detection of designated persons and related parties. • Suruhanjaya Syarikat Malaysia (SSM) to continue heighten supervision to ensure compliance with their regulations and to consider enforcement action for breaches on their regulations such as incorporating or registering new business entities owned by DPRK or increase in shareholding or equity in any existing business entity owned by DPRK.7 • Reporting institution and related government agencies to leverage the ultimate beneficial owner (UBO) depository system by SSM and Labuan Financial Services Authority (LFSA). • Intensify analysis on individuals with dual nationality, especially golden passport programme. • Intensify targeted joint operation on immigrants and overstayed foreigners to reduce exposure on countries from P/PF concerns.

Proliferation Financing Risk Assessment 2024 4 Executive Summary Generally, science and technology is observed to be more vulnerable to potential risk associated with weapons of mass destruction. Risk Outlook a) The presence of DPRK nationals in Malaysia continues to decline given the diplomatic relations between Malaysia and DPRK is expected to remain ceased, although concerns persist on individuals with dual nationality. b) Although Malaysia has yet to experience any financial losses due to hacking activities linked to DPRK, the risk remains. This is because cryptocurrency heists by DPRK￾linked hackers are expected to continue, given some incidents that have occurred internationally. For example,8 cyberattacks that targeted Alphapo, CoinsPaid and Atomic Wallet. c) Malaysia remain susceptible to DPRK’s other methods in continuously violating and evading sanctions, as highlighted by UN’s Panel of Experts (POE) reports.9 a) The presence of Iranian nationals in Malaysia is anticipated to increase, particularly following the termination of UNSCR 2231 in October 2023 and improving bilateral ties between Malaysia and Iran.10 8 Link to FBI announcements: (1) FBI Identifies Cryptocurrency Funds Stolen by DPRK — FBI; (2) FBI Identifies Lazarus Group Cyber Actors as Responsible for Theft of $41 Million from Stake.com — FBI 9 Link to POE’s reports: UN’s Panel of Expert Report March 2024 (FINAL) 10 Source: Improving Bilateral Ties DPRK Iran