Circular No. (8/2026): Regulatory and Supervisory Controls regarding Combating Money Laundering, Terrorist Financing and Financing of the Proliferation of Weapons

CENTRAL BANK OF SUDAN
Banking Regulation & Development Department
Central Bank of Sudan
General Administration for Banking Regulation and Development

Date: 30 April 2026
Corresponding to: 13 Dhu al-Qi'dah 1447 AH
Bulletin: C.B.S./B.R.D.D./M/2026

General Administration for Banking Regulation and Development Circular No. (8/2026) Addressed to all institutions subject to the supervision of the Central Bank of Sudan Subject: Regulatory and Supervisory Controls regarding Combating Money Laundering, Terrorist Financing and Financing of the Proliferation of Weapons

Based on the provisions of Article (118/2) of the Banking Business Regulation Act of 2026, and Article 44 of the Anti-Money Laundering and Terrorist Financing Act of 2014, and within the framework of enhancing and developing the regulatory and supervisory controls related to combating money laundering, terrorist financing and financing of the proliferation of weapons, and in keeping with developments and changes at the local and international levels, the Central Bank of Sudan has issued the following guidelines:

First: Cancellation of the following circulars and directives:

1/ Circular No. (8/2014) Regulatory and Supervisory Controls for Institutions Subject to the Supervision of the Central Bank of Sudan regarding Combating Money Laundering and Terrorist Financing Crimes.

Circular No. (2/2026) Controls for Regulating Customer Transfers.

3/ The circular issued on 17 August 2015 regarding the amendment of paragraph (57) of Circular (8/2014).

4/ The circular issued on 01 November 2018, the circular issued on 04 November 2019, and the circular issued on 23 August 2020 regarding dealing with international sanctions lists.

Second: Scope of application of the circular:

This circular applies to all institutions subject to the supervision of the Central Bank of Sudan according to the definition of the institution set out in Third, and the institution must ensure that its branches and subsidiaries locally or in other countries - in which it owns an ownership share (50% or more) or over which it exercises effective administrative or operational influence - apply the anti-money laundering and terrorist financing controls set out in this circular, and in the event that the controls differ from those of the host country, the stricter controls shall be applied, and in the event of any obstacles preventing the application of these controls, the Central Bank of Sudan must be notified immediately.

CENTRAL BANK OF SUDAN
Central Bank of Sudan
Banking Regulation & Development Department
General Administration for Banking Regulation and Development

Third: Interpretations:

In this circular, and unless the context requires otherwise, the following words and phrases shall have the meanings assigned to them below wherever they appear:

The Law: means the Anti-Money Laundering and Terrorist Financing Act of 2014.

Funds: means financial and non-financial assets, and all types of property, whether tangible or intangible, movable or immovable, regardless of how they were obtained, and legal documents and instruments of whatever form, including electronic or digital, which establish a right to or benefit in these assets, and includes banking financings, tourist networks, banking networks, payment orders, shares, securities, bonds, bills of exchange and letters of credit, and any interest, profits or other income resulting from these funds or other assets.

Money Laundering: means the acts criminalized by Article 35 of the Law.

Terrorist Financing: means the acts criminalized by Article 36 of the Law.

The Unit: means the "Financial Information Unit" established under the provisions of Article 12 of the Law.

Person: means any natural or legal person or legal entity.

Institution: means any bank, exchange company, money transfer company, leasing company, microfinance institution, or any other financial institution licensed by the Central Bank of Sudan to provide a specific financial activity.

Controlling: means the direct or indirect ability of a person to exercise effective influence over the decisions and actions of another person, including financial ones.

Control over a legal person or legal entity includes:

Possessing the ability to appoint or remove, alone as a result of exercising voting rights, the majority of the members of the board of directors or the supervisory body of the legal person or legal entity.

Possessing the ability to control alone the majority of the members or shareholders of the legal entity or legal person by virtue of an agreement with the other members or shareholders of that legal entity or legal person.

Possessing the right to effective control over the legal person or legal entity by virtue of an agreement, or by virtue of a provision in the articles of incorporation or the bylaws, if the law governing that legal person or legal entity permits so.

CENTRAL BANK OF SUDAN
Central Bank of Sudan
CBOS
General Administration for Banking Regulation and Development Banking Regulation & Development Department

d. Possessing the authority to exercise the right to impose the effective control mentioned in paragraph (c) above, without being the owner of that right.

e. Possessing the right to use all or part of the property of the legal person or legal entity.

f. Participating jointly or individually in bearing the financial responsibility of the legal person or legal entity or guaranteeing them.

g. The ability to control in any manner, including the use of unlawful means.

Due Diligence Measures: the process of identifying or verifying the information of the customer or the beneficial owner that enables the financial institution to assess the extent of its exposure to risks.

Enhanced Measures: the financial institution taking additional procedures and measures when the risks of money laundering, terrorist financing and financing of the proliferation of weapons are high.

Simplified Measures: applying the measures and procedures in a mitigated and simplified manner when the risks of money laundering, terrorist financing and financing of the proliferation of weapons are low.

Beneficial Owner: means the natural person who owns or exercises control over the customer directly or indirectly, and includes the natural person on whose behalf the transaction is conducted, as well as the natural person who exercises ultimate effective control over a legal person or legal entity.

Business Relationship: means the relationship that arises between the institution and its customer and which is connected to the activities or services it provides to him whenever the institution expects the relationship to extend for a period of time.

Occasional Customer: means the customer who does not have a continuous business relationship with the institution.

Politically Exposed Persons: means persons who are or have previously been entrusted with:

a. Prominent public functions locally or in a foreign state, such as heads of state or government, high-level politicians, high-level government officials, judicial officials, high-ranking military personnel, senior executive employees in state-owned companies, and officials of important political parties.

b. Prominent functions with an international organization, namely members of senior management - i.e. directors - and their deputies and members of the board of directors or positions equivalent thereto.

Close Associates: means those who are widely known and recognized as close business colleagues and/or personal advisers of politically exposed persons, especially financial advisers or persons acting in a legal-financial capacity.

CENTRAL BANK OF SUDAN
Banking Regulation & Development Department
Central Bank of Sudan
General Administration for Banking Regulation and Development

Family members: means persons directly related to politically exposed persons (parents, brothers, sisters, sons and daughters), or through marriage.

Shell bank: means a bank that has no physical presence in the country in which it was established and obtained a license from, and that does not belong to any financial group subject to consolidated and effective banking regulation and supervision.

Private banking service: means the activities through which the institution provides financial services to customers with large deposits, usually performed through a central liaison officer between the institution and the customer, and this officer facilitates the customer's use of the financial services and products provided by the institution.

Legal arrangements: means the relationship arising under a contract between two or more parties that does not result in the creation of a legal personality, such as investment funds.

Third party: means the entity engaged by the financial institution to carry out due diligence measures, consisting of other financial institutions and specified non-financial professions that are subject to supervision and oversight.

Numbered account: means an account opened with the institution where the customer is identified by a specific number instead of a name, and access to information related to the customer is limited to a limited number of the institution's employees.

Correspondent banking relationship: means the provision of banking services, payment services and others by an institution (the correspondent institution) to another institution (the respondent institution) to enable the respondent institution to provide services and products to its customers.

Associations and non-profit organizations: means associations and institutions established under the Voluntary and Humanitarian Work Organization Act of 2006 or any other law replacing it, which aim to provide social services and do not aim to achieve any material profit or personal gain, and include non-governmental organizations, civil society organizations, and local and foreign charitable organizations.

Targeted financial sanctions: financial sanctions related to the implementation of United Nations Security Council resolutions relating to combating terrorism and its financing and preventing the proliferation of weapons of mass destruction and their financing, and include asset freezing measures and prohibition operations to prevent making funds and other assets available, directly or indirectly, to the benefit of designated persons and entities.

Sanctions lists: the lists issued in accordance with the mechanisms for implementing Security Council resolutions related to combating terrorism and its financing, and preventing the proliferation of weapons of mass destruction and their financing.

Designated person: any natural or legal person, group of persons or organization listed in the sanctions lists.

CENTRAL BANK OF SUDAN
Central Bank of Sudan
CBOS
General Administration for Regulation and Development of the Banking System Banking Regulation & Development Department

Technical Committee: the Technical Committee for the Implementation of Security Council Resolutions, formed under Cabinet Resolution No. (360), based on Cabinet Resolutions Nos. (358), (359) of 2014, and nationally competent to follow up and coordinate the implementation of targeted financial sanctions, circulate the lists and take related measures.

Fourth: Risks of money laundering, terrorism financing and proliferation of weapons:

1/ The institution must apply the risk-based approach to identify, assess, monitor and mitigate the risks of money laundering, terrorism financing and financing of the proliferation of weapons to which it is exposed, provided that the level of assessment is proportionate to the size and nature of the institution's business, and it must update the assessment twice each year. The institution must also document both the risk assessment and its updates and the information related to these assessments, and the institution must have an appropriate mechanism for providing information related to the risk assessment to the competent authorities. The institution must also do the following:

The risk assessment must be consistent with the results of the national assessment of the risks of money laundering, terrorism financing and financing of the proliferation of weapons and its updates, and any other guidance related to risk assessment issued by the Central Bank of Sudan.

The risk assessment must take into account internal changes in the institution such as changes in the ownership structure, the board of directors, mergers and acquisitions, and major changes in banking activities.

The risk assessment must reflect qualitative and quantitative elements of the type, size and number of operations and determine the level of risk.

The institution must develop and adopt internal measures and procedures and apply them in proportion to the risk levels determined in accordance with the results of the self-assessment of risks in order to manage and mitigate them, and enhanced due diligence procedures must be applied to high risk levels.

Where the Central Bank of Sudan identifies certain areas and activities as low risk, the institution is permitted to apply simplified measures in accordance with specific guidance on how to apply them.

2/ When identifying and assessing the risks of money laundering and terrorism financing and establishing a system to manage, monitor and mitigate them, the institution must take into account the following risk categories:

Risks related to customers.

Risks related to specific geographic areas.

Risks related to products and services.

Risks of the channels for delivering services and products.

3/ The institution must take the following measures in managing and reducing risks:

CENTRAL BANK OF SUDAN
Banking Regulation & Development Department
Central Bank of Sudan
General Administration for Regulation and Development of the Banking System

a. Preparing a risk profile for classifying customers and transactions such that it includes determining the risk category (high – medium – low) for each customer, provided that the profile is based on complete information about the customer and the beneficial owner in case of difference, including the expected business relationship with the institution, and the source of the customer's funds and assets. The risk profile must be updated periodically or when changes occur in the information available about the customer or the pattern of his operations.

b. Enhanced due diligence procedures shall be applied to high-risk customers.

c. Taking into account all relevant risk factors before determining the overall risk level and the appropriate level of risk mitigation measures to be applied.

d. Updating information relating to all customers on a regular basis.

e. Documenting risk assessment processes by keeping comprehensive records of all classification processes, risk assessment and the application of due diligence, and these records must be available for audit and internal review.

Fifth: Customer due diligence:

Customer due diligence procedures:

4/ Customer due diligence means taking a set of measures including:

a. Identifying and verifying the identity of the customer: using original documents and data or information documented from independent sources, in the manner set out in this circular for each category.

b. Verifying authorized persons: obtaining documents proving the identity of any person dealing with the institution on behalf of the customer, including obtaining documents confirming the validity of his authorization to act on his behalf.

c. Identifying the beneficial owner: taking reasonable measures to verify his identity.

d. Understanding the ownership and control structure of the customer that is a legal person or legal arrangement.

e. Understanding the intended purpose of the business relationship and the intended claimant thereof, and obtaining information related to the nature of that relationship.

w. Exercising ongoing due diligence regarding business relationships, using specialized technical systems that monitor the relationship with the customer until the pattern of their transactions is recognized and any unusual transactions that are inconsistent with this pattern or with what the institution knows about its customer, their activity, and their risk profile are detected, including knowledge of the source of funds and wealth when necessary, and monitoring includes setting prior restrictions on the amount, volume, and type of transactions.

z. Updating the information, data, and documents collected within the framework of due diligence procedures on an ongoing basis, especially for high-risk customers, and periodically verifying their validity by reviewing existing records at an appropriate frequency determined by the institution.

CENTRAL BANK OF SUDAN
Banking Regulation & Development Department
Central Bank of Sudan
General Administration for Regulation and Development of the Banking System

5/ The institution, when applying the due diligence procedures mentioned above, may determine the extent to which any one of these procedures should be applied based on the risk-based approach.

6/ The institution must take due diligence measures itself, and it may rely on a third party in fulfilling these procedures in accordance with the controls determined by the Central Bank of Sudan in this regard, provided that the ultimate responsibility for due diligence procedures remains with the institution that relies on the third party, and in this case it must include at a minimum the following:

Ensuring that the third party is subject to supervision and oversight, and follows procedures compatible with the recommendations of the Financial Action Task Force (FATF) regarding customer due diligence and record keeping.

Obtaining data and documents for identifying the customer or the beneficial owner immediately and understanding the nature of their activity and understanding the purpose and nature of the business relationship.

Ensuring the possibility of obtaining any data or documents related to identifying the customer or the beneficial owner or any documents related to due diligence when requested from the third party without delay.

When using a third party in another country, the level of risk of that country and its application of the recommendations of the Financial Action Task Force (FATF) must be taken into account.

Reviewing the terms of contracting with third parties periodically.

Cases in which customer due diligence procedures must be applied:

7/ The institution must take customer due diligence measures in the following cases:

Before establishing a business relationship with the customer or before opening an account.

Before conducting an occasional transaction whose value equals or exceeds the equivalent of 15,000 euros in national or foreign currency, whether conducted as a single transaction or several transactions that appear to be linked to each other.

Before conducting local or international electronic transfers.

Whenever the institution has doubts about the validity or accuracy of the data previously obtained regarding the identification of customers or its adequacy.

Whenever there is suspicion of money laundering, terrorism financing, or financing of the proliferation of armaments.

CENTRAL BANK OF SUDAN
Central Bank of Sudan
CBOS
General Administration for Regulation and Development of the Banking System Banking Regulation & Development Department

Timing of customer due diligence procedures:

8/ A business relationship may be established or a transaction executed before verifying the identity of the customer or the beneficial owner in accordance with the following:

That postponing the verification procedures is necessary for the normal course of business procedures.

That the institution completes customer due diligence procedures as soon as possible.

That the institution has taken the necessary measures for the prudent management of money laundering and terrorism financing risks for the case in which the postponement occurred, including setting limits on the number, type, and value of transactions that can be executed before completing the verification procedures.

9/ In the event that the institution is unable to fulfill the customer due diligence procedures mentioned in paragraph (4) above, the account must not be opened or any business relationship entered into with the customer or any transactions executed for their account. The business relationship must also be terminated if the institution is unable to fulfill customer due diligence procedures for business relationships that existed before the effective date of this circular or when it is impossible to complete these procedures later due to their postponement as stated in paragraph (8) above. In all these cases, the institution must consider submitting a notification to the unit accordingly.

10/ In cases of suspicion of money laundering, terrorism financing, or financing of the proliferation of armaments at the institution, and its belief for logical reasons that implementing due diligence procedures will alert the customer, it is permitted not to complete due diligence procedures provided that a notification of the suspicious transaction is submitted to the unit.

11/ The institution must apply due diligence measures to existing business relationships at appropriate times based on materiality and risk, taking into account whether due diligence procedures have been taken before and the time they were taken, and the adequacy of the data obtained.

Identification and verification procedures:

12/ The institution must rely on official documents to identify the customer's identity, while ensuring their validity and keeping a copy signed by the competent employee indicating that it is a true copy of the official document.

13/ Identification and verification procedures for natural persons:

The identity of the natural person must be verified by relying on valid official identification documents (national ID, driving license, military ID, judicial ID, police ID, residence document, passport or travel document), taking into account that the identification data includes the customer's full name, nationality, national number, date of birth, permanent residence address

CENTRAL BANK OF SUDAN
Banking Regulation & Development Department
Central Bank of Sudan
General Administration for Regulation and Development of the Banking System

phone numbers, work address, type of activity, purpose of dealing, names of authorized persons to deal with the account and their data, and any other information the institution deems necessary to obtain.

b. In the event that another person deals with the institution on behalf of the customer, the institution must review the legal power of attorney or valid authorization that permits them to do so, while keeping a certified copy thereof. The institution must also verify the identity of the authorized person in accordance with the procedures stipulated in customer identification.

c. The institution must take the necessary measures to verify the validity and accuracy of the data and information obtained from the customer, including civil registry databases, commercial registry, credit inquiry and classification agency, and any other approved official databases.

d. With regard to other business relationships with natural persons, verification of their existence through the identification documents specified in the Central Bank of Sudan circulars in this regard, and the information they contain, shall be observed in accordance with the following:

Joint accounts:

d – 1) Presenting the necessary identification documents for all partners.

d – 2) Determining the nature of the account management responsibility, whether individual or joint.

Accounts of guardians and executors of wills:

d – 3) Presenting the necessary identification documents for each of the guardians and executors of wills.

d – 4) Providing evidence of appointment as guardian, provided that it is issued by the competent court.

d – 5) Presenting the guardianship or trusteeship and execution in accordance with the conditions stated in either of them.

Accounts of estate administrators:

d – 6) Submission of legal notification.

d – 7) Presentation of the necessary supporting documents for each of the estate administrators.

d – 8) Submission of the decision of the Sharia court or the Director General of Estates designating an administrator for the estate concerned.

Employee accounts:

d – 9) Submission of a salary certificate from the employer.

CENTRAL BANK OF SUDAN
Banking Regulation & Development Department
Central Bank of Sudan
General Administration for Regulation and Development of the Banking System

(d - 10) Presentation of the necessary supporting documents for any employee.

14/ Identification and verification procedures for legal persons:

a. The identification data must include the name of the legal person, legal form, headquarters address, type of activity, capital, names of those authorized to manage the account and their nationalities, telephone numbers, purpose of the dealing, and any other information the institution deems necessary to obtain. The institution must also verify the identity of the legal person and obtain official documents proving its existence (registration certificate, or any other documents).

b. A copy of the documents indicating the existence of an authorization from the legal person to one or more natural persons for the purpose of representing it or authorizing natural persons to manage the account must be obtained, in addition to the necessity of verifying the identity of those authorized to deal in accordance with the customer identification procedures stipulated in this circular.

c. The names and addresses of the partners must be obtained, and for public shareholding companies, a statement of the names and addresses of the shareholders must be obtained. With regard to business relationships with legal persons, the legal existence of the legal personality must be verified through the necessary documents and the information they contain and compared with the databases of the civil registry, commercial registry, credit inquiry and classification agency, and any other approved official databases in accordance with the following:

Partnership accounts:

(c - 1) Business name registration certificate extracted from the business registrar or partnership registration certificate if registered in the name of one or more partners.

(c - 2) The partnership contract documented and approved by the courts administration, showing the names and addresses of the partners, and specifying the persons authorized to sign jointly or individually.

Corporate accounts:

(c - 3) The company's registration certificate with the commercial registrar and the commencement of business certificate for public shareholding companies.

(c - 4) A commercial license issued by the competent authority for companies and institutions registered in Sudan and the signature authorization form, and for companies and institutions registered outside Sudan, documents issued by the foreign registration authority that have been authenticated in Sudan must be submitted.

(c - 5) The contract and articles of incorporation.

(c - 6) The company's address and headquarters.

CENTRAL BANK OF SUDAN
Banking Regulation & Development Department
Central Bank of Sudan
General Administration for Regulation and Development of the Banking System

(c - 7) The company's board of directors' resolution to open an account with the institution.

(c - 8) The company's board of directors' resolution appointing those authorized to manage the company's accounts and the limits of their powers.

Accounts of government units and accounts of public institutions and bodies:

(c - 9) Approval of the competent authority to which the government unit belongs or the director general of the institution or body, as the case may be, to open the account.

(c - 10) Approval of the Federal or State Ministry of Finance, as the case may be.

(c - 11) An authorization specifying the names of the persons authorized to sign on the account and the limits of their powers, signed by the head of the government unit or the director general, as the case may be.

(c - 12) A copy of the law by which the government body or institution was established.

Accounts of associations and non-profit organizations (associations and voluntary organizations):

(c - 13) A registration certificate from the competent authority, and for associations and organizations registered outside Sudan, documents issued by the foreign registration authority that have been authenticated in Sudan must be submitted.

(c - 14) A copy of the constitution and the bylaws governing and regulating the work.

(c - 15) The decision to form the executive committee and appoint the three officers, approved by the registrar of bodies.

(c - 16) A letter specifying the bank in which the current account is to be opened, signed by the president or secretary, specifying the names of the persons authorized to sign on behalf of the entity concerned and the limits of their powers to use that account.

(c - 17) Completion of identification data for donors and beneficiaries of deposited and withdrawn funds.

15/ Identification and verification procedures for legal entities:

The identification data include the name of the legal entity, headquarters address if any, purpose of the entity, name of the founder, trustee, and beneficiaries, and any other person exercising ultimate control over the legal entity, telephone numbers, purpose of the dealing, and any other information the institution deems necessary to obtain.

CENTRAL BANK OF SUDAN
Central Bank of Sudan
CBOS
General Administration for Regulation and Development of the Banking System Banking Regulation & Development Department

b. A copy of the documents indicating the existence of an authorization from the legal entity to a concerned person for the purpose of representing it or authorizing natural persons to manage the account must be obtained, in addition to the necessity of identifying the identity of those authorized to act in accordance with the customer identification procedures stipulated in this circular.

Identification of the beneficial owner:

16/ In order to determine whether the customer is acting on behalf of one or more other beneficial owners, the institution must require each customer, when opening an account or establishing a business relationship, to sign a written declaration disclosing information about the beneficial owner of the business relationship that leads to identifying his identity. The institution may take other measures to identify the beneficial owner through any other sources it deems necessary.

17/ The institution must verify the identity of the beneficial owners and take reasonable measures to verify their identity, including reliance on reliable data, information, or documents from independent sources, such that the institution is satisfied that it knows the identity of the beneficial owners. For legal persons and legal entities, this must include the institution's understanding of the ownership and control structure of the customer.

18/ The identity of the beneficial owners of legal persons and legal entities shall be determined as follows:

a. For legal persons, the identity of every natural person who owns or controls, directly or indirectly, more than 10% of the legal person must be determined. If it is not possible to ascertain that this person is actually the beneficial owner, or there is no natural person exercising control through ownership, then the identity of every natural person exercising control by other means must be determined. If identification according to the foregoing is not possible, the identity of the person responsible for managing the legal person must be determined.

b. For customers listed on the Khartoum Stock Exchange, the institution is not required to identify or verify the identity of shareholders or beneficial owners, and this procedure does not exempt the institution from obtaining copies of the documents required to identify the legal person as stated in paragraph 14 above.

c. For legal entities, the identity of the founder, trustee, guardian (if any), beneficiaries, and any other natural person exercising ultimate, direct or indirect, effective control over the legal entity must be verified.

19/ The institution must investigate the background of complex, unusual transactions or those that have no clear economic or legal justification, and when the risks of money laundering, terrorism financing, or proliferation financing are high, enhanced due diligence measures proportionate to the risks must be applied, and the institution must increase the nature and level of monitoring of these business relationships

CENTRAL BANK OF SUDAN
Banking Regulation & Development Department
Central Bank of Sudan
General Administration for Regulation and Development of the Banking System

To determine whether these transactions or activities are suspicious, and special records of these operations must be kept regardless of the decision taken regarding them and made available to the competent authorities and auditors upon request.

20/ In addition to the normal due diligence measures, the institution must take enhanced due diligence measures towards high-risk business relationships in accordance with the risk-based approach, including at a minimum the following:

Obtaining additional documents and information related to the customer, the beneficial owner, contact details, and residence.

Obtaining additional documents and information related to determining the occupation, economic activity of the customer, source of funds, source and nature of wealth, business relationships with other financial institutions, the intended nature of the business relationship, and the purpose of the intended or executed transaction.

Updating documents, information, and data related to customers and beneficial owners at a faster pace, conducting periodic review of the business relationship, and conducting enhanced monitoring of transactions.

Obtaining senior management approval before establishing or continuing a high-risk business relationship, with documentation of the reasons for approval and the measures taken to manage the risks.

Applying enhanced follow-up measures for the business relationship, by intensifying the number and timing of controls, identifying patterns of operations that require a higher level of examination and review, and subjecting them to in-depth analysis according to the degree of risk.

Conducting the first payment to the account balance through an account in the name of the customer at one of the banks subject to similar due diligence standards.

21/ The institution must apply enhanced due diligence measures according to the specific risks regarding business relationships and transactions conducted with persons who belong to or are located in countries that do not apply the recommendations of the Financial Action Task Force or do not apply them with the required efficiency, and in the case where their risks are high, the institution must limit dealings with them and consider terminating the business relationship.

22/ The institution must include in its policies effective procedures regarding business relationships that are not conducted in the presence of the customer, such that they are strict in determining and verifying his identity. Examples of these measures include:

Requesting documentation of documents submitted by competent and accredited authorities when establishing the business relationship.

Requesting additional documents aimed at verifying identity, contact details, wealth, source of funds, and others.

Obtaining a recommendation from an independent and reliable third party to identify the customer.

CENTRAL BANK OF SUDAN
Banking Regulation & Development Department
Central Bank of Sudan
General Administration for Regulation and Development of the Banking System

d. Imposing restrictions on the disposal of the account, such as setting ceilings on amounts, the type of transactions permitted to be executed, and the scope of use of the account until an appropriate level of verification is completed.

e. Conducting continuous enhanced monitoring of the business relationship to ensure that executed transactions are consistent with the customer's transaction pattern and do not involve unusual or suspicious transactions.

Sixth: Other controls for establishing business relationships:

23/ The institution is prohibited from opening or maintaining any numbered accounts for its customers or dealing with any numbered accounts.

24/ The institution is prohibited from opening anonymous or fictitious-name accounts or maintaining such accounts.

25/ It must be verified that the customer is not listed on the lists of delinquent or prohibited customers issued by the Central Bank of Sudan before entering into a business relationship with them, and no transaction must be executed for a passer-by customer listed on these lists.

26/ The approval of the branch manager or their deputy must be obtained when entering into a business relationship with any customer.

27/ No employee in any institution may manage any account on behalf of any customer.

Seventh: Cases Requiring Special Procedures:

In addition to the due diligence procedures set out in "Section Fourth" of this Circular, the institution must take special procedures when dealing with the following cases:

Politically Exposed Persons:

28/ The institution must establish an appropriate risk management system to determine whether the customer or the beneficial owner is a politically exposed person, which must include at least the following procedures:

Requesting a declaration from the customer and the beneficial owner containing relevant information.

Verifying the information available about the customer and the beneficial owner.

Searching commercial electronic databases of politically exposed persons, if available.

29/ If it appears to the institution that the customer or the beneficial owner is a politically exposed person, it must:

If they are a foreigner who holds/held a prominent public office in a foreign country:

Obtain the approval of the institution's senior management before establishing or continuing a business relationship with this person.

Take appropriate measures to determine the source of the customer's wealth and funds.

CENTRAL BANK OF SUDAN
Banking Regulation & Development Department
Central Bank of Sudan
General Directorate for the Regulation and Development of the Banking System

(a-3) Conduct ongoing monitoring of the business relationship to determine whether transactions appear unusual or suspicious.

b. If the politically exposed person is local or has held or holds a prominent office in Sudan or in an international organization and is considered high-risk, the procedures set out in paragraph (a) above shall apply to them.

30/ The special procedures for politically exposed persons apply equally to close associates and family members.

Correspondent Banking Relationships:

31/ In addition to applying the basic due diligence procedures mentioned in "Section Fourth" of this Circular, the institution must take the following due diligence measures when establishing a correspondent banking relationship with respondent institutions:

a. Collect sufficient information about the respondent institution to fully understand the nature of its activities, and to determine, through publicly available information or information provided upon request, the reputation of the respondent institution and the level of supervision it is subject to, including whether the respondent institution or any of its board members or controlling shareholders has been subject to any investigation related to money laundering or terrorist financing, or any regulatory action in this regard.

b. Assess the respondent institution's anti-money laundering, terrorist financing, and proliferation financing controls, and ensure their effectiveness and adequacy.

c. Obtain the approval of the institution's senior management before entering into a business relationship with a respondent institution.

d. Clearly understand and document the anti-money laundering, terrorist financing, and proliferation financing responsibilities of each institution in relation to correspondent banking relationships.

e. If the respondent institution provides payment account services to its customers, the correspondent institution must satisfy itself that the respondent institution has carried out due diligence on its customers who have direct access to these accounts, and that it has the ability to provide information relating to these customers when necessary.

f. The institution is prohibited from entering into or continuing a business relationship with shell banks, and it must not deal with a financial institution that allows its accounts to be used by a shell bank.

g. Complete a written questionnaire setting out the respondent institution's position on compliance with its local legislation and regulatory controls, the due diligence standards it applies to its customers, and the extent to which the respondent institution has effective internal policies and procedures in this regard.

32/ The above procedures must be applied to cross-border correspondent relationships and similar relationships.

CENTRAL BANK OF SUDAN
Central Bank of Sudan
CBOS
General Directorate for the Regulation and Development of the Banking System Banking Regulation & Development Department

Electronic Transfers:

33/ Scope of Application:

a. The provisions of this paragraph apply to domestic and foreign transfers issued or received by the institution in any currency.

b. These provisions do not apply to transfers arising from transactions made using payment or debit cards or any similar means of payment, provided that all transfers arising from these transactions bear a unique reference number that allows the transaction to be traced to the person initiating the transfer and the recipient.

c. These provisions do not apply to transfers or settlements made between financial institutions where both parties to the transfer are financial institutions dealing for their own account.

Obligations of the Originating Institution:

34/ The originating institution must obtain complete information about: a- The person initiating the transfer, including: the name of the initiator, account number, address; b- Obtain complete information about the beneficiary, including: the name of the beneficiary and their account number if used to carry out the transaction. In the event that the initiator or beneficiary does not have an account number, the institution must assign a unique reference number to the transfer transaction that allows the transaction to be fully traced.

35/ The originating institution must verify the accuracy of the information about the person initiating the transfer before sending the transfer through official documents and data, and must ensure that the transfer form includes all the data referred to in paragraph 34 above.

36/ For transfers sent by a single originator in a single batch for the benefit of several beneficiaries, the batch must include all the data referred to in paragraph 34 so that each transfer can be fully traced individually in the receiving country, and the originating institution must include the originator's account number or their unique reference number in the event that they do not have an account number, subject to the following:

a. The institution must be able to provide the receiving institution or the competent authorities with the required information in full within three working days from the date of receipt of the request for information.

b. The institution must immediately respond to any order issued by the competent law enforcement authorities to access this information.

c. The institution must ensure that unusual or high-risk transfers are not included in a single batch in cases that would increase the risks of money laundering, terrorist financing, and proliferation financing.

37/ The institution must retain all the data referred to in paragraph 34 and the related information and documents.

CENTRAL BANK OF SUDAN
Banking Regulation & Development Department
Central Bank of Sudan
General Directorate for the Regulation and Development of the Banking System

38/ The institution must not execute any electronic transfer for which the requirements stipulated in paragraphs 34-37 above have not been fulfilled.

Obligations of the Receiving Institution:

39/ The receiving institution shall take reasonable measures to identify any deficiency in the electronic transfer data of the originator or the beneficiary referred to in paragraph 34 above, and may include monitoring measures to be implemented or follow-up measures during implementation where possible.

40/ In the event that the identity of the beneficiary is not verified by the originating institution when sending it, the receiving institution must identify and verify it and retain the data, information and documents related to it in accordance with the record retention rules set out in Section Seven of this Circular.

41/ The receiving institution shall adopt an effective policy and procedures based on a risk-based approach, relying on a risk assessment, for dealing with transfers where the data referred to in paragraph 34 above is incomplete, and determining when to execute, reject, or report the transfer that lacks this data. These procedures include requesting the missing information from the originating financial institutions, and in the event it is not provided, the institution shall take action based on a risk assessment, including rejecting the transfer, notifying the Unit thereof, and applying appropriate follow-up measures.

Obligations of the Intermediary Institution:

42/ If an intermediary institution participates in the execution of a transfer without being its originator or recipient, it must ensure that all data contained in paragraph 34 above accompanies it.

43/ If the institution is unable to keep the information attached to the transfer for technical reasons, it must retain all the information as it received it for at least five years, regardless of whether this information is complete or incomplete, and be able to provide this information to the receiving financial institutions within one working day of the date of its request.

44/ The intermediary institution shall take reasonable measures to identify electronic transfers that do not meet the required data regarding the originator of the transfer and the beneficiary, and shall adopt risk-level-based policies and procedures to determine the following:

Halting the execution of an electronic transfer that lacks the necessary information, or rejecting or suspending it.

CENTRAL BANK OF SUDAN
بنك السودان المركزي
Banking Regulation & Development Department
General Directorate of Regulation and Development of the Banking Sector

b. Determining the necessary follow-up procedures.

Other Obligations:

45/ Any institution engaged in money transfer services shall maintain an updated list of its agents and make it available to inspection teams upon request.

46/ The institution shall immediately terminate correspondent relationships with any blocked institution that does not comply with what is stated in this Circular regarding financial transfers.

New Technologies:

47/ The institution shall identify, understand, and take appropriate measures to manage and mitigate the risks of money laundering, terrorist financing, and proliferation financing that may arise as a result of the following:

The development of new products or services and professional practices, including new means of providing services.

The use of new or developing technologies in relation to both new and existing products.

When providing payment services via mobile phone, the institution shall, at a minimum, apply the following requirements and procedures:

Ensuring the acquisition of information regarding the transfers covered by this Circular when using this service for money transfers.

Ensuring the possibility of suspending the service in case of misuse, including this condition in the terms of the contract for providing the service.

Continuous monitoring of operations and generating exception reports for any unusual operations carried out using this service.

Setting reasonable limits for funding the accounts used in this service, as well as for the value of the operations that can be performed using the service.

Seventh: Retention of Records and Documents:

48/ The institution must retain records, data, and evidence supporting the business relationship, banking operations, due diligence procedures, and the results of examining unusual operations, such that they include original supporting documents or copies thereof acceptable to courts in accordance with the legislation in force in Sudan, and these records must be sufficient to allow the reconstruction

CENTRAL BANK OF SUDAN
Banking Regulation & Development Department
Central Bank of Sudan
General Administration for Regulation and Development of the Banking System

of individual operations (including the amounts and types of currencies used, if any), and that these records and information be made available to the competent authorities with appropriate speed. The records and data include the following:

All records and data obtained through taking due diligence measures in verifying customers, including documents proving the identities of customers and beneficial owners, accounting files, and business correspondence, for a period of at least five years after the end of the business relationship or the date of execution of the transaction for an occasional transaction, whichever is longer.

Records and data related to domestic and international transactions, whether actually executed or attempted to be executed, for a period of not less than five years from the date of execution of the transaction or the attempt to execute it. Provided that these records are detailed and accurate to the extent that allows the possibility of tracing and detailing each transaction independently.

Records and data related to notifications submitted to the Unit and related documents for a period of at least five years after the date of notification to the Unit, and those related to a criminal case until it is decided, even if it exceeds the legally specified period.

Records of unusual operations for which a decision was made to retain them, for a period of five years.

Records related to risk assessment and any information associated with it for a period of five years from the date of their execution or update.

Documented records of all training programs on combating money laundering, terrorism financing, and proliferation financing that took place during a period of not less than the past five years, such that these records include the names of trainees, their qualifications, and the entity that trained them, whether domestically or abroad.

Ninth: Notification of suspicious operations:

49/ The institution must immediately notify the Unit of any transaction or attempted transaction whenever it suspects or has reasonable grounds to suspect that it is related to the proceeds of a crime or related to money laundering or terrorism financing; regardless of its value.

50/ The compliance manager and his deputy at the institution are the ones competent to notify and report suspicion cases to the Unit and provide it with data and information pursuant to Article (6) of the Law in accordance with the reporting form prepared by the Unit for this purpose.

51/ If any of the institution's employees suspects that any operation is related to the proceeds of a crime, money laundering, terrorism financing, or proliferation financing, he must inform the compliance manager of that, provided that all data and copies of documents related to that operation are attached.

52/ The institution must adopt internal procedures, systems, and specific and binding instructions for notifying the compliance department, and circulate them to all employees of the institution, while specifying clear and safe reporting mechanisms to ensure the speed and accuracy of reporting and the protection of reporters, and evaluate their effectiveness periodically and update them when necessary.

CENTRAL BANK OF SUDAN
Banking Regulation & Development Department
Central Bank of Sudan
General Administration for Regulation and Development of the Banking System

53/ The institution must adopt mechanisms and means that ensure the speed and effectiveness of examining unusual operations reports and making decisions regarding them in a timely manner.

54/ When a decision is made to retain the case and not notify the Unit, the institution must document the reasons and justifications for retention separately and adequately, while specifying the levels of review and approval.

55/ The compliance manager and his deputy shall provide the Unit with data and facilitate its access to records and information for the purpose of carrying out its tasks.

56/ The institution must immediately provide the Unit with any data or information that becomes available or is obtained later, which is related to suspicion cases that were previously reported.

57/ The institution must study and review the reported suspicion cases, the cases for which a decision was made to retain them, and the reverse execution operations received from the Unit, and benefit from the results of the study in the process of setting and updating suspicion indicators, and the processes of updating data and files for classifying the risks of customers and transactions.

58/ The institution, its managers, and employees are prohibited from disclosing to any person, directly or indirectly, by any means, that there is a notification that has been or will be submitted to the Unit under the notification obligations, or any information related to the Unit or to any investigation into money laundering, terrorism financing, or proliferation financing. Exempted from this prohibition is disclosure or communication between the institution's managers and employees towards lawyers, authorities, competent bodies, and the public prosecution regarding these operations.

59/ Civil, criminal, and administrative liability is negated for any institution, its managers, or employees for breaching any prohibition on disclosing information imposed by contract or law in the case of carrying out in good faith the duty to notify the Unit of any suspicious transaction, or providing information or data about it.

Tenth: Internal control system:

60/ The institution must establish and apply an internal system in accordance with the risk-based approach, commensurate with the size of the institution's activity and the risks of money laundering, terrorism financing, and proliferation financing to which it is exposed, provided that it includes policies, procedures, internal controls, compliance, training, appointment, and the tasks of internal and external audit, and financial groups must establish and apply internal policies and procedures at the group level, provided that they include mechanisms for exchanging information and maintaining its confidentiality.

The internal system for combating money laundering, terrorism financing, and proliferation financing must include at a minimum the following:

CENTRAL BANK OF SUDAN
Banking Regulation & Development Department
Central Bank of Sudan
General Administration for Regulation and Development of the Banking System

a. Clear internal policy, procedures, and controls for combating money laundering, terrorism financing, and proliferation financing, approved by the board of directors or the regional director for branches of foreign institutions, with continuous updating, and addressing at a minimum the following:

1 - 1 Risk assessment at the institution level and determining its management system.

2 - 1 Assessing customer risks, classifying them, and determining a risk profile for each customer.

3 - 1 Criteria and mechanisms for assessing and determining the risks of customers, geographic areas, products and services, and service delivery channels.

4 - 1 Accepting customers and terminating the business relationship.

5 - 1 Due diligence procedures and controls for postponing them and circumstances for tightening them.

6 - 1 Mechanisms for applying targeted financial sanctions.

7 - 1 Mechanisms for monitoring operations and business relationships.

8 - 1 Measures and procedures relating to politically exposed persons, correspondent banking relationships, and electronic transfers.

9 - 1 Retention, updating, and electronic archiving of documents and records.

10 - 1 Procedures for reporting suspicious cases and controls prohibiting disclosure and ensuring confidentiality of information.

11 - 1 Internal review mechanism and administrative controls.

12 - 1 Application of policies, procedures, controls, and monitoring at the level of branches, subsidiaries, and the group.

13 - 1 Responding to requests from supervisory authorities, other authorities, and the Unit.

B. Appointing a Compliance Officer and his deputy in an independent senior administrative position, working under the supervision of the Board of Directors, both of whom must possess appropriate academic qualifications and practical experience, and obtaining the approval of the Central Bank of Sudan before the transfer or dismissal of either of them, and they shall have the following responsibilities and powers:

Access to records and data necessary to carry out examination work and review the systems and procedures established by the institution to combat money laundering, terrorism financing, and proliferation financing.

CENTRAL BANK OF SUDAN
Central Bank of Sudan
Banking Regulation & Development Department
General Administration for Regulation and Development of the Banking System

(b - 2) The Compliance Officer shall exercise his powers independently and shall be accountable to the Board of Directors for the purpose of verifying the extent to which the anti-money laundering and terrorism financing system is applied in the institution.

(b - 3) Receiving information and reports on unusual or suspicious transactions to examine them and take the appropriate decision regarding reporting them to the Unit or retaining them, provided that the retention decision is justified.

C. Specialized technical systems for monitoring transactions, and the application of targeted financial sanctions.

D. Establishing continuous training plans and programs for employees, members of the Board of Directors, members of executive and supervisory management, and trainers in the field of combating money laundering, terrorism financing, and proliferation financing, in cooperation with the Compliance Officer, taking care that these programs include methods of money laundering, terrorism financing, and proliferation financing and how to detect and report them, and developments in terms of risks, their assessment and treatment, and how to deal with suspicious customers.

E. The internal review conducting an examination of the internal control and oversight systems to verify their effectiveness, and verifying the implementation by employees and the Compliance Officer of their responsibilities, and the extent of adherence to the policies and procedures for combating money laundering, terrorism financing, and proliferation financing, and including the results of that in its report submitted to management.

F. The existence of an external review mechanism whose task is to verify the application of this circular and the adequacy of the policies and procedures related thereto, and to include the results of that in its report submitted to management.

G. The existence of precise examination and investigation procedures to ensure the availability of high standards of competence and integrity in selecting applicants when appointing new employees, provided that these procedures include checking the criminal record and any other information useful to ensure the absence of breach of trust or fraud.

Eleven: Targeted Financial Sanctions:

61/ The institution must implement its obligations contained in Council of Ministers Resolutions No. 358/359 of the year 2014 concerning the implementation of United Nations Security Council resolutions, under Chapter VII of the Charter of the United Nations, and subsequent resolutions related to combating terrorism and its financing, and related to preventing the proliferation of weapons of mass destruction and its financing. To ensure the application of targeted financial sanctions, the institution must do the following:

A. Adopt specialized technical systems capable of real-time matching with sanctions lists and detecting and alerting to any name match, and adopt examination mechanisms and means commensurate with the nature of the institution's activity, the volume of its operations, and the level of risks it is exposed to, and verify the effectiveness of the systems periodically.

CENTRAL BANK OF SUDAN
Banking Regulation & Development Department
Central Bank of Sudan
General Administration for Regulation and Development of the Banking System

B. Examining the names and information of customers, transactions, beneficial owners, managers, persons authorized to manage accounts, and other related parties, based on the latest resolutions issued by the United Nations Security Council and the sanctions lists issued by the Technical Committee, and the results of the examination and audit and the measures taken regarding them must be documented.

C. Immediately and without delay or prior notice freezing any funds related to, owned by, controlled by, managed by, or possessed in whole or in part, directly or indirectly, by any listed person, provided that the freezing also includes the funds of any person acting for the benefit of, or under the direction of, or acting on behalf of, or owned or controlled by the listed person.

D. Refraining from making available any funds, or any form of financial services, or other services, directly or indirectly, to any listed person or any person acting for his benefit, or at his direction, or acting on his behalf, or controlled or owned by him.

E. The freezing procedures shall include entities owned by any listed person, or subject to his control individually or collectively, or managed by him directly or indirectly.

F. Notifying the Technical Committee immediately after implementing the freezing procedures, and providing it with information on the frozen funds, their nature, value, and status, the freezing procedures taken, and any other information requested by the Committee through the means of communication it determines.

G. Informing the Unit immediately upon the institution's knowledge or suspicion that its customer or any former customer or any other person who dealt with it has been listed, or is acting on behalf of a listed person or entity.

H. Informing the Unit immediately when any person attempts to conduct a transaction related to frozen funds and financial resources.

I. The institution is prohibited from alerting or notifying the listed person or entity of the freezing of funds and financial resources at any time before the freezing.

J. Information obtained must be used only for the purposes for which it was requested, and providing this information to the Technical Committee or the Unit shall not be considered a breach of any restrictions imposed by law.

Final Provisions:

62/ The external auditor of the institution must inform the Central Bank of Sudan immediately upon discovering any violation of this circular.

63/ Anyone who violates this circular shall be subject to the Administrative and Financial Penalties Regulations as well as the penalties prescribed under the provisions of Articles 38 and 41 of the Law.

CENTRAL BANK OF SUDAN
Central Bank of Sudan
CBOS
Banking Regulation & Development Department
General Administration for Regulation and Development of the Banking System

This circular shall be effective from its date.

S/ Central Bank of Sudan

Yasser Abdelrahman Elias
Dr. Al-Fatih Al-Nour Al-Hassan

Financial Institutions Administration
General Administration for Regulation and Development of the Banking System