Consultation Paper No. 1 of 2019 – Proposed Revisions to the Anti-Money Laundering Regime in ADGM — FSRA — AE

CONSULTATION PAPER
NO. 1 OF 2019
11 FEBRUARY 2019
PROPOSED REVISIONS TO THE ANTIMONEY LAUNDERING REGIME IN ADGM

TABLE OF CONTENTS
INTRODUCTION................................................................................................................ 3
BACKGROUND.................................................................................................................. 5
AML REGIME – PROPOSED AMENDMENTS........................................................................ 8
FINALISATION OF FEDERAL AML LEGISLATION AND ENACTMENT IN ADGM..................... 16
PROPOSED LEGISLATIVE AND REGULATORY AMENDMENTS............................................ 17
RECOMMENDATION....................................................................................................... 17
ANNEXURE A:PROPOSED AMENDMENTS TO FSMR......................................................... 18
APPENDIX 1: PROPOSED AMENDMENTS TO THE AML RULEBOOK .................................. 19
APPENDIX 2: PROPOSED AMENDMENTS TO GLO ........................................................... 20

INTRODUCTION
WHY ARE WE ISSUING THIS PAPER?

The Financial Services Regulatory Authority (the “FSRA“) of Abu Dhabi
Global Market (“ADGM“) has issued this consultation paper to invite public feedback and comments on its proposals to revise the regime in ADGM for combatting money laundering, the financing of terrorism and proliferation, and the financing of unlawful organisations (the “AML regime”).
The proposed revisions to the AML regime have been formulated in the
context of a recent review of the federal criminal laws of the United Arab Emirates (“UAE”) in relation to money laundering and terrorist financing 1 (the “Federal AML Legislation”), and the forthcoming “mutual evaluation” by the Financial Action Task Force (the “FATF”) of the compliance of the UAE with its recommendations of in this area, scheduled for the middle of 2019.
The FSRA would now like to invite comments on the proposed
amendments to the legislative and regulatory framework that supports the AML regime in ADGM.
Unless otherwise defined, capitalised terms used in this paper have the
meanings attributed to such terms as contained in the Financial Services and Markets Regulations 2015 (“FSMR”) and/or the Glossary (“GLO”). WHO SHOULD READ THIS PAPER?
This Consultation Paper should be of particular interest to all entities
incorporated in ADGM, most especially those operating in the financial sector, but also including those in the non-financial sector that fall within the scope of the AML regime. The latter would include those entities

1 ADGM is subject to the federal UAE criminal laws in relation to money laundering and terrorist financing, which currently comprise (i) Federal Decree by Law No. 20 of 2018 (which, from 23 September 2018, replaced Federal Law No. 4 of 2002), (ii) Federal Law No. 7 of 2014, and (iii) related secondary regulations made under those laws including Cabinet Resolution No. 38 of 2014.

registered to provide certain professional services, alongside dealers in high-value goods and non-profit organisations. HOW TO PROVIDE COMMENTS
6. All comments should be in writing and sent to the address or email
specified below. If sending your comments by email, please use the Consultation Paper number in the subject line. If relevant, please identify the organisation you represent when providing your comments.
7. The FSRA reserves the right to publish, including on its website, any
comments you provide, unless you expressly request otherwise at the time of making any comments. Comments supported by reasoning and evidence will be given more weight by the FSRA. WHAT HAPPENS NEXT?
8. The deadline for providing comments on the proposed framework is
12 March 2019. Once we receive your comments, we will consider whether any modifications are required to the proposed amendments to the legislative and regulatory framework in ADGM. The Board and the FSRA will then proceed to enact the proposed framework.
9. You should not act on these proposals until the final regulations, rules and
guidance are issued by the FSRA. We will issue a notice on our website when this happens. COMMENTS TO BE ADDRESSED TO:
Consultation Paper No. 1 of 2019
Financial Services Regulatory Authority
Abu Dhabi Global Market Square
Al Maryah Island
PO Box 111999
Abu Dhabi, UAE
Email: consultation@adgm.com

BACKGROUND

ADGM currently has a robust regime in place for the prevention of money
laundering, the financing of terrorism and proliferation, and the financing of unlawful organisations (collectively termed “money laundering” in the remainder of this consultation paper). This regime is underpinned by legislative measures embedded in FSMR and more detailed requirements in the Anti-Money Laundering and Sanctions Rules and Guidance Rulebook (the “AML Rulebook”) for those entities authorised to undertake financial services in ADGM, plus some other entities that provide services that might pose a risk of being used for money laundering.
ADGM contributes to the efforts of the UAE as a whole in combatting money
laundering and, in the light of the recent revisions to the Federal AML Legislation, believes that it is necessary to update its AML regime. Through its membership of the Gulf Cooperation Council the UAE has committed itself to implementing the anti-money laundering (“AML”) and counter-terrorist financing measures agreed by FATF members, the “FATF Recommendations” (“FATF Recommendations”) 2 . Enhancing observance of and compliance with those recommendations is a further consideration for ADGM, although the existing AML regime already reflects them very closely.
There is therefore an opportunity at this time for the FSRA to update the AML
regime with an eye on ensuring continued alignment with the revised Federal AML Legislation and the current suite of FATF Recommendations. Scope
Before considering the proposals in detail, an important consideration is the
scope of the AML regime in terms of those entities that would be subject to it. The scopes of both the revised AML Federal Legislation and the FATF Recommendations encompass both “financial institutions and designated

2 The “International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation – The FATF Recommendations” (http://www.fatf-gafi.org/publications/fatfrecommendations/documents/internationalstandardsoncombatingmoneylaunderingandthef inancingofterrorismproliferation-thefatfrecommendations.html, February 2012, updated October 2018)

non-financial businesses and professions”, the latter group being termed “DNFBPs”. The AML Rulebook does not currently use this term, but the members of that group are captured within its scope, so it is proposed that thisspecific designation be introduced. Moreover, it is also proposed that the scope of the AML Rulebook be extended to also capture Non-Profit Organisations (“NPOs”), see section G below.
5. The three distinct groups of entities – financial institutions, DNFBPs and NPOs
constitute the “Relevant Persons” that the AML Rulebook applies to. These groups may be supplemented by other entities that are deemed to be Relevant Persons by the FSRA where it believes they may pose a moneylaundering risk, but that do not fall within the earlier categories. Proposed areas of change
6. The main amendments proposed to the Regulations and rules are detailed in
the next section, under the following headings, with references to any related FATF Recommendations.
Section Revised FSMR/AML
Rulebook
A. Clarification of the status of the FSRA as the “Supervisory Authority” for ADGM FSMR 256A(3) B. Beneficial Ownership AML 3.2.1, and
8.3.3 to 8.3.6
C.
Designated NonFinancial Businesses and Professions

definition AML 3.2.1
registration and supervision as
Relevant Persons
AML 15
D. Risk assessments –
Business and Customer
business AML 6.1
customer AML 7
triggers AML 8.1.1

Section Revised FSMR/AML
Rulebook
E.
Customer Due
Diligence

simplified CDD AML 8.5
source of funds and source of
wealth
AML 8.3.1
F. Reporting obligations
AML 4.6.1 and
AML 12.4
G. Registration and supervision of Non-Profit Organisations AML 16

Additionally, there are a number of proposals for less significant
amendments to the AML Rulebook in the following areas that are not discussed separately in this Consultation Paper, but of which readers should be aware.  In the existing Chapter 9, when a Relevant Person outsources its Customer Due Diligence (“CDD”) to a third party it must undertake an assessment of the “equivalence” to the FATF Regulations of any overseas jurisdiction in which that third party operates. It is proposed to specify some factors explicitly, in the form of a rule, that must be considered when arriving at this determination of equivalence (or not) in order to provide clarity to Relevant Persons on what factors the FSRA considers to be acceptable when making that determination.  It is also proposed to provide further clarity in the existing Chapter 11, where further detail would be provided on the measures that would have to be considered when a Relevant Person is ensuring its compliance with sanctions and other obligations in that area.  The “General Obligations” that are currently contained in Chapter 15 of the AML Rulebook would be merged with the existing Chapter 4, “General Compliance Requirements”.

 The proposal is made to set out the existing, overarching obligations on firms to conduct CDD and keep related records (FATF Recommendation 11) in both legislation, via FSMR, and rules, where those obligations currently exist only in the latter.  It is being proposed that all existing requirements for records relating to AML practices to be kept for a period of ten years would be reduced to six years as this would be consistent with the other record-keeping obligations for entities subject to FSRA requirements. AML REGIME – PROPOSED AMENDMENTS
8. The main amendments proposed would update FSMR and the AML Rulebook
to better reflect the requirements of the Federal AML Legislation and the FATF Recommendations, with minor, related consequential amendments proposed as appropriate. A brief glossary has also been added to the AML Rulebook to aid Relevant Persons and others as it has been recognised that there are a material number of terms specific to this area of the regulatory framework. A. Clarification of the status of the FSRA as the “Supervisory Authority” for ADGM
9. The Federal AML Legislation requires “Supervisory Authorities” to ensure
that all entities that might potentially be used for money laundering are aware of their obligations under that legislation and to perform appropriate and adequate supervision of those entities. The authorities in the UAE that are responsible for prohibiting and countering money laundering consider the FSRA as fulfilling this responsibility for ADGM, although it has not been formally designated as such. 10.The FSRA also considers itself to be the Supervisory Authority in ADGM for the purposes of the application of the Federal AML Legislation there, based on the powers given to it under subsection 7(6) of FSMR, which allow it to make rules applying to any person in relation to money laundering and terrorist financing. Accordingly, the FSRA has administered the AML regime arising from the Federal AML Legislation through making regulations and

rules that prohibit money laundering in ADGM and supervising the compliance of relevant entities with the AML Rulebook that was implemented in 2015. 11.We propose, therefore, that FSMR be amended by adding appropriate provisions that explicitly set out the anti-money laundering powers of the FSRA and formally articulate the role and jurisdiction of the FSRA as the Supervisory Authority, under the Federal AML Legislation, for ADGM. Identification of the FSRA as such will also provide a clearer link to its obligations under the FATF Recommendations. PROPOSAL 1 CLARIFY THE STATUS OF THE FSRA AS THE “SUPERVISORY AUTHORITY” FOR ADGM FOR THE PURPOSES OF ADMINISTERING THE FEDERAL AML LEGISLATION. B. Beneficial Ownership 12.The Federal AML Legislation has been revised to require financial institutions and other, relevant entities to identify the ultimate beneficiaries of commercial activities they undertake on behalf of clients. Alongside this, FATF Recommendation 10 requires financial institutions, amongst other things, to identify the beneficial owner and take reasonable measures to verify the identity of the “Beneficial Owner”. Similarly, FATF Recommendation 22 (DNFBPs) provides that the CDD requirements in FATF Recommendation 10 must also apply to DNFBPs in certain circumstances, with the obligation to identify the Beneficial Owner. 13.The AML Rulebook does currently use a definition of Beneficial Owner in respect of the identification and verification of beneficial ownership that is consistent with FATF Recommendations 10 and 22. However, the Registration Authority (the “RA”) in ADGM has recently enacted the Beneficial Ownership and Control Regulations 2018 3 , which set out detailed provisions for:

3 http://adgm.complinet.com/en/display/display_main.html?rbid=4503&element_id=19354

 the reporting of beneficial ownership information for legal entities operating in ADGM; and  the maintenance of a registry of beneficial ownership information for all legal entities undertaking commercial activities in ADGM, which will allow more systematic identification of Beneficial Owners. 14.As part of those Regulations, the RA hasintroduced a new, detailed definition of beneficial ownership of an entity, termed “Ultimate Beneficial Ownership”. This is based on either “control” or, newly introduced, a meaningful degree of ownership of that entity, where the latter applies to categories of entities where “ownership” is relevant and more than 25% of the shares or voting rights are held directly or indirectly. The result is that the characteristics of what constitutes Beneficial Ownership are different across the following categories of entities: (i) companies, limited liability partnerships or partnerships; (ii) trusts; and (iii) foundations or similar arrangements. 15.The FSRA proposes to update the definition of Beneficial Owner contained in GLO so that it is consistent with the new definition currently used by the RA. In tandem with this, the current AML Rulebook provides guidance to Relevant Persons in respect of the identification of Beneficial Ownership of different types of legal entities; it is now proposed that this be codified in Rules, thereby ensuring further consistency with the Beneficial Ownership and Control Regulations 2018. 16.Adoption of these proposals would ensure that the definition to be used by the FSRA would be consistent with those used by the RA and the FATF, whilst affording the FSRA greater flexibility in the identification of Beneficial Owners. PROPOSAL 2 AMEND THE DEFINITION OF “BENEFICIAL OWNER” TO BRING IT INTO LINE WITH THE NEW DEFINITION OF “ULTIMATE BENEFICIAL OWNER” CONTAINED IN THE REGULATIONS TO BE ISSUED BY THE RA AND CODIFY CDD REQUIREMENTS FOR THE IDENTIFICATION AND VERIFICATION OF BENEFICIAL OWNERSHIP BY RELEVANT PERSONS IN CHAPTER 8 OF THE AML RULEBOOK.

C. Designated Non-Financial Businesses and Professions
Definition
17.The term “Designated Non-Financial Businesses and Professions”, and similarly “DNFBPs”, covers any business or profession that poses a money laundering risk, but that cannot be classified as a financial institution, such as real estate agencies, dealers in precious metals and precious stones, notaries, legal and tax advisers and other accounting professions. The AML Rulebook does not currently use the term when specifying the scope of Relevant Persons: it does, however, identify particular classes of persons that align with the classes that comprise DNFBPs in the FATF Recommendations. 18.Explicitly adopting the term “DNFBPs” in the AML Rulebook would therefore bring it into line with the use of the term in the revised Federal AML Legislation and the FATF Recommendations. We are also proposing that this opportunity be taken to clarify that providers of “taxation services” should also fall within the definition of DNFBPs. PROPOSAL 3 USE THE TERM “DESIGNATED NON-FINANCIAL BUSINESSES AND PROFESSIONS” EXPLICITLY TO INCLUDE PROVIDERS, WHERE THEY ARE NOT FINANCIAL INSTITUTIONS, OF CERTAIN SERVICES. Registration and supervision as Relevant Persons 19.FATF Recommendation 28 states that all DNFBPs should be subject to appropriate regulatory and supervisory measures that are comparable to those for financial institutions, which include having an effective system for monitoring and ensuring their compliance with AML requirements. 20.The FSRA does not currently register DNFBPs nor considers the fitness and propriety of their controllers and management. Instead, the current process involves the RA issuing a commercial license to a DNFBP, with the FSRA reviewing:
 the experience and qualifications of any proposed Money Laundering Reporting Officer (“MLRO”), but not their fitness and propriety; and

 the policies and processes of the DNFBP.
21.The FSRA believes that the current approach does not meet the level of regulatory and supervisory scrutiny expected of DNFBPs under FATF Recommendation 28. In order to put DNFBPs on the same footing as financial institutions in that area, the FSRA believes that it should be given enhanced powers to register them, and thereafter to scrutinise and hold DNFBPs to account in order to reduce any money-laundering threat to ADGM from their activities. These detailed powers would include the ability to exclude a person from owning or controlling a DNFBP if they are not fit and proper, as well as the power to suspend or withdraw the registration of an existing DNFBP in ADGM, for the same reasons. 22.Under the proposed new registration and supervision regime for DNFBPs the FSRA would work closely with the RA to ensure that the registration and supervision processes used by the FSRA are effected in a proportionate and efficient manner. Adopting this proposal would also further enhance the cross-authority nature of the AML regime that exists in ADGM. PROPOSAL 4 GIVE THE FSRA THE POWER TO REGISTER AND SUPERVISE DNFBPs AND, IF APPORPRIATE, SUSPEND OR WITHDRAW THEIR COMMERCIAL LICENSES, WITH THE OPTION OF DELEGATING ITS AUTHORITY TO THE RA TO UNDERTAKE THOSE ACTIONS. D. Risk assessments Business 23.There is an existing requirement in the AML Rulebook for a Relevant Person to undertake a risk assessment of the money laundering risks to which its business is exposed, with that assessment being proportionate to the nature, size and complexity of the business of the Relevant Person. The business risk assessment should take into account various factors such as the types of customer the Relevant Person is dealing with, its locations, products offered and their complexity, and it should also be forward-looking, i.e. reflect potential new business lines, products and customers.

24.It is proposed that the forward-looking aspect of the business risk assessment should be further emphasised as venturing into new areas may very well pose a more significant threat to a Relevant Person, given likely unfamiliarity with the potential for money laundering to take place. Customer 25.It is also proposed that the requirements for customer risk assessments, which consider relevant risk factors that might see a customer deemed to pose a higher or a lower risk of money laundering, are specified in the AML Rulebook: currently they are in the form of guidance. PROPOSAL 5 (i) FOR BUSINESS RISK ASSESSMENTS, INCORPORATE A SPECIFIC REQUIREMENT FOR RELEVANT PERSONS TO UNDERTAKE THEM WHENEVER A NEW BUSINESS LINE IS LAUNCHED OR A NEW TECHNOLOGY ADOPTED AND MITIGATE ANY IDENTIFIED RISKS, AND (ii) FOR CUSTOMER RISK ASSESSMENTS, CHANGE CONSIDERATION OF THE RISK FACTORS TO BE ASSESSED FROM GUIDANCE TO BE A REQUIREMENT IN THE FORM OF RULES. E. Customer Due Diligence Triggers 26.The existing requirement in the AML Rulebook to undertake CDD makes no distinction between that required of financial institutions and DNFBPs, which does not reflect the primarily relationship-based business model of the former group and the transactional business model of the latter group. The proposal is that appropriate triggers to undertake CDD, differentiated across the two groups of Relevant Persons, are included. This would better align the CDD requirements in the AML Rulebook with the FATF Recommendations in this area and to ensure that each of those groups of Relevant Persons would have clear and relevant CDD requirements. PROPOSAL 6 DIFFERENTIATE THE CRITERIA FOR FINANCIAL INSTITUTIONS AND DNFBPs THAT TRIGGER THE REQUIREMENT TO UNDERTAKE CDD.

Simplified CDD
27.The current requirements in the AML Rulebook for customer risk assessment require all Relevant Persons to undertake CDD for each customer. “Standard” CDD is the starting point for all customers, and “enhanced” CDD measures supplement this for customers assessed to exhibit a high risk of potential money laundering; however, “simplified” CDD is not based on the customer risk assessment and it may be undertaken for customers falling into certain specified categories of entities and it represents a less stringent set of CDD requirements. 28.In order to make the CDD requirements in the AML Rulebook consistent with those in the FATF Recommendations it is proposed that the specification of categories of entities eligible for simplified CDD is removed. Instead simplified CDD would be performed for those entities assessed as being low risk for money laundering. PROPOSAL 7 ALLOW SIMPLIFIED CDD ONLY FOR LOW-RISK CUSTOMERS, RATHER THAN FOR CERTAIN CUSTOMER CATEGORIES. Source of funds and source of wealth 29.FATF Recommendation 10 imposes standard CDD obligations on financial institutions and FATF Recommendation 22 similarly places the same obligation on DNFPBs. Financial institutions and DNFBPs must undertake this CDD when establishing business relations, carrying out certain transactions, having any suspicions about money-laundering or the veracity of customer data. 30.The interpretive note to FATF Recommendation 1 (Assessing Risks and Applying a Risk-Based Approach) also indicates where enhanced CDD should be undertaken, i.e. for customers believed to pose a high risk of money laundering. In those cases, it is appropriate to determine both the source of

funds and the source of wealth of the customer 4 , but this is not a requirement under standard CDD for the FATF Recommendations. The AML Rulebook, however, is currently super-equivalent to the FATF Recommendations in requiring that additional information for standard CDD. 31.We are proposing that this additional requirement be removed, which would align the requirement for standard CDD more closely with the FATF Recommendations. PROPOSAL 8 REMOVE THE EXISTING REQUIREMENT UNDER STANDARD CDD OBLIGATIONS TO IDENTIFY CUSTOMERS’ SOURCE OF FUNDS AND OF WEALTH, IN ORDER TO BRING CDD REQUIREMENTS UNDER THE AML RULEBOOK IN LINE WITH FATF RECOMMENDATIONS. F. Reporting obligations 32.The Federal AML Legislation requires an independent controller or Money Laundering Reporting Officer (“MLRO”) for each financial institution “to prepare biannual reports for internal use and provide a copy to the Central Bank. The AML Rulebook requires Authorised Persons, Recognised Bodies and auditors to complete an annual “AML Return” and retain it, for inspection by the FSRA at the request of the latter. 33.We are proposing that submission of the annual AML Return by Relevant Persons to the FSRA is made mandatory, as that would provide the FSRA with consistent, industry-wide information relevant for monitoring risks associated with money laundering. PROPOSAL 9 REQUIRE RELEVANT PERSONS TO SUBMIT THE ANNUAL AML RETURN TO THE FSRA ON AN ANNUAL BASIS.

4 The “source of funds” of a customer is defined in GLO as “the origin of Customer's funds which relate to a Transaction or service and includes how such funds are connected to a Customer's Source of Wealth”. The “source of wealth” of a customer is defined there as “how the Customer's global wealth or net worth is or was acquired or accumulated”.

G. Registration and supervision of Non-Profit Organisations 34.FATF Recommendation 8 requires focussed and proportionate measures to be applied to NPOs to protect them from potentially being used for terrorist financing. The interpretive note for FATF Recommendation 8 makes clear that the recommendation is mainly focussed on charitable organisations, which is relevant to NPOsin the wider UAE outside ADGM, whereas the NPOs registered in ADGM are not charitable organisations. 35.In order to ensure consistency with the FATF Recommendation, the proposal is to include NPOs, which in ADGM are non-charitable in nature, within the definition of a Relevant Person and detail the associated AML requirements via a new chapter in the AML Rulebook. These requirements would include that NPOs establish and maintain appropriate controls over the funds they receive and disburse, and additionally confirm the identity and goodstanding of their beneficiaries, but they would not be subject to any other requirements in AML, including the need to perform CDD. PROPOSAL 10 INCLUDE NPOs WITHIN THE DEFINITION OF RELEVANT PERSONS AND ESTABLISH PROPORTIONATE REQUIREMENTS FOR THEM TO MAINTAIN APPROPRIATE CONTROLS TO PROTECT THEIR ACTIVITIES FROM BEING USED FOR TERRORIST FINANCING. FINALISATION OF FEDERAL AML LEGISLATION AND ENACTMENT IN ADGM 36.The revisions to the AML regime proposed by the FSRA in this consultation paper are to align that regime with the revised Federal AML Legislation, where the FSRA has worked alongside the federal authorities that are responsible for reviewing and revising that legislation. The proposals are therefore aligned with the anticipated form and intention of the revised legislation. 37.The FSRA anticipates that that legislation will shortly be finalised and enacted; where there are any material changes in the final form of the legislation we shall consider how best to amend and/or supplement the proposals and present those for further public consultation.

PROPOSED LEGISLATIVE AND REGULATORY AMENDMENTS 38.The proposed framework will require amendments to FSMR, the AML Rulebook and the Glossary (“GLO”), as contained in the following:
 Annexure A: Proposed amendments to FSMR.
 Appendix 1: Proposed amendments to the AML Rulebook.
 Appendix 2: Proposed amendments to GLO.
RECOMMENDATION
39.In summary, and subject to any further developments regarding amendments to the Federal AML Legislation, we recommend accepting the proposals in this paper as they have significant benefits for ADGM and the wider UAE. Specifically in relation to ADGM the benefits are that:
(i) they will align the AML regime in ADGM more closely with the Federal AML Legislation and the FATF Recommendations, in time for the Mutual Evaluation of the UAE that is taking place in 2019; and (ii) they will strengthen the AML regime within ADGM.

ANNEXURE A: PROPOSED AMENDMENTS TO FSMR

APPENDIX 1: PROPOSED AMENDMENTS TO THE AML RULEBOOK

APPENDIX 2: PROPOSED AMENDMENTS TO GLO

Annex A - Proposed Amendments to Financial Services and Markets Regulations (FSMR)

Annex A
FINANCIAL SERVICES AND MARKETS
(AMENDMENT NO x) REGULATIONS 2019
*In this Annex, underlining indicates new text and strikethrough indicates deleted text, unless otherwise indicated.

Annex A
FINANCIAL SERVICES AND MARKETS (AMENDMENT NO X) REGULATIONS 2019 Regulations to amend the Financial Services and Markets Regulations 2015. Date of Enactment: [] The Board of Directors of the Abu Dhabi Global Market, in exercise of its powers under Article 6(1) of Law No. 4 of 2013 concerning the Abu Dhabi Global Market issued by His Highness the Ruler of the Emirate of Abu Dhabi, hereby enacts the following Regulations–

Amendments to the Financial Services and Markets Regulations 2015
Part 2 Rules and Guidance
Chapter 1 Rule-making Powers
….
Other specific rule-making powers
…..
(6) The Regulator may make Rules applying to any person (whether or not an Authorised Person, Approved Person, Recognised Body or Remote Body ) in relation to money laundering and terrorist financing, including Rules prescribing systems, duties and obligations designed to detect, defend against, and prevent money laundering and terrorist financing activities. The Regulator may make Rules in connection with the creation and implementation of anti-money laundering measures, policies and procedures, including Rules as to:
(a) the persons or classes of persons who shall be subject to any such measures, policies and procedures; (b) the nature and extent of any duty, requirement, prohibition, obligation or responsibility applicable to such persons; and (c) registration of any or all such persons with the Regulator, including the criteria that person must meet to become and remain registered by the Regulator. …..
Chapter 3 Guidance

Annex A
15. Power of the Regulator to give Guidance
(1) The Regulator may give Guidance with respect to— …..
(3) Nothing shall constitute Guidance unless it is published by the Regulator on its website.
Chapter 4 Anti-Money Laundering Powers
15A. Powers of the Regulator
(1) This chapter is made in recognition of the application in the Abu Dhabi Global Market of Federal Decree by Law No. 20 of 2018 on Anti Money Laundering, Combating the Financing of Terrorism and Financing of Illegal Organisations, Federal Law No. 7 of 2014 on Combating Terrorism Offences and any other Federal legislation relating to money laundering, terrorist financing, the financing of unlawful organisations or sanctions non-compliance. (2) A reference in these Regulations to money laundering is taken to include terrorist financing, the financing of unlawful organisations and sanctions non-compliance. (3) The Regulator:
(a) is designated as the Supervisory Authority for the Abu Dhabi Global Market, for the purposes of the Federal AML Legislation; (b) is responsible for regulation in relation to money laundering in the Abu Dhabi Global Market; and (c) has the power to supervise compliance with relevant AML laws in the State by Relevant Persons. (4) The Regulator may, by written notice, deem a person to be a Relevant Person for the purposes of this Chapter and the Rules made under these Regulations, subject to such terms and conditions as it may consider appropriate. (5) Nothing in this section 15A is intended to limit any function or power conferred on another body or authority under the Federal AML Legislation. 15B. Anti-Money Laundering Obligations of Relevant Persons (1) A Relevant Person shall comply with Federal AML Legislation as it applies to such person in the Abu Dhabi Global Market. (2) A Relevant Person shall comply with any duty, requirement, prohibition, obligation or responsibility to which that person is subject under the Rules. (3) Where the Regulator detects conduct that it suspects may relate to money laundering, it shall promptly report its suspicions to the relevant authority exercising powers and performing functions under the relevant Federal AML Legislation. (4) A Relevant Person shall conduct customer due diligence as specified in the Rules. (5) A Relevant Person shall maintain records relating to customer due diligence, transactions and anti-money laundering measures as prescribed in the Rules. ….

Annex A
Part 21 Enforcement Procedure
….
246. Requirement to give warning notices
….
(1) If the Regulator proposes to exercise any of the following powers, it must give a warning notice to any person in relation to whom the power is proposed to be exercised— (a) exercising its power under section 30(4)(a) or (b) on giving a Financial Services Permission; (b) exercising its power under section 35(1) in connection with an Application for a Financial Services Permission; (c) exercising its power under section 30(4)(a) or (b) in relation to the variation of a Financial Services Permission on the application of an Authorised Person; (d) exercising its power under section 35(1) in connection with an application for the variation of a Financial Services Permission; (e) exercising its power under section 33(2)(b) to cancel a Person's Financial Services Permission otherwise than at the Person's request; (f) refusing an application made under Part 4; (g) withdrawing approval under section 46; (h) refusing an Application for Approval or granting the Application subject to any conditions or for a limited period (or both) under section 45(2); (i) refusing an Application under section 47 or granting the Application subject to any conditions or for a limited period (or both) under section 47(1); (j) refusing an Application for Listing, or imposing conditions or restrictions in relation to such an Application, under section 52(1); (k) refusing an application by the Issuer of Financial Instruments for the Discontinuance or Suspension of the Listing of the Financial Instruments under section 55; (l) refusing an application by the Issuer of Financial Instruments for the cancellation of a Suspension of Listing under section 55(4); (m) refusing approval to a Prospectus under Rules made under section 61; (n) exercising its power under section 72(4) on its own initiative; (o) exercising the power of Direction in section 84;

Annex A
(p) refusing an application under section 72(4)(a)(ii) or imposing any conditions or restrictions in respect of a declaration made following such application; (q) exercising its powers under section 202; (r) publishing a statement under section 231; (s) imposing a financial penalty under section 232; (t) exercising its powers under section 233; (u) imposing a Prohibition Order under section 234 or refusing an application for variation or revocation of such an order made under subsection (5) of that section; (v) refusing an Application for registration of a Public Fund under section 109; (w) withdrawing the registration of a Public Fund under section 111; (x) giving a Direction under section 111(3); (xx) refusing an application for DNFBP registration under the Rules made under section 7(6)(1)(c)); or (xxx) exercising its power to suspend or withdraw the registration of a DNFPB on its own initiative under the Rules made under section 7(6)(1)(c); (y) giving a Direction under section 117; and (z) exercising its power under section 241(5). ….
Part 22 General
….
258. Definitions
(1) In these Regulations, unless the context otherwise requires – Anti-Money Laundering Legislation means- (a) Federal AML Legislation; and (b) legislation administered by the Regulator relating to money laundering, terrorist financing, the financing of unlawful organisations and non-compliance with sanctions. Designated Non-Financial Business or Profession (DNFBP) means the following class of persons whose business is carried out in the ADGM:
(a) A real estate agency, which carries out transactions with other Persons that involve the acquiring or disposing of Real Property;

Annex A
(b) A dealer in precious metals or precious stones; (c) A dealer in any saleable item of a price equal to or greater than USD15,000; (d) An accounting firm, audit firm, insolvency firm or taxation consulting firm; (e) A law firm, notary firm or other independent legal business; or (f) A company service provider that carries out any of the following services to a customer:
(i) acting as a formation agent of a
Legal Person;
(ii) acting as (or arranging for another person to act as) a director or secretary of a company, a partner of a partnership or a similar position in relation to other Legal Persons or any other legal arrangement; (iii) providing a registered office, business address or accommodation, correspondence or administrative address for a Legal Person or any other legal arrangement; (iv) acting as (or arranging for another person to act as) a trustee of an express trust or performing the equivalent function for another form of legal arrangement; or (v) acting as (or arranging for another Person to act as) a nominee shareholder for another person. Federal AML Legislation means Federal Decree by Law No. (20) of 2018 on Anti-Money Laundering, Combating the Financing of Terrorism and Financing of Illegal Organisations, Federal Law No. 7 of 2014 on Combating Terrorism Offences and any other Federal legislation relating to money laundering. Legal Person means any entity other than an individual that can establish a customer relationship with a Relevant Person or otherwise own property. This can include companies, Bodies Corporate or unincorporate, trusts, foundations, Partnerships, associations, states and governments and other relevantly similar entities.

Annex A
money laundering Means as described in section 15A(2).
Non-Profit Organisation means a legal person or arrangement or organization that primarily engages in raising or disbursing funds for purposes such as charitable, religious, cultural, educational, social or fraternal purposes or for other charitable purpose. Registrar of Companies means the ADGM Registrar of Companies. Relevant Person means – (a) for the purposes of section 209, and in relation to a person who is required to produce a Document— (i) has been or is or is proposed to be a Director or Controller of that person; (ii) has been or is an auditor of that person; (iii) has been or is an actuary, accountant or lawyer appointed or instructed by that person; or (iv) has been or is an employee of that person; and (b) for the purposes of section 237, Authorised Persons and Recognised Bodies as defined in subsection (1)(a) of that section. (c) means, for the purposes of Part 2,
Chapter 4 and the Rules made under this
Chapter:
(i) an Authorised Person other than a Credit Rating Agency; (ii) a Recognised Body; (iii) a Designated Non-Financial Business or Profession; (iv) a Non-Profit Organisation; or (v) any other person, as deemed by the Regulator to be a Relevant person for the purposes of
Chapter 4 by the Regulator under
section 7(6) of these Regulations.
Supervisory Authority means a competent authority responsible for licensing or supervising financial institutions, DNFBPs and NPOs or for ensuring their

Annex A
compliance with requirements to combat money laundering, in accordance with the Federal AML Legislation.

Annex A
2. Short title, extent and commencement
(1) These Regulations may be cited as the Financial Services and Markets (Amendment No x) Regulations 2019. (2) These Regulations shall apply in the Abu Dhabi Global Market. (3) These Regulations come into force on the date of their publication.

Appendix 1 - Draft Amendments to the AML Rulebook (AML)

Appendix 1
Anti-Money Laundering and Sanctions Rules and Guidance (AML) *In this Appendix, underlining indicates new text and strikethrough indicates deleted text, unless otherwise indicated.

Appendix 1
i
TABLE OF CONTENTS
The contents of the AML Rulebook are divided into the following Chapters and Sections:

INTRODUCTION ................................................................................................................. 1
1.1 Jurisdiction............................................................................................................ 1
1.2 Application............................................................................................................ 1
1.3 Responsibility for compliance with the AML Rulebook........................................ 3
1.4 Application table................................................................................................... 3
OVERVIEW AND PURPOSE OF THE AML RULEBOOK........................................................ 5
INTERPRETATION AND TERMINOLOGY ............................................................................ 9
3.1 Interpretation ....................................................................................................... 9
3.2 Glossary for AML................................................................................................... 9
GENERAL COMPLIANCE REQUIREMENTS ....................................................................... 18
4.1 General requirements......................................................................................... 18
4.2 Groups, Branches and subsidiaries..................................................................... 19
4.3 Group policies..................................................................................................... 20
4.4 Notifications........................................................................................................ 20
4.5 Record keeping ................................................................................................... 21
4.6 Annual AML Return............................................................................................. 23
4.24.7 Cooperation with the Rregulators...................................................................... 23
4.8 Employee disclosures.......................................................................................... 24
APPLYING A RISK-BASED APPROACH TO AML ............................................................... 25
5.1 The risk-based approach..................................................................................... 25
BUSINESS RISK ASSESSMENT .......................................................................................... 27
6.1 Assessing business AML risks.............................................................................. 27
6.2 Anti-Money LaunderingAML systems and controls............................................ 29
CUSTOMER RISK ASSESSMENT ....................................................................................... 30
7.1 Assessing customer Anti-Money Laundering risks ............................................. 36
7.2 Prohibition on Establishing Business Relationships with Certain Customers..... 41

Appendix 1
ii
8. CUSTOMER DUE DILIGENCE ............................................................................................ 43
8.1 Requirement to undertake Customer Due Diligence ......................................... 43
8.2 Timing of Customer Due Diligence ..................................................................... 48
8.3 Customer Due Diligence requirements .............................................................. 52
8.4 Enhanced Customer Due Diligence..................................................................... 70
8.5 Simplified Customer Due Diligence .................................................................... 72
8.6 On-going Customer Due Diligence...................................................................... 73
8.7 Failure to conduct or complete Customer Due Diligence................................... 74
9. RELIANCE AND OUTSOURCING OF ANTI-MONEY LAUNDERING AML COMPLIANCE.... 76
9.1 Reliance on a third party..................................................................................... 76
9.2 Business partner identification........................................................................... 79
9.3 Outsourcing......................................................................................................... 82
9.4 Record Keeping and Data Protection.................................................................. 82
9.5 A diagram outlining the reliance and outsourcing of AML compliance
requirements is contained in A1.5...................................................................... 82
10. CORRESPONDENT BANKING, WIRE TRANSFERS, ANONYMOUS ACCOUNTS AND
AUDIT............................................................................................................................... 83
10.1 Application.......................................................................................................... 83
10.2 Correspondent banking ...................................................................................... 83
10.3 Wire transfers..................................................................................................... 84
10.4 Audit.................................................................................................................... 86
10.5 Anonymous and nominee accounts ................................................................... 86
11. SANCTIONS AND OTHER INTERNATIONAL OBLIGATIONS ............................................. 87
11.1 Resolutions and Sanctions and Other International Obligations........................ 87
11.2 Government, regulatory and international findings........................................... 88
12. MONEY LAUNDERING REPORTING OFFICER .................................................................. 91
12.1 Appointment of a MLRO..................................................................................... 91
12.2 Qualities of a MLRO ............................................................................................ 92
12.3 Responsibilities of a MLRO ................................................................................. 93
12.4 Reporting ............................................................................................................ 93
13. ANTI-MONEY LAUNDERING AML TRAINING AND AWARENESS.................................... 95
13.1 Training and awareness...................................................................................... 95
13.2 Frequency ........................................................................................................... 96
13.3 Record-keeping................................................................................................... 96

Appendix 1
iii
14. SUSPICIOUS ACTIVITY REPORTS...................................................................................... 97
14.1 Application and definitions................................................................................. 97
14.2 Internal reporting requirements......................................................................... 97
14.3 External Suspicious Activity Report .................................................................... 99
14.4 Suspension of Transactions and “nNo tTipping-off” rRequirement................. 100
14.5 Record-keeping................................................................................................. 100
14.6 Freezing of assets.............................................................................................. 101
15. DNFBP Registration and supervision............................................................................ 102
15.1 DNFBP Prohibition ............................................................................................ 103
15.2 Criteria for Registration as a DNFBP ................................................................. 103
15.3 Application for Registration as a DNFBP........................................................... 103
15.4 Grant of an Application..................................................................................... 104
15.5 Refusal of an Application .................................................................................. 104
15.6 DNFBP Notifications.......................................................................................... 104
15.7 Suspension and withdrawal of DNFBP Registration ......................................... 105
15.8 Disclosure of regulatory status......................................................................... 105
15.9 Co-ordination between the Regulator and the Registrar of Companies.......... 106
16. Non-profit organisations (“NPOs”)............................................................................... 107
16.1 Responsibility for NPO compliance................................................................... 107
16.2 Record Keeping ................................................................................................. 107
16.3 Cooperation ...................................................................................................... 107
APP 1 FLOWCHARTS ....................................................................................................... 109
A1.1 Figure 1. The Risk-Based Approach ................................................................. 109
A1.2 Figure 2. Business risk-based assessment....................................................... 110
A1.3 Figure 3. Customer risk-based assessment ..................................................... 111
A1.4 Figure 4. Customer due diligence .................................................................... 111
A1.5 Figure 5. Reliance and outsourcing of AML compliance................................. 112

Appendix 1
i

INTRODUCTION
1.1 Jurisdiction
1.1.1 (1) The AML Rulebook is made in recognition of the application in Abu Dhabi Global
Market ("ADGM") of the Federal AML Legislation Law No. 4 of 2002 regarding 'Criminalisation of Money Laundering', Federal Decree Law No. 1 of 2004 regarding 'Combating Terrorism Offences', and Federal Law No. 7 of 2014 regarding 'Combating Terrorist Crimes'. (2) Nothing in the AML Rulebook affects the operation of: Federal AML Legislation. (a) Federal Law No. 4 of 2002 regarding 'Criminalisation of Money Laundering'; (b) Federal Law No. 1 of 2004 regarding 'Combating Terrorism Offences'; (c) Federal Law No. 7 of 2014 regarding 'Combating Terrorist Crimes'; (d) the Penal Code of the United Arab Emirates; or (e) any other Federal Law that is applicable in the Abu Dhabi Global Market in relation to money laundering.
1.2 Application
1.2.1 (1) Subject to (2), Tthe AML Rulebook applies to:
(a) every Relevant Person in respect of all its activities carried on, in, or from the ADGM; and (b) the Persons specified in Rule 1.3.3 as being responsible for a Relevant Person’s compliance with the AML Rulebook. except to the extent that a provision of AML provides for a narrower application. (2) For a dealer in precious metals or precious stones, or a dealer in any saleable item of a price equal to or greater than $15,000, Chapters 7 to 9 of the AML Rulebook apply only if it engages in any cash or cash-equivalent Transaction with a Customer equal to or above $15,000, whether the Transaction is executed as a single operation or in several connected operations. In respect of a Relevant Person that is:
(a) an Authorised Person (other than a Credit Rating Agency) and a Recognised Body, only the requirements of Chapters 1 to 14 of the AML Rulebook apply; (b) a Representative Office only the requirements of Chapters 1 to 6 and 11 to 14 of the AML Rulebook apply;

Appendix 1
(c) a DNFBP, only the requirements of Chapters 1 to 9 and 11 to 15 of the AML Rulebook apply; and (d) an NPO only the requirements of Chapter 16 of the AML Rulebook apply. Guidance

Chapters 7 to 9 of the AML Rulebook deal with customers. As a Representative Office
does not have customer these chapters do not apply.
Chapter 10 of the AML Rulebook deals with correspondent banking, electronic
transfer of funds and audits.
Relevant Persons should consider these Chapters and determine which provisions
apply. To assist Relevant Persons the following table sets out the application of the AML Rulebook to each of the different types of Relevant Persons specified in Rule 1.2.1(1). This table is for guidance purposes only. Application table Relevant Person Applicable Chapter(s) Authorised Person (other than a credit Rating Agency) or Recognised Body 1 - 14 Representative Office 1 - 6 11 - 14 DNFBP 1 - 9 11 - 15 NPO 16
1.2.2 For the purposes of these Rules, a Relevant Person means:
(a) an Authorised Person;
(b) a Recognised Body; or
(c) any Licensed Person who is not an Authorised Person or Recognised Body and who falls within any of the categories of business in Rule 1.2.3.
1.2.3 A Person falls within this Rule if it carries on any of the following business:
(1) A real estate developer or agency which carries out Transactions with a Customer involving the buying or selling of real property; (2) A dealer in precious stones or precious metals; (3) A dealer in any saleable item of a price equal to or greater than USD 15,000;

Appendix 1
(4) A law firm, notary firm or other independent legal business; (5) An accounting firm, audit firm or insolvency firm; or (6) A Company Service Provider.
1.3 Responsibility for compliance with the AML Rulebook
1.3.1 A Relevant Person's Governing Body is responsible for establishing, maintaining and
monitoring the Relevant Person's AML policies, procedures, systems and controls and compliance with applicable AML legislation.
1.3.2 A Relevant Person's Governing Body must ensure the policies, procedures, systems and
controls referred to in Rule 1.3.1 are effective to meet the obligations of the Relevant Person.
1.3.3 (1) Responsibility for a Relevant Person's compliance with the AML Rulebook lies with
every member of the Governing Body, and its Senior Management unless a senior officer is acting as the Money Laundering Officer (“MLRO”) of the Relevant Person in his/her capacity as a Recognised Person. (2) In carrying out their responsibilities under the AML Rulebook every member of a Relevant Person's Governing Body, and its Senior Management and or the MLRO (as the case may be) must exercise due skill, care and diligence. (3) Nothing in this Rule precludes the Regulator from taking enforcement action against any Person, including any one or more of the following Persons, in respect of a breach of any Rule in the AML Rulebook:
(a) a Relevant Person;
(b) members of a Relevant Person's Senior Management; or (c) an Employee of a Relevant Person.
1.4 Application table
Guidance
 Partially applicable. Relevant Persons should consider these Chapters and determine which provisions apply. Relevant Person Applicable Chapters Authorised Person and Recognised Body 1 - 15 Representative Office 1 - 6 11 - 15 Real estate developer or agency 1 - 9 11 - 15

Appendix 1
Relevant Person Applicable Chapters
Law firm, notary firm, or other independent legal business 1 - 9 11 - 15 Accounting firm, audit firm or insolvency firm 1 - 9 11 - 15 Company service provider 1 - 9 11 - 15 Dealer in precious metals or precious stones 1 - 9 13 14* 15 Dealer in high-value goods 1 - 9 13 14* 15

Appendix 1
2. OVERVIEW AND PURPOSE OF THE AML RULEBOOK
Guidance

Under Section 15A of the Financial Services and Markets Regulations 2015 ("FSMR"),
the Regulator has jurisdiction for the regulation of AML in ADGM. The AML Rulebook sets out the requirements imposed by the Regulator. The U.A.E. criminal law applies in the ADGM and, therefore, Persons in the ADGM must be aware of their obligations in respect of the criminal law as well as these Rules. Relevant U.A.E. criminal laws include Federal AML Legislation and Federal Law No. 3 of 1987 (the Penal Code of the United Arab Emirates). The Rules in the AML Rulebook should not be relied upon to interpret or determine the application of the criminal laws of the U.A.E.
The AML Rulebook has been designed to provide a single reference point for all
Relevant Persons and entities (collectively called "Relevant Persons") who are supervised by the Regulator for Anti-Money Laundering and Sanctions compliance in accordance with the scope of application outlined in Rule 1.2.1. Accordingly it applies to Relevant Persons, but in different degrees as provided for in Rule 1.4 1.2.2(2). The AML Rulebook takes into consideration the fact that Relevant Persons have differing AML risk profiles. A Relevant Person should familiarise itself with the AML Rulebook, and assess the extent to which the Chapters and sections apply to it.
The AML Rulebook is not intended to be read in isolation from other UAE relevant
legislation or developments in international policy and best practice and, to the extent applicable, Relevant Persons need to be aware of, and take into account, how these aforementioned matters may impact on the Relevant Person's day to day operations. This is particularly relevant when considering the List of terrorist organisations or persons issued under Article 63 of Federal Law No.7 of 2014 on Combatting Terrorism and the United Nations Security Council ("UNSC") Resolutions which apply in the ADGM, and Sanctions imposed by other jurisdictions which may apply to a Relevant Person depending on the Relevant Person's jurisdiction of origin, its business and/or Customer base.
Chapter 1 of the AML Rulebook contains an application table which should assist a
Relevant Person to navigate through the AML Rulebook and to determine which Chapters are applicable to it. Chapter 1 also specifies who is ultimately responsible for a Relevant Person's compliance with AML. The Regulator expects the Governing Body and Senior Management of a Relevant Person to establish a robust and effective AML and Sanctions compliance culture for the business.
Chapter 2 provides an overview of the AML Rulebook and Chapter 3 sets out the key
definitions in the AML Rulebook. Note that not all definitions used in the AML Rulebook are capitalised.
Chapter 4 outlines the general compliance including Group polices, notifications,
record keeping requirements and the annual AML Return.
Chapter 5 explains the meaning of the risk-based approach ("RBA"), which should be
applied when complying with the AML Rulebook. The RBA requires a risk-based assessment of a Relevant Person's business (in Chapter 6) and its Customers (in
Chapter 7). A risk-based assessment should be a dynamic process involving regular

Appendix 1
review, and the use of these reviews to establish the appropriate processes to match the levels of risk. No two Relevant Persons will have the same approach, and implementation of the RBA and the AML Rulebook permits a Relevant Person to design and implement systems and controls that should be appropriate to their business and Customers, with the obvious caveat being that such systems should be reasonable and proportionate in light of the AML risks. The Regulator expects the RBA to determine the breadth and depth of the Customer Due Diligence ("CDD") which is undertaken for a particular Customer under Chapter 8, though the Regulator understands that there is an inevitable overlap between the risk-based assessment of the Customer in Chapter 7 and CDD in Chapter 8. This overlap may occur at the initial stages of Client on-boarding but may also occur when undertaking on-going CDD.
78. Chapter 9 sets out when and how where a Relevant Person may rely on a third party
to undertake all or some of its CDD obligations. Reliance on third-party CDD reduces the need to duplicate CDD already performed for a Customer. Alternatively, a Relevant Person may outsource some or all of its CDD obligations to a service provider.
89. Chapter 10 sets out certain obligations in relation to correspondent banking, wire
transfers and other matters which are limited to Authorised Persons (other than a Credit Rating Agency) and Recognised Bodies, and, in particular, to banks.
910. Chapter 11 sets out a Relevant Person's obligations in relation to UNSC resolutions
and Sanctions, and government, regulatory and international findings (in relation to AML, terrorist financing and the financing of weapons of mass destruction).
1011. Chapter 12 sets out the obligation for a Relevant Person to appoint an MLRO and the
responsibilities of such a Person.
1112. Chapter 13 sets out the requirements for AML training and awareness. A Relevant
Person should adopt the RBA when complying with Chapter 13, so as to make its training and awareness proportionate to the AML risks of the business and the Employee role.
1213. Chapter 14 contains the obligations applying to all Relevant Persons concerning
Suspicious Activity Reports, which are required to be made under Federal AML Legislation Law No. 4 of 2002.
1314. Chapter 15 sets out additional obligations applying to DNFBPs, including registration
and notification requirements contains the general obligations applying to all Relevant Persons, including Group policies, notifications, record-keeping requirements and the annual AML Return.
15. Chapter 16 sets out the obligations applying to Relevant Persons that are NPOs.
The U.A.E. criminal law
14. Under section 7(6) of the Financial Services and Markets Regulations 2015 (the
"FSMR"), the Regulator has jurisdiction for the regulation of AML in the ADGM. The AML Rulebook sets out the requirements imposed by the Regulator under section 7(6) of the FSMR. The U.A.E. criminal law applies in the ADGM and, therefore, Persons in the ADGM must be aware of their obligations in respect of the criminal law as well as these Rules. Relevant U.A.E. criminal laws include Federal Law No. 4 of 2002 regarding

Appendix 1
the Criminalisation of Money Laundering, Federal Law No. 1 of 2004 regarding Combating Terrorism Offences, Federal Law No. 7 of 2014, and the Penal Code of the United Arab Emirates. The Rules in the AML Rulebook should not be relied upon to interpret or determine the application of the criminal laws of the U.A.E.
1516. Under Article 43 of Federal Decree By Law No. 20 of 2018 4 of 2002, a Relevant Person
may be criminally liable for the offence of money laundering if such an activity is intentionally committed in its name or for its account. Relevant Persons are also reminded that:
(a) the failure to report suspicions of money laundering; (b) "tipping off"; and (c) assisting in the commission of money laundering, may each constitute a criminal offence that is punishable under the laws of the U.A.E. Financial Action Task Force Standards
1617. The Financial Action Task Force (the “FATF”) is an inter-governmental body whose
purpose is the development and promotion of international standards to combat money laundering and terrorist financing.
1718. The Regulator has had regard to the FATF Recommendations in making these Rules.
and has determined to closely align these Rules with the FATF Recommendations, where that is deemed to be necessary and appropriate. A Relevant Person may wish to refer to the FATF Recommendations and interpretive notes to assist it in complying with these Rules. However, in the event that a FATF Recommendation or interpretive note conflicts with a Rule in the AML Rulebook, the relevant Rule takes precedence.
1819. A Relevant Person may also wish to refer to the FATF typology reports which may
assist in identifying new money laundering threats and which provide information on money laundering and terrorist financing methods. The FATF typology reports cover many pertinent topics for Relevant Persons, including corruption, new payment methods, money laundering using trusts and Company Service Providers, and vulnerabilities of free trade zones. These typology reports can be found on the FATF website www.fatf-gafi.org. Basel Committee Standards
1920. The Basel Committee on Banking Supervision has published a set of guidelines for
banks (Sound Management of Risks related to Money Laundering and Financing of Terrorism, January 2014) which are intended to supplement the FATF Recommendations. Banks operating in ADGM should read the Basel Committee guidelines in conjunction with the FATF Recommendations and in complying with these Rules.
2021. In the event that any of the Basel Committee guidelines conflict with a Rule in the
AML Rulebook, the relevant Rule takes precedence.

Appendix 1
Wolfsberg Group
22. The Wolfsberg Group is an association of thirteen global banks that has published
guidance aimed at assisting financial institutions in managing money laundering risks (Wolfsberg Statement Guidance on a Risk Based Approach for Managing Money Laundering Risks, March 2006) and in preventing terrorist financing (Wolfsberg Statement on the Suppression of the Financing of Terrorism, January 2002). Banks operating in ADGM should be familiar with relevant Wolfberg Group published guidance in conjunction with the FATF Recommendations and in complying with these Rules.
23. In the event that any of the Wolfsberg Group published guidance conflict with a Rule
in the AML Rulebook, the relevant Rule takes precedence.
Sanctions
2124. The U.A.E., as a member of the United Nations, is required to comply with all Sanctions
issued and passed by the UNSC. The U.A.E periodically publicises its imposition of sanctions. These UNSC obligations apply in the ADGM and their importance is emphasised by specific obligations contained in the AML Rulebook requiring Relevant Persons to establish and maintain effective systems and controls to make appropriate use of UNSC Sanctions and resolutions (see Chapter 11).
2225. The FATF has issued guidance on a number of specific UNSC Sanctions and resolutions
regarding the countering of the proliferation of weapons of mass destruction. Such guidance has been issued to assist in implementing the targeted financial Sanctions and activity based financial prohibitions. This guidance can be found on the FATF website (at www.fatf-gafi.org).
2326. In relation to unilateral Sanctions imposed in specific jurisdictions such as the
European Union, the U.K. (by "HM Treasury") and the U.S. (by the Office of Foreign Assets Control ("OFAC")) and any other Sanctions that may apply to the Relevant Person’s business partners and customers, the Regulator expects a Relevant Person to consider and take positive steps to ensure compliance where required or appropriate.

Appendix 1
3. INTERPRETATION AND TERMINOLOGY
3.1 Interpretation
3.1.1 A reference in the AML Rulebook to "money laundering" in lower case includes a reference to
terrorist financing, the financing of unlawful organisations and sanctions non-compliance unless the context provides or implies otherwise.
3.2 Glossary for AML
Guidance
The defined terms and abbreviations in the AML Rulebook can be found in the Regulator's Glossary Rulebook ("GLO").
3.2.1 The following terms and abbreviations bear the following meanings for the purposes of these
Rules.
ADGM Means the Abu Dhabi Global Market.
ADGM Entity Means a Legal Person which is incorporated or registered in the ADGM (excluding a registered Branch). AML or AML Rulebook Means the Anti-Money Laundering and Sanctions Rules and Guidance. AML Return Means the return which is required to be completed by Relevant Persons in accordance with AML 4.6. Authorised Person Means a Person, other than a Recognised Body, who is authorised under the FSMR. Beneficial Owner Means, in relation to a customer, a natural person who ultimately owns or controls the customer or a natural person on whose behalf a transaction is conducted or a business relationship is established and includes:
(a) in relation to a body corporate, a person referred to in Rule 8.3.3(2); (b) in relation to a Partnership, a person referred to in Rule 8.3.4(2); (c) in relation to a trust or other similar Legal Arrangement, a person referred to in Rule 8.3.5 (2); and (d) in relation to a foundation, a person referred to in Rule 8.3.6(2).

Appendix 1
Body Corporate Means any body corporate, including limited liability partnership and a body corporate constituted under the law of a country or territory outside of the ADGM. Branch Means a place of business within the ADGM:
(a) which has no separate legal personality;
(b) forms a legally dependant part of an Authorised Person whose principal place of business and head office is in a jurisdiction other than the ADGM; and (c) through which the Authorised Person carries on Regulated Activities in or from the ADGM. Client Means a Retail Client, Professional Client or Market Counterparty as defined in COBS 2. Client Agreement Means an agreement between an Authorised Person and a Client which is made or entered into in accordance with COBS 3.3. Client Money Means money of any currency which an Authorised Person holds on behalf of a Client (including any receivables of the Authorised Person in respect of bank accounts or clearing or brokerage accounts) or which an Authorised Person treats as Client Money, subject to the exclusions in COBS 14.2.6. COBS Means the Conduct of Business Rulebook. Company Includes:
(a) any Body Corporate (wherever incorporated); and (b) any unincorporated body constituted under the law of a country, territory or jurisdiction outside the ADGM. Company Service Provider Means a Person that, carries out the following services to a Customer:
(a) acting as a formation agent of Legal Persons; (b) acting as (or arranging for another Person to act as) a director or secretary of a company, a partner of a partnership or a similar position in relation to other Legal Persons or Legal Arrangements; (c) providing a registered office, business address or accommodation, correspondence or administrative address for a company, a partnership or any other Legal Person or Legal Arrangement;

Appendix 1
(d) acting as (or arranging for another Person to act as) a trustee of an express trust or performing the equivalent function for another form of Legal Arrangement; or (e) acting as (or arranging for another Person to act as) a nominee shareholder for another Person. Contract of Insurance Has the meaning given in Part 4 of Schedule 1 of FSMR. Contravention Means a contravention of any Regulations or Rules made by the ADGM Board and the Regulator, as the case may be. Correspondent Account Means an account opened on behalf of a Correspondent Banking Client to receive deposits from, to make payments on behalf of or to otherwise handle financial transactions for or on behalf of the Correspondent Banking Client. Correspondent Bank Means a bank in a jurisdiction other than the ADGM where an Authorised Person opens a Correspondent Account. Correspondent Banking Client Means a Client of an Authorised Person which uses the firm's correspondent banking services account to clear transactions for its own customer base. Counterparty Means any Person with or for whom an Authorised Person carries on, or intends to carry on, any regulated business or associated business. In this context, a Counterparty includes an individual, unincorporated association, Company, government, local authority or other public body. Credit Rating Agency Means a Person carrying on in or from the ADGM the Regulated Activity of Operating a Credit Rating Agency for which it has an authorisation under its Financial Services Permission. Customer Due Diligence (CDD) Has the meaning given in AML 8.3. Designated Non-Financial Business or Profession (DNFBP) Means the following class of Persons who carries out the following businesses in the ADGM:
(a) a real estate agency which carries out transactions with other Persons that involve the acquiring or disposing of real property; (b) a dealer in precious metals or precious stones; (c) a dealer in any saleable item of a price equal to or greater than USD15,000; (d) an accounting firm, audit firm, insolvency firm or taxation consulting firm;

Appendix 1
(e) a law firm, notary firm or other independent legal business; or (f) a Company Service Provider. Director Means:
(a) In relation to an Undertaking established under the ADGM Companies Regulations 2015, a Person who appears on the Register of Directors maintained by the ADGM Registrar of Companies; (b) In relation to all other Undertakings, a Person who has been admitted to a register which has a corresponding meaning to the Register of Directors or performs the function of acting in the capacity of a Director, by whatever name called; (c) who is employed or appointed by a Person in connection with that Person's business, whether under a contract of service or for services or otherwise; or (d) whose services, under an arrangement between that Person and a third party, are placed at the disposal and under the control of that Person. Employee Means an individual:
(a) who is employed or appointed by a Person in connection with that Person's business, whether under a contract of service or for services or otherwise; or (b) whose services, under an arrangement between that Person and a third party, are placed at the disposal and under the control of that Person. Enhanced Customer Due Diligence Means undertaking Customer Due Diligence and the enhanced measures under AML 8.4. FATF Recommendations Means the publication entitled the "International Standards on Combatting Money Laundering and the Financing of Terrorism & Proliferation", as published and amended from time to time by the Financial Action Task Force (FATF). Federal AML Legislation Means the legislation described in section 258 of FSMR. Federal Decree by law No. Means U.A.E Federal Decree by Law No. 20 of 2018 On Anti Money Laundering, Combating the Financing of Terrorism and Financing of Illegal Organisations. Federal Law No. 1 of 2004 Means U.A.E Federal Law No. 1 of 2004 regarding Combatting Terrorism Offences.

Appendix 1
Federal Law No. 4 of 2002 Means U.A.E Federal Law No. 4 of 2002 regarding the Criminalisation of Money Laundering. Federal Law No. 7 of 2014 Means Federal Law No. 7 of 2014 regarding Combatting Terrorist Crimes. FIU Means the Financial Intelligence Unit of the U.A.E. Financial Institution Means:
(1) an Authorised Person;
(2) any Person which carries out as its principal business an activity which would, if carried out in ADGM, be a Regulated Activity; and (3) is not one of the following:
(A) a governmental organisation, including the Central Bank of any State; or (B) a multilateral development bank. Financial Services Permission Means a permission given, or having effect as if so given, by the Regulator in accordance with Part 4 of FSMR. Financial Services Regulator Means a regulator of financial services activities established in a jurisdiction other than the ADGM FSMR Means the Financial Services and Markets Regulations 2015. Governing Body Means the board of directors, partners, committee of management or other governing body of an Undertaking Group Has the meaning given in section 258 of FSMR. Guidance Has the meaning given in section 15(2) of FSMR. International Organisation Means an organisation established by formal political agreement between member countries, where the agreement has the status of an international treaty, and the organisation is recognised in the law of countries which are members Investment Means Specified Investments set out in Part 3 of Schedule 1 of FSMR, unless otherwise specified. Legal Arrangement Means express trusts or other similar legal arrangements Legal Person Means any entity other than a Natural Person that can establish a customer relationship with a Relevant Person or otherwise own property. This can include companies, Bodies Corporate or unincorporate, trusts, foundations, partnerships,

Appendix 1
associations, states and governments and other relevantly similar entities. Listed Body Corporate Means, for the purposes of Rule 8.3.3(4), a Body Corporate listed on a stock exchange recognised by the Regulator. Money Laundering Reporting Officer (MLRO) Means, for the purposes of an Authorised Person other than a Credit Rating Agency, the Recognised Function described in GEN 5.4.8. Natural Person Means an individual. Non-Profit Organisation (NPO) Means a Legal Person or arrangement or organisation that primarily engages in raising or disbursing funds for purposes such as charitable, religious, cultural, educational, social or fraternal purposes or for other charitable purpose. Officer Means:
(a) in relation to a limited liability partnership, a member of the limited liability partnership; and (b) in relation to a Body Corporate:
(i) a Director, member of the committee of management, Chief Executive, manager, secretary or other similar officer of the body, or a person purporting to act in any such capacity; and (ii) an individual who is a Controller of the body. Parent Means a Holding Company as defined in section 1015 of the Companies Regulations 2015. Partner Means, in relation to an Undertaking which is a Partnership, a Person occupying the position of a partner, by whatever name called. Partnership Means any partnership, including a partnership constituted under the law of a country, jurisdiction or territory outside the ADGM, but not including a Limited Liability Partnership. Person Means any Natural Person, Body Corporate or body unincorporated, including a Legal Person, company, Partnership, unincorporated association, government or state. Politically Exposed Person (PEP) Means a Natural Person (and includes, where relevant, a family member or close associate) who is or has been entrusted with a prominent public function, including but not limited to, a head of state or of government, senior officials and functionaries of an international or supranational organisation, senior politician, senior government, judicial or military official,

Appendix 1
ambassador, senior executive of a state owned corporation, or an important political party official, but not middle ranking or more junior individuals in these categories. Recognised Body Means a Recognised Investment Exchange or a Recognised Clearing House. Regulated Activity Has the meaning given in section 19 of FSMR. Regulated Financial Institution A person who does not hold a FSP but who is authorised in a jurisdiction other than the ADGM to carry on any financial service by another Financial Services Regulator. Regulator Means the ADGM Financial Services Regulatory Authority. Relevant Person Has the meaning given in section 258 of FSMR. Representative Office Means the business operations of Person authorised to carry on the Regulated Activity of Operating a Representative Office in the ADGM and which actually carries on the Regulated Activity of Operating a Representative Office. Restricted Scope Company Has the meaning given in section 3(4) of the Companies Regulations 2015. Rule Means any rule made by the Regulator or the ADGM Board, as applicable, in accordance with the procedures in Part 2 of FSMR. Sanctions Means any law executing foreign policy, security, sanction, trade embargo, or anti-terrorism objectives or similar restrictions imposed, administered or enforced from time to time by: (i) the U.A.E.; (ii) the United Nations Security Council; (iii) the European Union; (iv) H.M. Treasury of the United Kingdom; (v) the Office of Foreign Assets Control (OFAC) of the U.S. Department of the Treasury; (vi) any other relevant governmental authority; or (vii) any of their successors. Sanctions List Means any official list of Persons or entities targeted by Sanctions from time to time. Senior Management Means in relation to a Relevant Person every member of the Relevant Person's executive management and includes:
(i) for an ADGM Entity, every member of the Relevant Person's Governing Body; (ii) for a Branch, the Person or Persons who control the day to day operations of the Relevant Person in the ADGM; or

Appendix 1
(iii) for an auditor, every member of the Relevant Person's executive management in the U.A.E. Shareholder Means a Natural Person or legal entity governed by private or public law, who holds, directly or indirectly:
(a) Shares of the Issuer in its own name and on its own account; (b) Shares of the Issuer in its own name, but on behalf of another natural person or legal entity; or (c) depository receipts, in which case the holder of the depository receipt shall be considered as the shareholder of the underlying Shares represented by the depository receipts. Shell Bank A bank that has no physical presence in the country in which it is incorporated or licensed and which is not affiliated with a regulated financial Group that is subject to effective consolidated supervision Simplified Customer Due Diligence Means Customer Due Diligence as modified under AML 8.5. Source of Funds Means the origin of customer's funds which relate to a Transaction or service and includes how such funds are connected to a customer's Source of Wealth. Source of Wealth Means how the customer's global wealth or net worth is or was acquired or accumulated. Suspicious Activity Report (SAR) Means a report in the prescribed format regarding suspicious activity (including a suspicious Transaction) made to the FIU. Transaction Means any transaction undertaken by a Relevant Person for or on behalf of a customer in the course of carrying on a business in or from the ADGM. U.A.E. Means the United Arab Emirates. Undertaking Means:
(a) a Body Corporate or Partnership; or
(b) an unincorporated association carrying on a trade or business, with or without a view to profit. Unlawful Organisation An organisation, the establishment or activities of which have been declared to be criminal under Federal AML Legislation

Appendix 1
Waiver Means in relation to GEN 8.2 written notice provided under FSMR.

Appendix 1
4. GENERAL COMPLIANCE REQUIREMENTS
4.1 General requirements
4.1.1 (1) A Relevant Person must establish and maintain effective Anti-Money Laundering AML
policies, procedures, systems and controls to prevent opportunities for Mmoney Llaundering, in relation to the Relevant Person and its activities. (2) A Relevant Person's Anti-Money Laundering AML policies, procedures, systems and controls mustshould:
(a) ensure compliance with Federal AML Legislation U.A.E. Law No. 4 of 2002, U.A.E. Law No. 1 of 2004, Federal Law No. 7 of 2014, and any other relevant federal laws of the U.A.E. relating to Money Laundering; (b) enable suspicious Customers Persons and Transactions to be detected and reported; (c) ensure the Relevant Person is able to provide an appropriate audit trail of a Transaction; and (d) ensure compliance with any other obligation in these Rules. (3) A Relevant Person must take reasonable steps to ensure that its Employees comply with the relevant requirements of its Anti-Money Laundering AML policies, procedures, systems and controls. (4) A Relevant Person must review the effectiveness of its Anti-Money Laundering AML policies, procedures, systems and controls at least annually. (5) The review process may be undertaken:
(a) internally by its internal audit or compliance function; or (b) by a competent firm of independent auditors or compliance professionals. (6) The review process required under Rule 4.1.1(4) must cover at least the following:
(a) a sample testing of CDD processes "Know Your Customer" arrangements; (b) an analysis of all Suspicious Activity Reports to highlight any area where procedures or training may need to be enhanced; and (c) a review of the nature and frequency of the dialogue between the adequacy of the level of responsibility and oversight of the Relevant Person’s Governing Body and or Senior Management with the MLRO to ensure that their responsibility for implementing and maintaining in ensuring the Relevant Person has implemented and maintained adequate controls is satisfactory.

Appendix 1
4.1.2 A Relevant Person which that is a Domestic Firm must ensure that its Anti-Money Laundering
AML policies, procedures, systems and controls apply to any Branch or Subsidiary operating in another jurisdiction.
4.1.3 If another jurisdiction's laws or regulations prevent or inhibit a Relevant Person from
complying with U.A.E. Law No. 4 of 2002, U.A.E. Law No. 1 of 2004 the Federal AML Legislation or with these Rules, the Relevant Person must immediately promptly inform the Regulator in writing.
4.2 Groups, Branches and subsidiaries
4.2.1 (1) A Relevant Person which is an ADGM Entity must ensure that its policies, procedures,
systems and controls required by Rule 4.1.1 apply to:
(a) all of its Branches or Subsidiaries; and
(b) all of its Group entities in the ADGM.
(2) The requirement in (1) does not apply if the Relevant Person can satisfy the Regulator that the relevant branch, Subsidiary or Group entity is subject to regulation, including Anti-Money Laundering, by a Financial Services Regulator or other competent authority in a country or jurisdiction with Anti-Money Laundering regulations which are equivalent to the standards set out in the FATF Recommendations and is supervised for compliance with such regulations. (3) Where the regulator in another jurisdiction does not permit the implementation of policies, procedures, systems and controls consistent with these Rules, the Relevant Person must:
(a) inform the Regulator in writing; and
(b) apply appropriate additional measures to manage the money laundering risks posed by the relevant Branch or Subsidiary. Guidance A Relevant Person that is an ADGM Entity should conduct a periodic review to verify that any Branch or Subsidiary operating in another jurisdiction is in compliance with the obligations imposed under these Rules.
4.2.2 A Relevant Person must:
(a) communicate the policies and procedures that it establishes and maintains in accordance with these Rules to its Group entities, Branches and Subsidiaries; and (b) document the basis for its satisfaction that the requirement in Rule 4.2.1(1) is met. Guidance In relation to an Authorised Person, if the Regulator is not satisfied in respect of the AntiMoney Laundering compliance of its Branches and Subsidiaries in another jurisdiction, it may

Appendix 1
take action, including making it a condition of the Authorised Person's Financial Services Permission that it must not operate a Branch or Subsidiary in that jurisdiction.
4.3 Group policies
4.3.1 A Relevant Person which is part of a Group must ensure that it:
(a) has developed and implemented policies and procedures for the sharing of information between Group entities , including the sharing of information relating to CDD and money laundering risks; (b) has in place adequate safeguards on the confidentiality and use of information exchanged between Group entities, including consideration of relevant data protection legislation; (c) remains aware of the money laundering risks of the Group as a whole and of its exposure to the Group and takes active steps to mitigate such risks; (d) contributes to a Group-wide risk assessment to identify and assess money laundering risks for the Group; and (e) provides its Group-wide compliance, audit and Anti-Money Laundering functions with customer account and Transaction information from its Branches and Subsidiaries when necessary for Anti-Money Laundering purposes.
4.4 Notifications
4.4.1 A Relevant Person must inform the Regulator in writing immediately if, in the course of its
activities carried on in or from the ADGM or in relation to any of its Branches or Subsidiaries, it:
(a) receives a request for information from a regulator or agency in another jurisdiction responsible for Anti-Money Laundering or Sanctions regarding enquiries into potential money laundering or terrorist financing or Sanctions breaches; (b) becomes aware, or has reasonable grounds to believe, that the following has or may have occurred in or through its business:
(i) money laundering, contrary to relevant Federal AML Legislations (ii) a breach of Sanctions; or (iii) acts amounting to bribery under the Organisation for Economic Co-operation and Development (“OECD”) Convention on Combating Bribery of Foreign Public Officials in International Business Transactions; (c) becomes aware of any money laundering or Sanctions matter in relation to the Relevant Person or a member of its Group which could result in adverse reputational consequences to the Relevant Person; or

Appendix 1
(d) becomes aware of any a significant breach of a Rule in the AML Rulebook or breach of relevant Federal AML Legislations
4.4.2 A Relevant Person must inform the Regulator in writing as soon as possible if, in the course of
its activities carried on in or from the ADGM, it suspects or becomes aware that another Person outside of its business is engaged in:
(a) money laundering, contrary to relevant Federal AML Legislations (b) a breach of Sanctions; or (c) acts amounting to bribery under the OECD Convention on Combating Bribery of Foreign Public Officials in International Business Transactions. This requirement does not apply to information or documents that are legally privileged or in the public domain.
4.5 Record keeping
4.5.1 A Relevant Person must, where relevant, maintain the following records:
(a) a copy of all documents and information obtained in undertaking initial and on-going CDD or due diligence on business partners; (b) records, consisting of the original documents or certified copies, in respect of the Customer business relationship, including:
(i) business correspondence and other information relating to a customer’s account; (ii) sufficient records of transactions to enable individual transactions to be reconstructed; and (iii) internal findings and analysis relating to a transaction or any business, if the transaction or business appears unusual or suspicious, whether or not it results in a Suspicious Activity Report; (c) Internal Suspicious Activity Report notifications made under Rule 14.2.2; (d) Suspicious Activity Reports and any relevant supporting documents and information, including internal findings and analysis; (e) any relevant communications with the FIU; (f) the documents in Rule 4.6.3; and (g) any other matter that the Relevant Person is expressly required to record under these Rules, for at least six years from the date on which the notification or report was made, the business relationship ends or the Transaction is completed, whichever occurs last.

Appendix 1
4.5.2 A Relevant Person must provide to the Regulator, upon request, or a law enforcement agency,
pursuant to a valid and enforceable request or requirement, immediately a copy of the record referred to in Rule4.6.1. Guidance The Regulator expects that a Relevant Person will be able to ordinarily provide the records within one day of a request from the Regulator.
4.5.3 A Relevant Person must document, and provide to the Regulator immediately, any of the
following:
(a) the risk assessment of its business as required by Rule 6.1.1; (b) how the assessment in (a) was used for the purposes of complying with Rule 7.2.1(1); (c) the risk assessment of the Customer undertaken under Rule 7.1.1(a); and (d) the determination made under Rule 7.1.1(b).
4.5.4 The records maintained by a Relevant Person must be kept in such a manner that:
(a) the Regulator or another competent third party is able to assess the Relevant Person's compliance with legislation applicable in ADGM; (b) any Transaction which was processed by or through the Relevant Person on behalf of a customer or other third party can be reconstructed; (c) any customer or third party can be identified; (d) all internal and external Suspicious Activity Reports can be identified; and (e) the Relevant Person can satisfy, within an appropriate time, any regulatory enquiry or court order to disclose information. Guidance

The records required to be kept under Rule 4.6.1 may be kept in electronic format,
provided that such records are readily accessible and available to respond promptly to any requests from the Regulator for information.
If the date on which the business relationship with a customer ended is unclear, it
may be taken to have ended on the date of the completion of the last Transaction.
4.5.5 Where the records referred to in Rule 4.6.1 are kept by a Relevant Person outside ADGM, a
Relevant Person must:
(a) take reasonable steps to ensure that the records are held in a manner consistent with these Rules; (b) ensure that the records are easily accessible to the Relevant Person; and (c) upon request by the Regulator, ensure that the records are immediately available for inspection.

Appendix 1
4.5.6 A Relevant Person must:
(a) identify where there is secrecy or data protection legislation that might restrict access without delay to the records referred to in Rule 4.6.1 by the Relevant Person, the Regulator or the law enforcement agencies of the U.A.E.; and (b) where such legislation exists, obtain without delay certified copies of the relevant records and keep such copies in a jurisdiction which allows access by those persons in (a).
4.5.7 A Relevant Person must be able to demonstrate that it has complied with the training and
awareness requirements in Chapter 13 through appropriate measures, including the maintenance of relevant training records. Guidance The Regulator considers that "appropriate measures" in Rule 4.6.7 may include the maintenance of a training log setting out details of:
(a) the dates when the training was given;
(b) the nature of the training; and
(c) the names of Employees who received the training.
4.6 Annual AML Return
4.6.1 A Relevant Person must complete the prescribed AML Return form and submit it to the
Regulator by the end of April each year. The AML Return must cover the period from 1 January to 31 December of the reporting year. Guidance Relevant Persons should be aware of their obligations under Cabinet Resolution 38 of 2014 to prepare AML reports and copy them to the FIU.
4.24.7 Cooperation with the Rregulators
4.2.1 A Relevant Person that receives a request for information from a Non-ADGM Financial
Services Regulator or agency responsible for AML regarding enquiries into potential Money Laundering related to Regulated Activities carried on in or from the ADGM, must promptly inform the Regulator in writing.
4.7.1 A Relevant Person must:
(a) be open and cooperative in all its dealings with the Regulator; and (b) ensure that any communication with the Regulator is conducted in the English language.

Appendix 1
4.8 Employee disclosures
4.8.1 A Relevant Person must ensure that it does not prejudice an Employee who discloses any
information regarding money laundering to the Regulator or to any other relevant body involved in the prevention of money laundering. Guidance The Regulator considers that "relevant body" in Rule 4.10.1 would include the FIU, any other financial intelligence unit, the police, or an Abu Dhabi or Federal ministry.

Appendix 1
5. APPLYING A RISK-BASED APPROACH TO AML
5.1 The risk-based approach
5.1.1 A Relevant Person must:
(a) assess and address its Anti-Money Laundering AML risks under the AML Rulebook by adopting an approach which is proportionate to reviewing the risks to which the Relevant Person is exposed as a result of the nature of its business, cCustomers, products, services and any other matters which are relevant in the context of money laundering and adopting a proportionate approach to mitigate or eliminate those risks; and (b) ensure that, when undertaking any risk-based assessment undertaken for the purposes of complying with a requirement in of the AML Rulebook, such assessment is:
(i) objective and proportionate to the risks; (ii) based on reasonable grounds; (iii) properly documented; and (iv) reviewed and updated at appropriate intervals. Guidance

Rule 5.1.1 requires a Relevant Person to adopt an approach to Anti-Money Laundering
AML which is proportionate to the risks. This is called the "risk-based approach" (“RBA”) and is illustrated in Figure 1 in A1.1. The Regulator expects the RBA to be a key part of the Relevant Person's anti-money laundering compliance culture and to cascade down from the Senior Management to the rest of the organisation. Embedding the RBA within its business allows a Relevant Person to make decisions and allocate Anti-Money Laundering AML resources in the most efficient and effective way.
In implementing the RBA, a Relevant Person is expected to have in place processes to
identify, assess, monitor, manage and mitigate money laundering risks. The general principle is that where there are assessed to be higher risks of money laundering, a Relevant Person is required to take enhanced measures to manage and mitigate those risks, and that, correspondingly, when the risks are assessed to be lower, simplified measures are permitted. Simplified measures are not permitted where there is any a suspicion of money laundering.
The RBA should not be seen as discourages a "tick-box" approach to Anti-Money
Laundering AML. Instead a Relevant Person is required to assess relevant money laundering risks and adopt a proportionate response to such risks; however, even where a customer is assessed through the RBA as being low risk a minimum of simplified CDD must be undertaken in relation to that customer. The outcome of using the RBA is akin to using a sliding scale, where the type of CDD undertaken on each

Appendix 1
Customer will ultimately depend on the outcome of the risk-based assessment made of such Customer under this Chapter.
4. The Rules regarding record-keeping for the purposes of the AML Rulebook are in Rule
15.4 4.6 and 4.7. These Rules apply in relation to Rule 5.1.1(b)(iii).
5.1.2 A flowchart outlining the RBA standards and their application is contained in A1.1.

Appendix 1
6. BUSINESS RISK ASSESSMENT
6.1 Assessing business AML risks
6.1.1 A Relevant Person must:
(a) take appropriate steps to identify and assess money laundering risks to which its business is exposed, taking into consideration the nature, size and complexity of its activities; (b) when identifying and assessing the risks in (a), take into account, to the extent relevant, any vulnerabilities relating to:
(i) its type of cCustomers and their activities; (ii) the countries or geographic areas in which it does business; (iii) its products, services and activity profiles; (iv) its distribution channels and business partners; (v) the complexity and volume of its Transactions; (vi) the development of new products and new business practices, including new delivery mechanisms, channels and partners; and (vii) the use of new or developing technologies for both new and pre-existing products and services; and (c) take appropriate measures to ensure that any risk identified as part of the assessment in (a) is taken into account in its day-to-day operations and is mitigated, including in relation to:
(i) the development of new products, services, business practices and technologies; (ii) the taking on of new cCustomers; and (iii) changes to its business profile.
6.1.2 A Relevant Person must use the information obtained in undertaking its business risk
assessment to:

Appendix 1
(a) develop and maintain its Anti-Money Laundering AML policies, procedures, systems and controls as required by Rule 6.2.1; (b) ensure that its Anti-Money Laundering AML policies, procedures, systems and controls adequately mitigate the risks identified as part of the assessment in Rule 6.1.1; (c) assess the effectiveness of its Anti-Money Laundering AML policies, procedures, systems and controls as required by Rule 6.2.1(c); (d) assist in the allocation and prioritisation of Anti-Money Laundering AML resources; and (e) assist in the carrying out of the cCustomer risk assessment under Chapter 7.
6.1.3 Without limiting Rules 6.1.1 and 6.1.2 a Relevant Person must, prior to launching any new
product, service, business practice or using a new or developing technology, take reasonable steps to ensure that it has:
(a) assessed and identified the money laundering risks relating to the product, business practice or technology; and (b) taken appropriate steps to mitigate or eliminate the risks identified under (a). Guidance

Unless a Relevant Person understands the money laundering risks to which it is
exposed, it cannot take appropriate steps to prevent its business being used for the purposes of money laundering. Money laundering risks vary from business to business depending on the nature of the business, the type of cCustomers a business has, and the nature of the products and services sold, and the geographical operations in which it operates.
Using the RBA, a Relevant Person should assess its own vulnerabilities to money
laundering and take all reasonable steps to eliminate or manage such risks. The results of this assessment will also feed into the Relevant Person's risk assessment of its customers under Chapter 7. For instance, if a Relevant Person reasonably concludes that a particular business line poses a negligible risk of money laundering, it may decide, using the RBA, that all its Customers in that business line should be treated as posing a lower risk of money laundering, and it may apply Simplified Customer Due Diligence.
A Relevant Person should, prior to launching any new product, service, business
practice pay specific attention to assessing the potential for risks associated with money laundering. This is especially important given the innovative nature of any such new offering as the Relevant Person may be less familiar with the functioning of the offering, compared to existing offerings.
Similarly, in using a new or developing technology, such as those associated with the
Regulated Activity of Developing Financial Technology Services within the RegLab, a Relevant Person should pay specific attention to assessing the potential for risks associated with money laundering that might arise as a result of implementing that innovative technology.

Appendix 1
6.2 Anti-Money LaunderingAML systems and controls
6.2.1 A Relevant Person must:
(a) establish and maintain effective policies, procedures, systems and controls to prevent opportunities for money laundering in relation to the Relevant Person and its activities; (b) ensure that its systems and controls in (a):
(i) include the provision to the Relevant Person's Senior Management of regular management information on the operation and effectiveness of its AntiMoney LaunderingAML systems and controls necessary to identify, measure, manage and control the Relevant Person's money laundering risks; (ii) enable it to determine whether a cCustomer or a Beneficial Owner is a Politically Exposed Person ("PEP"); (iii) enable the Relevant Person to comply with these Rules, Federal Law No. 4 of 2002, Federal Law No. 1 of 2004, Federal Law No. 7 of 2014, and any other relevant Federal laws and Federal AML Legislation; and (iv) enable the Relevant Person to comply with the Penal Code of the United Arab Emirates; and (c) ensure that regular risk assessments are carried out on the adequacy of the Relevant Person's Anti-Money LaunderingAML systems and controls to ensure that they continue to enable it to identify, assess, monitor and manage money laundering risk adequately, and are comprehensive and proportionate to the nature, scale and complexity of its activities. Guidance In Rule 6.2.1(c) the regularity of risk assessments will depend on the nature, size and complexity of the Relevant Person's business and also on when any material changes are made to its business.
6.3 A flowchart outlining the business risk-based assessment process is contained in A1.2.

Appendix 1
7. CUSTOMER RISK ASSESSMENT
Guidance

This Chapter prescribes the risk-based assessment that must be undertaken by a
Relevant Person on a customer and the proposed business relationship, Transaction or product. The outcome of this process is to produce a risk rating for a customer, which determines the level of CDD that must be undertaken in relation to that customer under Chapter 8. Chapter 8 prescribes the requirements of CDD and of Enhanced CDD for high-risk customers and, where appropriate, Simplified CDD for low-risk customers.
CDD in the context of AML refers to the process of identifying a customer, verifying
such identification and monitoring the customer's business and the potential for any money laundering risk on an on-going basis. CDD is required to be undertaken following a risk-based assessment of the customer and the proposed business relationship, Transaction or product.
Relevant Persons should note that the on-going CDD requirements in Rule 8.6.1
require a Relevant Person to ensure that it reviews a customer's risk rating to ensure that it remains appropriate in light of the potential money laundering risks.
The Regulator is aware that in practice there will often be some degree of overlap
between the customer risk assessment and CDD. For example, a Relevant Person may undertake some aspects of CDD, such as identifying a Beneficial Owner, when it performs a risk assessment of the customer. Conversely, a Relevant Person may also obtain relevant information as part of CDD which has an impact on its customer risk assessment. Examples of such relevant information include information on the Source of Funds or wealth or information on the ownership and control structure of the customer. Where information obtained as part of CDD of a customer affects the risk rating of a customer, the change in risk rating should be reflected in the degree of CDD undertaken.
7.1 Customer risk-based assessment
7.1.1 Generally, a Relevant Person is expected to take a risk-based approach when assessing any
business relationship or Transaction with respect to its specific money laundering risk and the information and evidence that might be required or validated for this purpose. "Know Your Customer" procedures need to be established and managed according to the perceived money laundering risk.
7.1.2 (1) The Relevant Person should take specific and adequate measures necessary to
compensate for the higher risk of money laundering which might arise, for example from the following products, services or Customers:
(a) non-face-to-face business relationships or Transactions, such as via mail, telephone or the internet; (b) internet-based products;

Appendix 1
(c) electronic money products;
(d) correspondent banking relationships;
(e) Customers from higher-risk countries; and (f) PEPs.
(2) A Relevant Person should apply an intensified monitoring of Transactions and accounts in relation to these products, services and Customers.
7.1.3 While a Relevant Person should assess the money laundering risks posed by the products and
services it offers and devise its products with due regard to those risks, an RBA does not release the Relevant Person from its overall obligation to comply with AML obligations. Guidance

This Chapter prescribes the risk-based assessment that must be undertaken by a
Relevant Person on a Customer and the proposed business relationship, Transaction or product. The outcome of this process is to produce a risk rating for a Customer, which determines the level of Customer Due Diligence ("CDD") which will apply to that Customer under Chapter 8. Chapter 8 prescribes the requirements of CDD and of Enhanced Customer Due Diligence for high-risk Customers and Simplified Customer Due Diligence for low-risk Customers.
CDD in the context of AML refers to the process of identifying a Customer, verifying
such identification and monitoring the Customer's business and money laundering risk on an on-going basis. CDD is required to be undertaken following a risk-based assessment of the Customer and the proposed business relationship, Transaction or product.
Relevant Persons should note that the on-going CDD requirements in Rule 8.6.1
require a Relevant Person to ensure that it reviews a Customer's risk rating to ensure that it remains appropriate in light of the AML risks.
The Regulator is aware that in practice there will often be some degree of overlap
between the Customer risk assessment and CDD. For example, a Relevant Person may undertake some aspects of CDD, such as identifying a Beneficial Owner, when it performs a risk assessment of the Customer. Conversely, a Relevant Person may also obtain relevant information as part of CDD which has an impact on its Customer risk assessment. Examples of such relevant information include information on the Source of Funds or wealth or information on the ownership and control structure of the Customer. Where information obtained as part of CDD of a Customer affects the risk rating of a Customer, the change in risk rating should be reflected in the degree of CDD undertaken.
7.2 Assessing Customer AML risks
7.2.1 (1) A Relevant Person must:
(a) undertake a risk-based assessment of every Customer; and

Appendix 1
(b) assign the Customer a risk rating proportionate to the Customer's money laundering risks. (2) The Customer risk assessment in (1) must be completed prior to undertaking CDD for new Customers, and whenever it is otherwise appropriate for existing Customers. (3) A Relevant Person may assign a low-risk rating to a Prescribed Low Risk Customer without the need to undertake the risk-based assessment of the Customer under (1)(a). (4) Where a Relevant Person has assigned a Customer a low-risk rating under (3) and the Customer ceases to meet the criteria to be a Prescribed Low Risk Customer the Relevant Person must undertake the risk-based assessment of the Customer under (1)(a). (5) When undertaking a risk-based assessment of a Customer under (1)(a) a Relevant Person must:
(a) identify the Customer and any Beneficial Owner; (b) obtain information on the purpose and intended nature of the business relationship; (c) take into consideration the nature of the Customer, its ownership and control structure, and its beneficial ownership (if any), including its possible status as a Politically Exposed Person; (d) take into consideration the nature of the Customer's business relationship with the Relevant Person; (e) take into consideration the Customer's country of origin, residence, nationality, place of incorporation or place of business; (f) take into consideration the relevant product, service or Transaction; and (g) take into consideration the outcomes of business risk assessment under
Chapter 6.
7.2.2 A Relevant Person must not establish a business relationship with a Customer which is a Legal
Person if the ownership or control arrangements of the Customer prevent the Relevant Person from identifying one or more of the Customer's Beneficial Owners. Guidance on the Customer risk assessment

In assessing the nature of a Customer, a Relevant Person should consider such factors
as the legal structure of the Customer, the Customer's business or occupation, the location of the Customer's business and the commercial rationale for the Customer's business model.
In assessing the Customer business relationship, a Relevant Person should consider
how the Customer is introduced to the Relevant Person and how the Customer is serviced by the Relevant Person, including for example, whether the Customer will be

Appendix 1
a private banking Client, will open a bank account or whether the business relationship will be purely advisory.
3. The risk assessment of a Customer, which is illustrated in Figure 3 in A1.3, requires a
Relevant Person to allocate an appropriate risk rating to every Customer. The Regulator would expect risk ratings to be either descriptive, such as "low", "medium" or "high", or a sliding numeric scale such as 1 for the lowest risk to 10 for the highest. Depending on the outcome of a Relevant Person's assessment of its Customer's money laundering risk, a Relevant Person should decide to what degree CDD will need to be performed.
4. Using the RBA, a Relevant Person could, when assessing two Customers with near
identical risk profiles, consider that one is high-risk and the other low-risk. This may occur, for example, where both Customers may be from the same high-risk country, but one Customer may be a Customer in relation to a low-risk product, such as those in part (i) of the definition of a Prescribed Low Risk Customer, or may be a longstanding Customer of a Group company who has been introduced to the Relevant Person.
5. In Rule 7.2.2, ownership arrangements which may prevent the Relevant Person from
identifying one or more Beneficial Owners include bearer shares and other negotiable instruments in which ownership is determined by possession.
6. The geographical location of a Relevant Person's Customer may also affect the money
laundering risk assessment. The Regulator recommendsthat where a Relevant Person has Customers located in countries:
(a) without adequate AML strategies;
(b) where cash is the normal medium of exchange; (c) which have a politically unstable regime with high levels of public or private sector corruption; (d) which are known to be drug producing or drug transit countries; or (e) which have been classified as countries with inadequacies in their AML regulations, it should consider which additional "Know Your Customer" and monitoring procedures might be necessary to compensate for the enhanced risks of money laundering.
7. Such measures may encompass, for example, the following:
a. requiring additional documentary evidence; b. taking supplementary measures to verify or certify the documents supplied;
c. requiring that the initial Transaction is carried out through an account opened
in the Customer's name with a Financial Institution subject to AML or regulated in a FATF country;

Appendix 1
d. performing direct mailing of account opening documentation to a Customer at an independently verified address; or e. establishing telephone contact with a Customer prior to opening the account.
8. A Relevant Person should be able to aggregate and monitor significant balances and
activity in accounts on a consolidated basis when Customers have multiple accounts with the same institution but in offices located in different countries. Guidance on the term "Customer"
9. The point at which a Person becomes a Customer will vary from business to business.
However, the Regulator considers that it would usually occur at or prior to the business relationship being formalised, for example, by the signing of a Client agreement or the acceptance of terms of business.
10. The Regulator does not consider that a Person would be a Customer of a Relevant
Person merely because such Person receives marketing information from a Relevant Person or where a Relevant Person refers a Person who is not a Customer to a third party (including a Group member).
11. The Regulator considers that a counterparty would generally be a "Customer" for the
purposes of the AML Rulebook and would therefore require a Relevant Person to undertake CDD on such a Person. However, this would not include a counterparty in a Transaction undertaken on a Regulated Exchange. Nor would it include suppliers of ordinary business services for consumption by the Relevant Person such as cleaning, catering, stationery, IT or other similar services.
12. A Representative Office should not have any Customers in relation to its ADGM
operations.
Guidance on Restricted Scope Companies
13. The Restricted Scope Company is a corporate vehicle offering a greater degree of
confidentiality than other forms of corporate entity in ADGM. Restricted Scope Companies are not required to file accounts and are not required to audit their accounts. Restricted Scope Companies must file an annual return, articles, and details of their registered offices, directors and secretary (if they have one) with the Registrar.
14. Relevant Persons will know that the Restricted Scope Company is subject to less
onerous corporate disclosure requirements than other forms of corporate entity due to the requirement to have "(Restricted)" in the company's name. Given that only a Restricted Scope Company's constitution and details of its registered office will be available in a public register, Relevant Persons will be required to have a bilateral dialogue with the Restricted Scope Company in accordance with the RBA to obtain any other relevant information which is needed to assess the money laundering risks to which it is exposed.
15. Restricted Scope Companies should be forthcoming with regards to requests for
information by other Persons and entities for the purpose of their compliance with AML. In such cases, Restricted Scope Companies should not have difficulty in establishing business relationships with other Persons and entities in ADGM. The fact that Restricted Scope Companies are not subject to strict standards of disclosure of

Appendix 1
corporate documentation to a public registry should not be interpreted by Restricted Scope Companies to prohibit their providing of any relevant information for AML purposes. Guidance on high-risk Customers
16. In complying with Rule 7.2.1, the Regulator considers that a Relevant Person should
consider the following factors, which may indicate that a Customer poses a higher risk of money laundering:
a. the business relationship is conducted in unusual circumstances (e.g. significant unexplained geographic distance between the location of the Relevant Person and the Customer); b. Legal Persons or arrangements that are personal investment vehicles;
c. companies that have nominee shareholders or directors or shares in bearer
form; d. businesses that are cash-intensive; e. the ownership structure of the Legal Person appears unusual or excessively complex given the nature of the Legal Person's business or activities; f. countries identified by credible sources, such as mutual evaluation or detailed assessment reports or published follow-up reports, as not having adequate AML systems; g. countries subject to Sanctions or identified by credible sources as having significant levels of corruption or other criminal activity; h. countries or geographic areas identified by credible sources as providing funding or support for terrorist activities, or that have designated terrorist organisations operating within their country;
i. a Person not meeting the definition of a PEP but whose high profile or
influence poses an elevated risk of corruption; j. anonymous Transactions (which may include cash); k. private banking relationships;
l. non-face-to-face business relationships or Transactions;
m. payment received from unknown or unassociated third parties; n. discretionary trusts; and o. charitable trusts and waqfs.
17. The highest risk products or services in respect of money laundering are those where
unlimited third party funds can be freely received, or where funds can regularly be paid to third parties, without evidence of the identity of the third parties being taken.

Appendix 1
18. Money laundering risks are increased if a Person is able to hide behind corporate
structures such as limited companies, trusts, special purpose vehicles and nominee arrangements. When devising its internal procedures, a Relevant Person should consider how its Customers and operational systems impact upon the capacity of its staff to identify suspicious Transactions. Generally, the lowest risk products in respect of money laundering are those where funds can only be received from a named Customer by way of payment from an account held in the Customer's name, and where the funds can only be returned to the named Customer.
7.3 A flowchart outlining the customer risk-based assessment process is contained in A1.3.
7.1 Assessing customer Anti-Money Laundering risks
7.1.1 (1) A Relevant Person must:
(a) undertake a risk-based assessment of every customer; and (b) assign the customer a risk rating proportionate to the money laundering risks associated with the customer. (2) The customer risk assessment in (1) must be completed:
(a) prior to undertaking CDD for new customers; (b) on a periodic basis, in accordance with Rule 8.6.1(e); and (c) whenever it is otherwise appropriate for existing customers, including where the Relevant Person becomes aware of any change to the risk factors associated with the customer that might contribute to the potential for money laundering risk to increase materially. (3) When undertaking a risk-based assessment of a customer under (a), a Relevant Person must identify, assess and consider:
(a) the customer and any Beneficial Owner;
(b) the purpose and intended nature of the business relationship, and the nature of the customer’s business; (c) the nature, ownership and control structure of the customer, its beneficial ownership (if any) and its business; (d) the customer's country of origin, residence, nationality, place of incorporation or place of business; (e) the relevant product, service or Transaction; (f) in relation to life insurance or other similar insurance policy, the beneficiary of the policy and Beneficial Owner of the beneficiary; and (g) the outcomes of the business risk assessment undertaken under Chapter 6.

Appendix 1
7.1.2 (1) When undertaking a risk-based assessment of a customer and considering whether or
not to assign a high risk rating under 7.1.1(1), a Relevant Person must take into account all relevant risk factors that would reasonably apply to the customer, including but not limited to:
(a) customer risk factors, including whether the:
(i) business relationship is conducted in unusual circumstances; (ii) customer is resident, established, registered or conducts business in a geographical area or jurisdiction of high risk (as set out in paragraph (c)); (iii) customer is a Legal Person or legal arrangement that is a vehicle for holding personal assets; (iv) customer is a company that has nominee shareholders or shares in bearer form; (v) customer is a business that is cash intensive, such as a business that receives a majority of its revenue in cash; (vi) corporate structure of the customer or any group to which it belongs is unusual or excessively complex given the nature of the business; (b) product, service, transaction or delivery channel risk factors, including whether:
(i) the service involves private banking;
(ii) the product, service or transaction is one that might allow for anonymity or obfuscation of the true identity of any of the parties involved in the transaction; (iii) the situation involves non face-to-face business relationships or transactions, or lacks appropriate safeguards, such as electronic signatures; (iv) payments will be received from unknown or unassociated third parties; (v) the service involves the provision of nominee directors, nominee shareholders or shadow directors, or the formation of companies in another country; (vi) new products and new business practices are involved, including new delivery mechanisms or the use of new or developing technologies for both new and pre-existing products; and (c) geographical or jurisdictional risk factors, including whether the relevant country or countries:
(i) are identified by credible sources, as:

Appendix 1
(A) not having effective systems to counter money laundering; or (B) not implementing requirements to counter money laundering that are consistent with FATF Recommendations; (ii) are identified by credible sources as having significant levels of corruption or other criminal activity, such as terrorism, money laundering or the production and supply of illicit drugs; (iii) are subject to sanctions, embargos or similar measures issued by, for example, the United Nations or the State; (iv) are identified by credible sources as providing funding or support for terrorism; (v) have organisations operating within their territory that have been designated by the State, other countries or International Organisations as terrorist organisations. (2) For the purposes of 7.2.1(1)(c), a credible source includes, but is not limited to, mutual evaluations, detailed assessment reports or follow up reports issued by FATF, the International Monetary Fund (“IMF”), the World Bank, the OECD and other International Organisations.
7.1.3 (1) When undertaking a risk-based assessment of a customer and considering whether or
not to assign a low risk rating under 7.2.1(1), a Relevant Person must take into account all relevant risk factors that would reasonably apply to the customer, including but not limited to:
(a) customer risk factors, including whether the customer is:
(i) a public body or a publicly owned enterprise; (ii) resident, established, registered or conducts business in a geographical area or jurisdiction of lower risk (as set out in paragraph (c)); (iii) an Authorised Person; (iv) a Regulated Financial Institution that is subject to regulation and supervision, including Anti Money Laundering regulation and supervision, in a jurisdiction with Anti Money Laundering regulations that are equivalent to the standards set out in the FATF Recommendations; (v) a Subsidiary of a Regulated Financial Institution referred to in (iv), if the law that applies to the Parent ensures that the Subsidiary also observes the same Anti-Money Laundering standards as its Parent; (vi) a company whose Securities are listed by the Regulator, another Financial Services Regulator or a Regulated Exchange, which is subject to disclosure obligations broadly equivalent to those set out in the Market Rules;

Appendix 1
(vii) a law firm, notary firm or other legal business that carries on its business in ADGM; (viii) an accounting firm, insolvency firm, auditor or other audit firm that carries on its business in ADGM; (b) product, service, transaction or delivery channel risk factors, including whether the product or service is:
(i) a Contract of Insurance which is non-life insurance; (ii) a Contract of Insurance which is a life insurance product with no investment return or redemption or surrender value; (iii) an insurance policy for a pension scheme that does not provide for an early surrender option, and cannot be used as collateral; (iv) a pension, superannuation or similar scheme that satisfies the following conditions:
(A) the scheme provides retirement benefits to employees; (B) contributions to the scheme are made by way of deductions from wages; and (C) the scheme rules do not permit the assignment of a member’s interest under the scheme; (v) a product where the risks of money laundering are adequately managed by other factors such as transaction limits or transparency of ownership; and (c) geographical and jurisdictional risk factors, including whether a country or countries:
(i) are identified by credible sources as having effective systems to counter money laundering; (ii) are identified by credible sources as having a low level of corruption or other criminal activity, such as terrorism, money laundering, or the production and supply of illicit drugs; (iii) have been assessed by credible sources, as having::
(A) requirements to counter money laundering that are consistent with the FATF Recommendations; and (B) effectively implement FATF Recommendations. (2) For the purposes of (1)(c), a credible source includes, but is not limited to, mutual evaluations, detailed assessment reports or follow up reports issued by FATF, the IMF, the World Bank, the OECD and other International Organisations.

Appendix 1
Guidance on the term "customer"

The point at which a Person becomes a customer will vary from business to business.
However, the Regulator considers that it would usually occur at or prior to the business relationship being formalised, for example, by the signing of a client agreement or the acceptance by the customer of terms of business.
The Regulator does not consider that a Person would be a customer of a Relevant
Person merely because such Person receives marketing information from a Relevant Person or where a Relevant Person refers a Person who is not a customer to a third party (including a Group member).
The Regulator considers that a Counterparty would generally be a customer for the
purposes of the AML Rulebook and would therefore require a Relevant Person to undertake CDD on such a Person. However, this would not include a counterparty in a Transaction undertaken on a Regulated Exchange. Nor would it include suppliers of ancillary business services for consumption by the Relevant Person such as cleaning, catering, stationery, IT or other similar services.
A Representative Office should not have any customers in relation to its ADGM
operations.
Guidance on the Customer risk assessment
The risk assessment of a customer requires a Relevant Person to allocate an
appropriate risk rating to the customer. Risk ratings should be either descriptive, such as "low”, “medium” or "high", or a sliding, ordinal numeric scale such as 1 for the lowest risk to 10 for the highest, with at least three differentiated risk ratings.
Depending on the outcome of a Relevant Person's assessment of its customer's
money laundering risk, a Relevant Person should decide to what degree CDD will need to be performed. For a customer exhibiting significant potential risk for money laundering, the Relevant Person is required to carry out Enhanced CDD under Rule 8.4, in addition to the normal CDD required under Rule 8.3. For a customer rated low risk, the Relevant Person may be able to carry out Simplified CDD under Rule 8.5. For any other customer, the Relevant Person must undertake CDD under Rule 8.3.
Using the RBA, a Relevant Person could, when assessing two customers with near
identical risk profiles, consider that one is high-risk and the other low-risk. This may occur, for example, where both Customers may be from the same high-risk country, but one Customer may be a Customer in relation to a low-risk product, or may be a long-standing Customer of a Group company which has been introduced to the Relevant Person. Guidance on high risk customers
When assessing the risk factors referred to in 7.2.2(1), Relevant Persons must bear in
mind that the presence of one or more risk factors may not always indicate a high risk of money laundering in a particular situation.
An example of a business relationship conducted in unusual circumstances, for the
purposes of Rule 7.2.2 (1)(a)(i), would include, but is not limited to a business relationship or proposed business relationship that involves, or would involve,

Appendix 1
significant unexplained geographic distance between the location of the Relevant Person and the customer or proposed customer.
3. The highest risk products or services in respect of money laundering are those where
unlimited third party funds can be freely received from or paid to third parties, without evidence of the identity of the third parties being obtained and the identity being verified.
4. Money laundering risks are likely to be increased if a Person is able to hide behind
corporate structures such as limited companies, trusts, special purpose vehicles and nominee arrangements. When devising its internal procedures, a Relevant Person should consider how its customers and operational systems impact upon the capacity of its staff to identify suspicious Transactions. Generally, the lowest risk products in respect of money laundering are those where funds can only be received from a named customer by way of payment from an account held in the customer's name, and similarly where the funds can only be remitted to a named customer. Guidance on low risk customers When assessing the risk factors referred to in 7.2.3 (1), a Relevant Person must bear in mind that the presence or absence of one or more risk factors may not always indicate a high or low risk of money laundering respectively in a particular situation.
7.2 Prohibition on Establishing Business Relationships with Certain Customers
7.2.1 A Relevant Person must not establish a business relationship with a customer that is a Legal
Person or Legal Arrangement if the ownership or control arrangements of the customer prevents the Relevant Person from identifying one or more of the customer's Beneficial Owners.
7.2.2 A Relevant Person must not establish or maintain a business relationship with a Shell Bank.
7.2.3 A Relevant Person must not knowingly establish or maintain an anonymous account, an
account in a fictitious name, or a nominee account which is held for the benefit of another person whose true identity has not been disclosed to the Relevant Person. Guidance

In Rules 7.2.1, ownership arrangements which may prevent the Relevant Person from
identifying one or more Beneficial Owners include bearer shares and other negotiable instruments in which ownership is determined by possession.
A Shell Bank is a bank that has no physical presence in the country in which it is
incorporated and licensed, and which is unaffiliated with a regulated financial Group that is subject to effective consolidated supervision. The Regulator does not consider that the existence of a local agent or low-level staff constitutes physical presence.
7.2.4 If a Relevant Person uses a numbered account with an abbreviated name, it must ensure that:
(a) such an account is used only for internal purposes; (b) it has undertaken the same CDD procedures in relation to the account holder as are required for other account holders;

Appendix 1
(c) it maintains the same information in relation to the account and account holder as is required for other accounts and account holders; and (d) staff performing AML functions, including staff responsible for identifying and monitoring transactions for suspicious activity, and staff performing compliance and audit functions, have full access to information about the account and the account holder. Guidance on anonymous accounts A Relevant Person should note that, in addition to the prohibition in Rule 7.2.3 against knowingly establishing anonymous accounts, accounts in a fictitious name or nominee accounts, the Federal AML legislation also prohibits the opening of accounts held under borrowed, mock or fake names or accounts designated solely with numbers and without the names of account holders. Guidance on Restricted Scope Companies

A Restricted Scope Company is a corporate vehicle offering a greater degree of
confidentiality than other forms of corporate entity in ADGM. Restricted Scope Companies are not required to file accounts and are not required to have their accounts audited. Restricted Scope Companies must file an annual return, articles, and details of their registered offices, directors and secretary (if they have one) with the ADGM Registrar of Companies.
Relevant Persons will know that Restricted Scope Companies are subject to less
onerous corporate disclosure requirements than other forms of corporate entities due to the requirement to have "(Restricted)" in a company's name. Given that only the constitution and details of the registered office of a Restricted Scope Company will be available in a public register, a Relevant Person will be required to have a bilateral dialogue with the Restricted Scope Company, in accordance with the RBA, to obtain any other relevant information which it needs to assess the money laundering risks to which it is exposed.
Restricted Scope Companies should be forthcoming with relevant information in
response to requests by other Persons and entities for the purpose of the compliance of the latter with the requirements in the AML Rulebook. The fact that Restricted Scope Companies are not subject to strict standards of disclosure of corporate documentation to a public registry should not be interpreted by Restricted Scope Companies to limit or prohibit their providing of any relevant information to other Persons and entities for Anti-Money Laundering purposes.

Appendix 1
8. CUSTOMER DUE DILIGENCE
8.1 Requirement to undertake Customer Due Diligence
8.1.1 (1) A Relevant Person must:
(a) undertake CDD under Rule 8.3.1 for each of its Customers (including those it has assigned as low-risk) with or for whom the Relevant Person acts or proposes to act; and (b) in addition to (a), undertake Enhanced Customer Due Diligence under Rule
8.4.1 in respect of any Customer it has assigned as high-risk.
(2) A Relevant Person may undertake Simplified Customer Due Diligence in accordance with Rule 8.5.1 by modifying CDD under Rule 8.3.1 for any Customer falling within the following categories:
(a) Authorised Person;
(b) Recognised Body;
(c) a Credit Institution; or
(d) other Financial Institution (including publically listed companies in or outside of ADGM) covered by equivalent identification requirements as set out in Guidance 4 below.
8.1.1 (1) A Relevant Person that is an Authorised Person or a Recognised Body must undertake
CDD under Rule 8.3.1 where the Relevant Person:
(a) establishes a business relationship with a customer; (b) carries out an occasional Transaction for a customer that is of an amount of equal to or more than USD15,000; or (c) suspects a customer of, or a Transaction to be for the purposes of, money laundering; or (d) doubts the veracity or adequacy of any documents or information previously provided by, or obtained for, a customer in relation to (a), (b) or (c) above. (2) A Relevant Person that is a DNFBP must undertake CDD under Rule 8.3.1 where it:
(a) is a real estate agency and it prepares for or is involved in a Transaction, or the provision of real estate agency services to a Person, that involves the buying and selling of real property; (b) is a dealer in precious metals or precious stones and it is involved in a Transaction in cash that amounts to USD15,000 or more, whether or not the Transaction is executed in a single operation or in several operations that are or appear to be linked;

Appendix 1
(c) is a dealer in any saleable item of a price equal to or greater than USD15,000 and it is involved in a Transaction in cash that amounts to USD15,000 or more, whether or not the Transaction is executed in a single operation or in several operations that are or appear to be linked; (d) is an accounting firm, audit firm, insolvency firm or taxation consulting firm and it prepares for or is involved in the provision of accounting, auditing, insolvency or taxation consulting services to a Person; (e) is a law firm, notary firm or other independent legal business and it prepares for or is involved in the provision of legal or notarial services to another Person participating in financial or real property Transactions concerning the following activities:
(i) the buying and selling of real property;
(ii) the managing of client money, securities or other assets; (iii) the management of bank, savings or securities accounts; (iv) the organisation of contributions for the creation, operation or management of companies; or (v) the creation, operation or management of legal persons or arrangements, and buying and selling of business entities; or (f) is a Company Service Provider and it prepares for or is involved in the provision of any of the following services to another Person:
(i) acting as a formation agent of Legal Persons or Legal Arrangements; (ii) acting as (or arranging for another Person to act as) a director or secretary of a company, a partner of a partnership, or a similar position in relation to other Legal Persons or Legal Arrangements; (iii) providing a registered office, business address or accommodation, correspondence or administrative address for a company, a partnership or any other Legal Person or Legal Arrangement; (iv) acting as (or arranging for another Person to act as) a trustee of an express trust or performing the equivalent function for another form of Legal Arrangement; or (v) acting as (or arranging for another Person to act as) a nominee shareholder for another Person. (3) In addition to undertaking CDD in accordance with Rule 8.3.1, a Relevant Person must undertake Enhanced CDD in accordance with Rule 8.4.1 for each of its customers assigned a high risk rating; (4) A Relevant Person may undertake Simplified CDD in accordance with Rule 8.5.1 by modifying the CDD undertaken in accordance with Rule 8.3.1 for any customer assigned a low risk rating.

Appendix 1
8.1.2 (1) The obligations must, subject to Rule 8.1.2(3), be fulfilled before the Relevant Person
effects any Transaction on behalf of the Customer.
(2) It is a Relevant Person's responsibility when it next has contact with a Customer who was an existing Customer, prior to the Relevant Person's authorisation by the Regulator, to assess whether it has performed the identification of that Customer which would have been required had these Rules been applicable when the Customer became a Customer, and to obtain without delay any missing information or evidence about the true identity of all relevant parties. (3) A Relevant Person does not have to fulfil the obligations under Rules 8.1.2(1) and 8.1.2(2) before effecting a Transaction for a Customer where it has, on reasonable grounds, established that:
(a) following a preliminary risk assessment, the proposed Transaction presents a low-risk in relation to Money Laundering and terrorist financing; (b) doing so would interrupt or delay the normal course of business in respect of effecting the Transaction; and (c) the Transaction is in respect of electronic money, Investment Business or Insurance Business. (4) Where the Relevant Person is unable to establish and verify the identity of the Customer referred to in Rule 8.1.2(3) including, where applicable, any beneficiaries, Beneficial Owners or trustees, within the 30 days following receipt of the Customer's instruction, it must:
(a) consider the circumstances and determine whether to make an internal Suspicious Activity Report to the MLRO; (b) where it has determined that it is unnecessary to make such a report, return to the Customer any monies associated with the Transaction, excluding any reasonable costs incurred by the Relevant Person; (c) where it has determined to make such a report, not return any monies or provide any Investments to the Customer, unless instructed to do so by the MLRO and otherwise act in accordance with instructions issued by the MLRO; and (d) not establish any further business relationship with that Customer until the verification process has been completed for that Customer in accordance with these Rules.
8.1.2 (1) A Relevant Person must also apply CDD measures to each existing customer under
Rules 8.3.1, 8.4.1 or 8.5.1:
(a) with a frequency appropriate to the outcome of the risk-based approach in relation to each customer; and (b) when the Relevant Person becomes aware that any of circumstances relevant to its risk assessment for a customer has changed.

Appendix 1
(2) For the purposes of 8.1.2(1), in determining when it is appropriate to apply CDD measures in relation to existing customers, a Relevant Person must take into account, amongst other things:
(a) any indication that the identity of the customer, or the customer’s Beneficial Owner, has changed; (b) any Transactions that are not reasonably consistent with the Relevant Person’s knowledge of the customer; (c) any change in the purpose or intended nature of the Relevant Person’s relationship with the customer; or (d) any other matter that might affect the Relevant Person’s risk assessment of the customer. Guidance

A Relevant Person should undertake appropriate CDD in a manner proportionate to
the customer's money laundering risks. This means that all customers are subject to CDD under Rule 8.3.1. However, for high-risk customers, additional Enhanced Customer Due Diligence measures should also be undertaken under Rule 8.4.1. For customers having a low-risk rating, the requirements under Rule 8.3.1may be modified according to the assessed risk, in accordance with Rule8.5.1.
The frequency for undertaking CDD for existing customers will be determined by the
risk rating assigned to a particular customer. The Regulator expects that customers rated high risk for money laundering should be reviewed more frequently than customers rated lower risk for money laundering.
8.1.3 (1) A Relevant Person must:
(a) undertake periodic reviews to ensure that the information and documentation concerning a Customer's identity remains appropriate, accurate and up-to-date; and (b) conduct on-going due diligence on its business relationship with, and ongoing scrutiny of Transactions undertaken by, a Customer throughout the course of the relationship. (2) If, at any time, a Relevant Person becomes aware that it lacks sufficient information or documentation concerning a Customer's identification, or develops a concern about the accuracy of its current information or documentation, it must promptly obtain appropriate material to verify the Customer's identity. Guidance
A Relevant Person should undertake CDD in a manner proportionate to the
Customer's money laundering risks identified under Rule 7.2.1(1). This means that all Customers are subject to CDD under Rule 8.3.1. However, for high-risk Customers, additional Enhanced Customer Due Diligence measures should also be undertaken under Rule 8.4.1. For low-risk Customers, Rule 8.3.1 may be modified according to the risks in accordance with Rule 8.5.1.

Appendix 1
2. Subject to the exception for Simplified Customer Due Diligence, in establishing and
verifying a Customer's true identity, a Relevant Person must obtain sufficient and satisfactory evidence of that identity, having considered its risk assessment in respect of the Customer and a Relevant Person must update, as appropriate, any Customer identification policies, procedures, systems and controls.
3. Subject to the exception for Simplified Customer Due Diligence, whenever a Relevant
Person comes into contact with a Customer with or for whom it acts or proposes to act, it must establish whether the Customer is acting on his own behalf or on behalf of another Person, and a Relevant Person must establish and verify the identity of both the Customer and any other Person on whose behalf the Customer is acting, including that of the Beneficial Owner of the relevant funds, which may be the subject of a Transaction to be considered, and must obtain sufficient and satisfactory evidence of their identities. A Relevant Person should obtain a statement from a prospective Customer to the effect that he is, or is not, acting on his own behalf. In cases where the Customer is acting on behalf of third parties, it is recommended that the Relevant Person obtain a written statement, confirming the statement made by the Customer, from the parties, including the Beneficial Owner.
4. An institution falls within Rule 8.1.1(2)(c) if it is:
a. a Credit Institution or other Financial Institution whose entire operations are subject to regulation, including AML, by:
i. a Non-ADGM Financial Services Regulator in a FATF country; or
ii. another relevant authority in a FATF country; or
iii. is publically listed in or outside of ADGM; or
b. a Subsidiary of a Credit Institution or other Financial Institution referred to in a., provided that the Parent Credit Institution or other Financial Institution ensures that the Subsidiary also observes the same provisions.
5. A Relevant Person must take reasonable steps to determine whether or not a
Customer falls within the exceptions under Rule 8.1.2(3), and, if applicable, must keep records of the basis on which a Customer was considered to fall within an exception.
6. A Relevant Person is required to be satisfied that a prospective Customer is who he
claims to be and to obtain evidence to prove this. "Know Your Customer" and knowing the Persons with or for whom the Customer acts or proposes to act, consists of several aspects:
a. personal details: a Relevant Person should obtain and verify details which include the true full name or names used and the current permanent address; b. the nature and level of business to be conducted: a Relevant Person should ensure that sufficient information is obtained regarding the nature of the business that the Customer expects to undertake, and any expected or predictable pattern of Transactions. This information should include the purpose and reason for opening the account or establishing the business relationship, the anticipated level and nature of the activity that is to be

Appendix 1
undertaken and the various relationships of signatories to the account and the underlying Beneficial Owners;
c. the origin of funds: a Relevant Person should identify how all payments were
made, from where and by whom. All payments should be recorded to provide an audit trail; and d. the Source of Wealth: a Relevant Person should establish a Source of Wealth or income, including how the funds were acquired, to assess whether the actual Transaction pattern is consistent with the expected Transaction pattern and whether this constitutes any grounds for suspicion of money laundering.
7. It is important for a Relevant Person to obtain such information because this process
should allow the risk of being exploited for the purpose of money laundering to be reduced to a minimum. It should also enable suspicious Transactions to be detected because they are incompatible with the information received.
8. Any unusual facts of which a Relevant Person becomes aware during the identification
process may be an indication of money laundering and should prompt the Relevant Person to request supplementary information and evidence.
9. The Regulator expects a Relevant Person to establish the full identity of all relevant
parties to the business relationship. Further, a Relevant Person should apply adequate measures to enable it to understand the relationship between the counterparties involved. The following list includes some identification checks for particular relationships:
a. joint account holders and joint applicants: identification should be performed and evidence obtained for all applicants and account holders; b. pooled accounts which are managed by professional intermediaries such as mutual funds, pension funds, money funds, lawyers and stockbrokers on behalf of entities or other Persons: all Beneficial Owners of the account held by the intermediary should be identified;
c. power of attorney: identification and evidence should be obtained for the
applicants and account holders as well as for the holder of the power of attorney; and d. minors: an account for a minor should be opened by a family member or guardian whose identification evidence should be obtained in addition to the birth certificate or passport of the minor.
8.2 Timing of Customer Due Diligence
8.2.1 (1) A Relevant Person must:
(a) undertake the appropriate CDD under Rule 8.3.1(a) to (c) when it is establishing a business relationship with a Customer; and

Appendix 1
(b) undertake the appropriate CDD under Rule 8.3.1(d) after establishing a business relationship with a Customer. (2) A Relevant Person must also conduct appropriate CDD if, at any time:
(a) in relation to an existing Customer, it doubts the veracity or adequacy of documents, data or information obtained for the purposes of CDD; (b) it suspects money laundering in relation to a Person; or (c) there is a change in risk-rating of the Customer, or it is otherwise warranted by a change in circumstances of the Customer. (3) A Relevant Person may establish a business relationship with a Customer before completing the verification required by Rule 8.3.1 if the following conditions are met:
(a) deferral of the verification of the Customer or Beneficial Owner is necessary in order not to interrupt the normal conduct of a business relationship; (b) there is little risk of money laundering occurring and any such risks identified can be effectively managed by the Relevant Person; (c) in relation to a bank account opening, there are adequate safeguards in place to ensure that the account is not closed and Transactions are not carried out by or on behalf of the account holder (including any payment from the account to the account holder) before verification has been completed; and (d) subject to (4), the relevant verification is completed as soon as reasonably practicable and in any event no later than 30 days after the establishment of a business relationship. (4) Where a Relevant Person is not reasonably able to comply with the 30 day requirement in (3)(d), it must, prior to the end of the 30 day period:
(a) document the reason for its non-compliance; (b) complete the verification in (3) as soon as possible; and (c) record the non-compliance event in its annual AML Return in accordance with Rule 15.5. (5) The Regulator may specify a period within which a Relevant Person must complete the verification required by (3) failing which the Regulator may direct the Relevant Person to cease any business relationship with the Customer. Guidance

For the purposes of Rule 8.2.1(2)(a), examples of situations which might lead a
Relevant Person to have doubts about the veracity or adequacy of documents, data or information previously obtained could be where there is a suspicion of money laundering in relation to that Customer, where there is a material change in the way that the Customer's account is operated which is not consistent with the Customer's

Appendix 1
business profile, or where it appears to the Relevant Person that a Person other than the Customer is the real Customer.
2. In Rule 8.2.1(3)(a), situations that the Relevant Person may take into account include,
for example, accepting subscription monies during a short offer period or executing a time critical Transaction which, if not executed immediately, would or may cause a Customer to incur a financial loss due to price movement or loss of opportunity or when a Customer seeks immediate insurance cover.
3. When complying with Rule 8.2.1, a Relevant Person should also, where relevant,
consider Rule 8.7.1 regarding failure to conduct or complete CDD and Chapter 14 regarding Suspicious Activity Reports and tipping off.
4. For the purposes of Rule 8.2.1(3)(d), the Regulator considers that in most situations
as soon as reasonably practicable would be within 30 days after the establishment of a business relationship. However, it will depend on the nature of the Customer business relationship.
8.2.1 (1) For a Relevant Person that is an Authorised Person or Recognised Body:
(a) the appropriate CDD obligations must, subject to (1)(b), must be fulfilled before the Relevant Person undertakes any Transaction on behalf of the customer or when undertaking an occasional transaction under 8.1.1(1)(b). (b) the Relevant Person does not have to fulfil the verification of the identity of a customer and Beneficial Owner obligations under the AML Rules before undertaking a Transaction for a customer or occasional transaction where it has, on reasonable grounds, established that:
(i) there is little risk of money laundering and that risk is effectively managed; and (ii) doing so would interrupt or delay the normal course of business in respect of effecting the Transaction. (2) (a) A Relevant Person that is a DNFBP must fulfil the appropriate CDD obligations before the Relevant Person prepares for or carries out a Transaction or provision of a service in Rule 8.1.1(2) (a), (d), (e) or (f). (b) A Relevant Person that is a DNFBP as a result of carrying on one or more of the business activities referred to in Rule 8.1.1(2) (b) or (c) must fulfil the appropriate CDD obligations before the Relevant Person prepares for or carries out a transaction in cash that amounts to USD 15,000 or more, whether in a single operation or several operations that are or appear to be linked. (3) The Relevant Person does not have to fulfil the verification of the identity of a customer and Beneficial Owner obligations under the AML Rules preparing for or carrying out a Transaction for its customer concerning those business activities referred to in Rule 8.1.1(2) where it has, on reasonable grounds, established that:
(i) there is little risk of money laundering and that risk is effectively managed; and

Appendix 1
(ii) doing so would interrupt or delay the normal course of business in respect of effecting the Transaction. (4) A Relevant Person that has relied on Rule 8.2.1(1)(b) or 8.2.1(3) must fulfil its CDD obligations as soon as practicable after effecting the Transaction. (5) Where the Relevant Person, having relied on Rule 8.2.1(1)(b) or 8.2.1(3) is unable to complete the verification of the identity of a customer and any Beneficial Owner, within thirty days of effecting a Transaction or occasional transaction it must:
(a) consider the circumstances and determine whether to make an internal Suspicious Activity Report to the MLRO; (b) where it has determined that it is unnecessary to make such a report, return to the customer any monies associated with the Transaction or occasional transaction, excluding any reasonable costs incurred by the Relevant Person; (c) where it has determined that it is necessary to make such a report, not return any monies or provide any Investments to the customer, unless instructed to do so by the MLRO and otherwise act in accordance with instructions issued by the MLRO; and (d) not establish any further business relationship with that customer until the verification process has been completed for that customer in accordance with these Rules.
8.2.2 (1) A Relevant Person must ensure that its Anti-Money Laundering systems and controls
referred to in Rule 6.2.1 include risk management policies and procedures concerning the conditions under which business relationships may be established with a customer before completing verification of the identity of a customer and Beneficial Owner. Guidance

Examples of situations that might lead a Relevant Person to have doubts about the
veracity or adequacy of documents, data or information previously obtained might be where: there is a suspicion of money laundering in relation to that customer; there is a material change in the way that the customer's account is operated which is not consistent with the customer's business profile; or it appears to the Relevant Person that a Person other than the nominal customer is the real customer.
Situations that the Relevant Person may take into account include, for example,
accepting subscription monies during a short offer period or executing a time critical Transaction which, if not executed immediately, would or may cause a customer to incur a financial loss due to price movement or loss of opportunity or when a customer seeks immediate insurance cover.
When complying with Rule 8.2.1, a Relevant Person should also, where relevant,
consider Rule 8.7.1 regarding failure to conduct or complete CDD and Chapter 14 regarding Suspicious Activity Reports and tipping off.

Appendix 1
8.3 Customer Due Diligence requirements
8.3.1 (1) In undertaking the CDD required by Rule 8.1.1(1)(a) a Relevant Person must:
(a) verify the identity of the Customer and any Beneficial Owner on the basis of original or properly certified documents, data or information issued by or obtained from a reliable and independent source; (b) understand the Customer's Source of Funds; (c) understand the Customer's Source of Wealth; and (d) undertake on-going due diligence of the Customer business relationship under Rule 8.6.1. (2) In complying with (1)(a) for life insurance or other similar policies, a Relevant Person must:
(a) verify the identity of any named beneficiaries of the insurance policy; and (b) verify the identity of the Persons in any class of beneficiary, or where these are not identifiable, ensure that it obtains sufficient information to be able to verify the identity of such Persons at the time of payout of the insurance policy. (3) A Relevant Person must have systems and controls in place to determine whether a Customer, or a Beneficial Owner of the Customer, is a PEP. If so, a Relevant Person must ensure that, in addition to (1) it also:
(a) increases the degree and nature of monitoring of the business relationship, in order to determine whether the Customer's Transactions or activities appear unusual or suspicious; and (b) obtains the approval of Senior Management to commence a business relationship with the Customer, unless the Customer is a Prescribed Low Risk Customer.
8.3.2 Subject to Rule 8.3.3, a Relevant Person is not required to establish:
(1) whether a Customer is acting on its own behalf; or (2) the Beneficial Owner(s) of the relevant funds, if the Relevant Person's Customer is a Person falling within Rule 8.1.1(2).
8.3.3 (1) Rules 8.1.1(2) and 8.3.2 do not apply where the Relevant Person:
(a) knows or suspects; or
(b) has reasonable grounds to know or suspect,

Appendix 1
that a Customer or a Person on whose behalf the Customer is acting, is engaged in Money Laundering. (2) The Relevant Person will be taken to have the knowledge or suspicion or to have reasonable grounds to have the knowledge or suspicion referred to in paragraph (1) if:
(a) any Employee handling the Transaction or potential Transaction; or (b) anyone managerially responsible for it, knows or suspects, or has reasonable grounds to know or suspect, that a Customer or a Person on whose behalf the Customer is acting is engaged in Money Laundering. Guidance on CDD

A Relevant Person is expected to establish to its satisfaction the true identity of a
Customer and any other Person on whose behalf the Customer is acting, including that of the Beneficial Owner of the relevant funds which may be the subject of a Transaction to be considered. The Relevant Person should verify that it is dealing with a true and existing Person. It also should obtain evidence of verification that is sufficient to establish that the Person is indeed who he claims to be. Because of the high degree of risk sensitivity needed to comply with CDD, the following (which is not meant to be exhaustive) sets out Guidance regarding the type of information and evidence which should be obtained by a Relevant Person to establish and verify the identity of a Customer. The standard of verification, taking into account the risk-based approach and circumstances where there are no original documents, is also set out below. Individuals
A Relevant Person should, in complying with Rule 8.3.1(1)(a), and adopting the RBA,
obtain, verify and record, for every Customer who is a Natural Person, the following identification information in either documentary (hard copy) or electronic form:
a. true full name (or names) used; b. date and place of birth;
c. nationality;
d. complete current permanent address, including all relevant details with regard to country of residence; and e. telephone and email address.
Items 2a. to 2c. above should be obtained by sighting a current valid passport or,
where a Customer does not own a passport, an official identification document which includes a photograph.
The following additional information may be requested depending on the facts and
the nature and size of the transaction or the business relationship:

Appendix 1
a. occupation or profession, name of employer and location of activity; b. information regarding the nature of the business to be conducted;
c. information regarding the origin of the funds;
d. legal domicile or fiscal residence; and e. information regarding the Source of Wealth or income.
5. The concept of domicile referred to at item 4d. above generally refers to the place
which a Person regards as his permanent home and with which he has the closest ties or which is his place of origin.
6. The address of a prospective Customer should enable a Relevant Person to physically
locate the Customer. If P.O. Box numbers are customary to a country, additional methods of physically locating the Customer should be applied.
7. Documentary evidence of identity:
a. current, signed passport; b. current, signed ID card; or
c. other identification documentation that is customary in the country of
residence, such as a driving licence, including a clear photograph of the prospective Customer.
8. A Relevant Person should ensure that any documents used for the purpose of
identification are original documents.
9. Where personal identity documents, such as a passport, ID card or other identification
documentation cannot be obtained in original form, for example because a Relevant Person has no physical contact with the Customer, the identification documentation provided should be certified as a true copy of the original document by any one of the following:
a. a registered lawyer; b. a registered notary;
c. a chartered accountant;
d. a government ministry; e. a post office; f. a police officer; or g. an embassy or consulate. The individual or authority undertaking the certification should be contactable if necessary.

Appendix 1
Where a copy of an original identification document is made by a Relevant Person, the copy should be dated, signed and marked with 'original sighted'.
10. Documentary evidence of address:
a. record of home visit; b. confirmation from an electoral register search that a Person of such a name lives at that address;
c. tenancy agreement;
d. utility bill; or e. local authority tax bill.
Unincorporated businesses or partnerships
11. Evidence to be obtained in either documentary or electronic form:
a. true full name or names; b. complete current registered and trading address, including relevant details with regard to country of establishment;
c. telephone number and email address;
d. fiscal residence; e. business activity; f. information on the nature of the business to be conducted; g. trading licence, with renewal date; h. a list of authorised signatories of the business or partnership;
i. regulatory body, if applicable;
j. information regarding the origin of funds; and k. information regarding the Source of Wealth/income.
12. Documentary evidence of identity:
a. the latest annual report and accounts, audited where applicable; and b. a certified copy of the partnership deed, to ensure that it has a legitimate purpose and to ascertain the nature of the business or partnership.
13. Evidence of the trading address of the business or partnership should be obtained and
may be verified with a visit to the place of business.
Guidance on Restricted Scope Companies

Appendix 1
14. The Restricted Scope Company is a corporate vehicle offering a greater degree of
confidentiality than other forms of corporate entity in ADGM. Restricted Scope Companies are not required to file accounts and are not required to audit their accounts. Restricted Scope Companies must file an annual return, articles, and details of their registered offices, directors and secretary (if they have one) with the Registrar.
15. Relevant Persons will know that the Restricted Scope Company is subject to less
onerous corporate disclosure requirements than other forms of corporate entity due to the requirement to have "(Restricted)" in the company's name. Given that only a Restricted Scope Company's constitution and details of its registered office will be available in a public register, Relevant Persons will be required to have a bilateral dialogue with the Restricted Scope Company in accordance with the RBA to obtain any other relevant information which is needed to assess the money laundering risks to which it is exposed.
16. Evidence to be obtained in either documentary or electronic form:
a. true full name or names; b. registered address;
c. telephone number and email address;
d. fiscal residence; e. business activity; f. information regarding the origin of funds; g. information regarding the Source of Wealth/income; and h. the latest annual report and accounts, audited where applicable. Corporate entities including Financial Institutions or Credit Institutions that are not covered by an exemption, including Financial Institutions or Credit Institutions that are not regulated by the Regulator or regulated in a FATF country
17. Evidence to be obtained in either documentary or electronic form:
a. registered corporate name and any trading names used; b. complete current registered address and any separate principal trading addresses, including all relevant details with regard to country of residence;
c. telephone number and email address;
d. date and place of incorporation; e. corporate registration number; f. fiscal residence; g. business activity;

Appendix 1
h. regulatory body, if applicable;
i. name and address of Group, if applicable;
j. legal form; k. name of external auditor;
l. information regarding the nature and level of the business to be conducted;
m. information regarding the origin of the funds; and n. information regarding the Source of Wealth/income.
18. Documentary evidence of identity:
a. copy of the extract of the register of the regulator or exchange, or state law or edict creating the entity, in case of regulated, listed or state-owned companies; b. certified copy of the articles of association or statutes;
c. certified copy of either the certificate of incorporation or the trade register
entry and the trading licence, including the renewal date; d. latest annual report, audited and published if applicable; e. certified copies of the list of authorised signatories specifying who is authorised to act on behalf of the Customer account and of the board resolution authorising the signatories to operate the account; f. certified copies of the identification documentation of the authorised signatories; g. names, country of residence, nationality of Directors or partners and of the members of the Governing Body; and h. list of the main shareholders holding more than 5% of the issued capital.
19. If the applying Customer is not obliged to publish an audited annual report, adequate
information about the financial accounts should be obtained.
20. A Relevant Person should verify that the applying Customer is active and has not been,
or is not in the process of being dissolved, wound-up or terminated. Trusts, nominees and fiduciaries
21. In addition to the identification documentation listed under 'corporate entities'
(Paragraphs 17 to 20 above), the following information and documentation should be obtained:
a. identity of any settlor, the trustee and any principal controller who has the power to remove the trustee, as well as the identity of the Beneficial Owner;

Appendix 1
b. a certified copy of the trust deed, to ascertain the nature and purpose of the trust; and
c. documentary evidence of the appointment of the current trustees.
22. A Relevant Person should ensure that it is advised about any changes concerning the
individuals who have control over the funds, and concerning the Beneficial Owners.
23. Where a trustee, principal controller or Beneficial Owner who has been identified is
about to be replaced, the identity of the new trustee, principal controller or Beneficial Owner should be verified before they are allowed to exercise control over the funds. Authorised Persons and Recognised Bodies regulated by the Regulator or Financial Institutions or Credit Institutions regulated in a FATF country
24. Pursuant to the exception under Simplified Customer Due Diligence, identification
evidence is generally not required for Customers of a firm who are themselves Authorised Persons, Auditors, Recognised Clearing Houses or Recognised Investment Exchanges registered or regulated by the Regulator or are Financial Institutions or Credit Institutions regulated by any FATF country's relevant Non-ADGM Financial Services Regulator or other relevant regulatory authority or regulator.
25. However, the confirmation of the existence of such a relevant firm or institution and
its regulatory status, including the application of AML applying in the ADGM or equivalent AML provisions, should be verified by the Relevant Person prior to entering into a Customer relationship. Regular professional and commercial checks and due diligence investigations should still be performed. The Relevant Person should verify the regulatory status of the firm or institution by one of the following means:
a. requesting confirmation from the relevant Non-ADGM Financial Services Regulator or other relevant regulatory authority, regulator, body, or home country Central Bank; or b. requesting a certified copy of a relevant licence or authorisation to conduct financial or banking business from the firm or institution. Clubs, cooperative, charitable, social or professional societies
26. A Relevant Person should take steps to satisfy itself as to the legitimate purpose of
clubs and societies by, for example, obtaining a certified copy of the constitution of the organisation.
27. The identity of the principal signatories and controllers should be verified in
accordance with the requirements for private individuals. The capacity of the signatories to act on behalf of the club or society and the identity of Beneficial Owners of the funds should be established and verified.
28. A Relevant Person should consider the following items while completing the Customer
identification requirements for a Client which is a charitable society:
a. whether the charity is licensed or permitted by a regulatory authority, regulator or government entity in its home country. (Note: charities in the U.A.E. are required to obtain from the U.A.E. Minister of Labour and Social

Appendix 1
Affairs a certificate which confirms their identity, permits them to open bank accounts and states whether they are permitted to collect donations and make financial transfers outside the U.A.E. through such bank accounts); b. the type and quality of regulation to which the charity is subject in its home state;
c. the structure and overall character of management and trustees;
d. whether the charity allows donors to specify beneficiaries. If yes, then it would be prudent to ensure that such charities are closely regulated; e. the pattern of beneficiaries: a small number of targeted beneficiaries could indicate potential risks; f. whether the charity and its functioning is dominated by a few large donors and the pattern of donors; and g. whether it is a private foundation as, if it is, it is more likely to be dominated by a single donor and linked to a small number of beneficiaries which will necessitate scrutiny of both the donor and the beneficiaries.
29. The Regulator may, from time to time:
a. review the relevant guidance in light of changing money laundering legislation issued by the U.A.E. Central Bank, money laundering trends and techniques and according to international standards, in order to keep the guidance current; and b. provide such other guidance as it deems appropriate regarding Customer identification obligations.
30. The Regulator expects that a Relevant Person will take these changes into account by
amending, as appropriate, its policies, procedures, systems and controls.
31. Sound "Know Your Customer" arrangements have particular relevance to the safety
and soundness of a Relevant Person, in that:
a. they help to protect its reputation and the integrity of the ADGM by reducing the likelihood of Relevant Persons becoming a vehicle for, or a victim of, financial crime and suffering consequential reputational damage; and b. they constitute an essential part of sound risk management, for example by providing the basis for identifying, limiting and controlling risk exposures to assets and liabilities, including assets under management. Risk-Based Approach
32. Any inadequacy of "Know Your Customer" standards can expose Relevant Persons to
serious business operation and control risks.
33. In complying with Rule 8.3.1(1)(a), a Relevant Person should adopt an RBA for the
Customer identification and verification process. Depending on the money laundering

Appendix 1
risk assessment regarding the Relevant Person's Customer, the Relevant Person should decide to what level of detail the Customer identification and verification process will need to be performed. The risk assessment regarding a Customer should be recorded in the Customer file.
34. The RBA does not release a Relevant Person from its overall obligation to identify fully
and obtain evidence of Customer identification to the Regulator's satisfaction.
35. A Relevant Person is advised that in cases of doubt it should adopt a stricter rather
than a moderate approach in its judgement concerning the risk level and the level of detail to which Customer identification is performed and evidence obtained. No Original Documents
36. In complying with Rule 8.3.1(1)(a), it may not always be possible to obtain original
documents. Where identification documents cannot be obtained in original form, for example because a Relevant Person has no physical contact with the Customer, the Relevant Person should obtain a copy certified as a true copy by a Person of good standing such as a registered lawyer or notary, a chartered accountant, a bank manager, a police officer, an Employee of the Person's embassy or consulate, or other similar Person. The Regulator considers that downloading publicly-available information from an official source (such as a regulator's or other official government website) is sufficient to satisfy the requirements of Rule 8.3.1(1)(a). The Regulator also considers that CDD information and research obtained from a reputable company or information-reporting agency may also be acceptable as a reliable and independent source as would banking references and, on a risk-sensitive basis, information obtained from researching reliable and independent public information found on the internet or on commercial databases.
37. For higher risk situations the Regulator would expect identification information to be
independently verified, using both public and non-public sources. For lower risk situations, not all of the relevant identification information would need to be verified.
38. In complying with Rule 8.3.1(1)(b) and (c), a Relevant Person is required to
"understand" a Customer's Source of Funds and wealth. This would mean obtaining information from the Customer or from a publicly-available source on the Source of Funds and wealth. For a public company, this might be achieved by looking at their published accounts. For a natural or Legal Person, this might involve including a question on Source of Funds and wealth in an application form or Client questionnaire. Understanding a Customer's Source of Funds and wealth is also important for the purposes of undertaking on-going due diligence under Rule 8.3.1(1)(d).
39. An insurance policy which is similar to a life policy would include life-related
protection, or a pension, or investment product which pays out to the policy holder or beneficiary upon a particular event occurring or upon redemption. Guidance on verification of Beneficial Owner
40. In determining whether an individual meets the definition of a Beneficial Owner or
controller, regard should be had to all the circumstances of the case, in particular the size of an individual's legal or beneficial ownership in a Transaction. The question of

Appendix 1
what is a "small" ownership interest for the purposes of the definition of a Beneficial Owner will depend on the individual circumstances of the Customer. The Regulator considers that the question of whether an ownership interest is small should be considered in the context of the Relevant Person's knowledge of the Customer and the Customer risk assessment and the risk of money laundering.
41. When verifying Beneficial Owners under Rule 8.3.1(1)(a), a Relevant Person is
expected to adopt a substantive (as opposed to form over substance) approach to CDD for Legal Persons. Adopting a substantive approach means focusing on the money laundering risks of the Customer and the product/service and avoiding an approach which focuses purely on the legal form of an arrangement or sets fixed percentages at which Beneficial Owners are identified (or not). It should take all reasonable steps to establish and understand a corporate Customer's legal ownership and control and to identify the Beneficial Owner. The Regulator does not set explicit ownership or control thresholds in defining the Beneficial Owner because the Regulator considers that the applicable threshold to adopt will ultimately depend on the risks associated with the Customer, and so the Regulator expects a Relevant Person to adopt the RBA and justify on reasonable grounds an approach which is proportionate to the risks identified. A Relevant Person should not set fixed thresholds for identifying the Beneficial Owner without objective and documented justification as required by Rule 5.1.1. An overly formal approach to defining the Beneficial Owner may result in a criminal "gaming" the system by always keeping his financial interest below the relevant threshold.
42. The Regulator considers that in some circumstances no threshold should be used
when identifying Beneficial Owners because it may be important to identify all underlying Beneficial Owners in order to ensure that they are not associated or connected in some way. This may be appropriate where there are a small number of investors in an account or fund, each with a significant financial holding and the Customer-specific risks are higher. However, where the Customer-specific risks are lower, a threshold can be appropriate. For example, for a low-risk corporate Customer combined with a lower-risk product or service, a percentage threshold may be appropriate for identifying "control" of the Legal Person for the purposes of the definition of a Beneficial Owner.
43. For a retail investment fund which is widely-held and where the investors invest via
pension contributions, the Regulator would not expect the manager of the fund to look through to any underlying investors where there are none with any material control or ownership levels in the fund. However, for a closely-held fund with a small number of investors, each with a large shareholding or other interest, the Regulator would expect a Relevant Person to identify and verify each of the Beneficial Owners, depending on the risks identified as part of its risk-based assessment of the Customer. For a corporate health policy with defined benefits, the Regulator would not expect a Relevant Person to identify the Beneficial Owners.
44. Where a Relevant Person carries out identification and verification in respect of actual
and potential Beneficial Owners of a trust, this should include the trustee, the settlor, the protector, the enforcer, the beneficiaries, other Persons with power to appoint or remove a trustee and any Person entitled to receive a distribution, whether or not such Person is a named beneficiary.

Appendix 1
Guidance on Politically Exposed Persons and corruption
45. Individuals who have, or have had, a high political profile, or hold, or have held, public
office, can pose a higher money laundering risk to a Relevant Person as their position may make them vulnerable to corruption. This risk also extends to members of their families and to known close associates. PEP status itself does not, of course, incriminate individuals or entities. It does, however, put the Customer into a higher risk category.
46. Generally, a foreign PEP presents a higher risk of money laundering because there is
a greater risk that such Person, if he were committing money laundering, would attempt to place his money offshore where he is less likely to be recognised as a PEP and where it would be more difficult for law enforcement agencies in his home jurisdiction to confiscate or freeze his criminal property.
47. Due diligence to uncover information about PEPs can be time consuming and difficult,
requiring close fact checking of the names, dates of birth, photographs and identification numbers of individuals against reputable PEP lists. However, despite the development of such lists by certain vendors, as well as the United Nations' compilation of a list of heads of states which fall within the FATF definition of PEPs, there is no "official" centralised global PEP list. It is therefore left to each Relevant Person to determine whether they would like to internally develop their own database or list of PEPs as a due diligence tool.
48. Where a Customer relationship is maintained with a PEP, detailed monitoring and due
diligence procedures should include:
a. analysis of any complex structures, for example involving trusts or multiple jurisdictions; b. appropriate measures to establish the Source of Wealth;
c. development of a profile of expected activity for the business relationship in
order to provide a basis for Transaction and account monitoring; d. initial screening and due diligence prior to the account opening; e. Senior Management approval for the account opening; f. regular oversight of the relationship with a PEP by Senior Management; and g. ongoing and periodical screening of accounts opened by PEPs.
49. A Relevant Person is advised that Customer relationships with family members or
close associates of PEPs involve similar risks to those with PEPs themselves.
50. Corruption-related money laundering risk increases when a Relevant Person deals
with a PEP. Corruption may involve serious crimes and has become the subject of increasing global concern. Corruption offences are predicate crimes under Federal Law No. 4 of 2002.

Appendix 1
51. The Regulator considers that after leaving office a PEP may remain a higher risk for
money laundering if such Person continues to exert political influence or otherwise pose a risk of corruption. Guidance on Insurers
52. With regard to Insurers, the following "Know Your Customer" verification and
identification set out in this section should be taken into account.
53. An Insurer undertaking verification should establish to its satisfaction that every
verification subject exists. All verification subjects of joining applicants for Insurance Business should normally be verified. In the case of arrangements such as trusts, nominee companies and front companies, verification should include an assessment of the substance of the arrangement, for example in relation to settlors, trustees and beneficiaries.
54. An Insurer should carry out verification in respect of the parties entering into the
Contract of Insurance. On some occasions there may be underlying principals and, if this is the case, the true nature of the relationship between principals and the policyholders should be established and appropriate enquiries performed about the former, especially if the policyholders are accustomed to acting on their instructions. 'Principal' should be understood in its widest sense to include, for example, Beneficial Owners, settlors, controlling shareholders, Directors and major beneficiaries. Guidance on electronic money
55. The following factors will increase the risk of electronic money products being used
for money laundering or terrorist financing:
a. high, or no, Transaction or purse limits: the higher the value and frequency of Transactions, and the higher the purse limit, the greater the risk, particularly where Customers are permitted to hold multiple purses; b. frequent cross-border Transactions, unless within a single scheme, can give rise to difficulties with information sharing: dependence on counterparty systems increases the risk;
c. funding of purses by unverified parties presents a higher risk of money
laundering, whether it is the Customer who is unverified or a third party; d. funding of purses using cash offers little or no audit trail of the source of the funds and hence presents a higher risk of money laundering; e. funding of purses using electronic money products that have not been verified may present a higher risk of money laundering; f. the non-face-to-face nature of many products gives rise to increased risk; g. the ability of consumers to hold multiple purses (for example, open multiple accounts or purchase a number of cards) without verification of identity increases the risk;

Appendix 1
h. cash access, for example by way of ATMs, as well as an allowance for the payment of refunds in cash for purchases made using electronic money, will increase the risk;
i. increased product functionality may, in some instances, give rise to a higher
risk of money laundering (product functionality includes Person-to-business, Person-to-Person, and business-to-business transfers); j. products that feature multiple cards linked to the same account increase the utility provided to the user, but may also increase the risk of money laundering, particularly where the Customer is able to pass on linked 'partner' cards to anonymous third parties; k. segmentation of the business value chain, including use of multiple agents and outsourcing, in particular to overseas locations, may give rise to a higher risk; and
l. the technology adopted by the product may give rise to specific risks that
should be assessed.
56. Electronic money issuers should address the risks that are inherent in payments in a
similar manner to other retail products: by putting in place systems and controls that prevent money laundering and terrorist financing by detecting unusual Transactions and predetermined patterns of activity.
57. The systems and controls electronic money issuers put in place must be
commensurate with the money laundering and terrorist financing risk to which they are exposed. The detail of electronic money issuers' systems and controls will therefore vary. Examples include those that:
a. place limits on purse storage values, cumulative turnover or amounts transacted; b. can detect money laundering Transaction patterns;
c. will detect anomalies to normal Transaction patterns;
d. can identify multiple purses held by a single individual or group of individuals, such as the holding of multiple accounts or the 'stockpiling' of pre-paid cards; e. can look for indicators of accounts being opened with different electronic money issuers as well as attempts to pool funds from different sources; f. can identify discrepancies between submitted and detected information, for example between country of origin submitted information and the electronically-detected IP address; g. deploy sufficient resources to address money laundering risks, including, where necessary, specialist expertise for the detection of suspicious activity; h. allow collaboration with merchants that accept electronic money to identify and prevent suspicious activity; and

Appendix 1
i. restrict funding of electronic money products to funds drawn on accounts
held in the ADGM.
8.3.1 (1) In undertaking CDD a Relevant Person must:
(a) identify the customer and verify the customer’s identity including identification and verification of the identify of any Person purporting to act on behalf of the customer; (b) identify all the Beneficial Owners and take reasonable measures to verify the identity of the Beneficial Owners, such that the Relevant Person is satisfied that it knows who the Beneficial Owners are; (c) assess and understand and, as appropriate, obtain information on the purpose and intended nature of the business relationship; and (d) conduct on-going due diligence of the business relationship as required under Rule 8.6.1. (2) In addition to complying with (a), for life insurance or other similar policies a Relevant Person must:
(a) record the names of any beneficiaries named in the policy; (b) verify the identity of all Persons in all classes of beneficiary when a payout of the policy is due; (c) undertake the measures referred to in (a) and (b) as soon as the beneficiary of the policy is identified or designated; and (d) verify the identity of beneficiaries and any Beneficial Owners of a beneficiary before it makes a payout under the policy. (3) A Relevant Person must have systems and controls in place and take reasonable measures to determine whether:
(a) a customer,
(b) any Beneficial Owner of the customer; or
(c) for a life insurance or other similar policy, any beneficiary of the policy, or any Beneficial Owner of a beneficiary; is a PEP. (4) If a PEP is identified under (3), then the Relevant Person must, in addition to CDD under 8.3.1, undertake Enhanced CDD under 8.4.1.
8.3.2 (1) For the purposes of Rule 8.3.1(1)(a), a Relevant Person must identify a customer and
verify the customer’s identity in accordance with this Rule.
(2) If a customer is a natural person, a Relevant Person must obtain and verify information about the person’s:

Appendix 1
(a) full name (including any alias);
(b) date of birth;
(c) nationality;
(d) legal domicile; and
(e) current residential address (other than a post office box).
(3) If a customer is a Body Corporate, the Relevant Person must obtain and verify:
(a) the full name of the Body Corporate and any trading name; (b) the address of its registered office and, if different, its principal place of business; (c) the date and place of incorporation or registration; (d) a copy of the certificate of incorporation or registration; (e) the constitution of the Body Corporate; and (f) the full names of the members of its Governing Body and persons exercising a senior management position. (4) If a customer is a foundation, the Relevant Person must obtain and verify:
(a) a certified copy of the charter and by-laws of the foundation or any other documents constituting the foundation; and (b) documentary evidence of the appointment of the guardian or any other person who may exercise powers in respect of the foundation. (5) If a customer is a trust or other similar Legal Arrangement, the Relevant Person must obtain and verify:
(a) a certified copy of the trust deed or other documents that set out the nature, purpose and terms of the trust or arrangement; and (b) documentary evidence of the appointment of the trustee or any other person exercising powers under the trust or arrangement. Guidance on CDD The information required under 8.3.2(2)(a) and (b) should be obtained through a first-hand inspection of a current, valid passport or, where a customer does not own a passport, an official identification document which includes a photograph.
8.3.3 (1) For the purposes of Rule 8.3.1(1)(b), and subject to (4), a Relevant Person must
identify the Beneficial Owner of a Body Corporate in accordance with this Rule. (2) The Relevant Person must identify any natural person who:

Appendix 1
(a) owns or controls (in each case whether directly or indirectly), including through bearer share holdings or by other means, more than 25% of the shares or voting rights in the Body Corporate; or (b) controls the Body Corporate. (c) exercises ultimate control over the management of the Body Corporate. (3) For the purposes of (2)(b), a natural person controls a Body Corporate if such person:
(a) holds, directly or indirectly:
(i) more than 25% of the Body Corporate’s shares; (ii) more than 25% of the voting rights in the Body Corporate; or (iii) the right to appoint or remove a majority of the board of directors of the Body Corporate; or (b) has the right to exercise, or actually exercises, significant influence or control over the Body Corporate. (4) A Relevant Person is not required to comply with Rule 8.3.1(1)(b) if the customer is:
(a) a Listed Body Corporate; or
(b) a Body Corporate that is wholly-owned by the Federal Government of the United Arab Emirates, or by any of the governments of the member Emirates of the United Arab Emirates; or (c) a Body Corporate created by Emiri decree within the United Arab Emirates.
8.3.4 (1) For the purposes of Rule 8.3.1(1)(b), a Relevant Person must identify the Beneficial
Owner of a Partnership in accordance with this Rule.
(2) The Relevant Person must identify any natural person who:
(a) ultimately is entitled to or controls (in each case whether directly or indirectly) more than 25% share of the capital or profits of the Partnership or more than 25% of the voting rights in the Partnership; or (b) otherwise exercises ultimate control over the management of the Partnership.
8.3.5 (1) For the purposes of Rule 8.3.1(1)(b), a Relevant Person must identify the Beneficial
Owner of a customer that is a trustee of a trust or an equivalent position in respect of a similar Legal Arrangement in accordance with this Rule. (2) The Relevant Person must identify:
(a) the settlor of the trust;
(b) any other trustee(s) aside from the Customer;

Appendix 1
(c) each beneficiary of the trust;
(d) where the persons (or some of the persons) benefiting from the trust have not been determined, the class of persons in whose main interest, in the opinion of the Registrar, the trust has been established or operates; and (e) any natural person who has control over the trust. (3) For the purposes of (2)(e),“control” means a power (whether exercisable alone, jointly with another person or with the consent of another person) under the trust instrument or by law to:
(a) dispose of, advance, lend, invest, pay or apply trust property; (b) vary or terminate the trust; (c) add or remove a person as a beneficiary to or from a class of beneficiaries; (d) appoint or remove trustees or give another person control over the trust; and (e) direct, withhold consent to or veto the exercise of a power mentioned in subparagraphs (a) to (d). (4) Where any of the persons identified under (2)(a) to (e) are fulfilled by a Body Corporate or Partnership, the Relevant Person must identify the Beneficial Owners of Body Corporate or Partnership in accordance with Rule 8.3.3 and Rule 8.3.4.
8.3.6 (1) For the purposes of Rule 8.3.1(1)(b), a Relevant Person must identify the Beneficial
Owner of a customer that is a foundation or other Legal Arrangement similar to a foundation in accordance with this Rule. (2) The Relevant Person must identify:
(a) the founder;
(b) the foundation council members (or otherwise members of the governing body of the foundation); (c) the guardian, if any; (d) the beneficiaries (if names) or designee (if no beneficiaries are named) in whose main interest, in the opinion of the Relevant Person, the foundation or arrangement has been established or operates; and (e) any natural person who has control over the foundation or other Legal Arrangement. (3) For the purposes of (2)(e), a natural person shall have “control” over a foundation or Legal Arrangement if such person:
(a) holds, directly or indirectly, more than 25% of the voting rights in the conduct and management of the foundation or other legal arrangement; or

Appendix 1
(b) holds the right, directly or indirectly, to appoint or remove a majority of the officials of the foundation or other legal arrangement. (4) Where any of the persons identified under (2) (a) to (e) are a Body Corporate or Partnership, the Relevant Person must identify the Beneficial Owners of Body Corporate or Partnership in accordance with Rule 8.3.3 and Rule 8.3.4. Guidance on verification of the identity of a Beneficial Owner

In determining whether an individual meets the definition of a Beneficial Owner
regard should be had to all the circumstances of the case, in particular the size of an individual's legal engagement or beneficial ownership in a Transaction.
For a retail investment fund that is widely-held and where the investors invest via
pension contributions, the Regulator would not expect the manager of the fund to look through to any underlying investors where there are none with any material control or ownership of the fund. However, for a closely-held fund with a small number of investors, each having a large shareholding or other interest, the Regulator would expect a Relevant Person to identify and verify each of the Beneficial Owners, depending on the risks identified as part of its risk-based assessment of the customer. For a corporate health policy with defined benefits, however, the Regulator would not expect a Relevant Person to identify the Beneficial Owners. Guidance on Politically Exposed Persons (PEPs) and corruption
Individuals who have, or have had, a high political profile, or hold, or have held, public
office, may pose a higher money laundering risk to a Relevant Person as their position may make them prone to corruption. This risk also extends to members of their families and to known close associates. Being a PEP does not, in itself, of course, incriminate individuals or entities.
Generally, a foreign PEP presents a higher risk of money laundering because there is
a greater risk that such a Person, if he were undertaking money laundering, would attempt to place his money offshore, away from his home jurisdiction, where he is less likely to be recognised as a PEP and where it would be more difficult for law enforcement agencies in his home jurisdiction to confiscate or freeze his criminal proceeds.
A Relevant Person should be aware that customer relationships with family members
or close associates of PEPs involve similar risks to those with PEPs themselves.
The risk of corruption-related money laundering increases where a Relevant Person
deals with a PEP. Corruption may involve serious crimes and has become the subject of increasing global concern. Corruption offences are predicate crimes under Federal AML Legislation.
The Regulator considers that after leaving office a PEP may remain a higher risk for
money laundering if such an individual continues to exert political influence or otherwise poses a risk of being involved in corruption.
The fact that an individual is a PEP does not automatically mean that the individual
must be assessed to be a high risk customer: however, Enhanced CDD still needs to

Appendix 1
be undertaken on PEPs. A Relevant Person will need to assess the particular circumstances relating to each PEP to determine what risk category is appropriate.
8.4 Enhanced Customer Due Diligence
8.4.1 Where a Relevant Person is required to undertake Enhanced Customer Due Diligence under
Rule 8.1.1(1)(b) it must, to the extent applicable to the Customer CDD, having assigned a customer a high risk rating or it or its Beneficial Owner is a PEP, then, in addition to CDD under Rule 8.3.1, it must:
(a) obtain and verify additional:
(i) additional identification information on the cCustomer and all any Beneficial Owners; (ii) additional information on the intended nature of the business relationship; and (iii) information on the reasons for a Transaction; (b) update more regularly the CDD information which it holds on the cCustomer and any Beneficial Owners more regularly; (c) identify and verify information on:
(i) the Customer's Source of Funds; and
(ii) the Customer's Source of Wealth; of the customer and, if applicable, all Beneficial Owners; (d) increase the degree and nature of monitoring of the business relationship, in order to determine whether the Customer's Transactions or activities appear unusual or suspicious; and conduct enhanced monitoring of the business relationship, by increasing the frequency and intensity of controls applied, and determining which groups of transactions need further examination; (e) obtain the approval of Senior Management to commence a business relationship with the a cCustomer.; and (f) require the first payment to be carried out through an account in the customer’s name with a financial institution that is subject to money laundering regulation and supervision in a jurisdiction that has standards equivalent to those set out in the FATF Recommendations. Guidance

In Rule 8.4.1 Enhanced Customer Due Diligence CDD measures are only mandatory to
the extent that they are applicable to the relevant cCustomer or the circumstances of the business relationship and to the extent that the risks would reasonably require it.

Appendix 1
Therefore, the extent of additional measures to be conducted is a matter for the Relevant Person to determine on a case by case basis.
2. In Rule 8.4.1(e), Senior Management approval may be given by an individual member
of the Relevant Person's Senior Management or by a committee of senior managers appointed to consider high-risk cCustomers. Such approval It may also be outsourced within the Group, but only to a suitably qualified individual or committee.
3. For high-risk cCustomers, a Relevant Person should, in order to mitigate the perceived
potential and actual risks, exercise a greater degree of diligence throughout the course of the cCustomer relationship and should endeavour to understand the nature of the cCustomer's business and consider whether it is consistent and reasonable.
4. A Relevant Person should be satisfied that a cCustomer's use of complex legal
structures and/or the use of trust and private investment vehicles, has a genuine and legitimate purpose.
5. For Enhanced Customer Due Diligence CDD, where there are one or more is a
Beneficial Owners, verification of the cCustomer's Source of Funds and Wwealth may require enquiring into the Beneficial Owner's Source of Funds and Wwealth because the Ssource of the Ffunds would normally be associated with the Beneficial Owners and not the cCustomer.
6. The Regulator considers that verification of Source of Funds includes obtaining
independent corroborating evidence such as the proof of dividend payments connected to a shareholding, bank statements, salary/bonus certificates, loan documentation and proof of all Transactions which gave rise to the payments into the account. A cCustomer should be able to demonstrate and have documented how the relevant funds are connected to a particular event which gave rise to the payment into the account or to the source of the funds for a Transaction.
7. The Regulator considers that verification of Source of Wealth includes obtaining
independent corroborating evidence such as share certificates, publicly-available registers of ownership, bank or brokerage account statements, probate documents, audited accounts and financial statements, news items from a reputable source and other similar evidence.
8. A Relevant Person may commission a third party vendor report from a third party
vendor to obtain further information on a cCustomer or Transaction or to investigate a cCustomer or Beneficial Owner in very high-risk cases. A third party vendor Such a report may be particularly useful where there is little or no publicly-available information on a Person or on a legal arrangement or where a the Relevant Person has difficulty in obtaining and verifying information.
9. In For Rule 8.4.1, circumstances where it may be applicable to require the first
payment made by a cCustomer in order to open an account with a Relevant Person to be carried out through a bank account in the cCustomer's name with a Prescribed Low Risk Customer include:
(a.) where, following the use of other Enhanced Customer Due Diligence CDD measures, the Relevant Person is not satisfied with the results of due diligence; or

Appendix 1
(b.) as an alternative measure, where one of the measures in Rule 8.4.1 (a) to (e) cannot be carried out.
8.5 Simplified Customer Due Diligence
8.5.1 (1) Where a Relevant Person is permitted to undertake Simplified Customer Due
Diligence CDD under Rule 8.1.1(2), modification of Rule 8.3.1 may include:
(a) verifying the identity of the cCustomer and any Beneficial Owners after the establishment of the business relationship under Rule 8.2.1(3); (b) deciding to reduce the frequency of, or as appropriate not undertake, cCustomer identification updates; (c) deciding not to verify a Beneficial Owner; (cd) deciding not to verify an identification document other than by requesting a copy; (e) not enquiring as to a Customer's Source of Funds or Source of Wealth; (df) reducing the degree of on-going monitoring of Transactions, based on a reasonable monetary threshold or on the nature of the Transaction; and or (eg) not collecting specific information or carrying out specific measures to understand the purpose and intended nature of the business relationship, but inferring such purpose and nature from the type of Transactions or business relationship established. (2) The modification undertaken under in (1) must be proportionate to the cCustomer's money laundering risks. Guidance

Rule 8.5.1(1) provides examples of Simplified Customer Due Diligence measures.
Other measures may also be used by a Relevant Person to modify CDD in accordance with the Customer risks. A Relevant Person should not use a "one size fits all" approach for all of its low-risk customers. Notwithstanding that the risks may be low for all such customers in that category, the extent of CDD undertaken needs to be proportionate to the specific risks identified on a case by case basis.
A Relevant Person should not use a "one size fits all" approach for all its low-risk
Customers. Notwithstanding that the risks may be low for all such Customers, the degree of CDD undertaken needs to be proportionate to the specific risks identified on a case by case basis. For example, for Customers where the money laundering risks are very low, a Relevant Person may decide to simply identify the Customer and verify such information only to the extent that this is commercially necessary. On the other hand, a low-risk Customer which is undertaking a complex Transaction might require more comprehensive Simplified Customer Due Diligence.

Appendix 1
32. An example of circumstances where Aa Relevant Person might reasonably reduce the
frequency of or, as appropriate, eliminate cCustomer identification updates would be where the money laundering risks are low and the service provided does not offer a realistic opportunity for money laundering.
43. An example of where a Relevant Person might reasonably reduce the degree of ongoing monitoring and scrutinising of Transactions, based on a reasonable monetary
threshold or on the nature of the Transaction, would be where the Transaction is a recurring, fixed contribution to a savings scheme, investment portfolio or fund or where the monetary value of the Transaction is not material for money laundering purposes given the nature of the cCustomer and the Transaction type.
8.6 On-going Customer Due Diligence
8.6.1 A Relevant Person must ensure that the information and evidence concerning a Customer's
identity is accurate and up-to-date. When undertaking on-going CDD under Rule 8.3.1(1)(d), a Relevant Person must, using the RBA:
(a) monitor Transactions undertaken during the course of its cCustomer relationship to ensure that the Transactions are consistent with the Relevant Person's knowledge of the cCustomer, his business and risk rating; (b) pay particular attention to any complex or unusually large Transactions or unusual patterns of Transactions that have no apparent or visible economic or legitimate purpose; (c) enquire into the background and purpose of the Transactions in (b); (d) periodically review the adequacy of the CDD information it holds on cCustomers and Beneficial Owners to ensure that the information is kept up to date, particularly for cCustomers with a high-risk rating; and (e) periodically review each cCustomer to ensure that the risk rating assigned to a cCustomer under Rule 7.21.1(1)(b) remains appropriate for the cCustomer in light of the money laundering risks.
8.6.2 A Relevant Person should apply an intensified and on-going monitoring programme with
respect to higher risk Transactions and customersaccounts.
Guidance

The cCustomer identification process does not end at the point of application. time of
establishing a business relationship with a customer or, where relevant, undertaking a specific transaction or business activity on behalf of a customer. Following the start of the cCustomer relationship, a Relevant Person should ensure that all relevant evidence and information is kept up-to-date including, for example, the list of authorised signatories who can act on behalf of a corporate customer Client.
In complying with Rule 8.6.1(d), a Relevant Person should undertake a periodic review
to ensure that non-static cCustomer identity documentation is accurate and up-todate. A Relevant Person is expected to ensure that the information and the evidence

Appendix 1
obtained from a cCustomer is valid and has not expired, for example when obtaining copies of identification documentation such as a passport or identification card. Examples of non-static identity documentation include passport number and residential/business address and, for a Legal Person, its share register or list of partners.
3. A Relevant Person should undertake a review under Rule 8.6.1(d) and (e) particularly
when:
(a.) the Relevant Person changes its CDD documentation requirements; (b.) an unusual Transaction with the cCustomer is expected to take place; (c.) there is a material change in the business relationship with the cCustomer; or (d.) there is a material change in the nature or ownership of the cCustomer.
4. The degree of the on-going due diligence to be undertaken will depend on the
cCustomer risk assessment carried out under Rule 7.21.1.
5. A Relevant Person's Transaction monitoring policies, procedures, systems and
controls, which may be implemented by manual or automated systems, or a combination thereof, are one of the most important aspects of effective CDD. Whether a Relevant Person should undertake the monitoring by means of a manual or computerised system (or both) will depend on a number of factors, including:
(a.) the size and nature of the Relevant Person's business and customer base; and (b.) the complexity and volume of customer Transactions.
8.6.3 A Relevant Person must review its cCustomers, their businesses, and Transactions, against
Sanctions Lists when complying with Rule 8.6.1(d).
8.7 Failure to conduct or complete Customer Due Diligence
8.7.1 (1) Where, in relation to any cCustomer, a Relevant Person is unable to conduct or
complete the requisite CDD in accordance with Rule 8.1.1 it must, to the extent relevant where appropriate:
(a) not carry out a Transaction with or for the cCustomer through a bank account or in cash; (b) not open an account or otherwise provide a service; (c) not otherwise establish a business relationship or carry out a Transaction; (d) terminate or suspend any existing business relationship with the cCustomer; (e) return any monies or assets received from the cCustomer; and (f) consider whether the inability to conduct or complete CDD necessitates the making of a Suspicious Activity Report under Rule 14.3.1(c).

Appendix 1
(2) A Relevant Person is not obliged to comply with (a) to (e) if:
(a) to do so would amount to "tipping off" the cCustomer, in breach of Article 16 of Federal Law No. 4 of 2002 Federal AML Legislation; or (b) the FIU AMLSCU directs the Relevant Person to act otherwise. Guidance

In complying with Rule 8.7.1(1) a Relevant Person should apply one or more of the
measures in (a) to (f) as appropriate in the circumstances. Where CDD cannot be completed to a significant degree, it may be appropriate not to carry out a Transaction pending completion of CDD. Where CDD cannot be conducted, including where a material part of the CDD such as identifying and verifying a Beneficial Owner cannot be undertaken conducted, a Relevant Person should not establish a business relationship with the cCustomer.
A Relevant Person should note that Rule 8.7.1 applies to both existing and prospective
cCustomers. For prospective new cCustomers it may be appropriate for a Relevant Person to terminate the business relationship before a product or service is provided. However, for existing cCustomers, while termination of the business relationship should not be ruled out, suspension may be more appropriate depending on the circumstances, whilst further investigations are carried out. Whichever course of action route is taken, the Relevant Person should be careful not to tip off the cCustomer.
A Relevant Person should adopt the RBA in order to inform the appropriate level of
for CDD to be undertaken for of existing cCustomers. For example, if a Relevant Person considers that any of its existing cCustomers (which may include cCustomers that which it migrates into the ADGM) have not been subject to CDD of a at an equivalent standard equivalent to that required by the AML Rulebook, it should adopt the RBA and take remedial action in a manner proportionate to the risks and within a reasonable period of time whilst complying with Rule 8.7.1.
8.8 A diagram outlining the Customer due diligence process is contained in A1.4.

Appendix 1
9. RELIANCE AND OUTSOURCING OF ANTI-MONEY LAUNDERING AML COMPLIANCE
9.1 Reliance on a third party
9.1.1 (1) A Relevant Person may rely on the following third parties ("qualified professionals")
to conduct one or more of the elements of CDD on its behalf:
(a) an Authorised Person or Recognised Body;
(b) a law firm, notary, or other independent legal business, accounting firm, audit firm or insolvency practitioner or an equivalent Person in another jurisdiction; (c) a Financial Institution; (d) a member of the Relevant Person's Group; or (e) other specialised utilities for the provision of outsourced Anti-Money Laundering AML services. (2) In (1), a Relevant Person may rely on the information previously obtained by a third party which covers one or more elements of CDD. (3) Where a Relevant Person seeks to rely on a Person in (1) it may only do so if and to the extent that:
(a) it immediately obtains the necessary CDD information from the third party in (1); (b) it takes adequate steps to satisfy itself that certified copies of the documents used to undertake the relevant elements of CDD will be available from the third party on request and without delay; (c) the Person in (1)(b) to (d) is subject to regulation, including AML, by a NonADGM Financial Services Regulator or other competent authority in a country with AML regulations that are equivalent to the standards set out in the FATF Recommendations and it is supervised for compliance with such regulations; (d) the Person in (1) has not relied on any exception from the requirement to conduct any relevant elements of CDD which the Relevant Person seeks to rely on; and (e) in relation to (2), the information is up to date. (4) Where a Relevant Person relies on a member of its Group to conduct one or more of the elements of CDD on its behalf, such Group member need not meet the condition in (3)(c) if:
(a) the Group is subject to policies and requirements equivalent to FATF standards, either:

Appendix 1
(i) where the Group applies and implements a Group-wide policy on CDD and record-keeping which is equivalent to the standards set by FATF; or (ii) where the effective implementation of those CDD and recordkeeping requirements and Anti-Money Laundering AML programmes are supervised at Group level by a Non-ADGM Financial Services Regulator or other competent authority in a jurisdiction country with Anti-Money Laundering AML regulations that are equivalent to the standards set out in the FATF Recommendations; (b) no exception from identification obligations has been applied in the original identification process; and (c) a written statement is received from the introducing member of the Relevant Person's Group confirming that:
(i) the cCustomer has been identified in accordance with the relevant standards under (4)(a) and (b); (ii) any identification evidence can be accessed by the Relevant Person without delay; and (iii) the identification evidence will be kept for at least six 10 years. (5) If a Relevant Person is not reasonably satisfied that a cCustomer or Beneficial Owner has been identified and verified by a third party in a manner consistent with these Rules, the Relevant Person must immediately perform the CDD itself with respect to any deficiencies identified. (6) Notwithstanding the Relevant Person's reliance on a Person in 9.1.1(1), the Relevant Person remains responsible for compliance with, and liable for any failure to meet the CDD requirements in the AML Rulebook.
9.1.2 (1) When assessing under Rule 9.1.1(3) or (4) if Anti-Money Laundering regulations in
another jurisdiction are equivalent to FATF standards, a Relevant Person must take into account factors including, but not limited to:
(a) mutual evaluations, assessment reports or follow-up reports published by FATF, the IMF, the World Bank, the OECD or other International Organisations; (b) membership of FATF or other international or regional groups such as the MENAFATF or the Gulf Co-operation Council; (c) contextual factors such as political stability or the level of corruption in the jurisdiction; (d) evidence of recent criticism of the jurisdiction, including in:
(i) FATF advisory notices;
(ii) public assessments of the jurisdiction’s Anti-Money Laundering regime by organisations referred to in (a); or

Appendix 1
(iii) reports by other relevant non-government organisations or specialist commercial organisations; and (e) whether adequate arrangements exist for co-operation between the AntiMoney Laundering regulator in that jurisdiction and the Regulator. (2) A Relevant Person making an assessment under (1) must rely only on sources of information that are reliable and up-to-date. (3) A Relevant Person must keep adequate records of how it made its assessment, including the sources and materials considered. Guidance

In complying with Rule 9.1.1(3)(a), "immediately obtaining the necessary CDD
information" means obtaining all relevant CDD information, and not just basic information such as name and address. However, compliance can be achieved by having the information sent in an email or other appropriate means. For the avoidance of doubt, it does not necessarily require a Relevant Person to immediately obtain the underlying certified documents used by the third party to undertake its CDD because under Rule 9.1.1(3)(b), these need only be available on request without delay.
The Regulator would expect a Relevant Person, in complying with Rule 9.1.1(5), to fill
any gaps in the CDD process as soon as it becomes aware that a customer or Beneficial Owner has not been identified and verified by the third party in a manner consistent with these Rules.
If a Relevant Person acquires another business, either in whole or in substantial part,
the Regulator would permit the Relevant Person to rely on the CDD conducted by the business it is acquiring, but would expect the Relevant Person to have done the following:
(a) as part of its due diligence for the acquisition, to have taken a reasonable sample of the prospective customers to assess the quality of the CDD undertaken; and (b) to have undertaken CDD on all the customers to cover any deficiencies identified in (a) as soon as possible following the acquisition, prioritising highrisk Customers.
Where the legislative framework of a jurisdiction (such as secrecy or data protection
legislation) prevents a Relevant Person from having access to CDD information upon request without delay as referred to in Rule 9.1.1(3)(b), the Relevant Person should undertake the relevant CDD itself and should not seek to rely on the relevant third party.
If a Relevant Person relies on a third party located in a foreign jurisdiction to conduct
one or more elements of CDD on its behalf, the Relevant Person must ensure that the foreign jurisdiction has Anti-Money Laundering regulations which are equivalent to the standards in the FATF Recommendations (see Rule 9.1.1(3)(c)).

Appendix 1
9.2 Business partner identification
9.2.1 (1) (a) Prior to establishing the business relationship, a Relevant Person must
establish and verify its business partners' identities in accordance with Rule 8.1.3 by obtaining sufficient and satisfactory evidence of the identity of any business partner it relies upon in carrying on its Regulated Activities. (ab) A Relevant Person must maintain accurate and up-to-date information and conduct on-going due diligence on its business partners, throughout the course of the business relationship. (bc) If at any time a Relevant Person becomes aware that it lacks sufficient information or documentation concerning a business partner's identification, or develops a concern about the accuracy of its current information or documentation, it must promptly obtain appropriate material to verify such business partner's identity. (2) In the context of this Rule, a 'business partner' includes:
(a) a qualified professional as specified in Rule 9.1.1(1); (b) a member of the Relevant Person's Group; (c) a Correspondent Bank; or (d) any other service provider. (3) A Relevant Person that establishes, operates or maintains a Correspondent Account for a Correspondent Banking Client must ensure that it has arrangements to:
(a) conduct due diligence in respect of the opening of a Correspondent Account for a Correspondent Banking Client, including measures to identify:
(i) its ownership and management structure;
(ii) its major business activities and Customer base; (iii) its location; and (iv) the intended purpose of the Correspondent Account; (b) identify all third parties that will use the Correspondent Account; and (c) monitor Transactions processed through a Correspondent Account that has been opened by a Correspondent Banking Client, in order to detect and report any suspicion of Money Laundering.
9.2.2 A Relevant Person must not:
(1) establish a correspondent banking relationship with a Shell Bank; (2) establish or keep anonymous accounts or accounts in false names; or

Appendix 1
(3) maintain a nominee account which is held in the name of one Person, but controlled by or held for the benefit of another Person whose identity has not been disclosed to the Relevant Person. Guidance

In complying with Rule 9.1.1(3)(a), "immediately obtaining the necessary CDD
information" means obtaining all relevant CDD information, and not just basic information such as name and address. However, compliance can be achieved by having the information sent in an email or other appropriate means. For the avoidance of doubt, it does not necessarily require a Relevant Person to immediately obtain the underlying certified documents used by the third party to undertake its CDD because under Rule 9.1.1(3)(b), these need only be available on request without delay.
The Regulator would expect a Relevant Person, in complying with Rule 9.1.1(5), to fill
any gaps in the CDD process as soon as it becomes aware that a Customer or Beneficial Owner has not been identified and verified in a manner consistent with these Rules.
If a Relevant Person acquires another business, either in whole or in part, the
Regulator would permit the Relevant Person to rely on the CDD conducted by the business it is acquiring but would expect the Relevant Person to have done the following:
(a) as part of its due diligence for the acquisition, to have taken a reasonable sample of the prospective Customers to assess the quality of the CDD undertaken; and (b) to have undertaken CDD on all the Customers to cover any deficiencies identified in a. as soon as possible following the acquisition, prioritising highrisk Customers.
Where a particular jurisdiction's laws (such as secrecy or data protection legislation)
would prevent a Relevant Person from having access to CDD information upon request without delay as referred to in Rule 9.1.1(3)(b), the Relevant Person should undertake the relevant CDD itself and should not seek to rely on the relevant third party.
7.1. "Know your business partner" is as important as "Know Your Customer". A Relevant
Person is therefore required to verify the identity of a prospective business partner and to obtain evidence of it. The same documentation that is used to identify cCustomers should be obtained from the business partner prior to conducting any business.
A Relevant Person should verify whether any secrecy or data protection law exists in
the country of incorporation of the business partner that would prevent access to relevant data.
5.3. The requirement to identify the business partner is meant to cover only those
business partners who may pose any relevant money laundering risk to the Relevant Person. Hence, a Relevant Person would be not required to establish and verify the identity of, for example, its maintenance or cleaning service.

Appendix 1
6.4. The Regulator may take into account the identity of a Relevant Person's business
partner and the nature of their relationship in considering the fitness and propriety of a Relevant Person.
8.5. Before entering into a business relationship, a Relevant Person should conduct a due
diligence investigation, which includes ensuring that the business partner is an existing Person authorised to conduct the kind of business in question and, if applicable, verifying that this Person is duly regulated by a Non-ADGM Financial Services Regulator or other relevant regulatory authority or regulator. In accordance with "The Wolfsberg Anti-Money Laundering Principles for Correspondent Banking", the Relevant Person should take into account, and verify the nature of:
(a.) the business to be conducted and the major business activities of the business partner; (b.) the jurisdiction where the business partner is located as well as that of its the parent; and (c.) the transparency and the nature of the ownership and the management structure.
9.6. A Relevant Person may also gather information about the reputation of the business
partner, including whether it has been subject to investigation or regulatory action in relation to money laundering or terrorist financing.
10.7. A Relevant Person should adopt a risk-based approach when verifying its business
partners' identities. Depending on the money laundering risk assessment of the Relevant Person's business partner, the Relevant Person should decide the level of detail to which of the business partner identification and verification process will need to be performed.
11. A Relevant Person should verify whether any secrecy or data protection law exists in
the country of incorporation of the business partner that would prevent access to relevant data.
12.8. A Relevant Person should have in place specific arrangements to ensure that adequate
due diligence and identification measures with regard to the business relationship are taken.
13.9. The Relevant Person should conduct regular reviews of the relationship with its
business partners.
14.10. The Senior Management or Governing Body of a Relevant Person should give its their
approval before it establishes any new correspondent banking relationships.
15.11. A Relevant Person should also have arrangements to guard against establishing a
business relationship with business partners who permit their accounts to be used by Shell Banks; further details on the definition of Shell Banks are set out in Guidance 2 to Rule 10.2.2.

Appendix 1
9.3 Outsourcing
9.3.1 A Relevant Person which outsources any one or more elements of its CDD to a service provider
(including those within its Group) remains responsible for compliance with, and liable for any failure to meet, such obligations. Guidance Prior to appointing an outsourced service provider to undertake CDD, a Relevant Person should undertake due diligence to assure itself of the suitability of the outsourced service provider and should ensure that the outsourced service provider's obligations are clearly documented in a binding agreement.
9.4 Record Keeping and Data Protection
9.4.1 Where Customer identification records are kept by the Relevant Person or other Persons
outside the ADGM, a Relevant Person must take reasonable steps to ensure that the records are held in a manner consistent with these Rules.
9.4.2 A Relevant Person must verify whether there is secrecy or data protection legislation that
would restrict access without delay to such data by the Relevant Person, the Regulator or the law enforcement agencies of the U.A.E. Where such legislation exists, the Relevant Person must obtain without delay certified copies of the relevant identification evidence and keep these copies in a jurisdiction which allows access by all those Persons.
9.5 A diagram outlining the reliance and outsourcing of AML compliance requirements is
contained in A1.5.

Appendix 1
10. CORRESPONDENT BANKING, WIRE TRANSFERS, ANONYMOUS ACCOUNTS AND AUDIT
10.1 Application
10.1.1 This Chapter applies only to all an Authorised Persons, other than Credit Rating Agencies or
Recognised Body other than a Representative Offices.
10.2 Correspondent banking
10.2.1 An Authorised Person proposing to have a correspondent banking relationship with a
respondent bank must:
(a) undertake CDD on the respondent bank;
(b) as part of (a), gather sufficient information about the respondent bank to understand fully the nature of the business, including making appropriate enquiries as to its management, its major business activities and the countries or jurisdictions in which it operates; (c) determine from publicly-available information the reputation of the respondent bank and the quality of the supervision that it is subject to, including whether it has been the subject of to a money laundering or terrorist financing investigation or relevant regulatory action; (d) assess the respondent bank's Anti-Money Laundering AML controls and ascertain if they are adequate and effective in light of the FATF Recommendations; (e) ensure that prior approval of the Authorised Person's Senior Management is obtained before entering into a new correspondent banking relationship; (f) ensure that the respective responsibilities of the parties to the correspondent banking relationship are properly documented; and (g) be satisfied that, in respect of any cCustomers of the respondent bank who have direct access to accounts of the Authorised Person, the respondent bank:
(i) has undertaken CDD (including on-going CDD) at least equivalent to that in Rule 8.3.1 in respect of each Customer; and (ii) is able to provide the relevant CDD information in (i) to the Authorised Person upon request; and (h) document the basis for its satisfaction that the requirements in (a) to (g) are met.
10.2.2 An Authorised Person must:
(a) not enter into a correspondent banking relationship with a Shell Bank; and

Appendix 1
(b) take appropriate measures to ensure that it does not enter into, or continue a corresponding banking relationship with, a bank which is known to permit its accounts to be used by Shell Banks. Guidance

The rules and guidance set out in Rule 9.2 above also applies to correspondent
banking business partners. This Rule provides further details on specific requirements applicable to a correspondent banking business relationship.
With regard to Correspondent Banking Clients and, if applicable, other qualified
professionals, specific care should be taken to assess their Anti-Money Laundering AML arrangements regarding cCustomer identification, Transaction monitoring, terrorist financing and other relevant elements, and to verify that these business partners comply with the same or equivalent Anti-Money LaunderingAML requirements as the Relevant Person. Information on applicable laws and regulations regarding the prevention of money laundering should be obtained.
A Relevant Person should ensure that a Correspondent Banking Client does not use
the Relevant Person's products and services to engage in business with Shell Banks. A Shell Bank would be a bank that has no physical presence in the country in which it is incorporated and licensed, and which is unaffiliated with a regulated financial Group that is subject to effective consolidated supervision. The Regulator does not consider that the existence of a local agent or low-level staff constitutes physical presence.
If applicable, information on distribution networks and delegation of duties should be
obtained.
10.3 Wire transfers
10.3.1 In this section:
(a) "beneficiary" means the natural or Legal Person or legal arrangement who is identified by the originator as the receiver of the requested wire transfer; (b) "originator" means the account holder who instructs the wire transfer from the relevant account, or where there is no account, the Nnatural or Legal Person that places the order with the ordering Financial Institution to perform the wire transfer; and (c) "wire transfer" includes any value transfer arrangement.
10.3.2 (1) An Authorised Person or a Recognised Body must:
(a) when it sends or receives funds by wire transfer on behalf of a cCustomer, ensure that the wire transfer and any related messages contain accurate originator and beneficiary information; (b) ensure that, while the wire transfer is under its control, the information in (a) remains with the wire transfer and any related message throughout the payment chain; and

Appendix 1
(c) monitor wire transfers for the purpose of detecting those wire transfers that do not contain both originator and beneficiary information and take appropriate measures to identify any money laundering risks. (2) The requirement in (1) does not apply to an Authorised Person or Recognised Body which:
(a) provides Financial Institutions with messages or other support systems for transmitting funds; or (b) transfers funds to another Financial Institution where both the originator and the beneficiary are Financial Institutions acting on their own behalf. (3) An Authorised Person and Recognised Body must ensure that information accompanying all wire transfers contains at a minimum:
(a) the name of the originator;
(b) the originator account number where such an account is used to process the Transaction; (c) the originator's address, or national identity number, or cCustomer identification number, or date and place of birth; (d) the name of the beneficiary; and (e) the beneficiary account number where such an account is used to process the Transaction. Guidance

'FATF Special Recommendation Number 16' seeks to ensure that national or
international electronic payment and message systems, including fund or wire transfer systems such as SWIFT, are not misused as a means to break the money laundering audit trail. Therefore, the information about a cCustomer as the originator of the fund transfer of funds should remain with the payment instruction throughout the payment chain.
In the absence of an account number, a unique Transaction reference number should
be included which permits traceability the progress of the Transaction to be traced at all times.
Relevant Persons should monitor for, and conduct enhanced scrutiny of, suspicious
activities, including incoming fund transfers that do not contain complete originator information, including name, address and account number or unique reference number.
The Regulator considers that concealing or removing in a wire transfer any of the
information required by Rule 10.3.2(3) would be a breach of the requirement to ensure that the wire transfer contains accurate originator and beneficiary information.

Appendix 1
10.4 Audit
10.4.1 An Authorised Person or a and Recognised Body must ensure that its internal audit function
undertakes includes regular reviews and assessments of the effectiveness of the Authorised Person or Recognised Body's money laundering policies, procedures, systems and controls, and its compliance with its obligations in the AML Rulebook. Guidance

The review and assessment undertaken for the purposes of Rule 10.4.1 may be
undertaken:
(a.) internally by the Authorised Person or Recognised Body's internal audit function; or (b.) by a competent firm of independent, external auditors or compliance professionals.
The review and assessment undertaken for the purposes of Rule 10.4.1 should cover
at least the following:
(a.) sample testing of compliance with the Authorised Person or the Recognised Body's CDD arrangements; (b.) an analysis of all notifications made to the MLRO to highlight any area where procedures or training may need to be enhanced; and (c.) a review of the nature and frequency of the dialogue between the Senior Management and the MLRO.
10.5 Anonymous and nominee accounts
10.5.1 An Authorised Person or a and Recognised Body must not establish or maintain:
(a) an anonymous account or an account in a fictitious name; or (b) a nominee account which is held in the name of one Person, but which is controlled by or held for the benefit of another Person whose identity has not been disclosed to the Authorised Person or the Recognised Body.

Appendix 1
11. SANCTIONS AND OTHER INTERNATIONAL OBLIGATIONS
11.1 Resolutions and Sanctions and Other International Obligations
11.1.1 (1) A Relevant Person must establish and maintain effective systems and controls to
ensure that on an ongoing basis it is properly informed as to, and takes reasonable measures to comply with, relevant obtain and make appropriate use of resolutions or Sanctions which it is required to comply with, under the laws of ADGM or any other jurisdiction. (2) A Relevant Person must immediately notify the Regulator when it becomes aware that it is, for or on behalf of a Person:
(a) carrying on or about to carry on an activity; (b) holding or about to hold money or other assets; or (c) undertaking or about to undertake any other business whether or not arising from or in connection with (a) or (b); for or on behalf of a Person, where such carrying on, holding or undertaking constitutes or may constitute a contravention of any Sanctions which the Relevant Person is required to comply with, under the laws of ADGM or any other jurisdiction. (3) A Relevant Person must ensure that the notification stipulated in (2) above includes the following information:
(a) a description of the relevant activity under (2)(a), (b) or (c); and (b) the action proposed to be taken or that has been taken by the Relevant Person with regard to the matters specified in the notification. Guidance

In relation to the term "make appropriate use" in Rule 11.1.1(1), taking reasonable
measures to comply with resolutions or Sanctions may include, for example, this may mean that a Relevant Person cannot undertakeing a tTransaction for or on behalf of a Person or that it may need to undertakeing further due diligence in respect of a Person. .
Relevant resolutions or Sanctions mentioned in Rule 11.1.1 may, among other things,
relate to money laundering, terrorist financing or the financing of weapons of mass destruction, or otherwise be relevant to the activities carried on by the Relevant Person. For example:
(a.) a Relevant Person should exercise due care to ensure that it does not provide services to, or otherwise conduct business with, a Person engaged in money laundering, terrorist financing or the financing of weapons of mass destruction; and

Appendix 1
(b.) a Recognised Investment Exchange or a Recognised Clearing House, as a Recognised Body, should additionally exercise due care to ensure that it does not facilitate fund raising activities or listings by Persons engaged in money laundering or terrorist financing or financing of weapons of mass destruction.
3. A Relevant Person should be proactive in checking for, and taking measures to comply
with, relevant resolutions or sanctions which the Relevant Person is required to comply with, under the laws of ADGM or any other jurisdiction. The Regulator expects Relevant Persons to perform checks on an ongoing basis against their customer databases and records for any names appearing in resolutions or sanctions which the Relevant Person is required to comply with as well as to monitor transactions accordingly.
4. A Relevant Person may use a database maintained elsewhere for an up-to-date list of
resolutions and sanctions, or to perform checks of customers or transactions against that list. For example, it may wish to use a database maintained by its head office or a Group member. However, the Relevant Person retains responsibility for ensuring that its systems and controls are effective to ensure compliance with this module.
11.2 Government, regulatory and international findings
11.2.1 (1) A Relevant Person must establish and maintain systems and controls to ensure that
on an ongoing basis it is properly informed as to, and takes reasonable measures to comply with, obtain and make appropriate use of any findings, recommendations, guidance, directives, resolutions, Sanctions, notices or other conclusions issued by:
(a) the government of the U.A.E. or any government departments in the U.A.E.; (b) the Central Bank of the U.A.E. or the FIU AMLSCU; (c) U.A.E. enforcement agencies; (cd) the FATF; (de) tThe Basel Committee on Banking Supervision; (e) U.A.E. enforcement agencies; (f) the Regulator; and (g) any other jurisdiction which promulgates Sanctions to which it is subject, concerning the matters in (2). (2) For the purposes of (1), the relevant matters are:
(a) arrangements for preventing money laundering, terrorist financing or the financing of weapons of mass destruction in a particular country or jurisdiction, including any assessment of material deficiency against relevant countries in adopting international standards; and

Appendix 1
(b) the names of Persons, Groups, organisations or entities or any other body where suspicion of money laundering or terrorist financing or the financing of weapons of mass destruction exists. (3) For the purposes of (1), measures that a Relevant Person must undertake when taking reasonable measures to comply with findings, recommendations, guidance, directives, resolutions, Sanctions, notices or other conclusions, include, but are not limited to, measures:
(a) requiring specific elements of enhanced CDD; (b) requiring enhanced reporting mechanisms or systematic reporting of financial transactions; (c) limiting business relationships or financial transactions with specified persons or persons in a specified jurisdiction; (d) prohibiting Relevant Persons from relying on third parties located in a specified jurisdiction to conduct CDD; (e) requiring the review and amendment, or if necessary termination, of correspondent relationships with banks in a specified jurisdiction; (f) prohibiting the execution of specified electronic fund transfers; or (g) requiring increased external audit requirements for financial groups with respect to any of their branches and subsidiaries located in a specified jurisdiction. (4) A Relevant Person must immediately notify the Regulator in writing if it becomes aware of non-compliance by a Person with a finding, recommendation, guidance, directive, resolution, Sanction, notice or other conclusion and provide the Regulator with sufficient details of the person concerned and the nature of the non-compliance. Guidance

The purpose of this Rule is to ensure that a Relevant Person takes into consideration
the broad range of tools used by competent authorities and international organisations to communicate Anti Money Laundering AML risks to stakeholders.
The Rule also permits the Regulator to require enhanced CDD or other specific
countermeasures to address risks identified in a specific country or jurisdiction. The Regulator may impose such countermeasures either when called upon to do so by FATF or independently of any FATF request. A Relevant Person should examine and pay special attention to any Transactions or business relationships with Persons located in countries or jurisdictions mentioned by the Persons in Rule 11.2.1(1)(a) to (f).
Relevant Persons considering Transactions or business relationships with Persons
located in countries or jurisdictions that have been identified as deficient, or against which the U.A.E. or the Regulator have outstanding advisories, should be aware of the background against which the assessments, or the specific recommendations have been made. These circumstances should be taken into account in respect of business

Appendix 1
introduced business from such jurisdictions, and when receiving inward payments for existing cCustomers or in respect of inter-bank Transactions.
4. The Relevant Person's MLRO is not obliged to report all Transactions from these
countries or jurisdictions to the FIU AMLSCU if they do not qualify as suspicious under Federal AML Legislation Law No. 4 of 2002 (see Chapter 14 on Suspicious Activity Reports).
5. Transactions with counterparties located in countries or jurisdictions which are no
longer identified as deficient or have been relieved from special scrutiny (for example, taken off sources mentioned in this Guidance) may nevertheless require attention which is higher than normal.
6. In order to assist Relevant Persons, the Regulator may, from time to time, publish
U.A.E., FATF or other findings, guidance, directives or Sanctions from U.A.E. authorities, the FATF or other relevant bodies. However, the Regulator expects a Relevant Person to take its own steps in acquiring relevant information from various available sources. For example, a Relevant Person may obtain relevant information from the consolidated lists of financial Sanctions published by in the European Union Office, HM Treasury, and OFAC.
7. In addition, the systems and controls outlined in Rule 11.2.1 should be established
and maintained by a Relevant Person taking into account its risk assessment under Chapters 6 and 7. In relation to the term "make appropriate use" in Rule 11.2.1, this may mean that a Relevant Person cannot undertake a Transaction for or on behalf of a Person or that it may need to undertake further due diligence in respect of such a Person.
8. A Relevant Person should be proactive in obtaining and appropriately using available
national and international information, for example, suspect lists or databases from credible public or private sources with regard to money laundering, including obtaining relevant information from sources mentioned in Guidance 6 above. The Regulator encourages Relevant Persons to perform checks against their cCustomer databases and records for any names appearing on such lists and databases as well as to monitor Transactions accordingly.
9. The risk of terrorists entering the financial system can be reduced if Relevant Persons
apply effective Anti-Money Laundering AML strategies, particularly in respect of CDD. Relevant Persons should assess which countries carry the highest risks and should conduct an analysis of Transactions from countries or jurisdictions known to be a source of terrorist financing.
10. The Regulator may require Relevant Persons to take any special measures it may
prescribe with respect to certain types of Transactions or accounts where the Regulator reasonably believes that any of the above may pose a money laundering risk to the ADGM.

Appendix 1
12. MONEY LAUNDERING REPORTING OFFICER
12.1 Appointment of a MLRO
12.1.1 (1) A Relevant Person must appoint an individual as the MLRO who has an appropriate
level of seniority, experience and independence to act in the role, with responsibility for implementation and oversight of its compliance with the Rules in the AML Rulebook, who has an appropriate level of seniority and independence to act in the role. It must do so by completing and filing with the Regulator the appropriate form specified by the Regulator. (2) The MLRO in (1) and Rule 12.1.57 must be resident in the U.A.E.
12.1.2 The individual appointed as the MLRO of a DNFBP that comprises as one officer, partner or
principle can, with the prior approval of the Regulator be the same person as the officer, partner or principle of the DNFBP.
12.1.23 The individual appointed as the MLRO of a Representative Office must be the same individual
who holds the position of Principal Representative of that Representative Office. Guidance

Authorised Persons are reminded that under GEN Rule 5.5.1 the MLRO function is a
mandatory appointment. For the avoidance of doubt, the individual appointed as the MLRO of an Authorised Person, other than a Representative Office, is the same individual who holds the Recognised Function of MLRO of that Authorised Person. Authorised Persons are also reminded that the guidance under GEN Rule 5.5.2 sets out the grounds under which the Regulator will determine whether to grant a waiver from the residence requirements for an MLRO. The same guidance would apply by analogy to other Relevant Persons seeking a waiver from the MLRO residence requirements.
The individual appointed as the MLRO of a Recognised Investment Exchange or
Recognised Clearing House is the same individual who holds the position of MLRO of that Recognised Investment Exchange or Recognised Clearing House under the relevant MIR REC Rule.
12.1.34 If an MLRO leaves the employment of the Relevant Person, the Relevant Person must
immediately appoint a new MLRO or arrange temporary cover for the MLRO appointment designate a successor within 28 days. An Authorised Person, other than a Representative Office, must appoint an individual to act as a deputy MLRO of the Authorised Person to fulfil the role of the MLRO in his absence.
12.1.5 A Relevant Person, other than a Representative Office, must appoint an individual to act as a
deputy MLRO of the Relevant Person to fulfil the role of the MLRO in his absence.
12.1.46 A Relevant Person's MLRO and deputy MLRO must deal with the Regulator in an open and cooperative manner and must disclose appropriately any information of which the Regulator
would reasonably be expected to be notified.

Appendix 1
Guidance

The individual appointed as the deputy MLRO need not apply for the Regulator’s
approval of an Authorised Person need not apply for Recognised Person status for performing the Recognised Function of MLRO, subject to Rules in GEN section 11.6.
A Relevant Person other than an Authorised Person should make adequate
arrangements to ensure that it remains in compliance with the AML Rulebook in the event that its MLRO is absent. Adequate arrangements would include appointing a temporary MLRO for the period of the MLRO's absence or making sure that the Relevant Person's AML systems and controls allow it to continue to comply with these Rules when the MLRO is absent.
12.1.57 A Relevant Person may outsource the role of MLRO to an individual outside the Relevant
Person provided that the relevant individual under the outsourcing agreement is and remains suitable to perform the MLRO role. Guidance Where a Relevant Person outsources specific AML tasks of its MLRO to another individual or a third party provider, including the case where they are within it’s a corporate Group, the Relevant Person remains responsible for ensuring that the duties undertaken by the MLRO ensure its compliance with the requirements in the AML Rulebook responsibilities of the MLRO. The Relevant Person should satisfy itself of the suitability of anyone who acts for it in the role of MLRO.
12.2 Qualities of a MLRO
12.2.1 A Relevant Person must ensure that its MLRO has:
(a) direct access to the Governing Body and its Senior Management; (b) sufficient and up-to-date qualifications and experience to fulfil the role; (c) sufficient resources including, if necessary, an appropriate number of appropriately trained Employees to assist in the performance of his duties in an effective, objective and independent manner; (d) a level of seniority and independence within the Relevant Person to enable him to act on his own authority; (e) timely and unrestricted access to information the Relevant Person has about the financial and business circumstances of a cCustomer or any Person on whose behalf the cCustomer is or has been acting, that is sufficient to enable him to carry out his responsibilities in accordance with Rule 12.3.1; and (f) unrestricted access to relevant information about the features of any Transaction which the Relevant Person has entered into or may have contemplated entering into with or for the cCustomer or a Person on whose behalf a cCustomer is or has been acting.

Appendix 1
Guidance
The Regulator considers that a Relevant Person will need to consider this Rule most especially when appointing an outsourced MLRO. Any external MLRO that is appointed will need to have the actual or effective level of seniority that the role requires.
12.3 Responsibilities of a MLRO
12.3.1 A Relevant Person must ensure that its MLRO implements and has oversight of and is
responsible for the following matters:
(a) the day-to-day operations for compliance by the Relevant Person with its Anti-Money Laundering AML policies, procedures, systems and controls; (b) acting as the point of contact to receive notifications from the Relevant Person's Employees under Rule 14.2.2; (c) taking appropriate action under Rule 14.3.1 following the receipt of a notification from an Employee; (d) making, in accordance with Federal AML Legislation Law No. 4 of 2002, Suspicious Activity Reports; (e) acting as the point of contact within the Relevant Person for competent U.A.E. authorities and the Regulator regarding money laundering issues; (f) responding promptly to any request for information made by competent U.A.E. authorities or the Regulator; (g) receiving and acting upon any relevant findings, recommendations, guidance, directives, resolutions, Sanctions, notices or other conclusions described in Chapter 11; and (h) establishing and maintaining an appropriate money laundering training programme and adequate awareness arrangements under Chapter 13.
12.4 Reporting
12.4.1 The MLRO must report at least annually twice a year in a form prescribed by the Regulator, to
the Governing Body or Senior Management of the Relevant Person on the following matters:
(a) the results of the review under Rule 4.1.1(4); (b) the Relevant Person's compliance with applicable Anti-Money Laundering AML laws including these Rules; (c) the quality of the Relevant Person's Anti-Money Laundering AML policies, procedures, systems and controls;

Appendix 1
(d) any relevant findings, recommendations, guidance, directives, resolutions, Sanctions, notices or other conclusions and how the Relevant Person has taken them into account; (e) any internal Suspicious Activity Reports made by the Relevant Person's Employees and action taken in respect of those reports, including the grounds for all decisions; (f) any external Suspicious Activity Reports made by the Relevant Person and action taken in respect of those reports including the grounds for all decisions; and (g) any other relevant matters related to Anti-Money Laundering as it concerns the Relevant Person's business.
12.4.2 A Relevant Person must ensure that its Governing Body or Senior Management promptly:
(a) assess the report provided under Rule 12.4.1; (b) take action, as required, subsequent to consideration of the findings of the report, in order to resolve any identified deficiencies; and (c) make a record of their assessment pursuant to paragraph (a) and the action taken pursuant to paragraph (b).
12.4.3 The report provided under Rule 12.4.1 and the records of the assessment and actions pursuant
to Rule 12.4.2 must be documented in writing.

Appendix 1
13. ANTI-MONEY LAUNDERING AML TRAINING AND AWARENESS
13.1 Training and awareness
13.1.1 A Relevant Person must:
(a) provide Anti-Money Laundering AML training to all relevant Employees at appropriate and regular intervals; (b) ensure that its Anti-Money Laundering AML training enables its Employees to:
(i) know the identity, and understand the responsibilities, of the Relevant Person's MLRO and his deputy; (ii) understand the relevant legislation relating to money laundering, including Federal AML Legislation Law No. 1 of 2004, Federal Law No. 4 of 2002, Federal Law No. 7 of 2014, and any other relevant Federal laws; (iii) understand its policies, procedures, systems and controls related to money laundering and any changes to these; (iv) recognise and deal with Transactions, risks, trends, techniques and other activities which may be related to money laundering; (v) understand the types of activity that may constitute suspicious activity in the context of the business in which an Employee is engaged and that may warrant a notification to the MLRO under Rule 14.2.2; (vi) understand its arrangements regarding the making of a notification to the MLRO under Rule 14.2.2; (vii) be aware of the prevailing techniques, methods and trends in money laundering relevant to the business of the Relevant Person; (viii) understand the roles and responsibilities of Employees in combating money laundering including the identity and responsibility of the Relevant Person's MLRO and deputy, where applicable; and (ix) understand the relevant findings, recommendations, guidance, directives, resolutions, Sanctions, notices or other conclusions described in Chapter 11; (c) ensure that its Anti-Money LaunderingAML training:
(i) is appropriately tailored to the Relevant Person's activities, including its products, services, cCustomers, distribution channels, business partners and the level and complexity of its Transactions; and (ii) indicates the different levels of money laundering risk and vulnerabilities associated with the matters in (c)(i); and

Appendix 1
(d) ensure that its Anti-Money LaunderingAML training is up-to-date with money laundering trends and techniques.
13.2 Frequency
13.2.1 A Relevant Person must provide Anti-Money Laundering conduct AML training sessions for all
Employees in accordance with Rule 13.1.1 at least annually at least once every 12 months.
13.3 Record-keeping
13.3.1 All relevant details of the Relevant Person's Anti Money Laundering AML training must be
recorded, including:
(a) dates when the training was given;
(b) the nature of the training; and
(c) the names of the Employees who received the training.
13.3.2 These records must be kept for at least six10 years from the date on which the training was
given.
Guidance

The Regulator considers it appropriate that all new relevant Employees of a Relevant
Person be given appropriate Anti-Money Laundering AML training as soon as reasonably practicable after commencing employment with the Relevant Person, and thereafter on a periodic basis.
A relevant Employee would include a member of the Senior Management or
operational staff, any Employee with customer contact or which handles or may handle customer monies or assets, and any other Employee who might otherwise encounter money laundering in the business.
Relevant Persons should take an RBA to Anti-Money Laundering AML training. The
Regulator considers that Anti-Money Laundering AML training should be provided by a Relevant Person to each of its relevant Employees at intervals appropriate to the role and responsibilities of the Employee. In the case of an Authorised Person the Regulator expects that training should be provided to each relevant Employee at least annually.
The manner in which Anti-Money Laundering training is provided by a Relevant Person
need not be in a formal classroom setting, rather it may be via an online course or any other similarly appropriate manner.
A relevant Employee would include a member of the Senior Management or
operational staff, any Employee with Customer contact or which handles or may handle Customer monies or assets, and any other Employee who might otherwise encounter money laundering in the business.

Appendix 1
14. SUSPICIOUS ACTIVITY REPORTS
14.1 Application and definitions
14.1.1 In this Chapter:
(a) "money laundering" means the criminal offence defined in Federal Law No. 4 of 2002; and (b) “terrorist financing” means the criminal offences defined in Federal AML Legislation Law No. 1 of 2004.
14.2 Internal reporting requirements
14.2.1 A Relevant Person must establish and maintain policies, procedures, systems and controls in
order to monitor and detect suspicious activity or Transactions in relation to potential money laundering or terrorist financing.
14.2.2 A Relevant Person must have policies, procedures, systems and controls to ensure that
whenever any Employee, acting in the ordinary course of his employment, either:
(a) knows;
(b) suspects; or
(c) has reasonable grounds for knowing or suspecting, that a Person is engaged in or attempting money laundering or terrorist financing, that Employee promptly notifies the Relevant Person's MLRO and provides the MLRO with all relevant details ("Internal Suspicious Activity Report").
14.2.3 A Relevant Person must have policies and procedures to ensure that disciplinary action can be
taken against any Employee who fails to make such a report.
Guidance

Circumstances that might give rise to suspicion or reasonable grounds for suspicion of
money laundering include:
(a.) Transactions which have no apparent purpose, which make no obvious economic sense, or which are designed or structured to avoid detection; (b.) Transactions requested by a Person without reasonable explanation, which are out of the ordinary range of services normally requested or are outside the experience of a Relevant Person in relation to a particular cCustomer; (c.) where the size or pattern of Transactions, without reasonable explanation, is out of line with any pattern that has previously emerged or may have been are deliberately structured to avoid detection;

Appendix 1
(d.) a cCustomer's refusal to provide the information requested without reasonable explanation; (e.) where a cCustomer who has just entered into a business relationship uses the relationship for a single Transaction or for only a very short period of time; (f.) an extensive use of offshore accounts, companies or structures in circumstances where the cCustomer's economic needs do not support such requirements; (g.) unnecessary routing of funds through third party accounts; or (h.) unusual Transactions without an apparently profitable motive.
2. CDD measures form the basis for recognising suspicious activity. Sufficient guidance
must therefore be given to the Relevant Person's Employees to enable them to form a suspicion or to recognise when they have reasonable grounds to suspect that money laundering or terrorist financing is taking place. This should involve training that will enable relevant Employees to seek and assess the information that is required for them to judge whether a Person is involved in suspicious activity related to money laundering or terrorist financing.
23. The requirement for Employees to notify the Relevant Person's MLRO should include
situations when no business relationship was developed because the circumstances were suspicious.
34. A Relevant Person may allow its Employees to consult with their line managers before
sending a report to the MLRO. The Regulator would expect that such consultation does not prevent making a report whenever an Employee has stated that he has knowledge, suspicion or reasonable grounds for knowing or suspecting that a Person may be involved in money laundering. Whether or not an Employee consults with his line manager or other Employees, the responsibility remains with the Employee to decide for himself whether a notification to the MLRO should be made.
45. An Employee, including the MLRO, who considers that a Person is engaged in or
engaging in activity that he knows or suspects to be suspicious would not be expected to know the exact nature of the criminal offence or that the particular funds were definitely those arising from the crime of money laundering or terrorist financing.
5. CDD measures form the basis for recognising suspicious activity. Sufficient guidance
must therefore be given to the Relevant Person's Employees to enable them to form a suspicion or to recognise when they have reasonable grounds to suspect that money laundering or terrorist financing is taking place. This should involve training that will enable relevant Employees to seek and assess the information that is required for them to judge whether a Person is involved in suspicious activity related to money laundering or terrorist financing.
6. A Transaction that appears unusual is not necessarily suspicious. Even customers with
a stable and predictable Transaction profile will have periodic Transactions that are unusual for them. Many customers will, for perfectly good reasons, have an erratic pattern of Transactions or account activity. So the unusual is, in the first instance, only a basis for further inquiry, which may in turn require judgement as to whether it is

Appendix 1
suspicious. A Transaction or activity may not be suspicious at the time, but if suspicions are raised later, an obligation to report it then arises.
7. Effective CDD measures may provide the basis for recognising unusual and suspicious
activity. Where there is a cCustomer relationship, suspicious activity will often be one that is inconsistent with a cCustomer's known legitimate activity, or with the normal business activities for that type of account or cCustomer. Therefore, the key to recognising "suspicious activity" is knowing enough about the cCustomer and the cCustomer's normal expected activities to recognise when their activity is abnormal.
8. A Relevant Person may consider implementing policies and procedures whereby
disciplinary action is taken against an Employee who fails to notify the Relevant Person's MLRO.
14.3 External Suspicious Activity Report
14.3.1 A Relevant Person must ensure that where the Relevant Person's MLRO receives an Internal
Suspicious Activity Report a notification under Rule 14.2.2, the MLRO, without delay:
(a) investigates and documents the circumstances in relation to which the notification made under Rule 14.2.2 was made; (b) determines whether in accordance with Federal AML Legislation Law No. 4 of 2002 an external Suspicious Activity Report must be made to the FIU AMLSCU and documents such determination; (c) if required, makes an external Suspicious Activity Report to the FIU AMLSCU as soon as practicable; and (d) notifies the Regulator of the making of such Suspicious Activity Report immediately following its submission to the FIU AMLSCU.
14.3.2 The MLRO must, following receipt of an Internal Suspicious Activity Report under Rule 14.2.2,
document:
(a) the steps taken to investigate the circumstances in relation to which an Internal Suspicious Activity Report is made; and (b) where no external Suspicious Activity Report is made to the FIU AMLSCU, the reasons why no such report was made.
14.3.3 A Relevant Person must ensure that if the MLRO decides to make an external Suspicious
Activity Report, his decision is made independently and is not subject to the consent or approval of any other Person. Guidance

Relevant Persons are reminded that the failure to report suspicions of money
laundering or terrorist financing may constitute a criminal offence that is punishable under the laws of the U.A.E.

Appendix 1
2. Suspicious Activity Reports under Federal AML Legislation Law No. 4 of 2002 should
be emailed to the FIU AMLSCU. The dedicated email address and the template for making a Suspicious Activity Report are available on the Regulator's website.
3. In the preparation of a Suspicious Activity Report, if a Relevant Person knows or
assumes that the funds which form the subject of the report do not belong to a cCustomer but to a third party, this fact and the details of the Relevant Person's proposed course of further action in relation to the case should be included in the report.
4. If a Relevant Person has reported a suspicion to the FIU AMLSCU, the FIU AMLSCU
may instruct the Relevant Person on how to continue its business relationship, including effecting any Transaction with a Person. If the cCustomer in question expresses his wish to move the funds before the Relevant Person receives instruction from the FIU AMLSCU on how to proceed, the Relevant Person should immediately contact the FIU AMLSCU for further instructions.
14.4 Suspension of Transactions and “nNo tTipping-off” rRequirement
14.4.1 A Relevant Person must not carry out Transactions that which it knows or suspects, or has
reasonable grounds for knowing or suspecting, to be related to mMoney lLaundering until it has informed the FIU AMLSCU and the Regulator pursuant to Rule 14.3. Guidance

Relevant Persons are reminded that in accordance with Article 16 of Federal AML
Legislation Law No. 4 of 2002, Relevant Persons or any of their Employees must not tip-off any Person, that is, inform any Person that he is being scrutinised for possible involvement in suspicious activity related to money laundering, or that any other competent authority is investigating his possible involvement in suspicious activity relating to money laundering.
If a Relevant Person reasonably believes that performing CDD measures will tip-off a
cCustomer or potential cCustomer, it may choose not to pursue that process and should file a Suspicious Activity Report. Relevant Persons should ensure that their Employees are aware of and sensitive to these issues when considering the CDD measures.
14.5 Record-keeping
14.5.1 All relevant details of any internal or external Suspicious Activity Report pursuant to Rules 14.2
and 14.3 must be kept for at least six 10 years from the date on which the report was made.

Appendix 1
14.6 Freezing of assets
Guidance
The Regulator has power under FSMR to restrict a Relevant Person from disposing of or transferring property including, for example, assets or other funds suspected of relating to money laundering. It may also apply to ADGM Court for an order restraining a Person from transferring or disposing of any assets suspected of relating to money laundering. In cases involving suspected money laundering, the FSRA will usually take such action in co-ordination with the FIU.

Appendix 1
15. DNFBP REGISTRATION AND SUPERVISION
Guidance

FSMR gives the Regulator a power to supervise DNFBPs’ compliance with relevant
Anti-Money Laundering laws in the State. FSMR also gives the Regulator a number of other powers in relation to DNFBPs, including powers of enforcement. This includes a power to obtain information and to conduct investigations into possible breaches of the FSMR. The Regulator may also impose fines for breaches of FSMR or the Rules. It may also suspend or withdraw the registration of a DNFBP in various circumstances.
The Regulator takes a risk-based approach to regulation of persons which it
supervises. Generally, the Regulator will work with DNFBPs to identify, assess, mitigate and control relevant risks where appropriate. The Guidance & Policies Manual (“GPM”) describes the Regulator’s enforcement powers under FSMR and outlines its policy for using these powers.
Rule 15.1.1 requires a DNFBP to be registered by the Regulator to conduct its activities
in the ADGM. Rule 15.2.1 sets out the criteria a DNFBP must meet to be registered.
A DNFBPs is defined in Rule 3.2.1 and includes the following class of persons whose
business is carried out in the ADGM:
(a) a real estate agency which carries out transactions with other Persons that involve the acquiring or disposing of real property; (b) a dealer in precious metals or precious stones; (c) a dealer in any saleable item of a price equal to or greater than USD15,000; (d) an accounting firm, audit firm, insolvency firm or taxation consulting firm; (e) a law firm, notary firm or other independent legal business; or (f) a Company Service Provider.
In determining if a Person is a DNFPB the Regulator will adopt a ‘substance over form’
approach. That is, it will consider what business or profession is in fact being carried on, and its main characteristics, and not just what business or profession the person purports, or is licensed, to carry on in the ADGM.
The Regulator considers that a “law firm, notary firm or other independent legal
business, includes any business or profession that involves a legal service, including advice or services related to laws in the U.A.E. The Regulator does not consider it necessary for the purposes of the definition that the:
(a) Person is licensed to provide legal services in the U.A.E; or THE CONTENTS OF CHAPTER 15 OF THE CURRENT VERSION OF AML HAVE BEEN REVIEWED AND INCORPORATED INTO THE PROPOSED DRAFTING OF CHAPTER 4. THE PROPOSED
CHAPTER 15 BELOW IS A NEW CHAPTER

Appendix 1
(b) the individuals or employees providing the legal service are qualified or authorised to do so, whether in the U.A.E.
7. The Regulator considers that that “accounting firm, audit firm, insolvency firm or
taxation consulting firm”, includes forensic accounting services that use accounting skills, principles and techniques to investigate suspected illegal activity or to analyse financial information for use in legal proceedings.
15.1 DNFBP Prohibition
15.1.1 A person who is a DNFBP must not carry on any activities in or from the ADGM unless that
person is registered under AML 15.4 by the Regulator as a DNFBP.
15.1.2 The Regulator may delegate its powers for the registration, suspension and cancellation of the
a DNFBP’s registration of a DNFBP to the Registrar of Companies.
15.2 Criteria for Registration as a DNFBP
15.2.1 (1) To be registered as a DNFBP, an applicant must demonstrate to the Regulator’s
satisfaction that:
(a) it is fit and proper to perform anti-money laundering functions; and (b) it has adequate resources, systems and controls, including policies and procedures, to comply with all applicable anti-money laundering requirements under Federal AML legislation, FSMR and these Rules; (2) In assessing if an applicant is fit and proper under (1)(a), the Regulator may, without limiting the matters it may take into account under that paragraph, consider the applicant, its senior management, its Beneficial Owners, other entities in its Group and any other Person with whom it has a relationship. (3) The Regulator will in assessing if an applicant is fit and proper, consider the cumulative effect of matters that, if considered individually, may be regarded as insufficient to give reasonable cause to doubt the fitness and propriety of the applicant.
15.3 Application for Registration as a DNFBP
15.3.1 A person may apply to the Regulator to be registered as a DNFBP by completing and
submitting the appropriate form.
15.3.2 The Regulator may require an applicant to provide additional information or documents
reasonably required by the Regulator for it to be able to consider an application for registration including, but not limited to, information or documents relating to the activities, ownership, group structure, financial and other resources of the applicant.
15.3.3 Where, at any time between filing an application and the grant or refusal of registration as a
DNFBP, an applicant becomes aware of a material change in its circumstances that is

Appendix 1
reasonably likely to be relevant to its application it shall inform the Regulator in writing of the change without delay.
15.3.4 Any person who is a DNFBP upon the making of this Chapter and was previously a Relevant
Person prior to the making of this Chapter:
(a) is deemed to be registered as a DNFBP at the time of the making of this Chapter; and (b) must apply for registration under Rule 15.3:
(i) within 12 months of the making of this Chapter; or (ii) at the date of the renewal of its Commercial Licence under the Commercial Licensing Regulations 2015; whichever comes first.
15.4 Grant of an Application
15.4.1 The Regulator may grant an application for DNFBP registration as a DNFBP if it is wholly
satisfied that the applicant meets the criteria for registration under Rule 15.3.1.
15.4.2 Where the Regulator decides to register a DNFBP, it shall as soon as is practicable inform the
applicant in writing of that decision and of the date on which registration is to take effect.
15.5 Refusal of an Application
15.5.1 The Regulator may refuse to grant an application for DNFBP registration where it is not wholly
satisfied that the applicant meets the criteria for registration under Rule 15.3.1.
15.6 DNFBP Notifications
15.6.1 A DNFBP must promptly notify the Regulator of any change in its:
(c) name;
(d) legal status;
(e) address;
(f) MLRO;
(g) senior management; or
(h) Beneficial ownership.
15.6.2 (1) A DNFBP must notify the Regulator in writing at least fourteen days in advance of it
ceasing to carry on the business activities that establishes it as a DNFBP.

Appendix 1
(2) The notice must include a request to cancel its registration, an explanation of the reason for the DNFBP ceasing business, the planned date of the cessation of its activities, and copies of any relevant documents must be submitted with the notice.
15.7 Suspension and withdrawal of DNFBP Registration
15.7.1 (1) The Regulator may suspend the registration of a DNFBP at the request of the DNFBP
or on its own initiative.
(2) The Regulator may withdraw the registration of a DNFBP:
(a) at the request of the DNFBP;
(b) if the Registrar of Companies notifies it that the DNFBP no longer holds the relevant commercial licence to operate in the ADGM; or (c) on its own initiative.
15.7.2 (1) The Regulator may exercise its power on its own initiative under Rule 15.7.1 (1) or
(2)(c) where:
(a) the DNFBP no longer meets the criteria for DNFBP registration; (b) the DNFBP is in breach of, or has been in breach of, the Law or Rules or other Anti-Money Laundering Legislation; (c) the DNFBP is insolvent or entering into administration; (d) the DNFBP is no longer carrying on business in the ADGM; or (e) the Regulator considers that exercising the power is necessary or desirable in the pursuit of its objectives in section 1.(3). Guidance

A DNFBP may request the withdrawal of its registration because, for example, it no
longer meets the definition of a DNFBP, becomes insolvent or enters into administration, or proposes to leave the ADGM.
In addition to being able to withdraw registration at the request of a DNFBP, the
Regulator may, on its own initiative, suspend or withdraw the registration of a DNFBP in various circumstances.
15.8 Disclosure of regulatory status
15.8.1 A DNFBP must not:
(a) misrepresent its regulatory status with respect to the Regulator expressly or by implication; or

Appendix 1
(b) use or reproduce the logo of the Regulator without express written permission from the Regulator and in accordance with any conditions for use imposed by the Regulator.
15.9 Co-ordination between the Regulator and the Registrar of Companies
15.9.1 (1) The Registrar of Companies shall not grant a person who is a DNFBP a commercial
licence to operate in the ADGM until the Regulator has confirmed to the Registrar of Companies that it intends to register the person as a DNFBP. (2) The Regulator shall as soon as is practicable notify the Registrar of Companies where it suspends or withdraws the registration of a DNFBP. (3) The Registrar of Companies shall as soon as is practicable suspend or withdraw (as the case may be) the commercial licence of the DNFBP where it receives a notification under (2).

Appendix 1
16. NON-PROFIT ORGANISATIONS (“NPOS”)
16.1 Responsibility for NPO compliance
16.1.1 An NPO's Governing Body is responsible for establishing, maintaining and monitoring the
NPO’s obligations under this chapter.
16.1.2 An NPO must maintain information on the following:
(a) the purpose and objectives of its stated activities; (b) the identity of the persons who own, control or direct its activities, including the Governing Body and senior officers; (c) what appropriate controls have been put in place to ensure that all funds are fully accounted for, and are spent in a manner that is consistent with the purpose and objectives of its stated activities; and (d) what reasonable measures it has taken to confirm the identity, credentials and good standing of beneficiaries and associated NPOs to ensure that they are not involved with terrorists or terrorist organisations or use its charitable funds to support.
16.2 Record Keeping
16.2.1 An NPO must maintain for a period of at least six years records of its obligations required
under Rule 16.1.2, covering both domestic and international transactions, which are sufficiently detailed to verify that funds have been received and spent in a manner consistent with the purpose and objectives of the NPO.
16.3 Cooperation
16.3.1 An NPO must deal with the Regulator in an open and co-operative manner and keep the
Regulator informed of significant events or anything else relating to the NPO of which the Regulator would be reasonable expect to be notified.
16.3.2 An NPO must, at the request of the Regulator:
(a) give or procure the giving of specified information, Documents, files, tapes, computer data or other material in the NPO's possession or control to the Regulator; (b) make its Employees readily available for meetings with the Regulator; (c) give the Regulator access to any information, Documents, records, files, tapes, computer data or systems, which are within the NPO's possession or control and provide any facilities to the Regulator; (d) permit the Regulator to copy Documents or other material on the premises of the NPO at the NPO's expense;

Appendix 1
(e) provide any copies of those Documents or other material as requested by the Regulator; and (f) answer truthfully, fully and promptly, all questions which are put to it by the Regulator.

Appendix 1
APP 1 FLOWCHARTS
A1.1 Figure 1. The Risk-Based Approach
[DELETED]

Appendix 1
A1.2 Figure 2. Business risk-based assessment [DELETED]

Appendix 1
A1.3 Figure 3. Customer risk-based assessment [DELETED] A1.4 Figure 4. Customer due diligence [DELETED]

Appendix 1
A1.5 Figure 5. Reliance and outsourcing of AML compliance.
[DELETED]

Appendix 2 - Draft Amendments to the Glossary (GLO)

Appendix 3
Glossary (GLO)
*In this Appendix, underlining indicates new text and strikethrough indicates deleted text, unless otherwise indicated.

Appendix 3
Defined Terms Definitions
Agent Means any Person who has been appointed by the Fund Manager of a Passported Fund to Promote the Units of that Passported Fund. Authority Means the Securities and Commodities Authority, the Financial Services Regulatory Authority or the Dubai Financial Services Authority. Home Jurisdiction Means, in relation to a Fund, the Jurisdiction in which the Fund is established or domiciled. Home Regulator Means:
(a) in relation to a Passported Fund, the Authority that is responsible for regulating the Passported Fund in the Home Jurisdiction where the Fund is established or domiciled; and (b) in relation to the Fund Manager of a Passported Fund, the Authority that is responsible for regulating the Fund Manager in the Home Jurisdiction where the Passported Fund is established or domiciled. Host Jurisdiction Means, in relation to a Passported Fund, a Jurisdiction into which the Passported Fund may be Promoted under the Fund Passporting Rules. Host Regulator Means in relation to a Passported Fund, the Authority in the Host Jurisdiction into which a Passported Fund may be Promoted in accordance with the Fund Passporting Rules. Jurisdiction Means the UAE, the Dubai International Financial Centre and the ADGM. Licensed Promoter Means a Person who is licensed or otherwise authorised by one of the Authorities to Promote Funds. Passported Fund Means a Fund that is registered on its Home Jurisdiction’s Register of Passported Funds. Private Fund Means a Passported Fund where:
(a) the initial subscription paid by a Person to become a Unitholder of the Fund is not less than $50,000; and (b) participation in the Passported Fund is restricted to Unitholders who are Professional Clients. Promote, Promoted, Promotion, Promoting Means the marketing and sale of units of a Passported Fund to investors domiciled in a Jurisdiction by means of any form of communication including a direct or indirect public offering or private placement performed by:
(a) the Fund Manager;

Appendix 3
Defined Terms Definitions
(b) an Agent; or
(c) any other Licensed Person.
In this definition “sale” includes any arranging, dealing and advising activities in relation to the Units of the Passported Fund. Register of Passported Funds Means:
(a) in relation to ADGM, the register of Passported Funds maintained by the Regulator; and (b) in relation to a Host Jurisdiction, the register of Passported Funds maintained by the applicable Host Regulator in that Jurisdiction.

Consultation Paper No. 1 of 2019 – Proposed Revisions to the Anti-Money Laundering Regime in ADGM

Annex A - Proposed Amendments to Financial Services and Markets Regulations (FSMR)

Appendix 1 - Draft Amendments to the AML Rulebook (AML)

Appendix 2 - Draft Amendments to the Glossary (GLO)

Lineage: In force

Similar documents from other regulators