Consultation Paper No. 3 of 2021 – Proposals on Digital Verification of Identity (eKYC)

CONSULTATION PAPER
NO. 3 OF 2021
PROPOSALS ON DIGITAL
VERIFICATION OF IDENTITY (eKYC)
23 June 2021

Consultation Paper No. 3 of 2021
Contents
Introduction.............................................................................................................................. 3
Why are we issuing this paper? ............................................................................................... 3
Who should read this paper? ................................................................................................... 3
How to provide comments ....................................................................................................... 3
What happens next?................................................................................................................ 4
Comments to be addressed to:................................................................................................ 4
Background ............................................................................................................................. 5
Updating the regulatory framework for eKYC........................................................................... 6
Advantages of eKYC.................................................................................................................6
Facilitation of eKYC ..................................................................................................................6
Inherent risks ............................................................................................................................8
Mitigation of eKYC risks............................................................................................................8
Biometric verification and authentication.................................................................................10
Miscellaneous amendments....................................................................................................11
Conclusion..............................................................................................................................11
Proposed amendments.......................................................................................................... 12

Consultation Paper No. 3 of 2021
Why are we issuing this paper?

1. The Financial Services Regulatory Authority (“FSRA“) of Abu Dhabi Global Market
   (“ADGM“) has issued this Consultation Paper to seek views on its proposed updates to the regulatory framework governing the use of non-face-to-face (“NFTF”), digital verification of identity, also known as “electronic Know Your Customer” (“eKYC”), used during the customer due diligence (“CDD”) process. Adopting these proposals would make the FSRA’s requirements in this area both clearer and more closely aligned with the recommendations and guidance issued on the topic by the Financial Action Task Force (“FATF”) as well as the UAE’s Federal Anti-Money Laundering legislation; and guidance 1 issued by the FSRA and other federal authorities in the context of the Covid￾19 pandemic (“the Joint Guidance”). The amendments are principally proposed to Anti￾Money Laundering and Sanctions Rules and Guidance (“the AML Rulebook”), although some amendments are also proposed to the General Rulebook (“GEN”). Who should read this paper?
2. This Consultation Paper should be of interest to all entities required to undertake CDD of
   natural persons 2
   , including in relation to Beneficial Owners. Whilst the measures proposed in this paper are principally directed at entities using or considering using eKYC, the majority of these measures also have implications for the wider population of entities undertaking CDD, irrespective of the method used. For example, the FSRA’s proposals on verification of a natural person’s current residential address would apply to all parties undertaking CDD, not just those using eKYC. Further, the FSRA’s guidance on how the business risk assessment and annual compliance review should interlink and interact has general application, rather than being limited to eKYC. How to provide comments
3. All comments should be made in writing and sent to the address or the email address
   specified below. If sending your comments by email, please use the Consultation Paper

1 Central Bank of the UAE (CBUAE), Dubai Financial Services Authority (DFSA), Financial Services Regulatory Authority (FSRA), the Securities and Commodities Authority (SCA), the Insurance Authority (IA), the Ministries of Justice and of Economy “Joint Guidance on the treatment of financial crime risks and obligations in the UAE in the context of the Covid-19 crisis” (https://www.adgm.com/documents/financial-crime-prevention-unit/notices/fsra-fcpu￾uae--supervisory-authorities-aml-guidance-covid-english.pdf May 2020) In this Consultation Paper, ‘entity’ means Relevant Person, as defined in the AML Rulebook. The term therefore includes Authorised Persons, Recognised Bodies, Designated Non-Financial Businesses or Professions, and Non￾Profit Organisations (all as defined in the AML Rulebook). Introduction

Consultation Paper No. 3 of 2021 number in the subject line. If relevant, please identify the organisation you represent when providing your comments.
4. The FSRA reserves the right to publish, including on its website, any comments you
provide, unless you expressly request otherwise at the time of submitting those comments. Comments supported by reasoning and evidence will be given more weight by the FSRA. What happens next?
5. The deadline for providing comments on the proposed framework is 29 July 2021. After
receiving your comments, we shall consider whether any modifications are required to the proposals and the Board of ADGM and the FSRA will then proceed to enact the proposals in their final form.
6. You should not act on these proposals until final rules and guidance are issued by the
FSRA. We shall issue a notice on our website when that happens.
Comments to be addressed to:
Consultation Paper No. 3 of 2021
Financial Services Regulatory Authority
Abu Dhabi Global Market Square
Al Maryah Island
PO Box 111999
Abu Dhabi, UAE email: consultation@adgm.com

Consultation Paper No. 3 of 2021

1. In March 2020, FATF published its Guidance on Digital ID 3
   (“the FATF Guidance”), which was supportive of the use of “reliable, independent” NFTF digital verification of customer identity (eKYC) during the CDD process. According to the FATF Guidance “reliable, independent” in this context means “that the digital ID system used to conduct CDD relies upon technology, adequate governance, processes and procedures that provide appropriate levels of confidence that the system produces accurate results”. The FATF Guidance outlines how eKYC can support the wider FATF Recommendations 4 , which are the international benchmark for regulatory frameworks for anti-money laundering and combatting terrorist financing (“AML/CTF”).
2. The FATF Guidance does not supersede the FATF Recommendations, instead it
   supports them by providing guidance on how eKYC systems (the technology and processes used to undertake eKYC) may be used most appropriately to ensure that they help entities comply with existing AML/CTF requirements. The FATF Guidance also recognises that eKYC has the potential to both reduce and be a source of AML/CTF risk, and makes nineteen recommendations to both help facilitate eKYC and mitigate those risks.
3. The FATF Guidance focusses on addressing the risks arising from eKYC in the
   following areas:
    initial and on-going CDD;
    reliance on third parties involved in the CDD process;  record-keeping; and  the risk-based approach to AML/CTF.
4. The timing of the publication of the FATF Guidance was opportune, as NFTF interaction
   (including when undertaking CDD) in many cases became a necessity during the global pandemic. In recognition of that and the general trend towards digitalisation of customer interaction with financial institutions, the FSRA and other UAE regulatory authorities published the Joint Guidance in May 2020. This provided guidance on how to mitigate the risks associated with NFTF interaction, including when using eKYC to on-board customers during the pandemic, but also in other areas, such as the monitoring of suspicious transactions.

3 Financial Action Task Force, “Guidance on Digital ID”, (http://www.fatf￾gafi.org/publications/fatfrecommendations/documents/digital-identity-guidance.html March 2020) 4 Financial Action Task Force, “The FATF Recommendations”, (http://www.fatf￾gafi.org/publications/fatfrecommendations/documents/fatf-recommendations.html, as amended October 2020) Background

Consultation Paper No. 3 of 2021
5. The AML Rulebook is ‘technology-neutral’ and therefore already permits the use of eKYC,
however we recognise that it may benefit from additional wording to make this clear. In addition, given the ever-increasing use of eKYC in ADGM, the FSRA believes its regulatory framework should be updated to reflect the key messages of the Joint Guidance and the FATF Guidance. The purpose of the measures proposed in this paper is to ensure that the FSRA’s regulatory framework contains the requisite measures to both facilitate eKYC and also to clarify how it expects applicable entities to employ the technology in a manner that mitigates its inherent risks. The FSRA is therefore proposing amendments to its Rulebooks to reflect this and the areas of focus addressed in the FATF Guidance. Benchmarking
6. In drawing-up its proposals the FSRA has sought to ensure greater alignment with
international best practices, including those promoted in the FATF Guidance. We have therefore examined a number of regulatory frameworks governing eKYC in comparable, peer jurisdictions and concluded that the proposals in this consultation paper would make the FSRA’s regulatory framework more comprehensive and reflective of current best practices. In addition, the proposed amendments also reflect the evolving practices in relation to eKYC that are employed by entities operating in or from ADGM. Advantages of eKYC
7. Reliable and independent eKYC has several benefits. From an AML perspective, it can
enhance CDD and thus help to prevent financial crime. In a wider sense, it may also improve customer experience, reduce compliance costs for entities, eliminate manual processing of physical documentation and advance the digitalisation of financial services. Consequently, the FSRA has proposed a number of measures which clarify that eKYC is permitted in ADGM as part of the CDD process, as well as providing a suitable level of flexibility to reduce regulatory burden as and where appropriate. Facilitation of eKYC
8. Given the advantages of eKYC outlined above and to encourage its use, the FSRA
wishes to make it clear to entities that eKYC is permitted in ADGM. It is proposing to do so by amending applicable guidance on CDD in the AML Rulebook and by proposing a number of substantive amendments to help facilitate the adoption of eKYC. The key proposals are in the following areas:
Updating the regulatory framework for eKYC

Consultation Paper No. 3 of 2021
 Verification of residential address. The existing requirement in the AML Rulebook is to both obtain and verify the current residential address of a natural person, but verification of residential address can be challenging for eKYC systems in the UAE. This is because documents evidencing address do not lend themselves to being verifiable by automated, digital processes, and typically must be checked by the human eye. Following a review of applicable FATF publications and peers within and outside the UAE, the FSRA proposes removing the hard requirement to always undertake address verification, as long as doing so is consistent with entities’ risk￾based approaches to AML/CTF and also all applicable Laws and Rules. This position would, we believe, better align our framework with applicable UAE Federal AML legislation 5 and the published Guidance on it 6 (which are more flexible on the issue than the AML Rulebook).  Further, we consider that our proposed amendments would make our framework more consistent with guidance produced by the FATF, which not only comments on the potential for flexibility on the issue of verification of address 7 , but also identifies national legislative frameworks which have provided similar flexibility 8 . Our proposed position does not preclude entities choosing to verify current residential address as a matter of good business practice, for commercial reasons and to assist verifying a customer’s identity. Finally, we have proposed amending the AML Rulebook so that all customers subject to Enhanced Customer Due Diligence must be subject to verification of current residential address.  Assurance assessments. In ADGM and elsewhere, eKYC systems tend to be obtained from outsourced service providers, rather than developed in-house. The AML Rulebook requires entities to undertake reviews of the service providers to whom they have outsourced an element of the CDD process. We have made a number of proposed amendments to rules and guidance in the AML Rulebook, to build-upon this existing requirement and therefore strengthen entities’ oversight of the outsourced service providers used. However, we are also proposing to provide

“Cabinet Resolution No. (10) of 2019 Concerning the Implementing Regulations of Federal Decree by Law No. (20) of 2018 Concerning Anti-Money Laundering and Counter Terrorism Financing and Financing of Illegal Organizations” (https://www.mof.gov.ae/en/lawsAndPolitics/CabinetResolutions/Pages/201910.aspx, 2019) “Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations. Guidelines for Financial Institutions” (https://www.adgm.com/documents/financial-crime-prevention-unit/useful-links/aml-cft-and￾illegal-organisations-guidelines-for-financial-institutions.pdf, March 2021) 7 Financial Action Task Force, “Guidance on Digital ID” (see pages 53 and 61) (http://www.fatf￾gafi.org/publications/fatfrecommendations/documents/digital-identity-guidance.html, March 2020) 8 Financial Action Task Force, “Anti-Money Laundering and Terrorist Financing Measures and Financial Inclusion”, see pages 11, 89,102 and 104, (http://www.fatf-gafi.org/media/fatf/content/images/Updated-2017-FATF-2013- Guidance.pdf, November 2017)

Consultation Paper No. 3 of 2021 some flexibility in this area, and we propose that entities be permitted to place a level of reliance on assurance assessments of eKYC systems performed by third parties. We propose that this reliance extend to assurance assessments conducted by another Group member, an independent third party, or where the eKYC system is government-authorised (a proposal consistent with the FATF Guidance).  We believe this approach strikes the right balance between requiring entities to exert strong oversight over outsourced service providers licensing their eKYC systems, and allowing entities to place appropriate reliance on reviews undertaken for them by other parties. We detail the conditions for such reliance within our proposals. For clarity, under our proposals we have not changed the requirement for entities using outsourcing arrangements to be entirely responsible for compliance with applicable rules.

1. THE FSRA INVITES COMMENTS ON THE PROPOSALS FOR FACILITATING
   eKYC IN ADGM.
   Inherent risks
2. Compared to traditional CDD, eKYC is vulnerable to distinct risks which merit specific
   consideration. These range from false acceptance rates (a measure of the proportion of individuals who have been on-boarded by an eKYC system, but should not have been) which can vary materially across different eKYC systems, to how criminals can utilise technology themselves to counter eKYC controls, and how technology allows for the scaling of impersonation fraud to levels not possible when it is attempted face￾to-face. Furthermore, noting the tendency for eKYC systems to be sourced from third parties, there are distinct risks in placing reliance on those parties for any significant parts of the CDD process, including the gathering and processing of sensitive customer information, cybersecurity and data protection risks. Therefore, eKYC both presents new risks and increases existing risks in a material enough manner so as to merit additional wording (primarily in the form of guidance) within the FSRA’s Rulebooks. Mitigation of eKYC risks
3. Given the risks of eKYC outlined above, the FSRA’s proposed amendments to mitigate
   risks arising from eKYC seek to ensure the following outcomes:

Consultation Paper No. 3 of 2021
 A robust, outcomes-based approach to using eKYC for customer on￾boarding. Our proposed guidance on eKYC does not specify granular technical standards on how eKYC systems used in ADGM must verify identity, e.g. which biometric authentication methods must be used. Instead we propose specifying the outcomes that should be achieved. For example, we propose outlining that eKYC should be ‘secure and effective’ and ‘at least as stringent’ as traditional CDD. We also emphasise the requirement for entities to identify, document and address applicable eKYC risks, by utilising those assessments already required by the AML Rulebook. The FSRA’s proposed amendments therefore highlight the business risk assessment, systems and controls review and annual compliance review as particularly important in addressing eKYC risk. Therefore, our proposals place the onus on entities using eKYC to assess and address eKYC risk itself, and subsequently to calibrate their eKYC systems and broader risk management frameworks as appropriate to the risks it has identified.  Strong ongoing customer due diligence and anti-financial crime controls. The proposed amendments seek to ensure that the use of an eKYC system supports other anti-financial crime measures, including suspicious transaction monitoring, mitigation of fraud risk, and on-going measures to address money laundering, terrorist financing and other potential financial crimes after the customer has been on-boarded. Consequently, a number of our proposed amendments outline that entities should duly consider financial crime risks beyond AML/CTF (such as fraud) in their operations, and to remind entities that on-going CDD is an essential component of their anti-financial crime controls. We have also amended GEN to ensure that entities are required to take measures to prevent fraud against customers, as well as themselves (as is the current requirement). Therefore, the measures proposed seek to avoid eKYC becoming the ‘entry point’ for criminals taking advantage of business relationships conducted entirely on an NFTF basis to perpetrate financial crime after on-boarding is completed.  Existing record-keeping requirements are adhered to. The FSRA proposes highlighting existing record keeping rules that require CDD records be held securely by both entities and eKYC system providers where third-party eKYC system providers handle sensitive customer data.
2. THE FSRA INVITES COMMENTS ON THE PROPOSALS TO AMEND THE AML
AND GEN RULEBOOKS TO HELP MITIGATE EKYC RISK.

Consultation Paper No. 3 of 2021
Multiple nationalities and residencies
11. We have taken the opportunity to draft miscellaneous guidance which may assist
Relevant Persons (“RPs”) on-boarding customers with more than one nationality. The guidance outlines that where a potential or existing customer has more than one nationality the customer risk assessment should take account of that, potentially requiring a background check against all nationalities held by such a customer. The proposed guidance in this area should be of interest to all entities that on-board new customers, including those that use more ‘traditional’ methods than eKYC.
3. THE FSRA INVITES COMMENTS ON THE PROPOSALS TO PROVIDE GUIDANCE
ON UNDERTAKING CDD FOR CUSTOMERS WITH MULTIPLE NATIONALITIES.
Biometric verification and authentication
12. The proposals do not specify granular requirements to be followed when using biometric
verification as part of eKYC. However, it should be noted that the use of biometrics is in￾scope of the recently issued draft ‘Guidelines for Financial Institutions adopting Enabling Technologies’ ; once finalised, we intend to include guidance in the AML Rulebook outlining that entities should implement them as applicable. Portability of CDD information
13. We recently enacted our regulatory framework for Third Party Providers (“TPPs”) 10
. Whilst not directly connected to the proposals outlined in this paper, we are taking this opportunity to remind entities of one particular obligation brought in by the TPP framework which may have relevance to entities’ use of eKYC. Our TPP framework brought in (via amendments to the AML Rulebook) the obligation on an applicable entity to share CDD information with another in-scope entity, as long as certain conditions were met. The TPP framework and the measures proposed in this paper are part of the ADGM’s ongoing efforts to foster innovation in financial services.

9 Central Bank of the UAE (CBUAE), the Securities and Commodities Authority (SCA), the Dubai Financial Services Authority (DFSA) and the Financial Services Regulatory Authority (FSRA) “Guidelines for Financial Institutions Adopting Enabling Technologies”, see pages 25-26, (https://www.adgm.com/media/announcements/uae-regulatory￾authorities-launch-consultation June 2021) “ADGM FSRA introduces a new regulatory framework for Third Party Financial Technology Services” (https://www.adgm.com/media/announcements/adgm-fsra-introduces-a-new-regulatory-framework-for-third-party￾financial-technology-services April 2021)

Consultation Paper No. 3 of 2021
Miscellaneous amendments
14. We are taking this opportunity, alongside the consultation on the proposals outlined
above, to correct some minor errors, omissions and typos that are present in the current version of the AML Rulebook, separately from the proposals for amendments to take account of eKYC. For example, our miscellaneous amendments include changing reporting deadlines from Calendar Days to Business Days, in line with other parts of our Rulebook. These corrections and amendments are not part of the consultation process and will be implemented as they stand in Appendix 4. Conclusion
15. We believe that the proposals in this paper clarify that eKYC is permitted in ADGM and
will help facilitate its adoption, whilst highlighting the strong controls that must govern its use. In doing so, we believe the FSRA’s regulatory framework will align the FATF Guidance’s specifications for ensuring “reliable and independent” eKYC is in operation. Finally, we believe the proposals strike an appropriate balance between drafting Rules and Guidance to facilitate eKYC and measures to mitigate its risks, and between high￾level and granular requirements. O

Consultation Paper No. 3 of 2021
 Appendix 1 Anti-Money Laundering and Sanctions Rules and Guidance (AML)  Appendix 2 General Rulebook (GEN)  Appendix 3 Glossary (GLO)  Appendix 4 Anti-Money Laundering and Sanctions Rules and Guidance (AML)

• miscellaneous changes not subject to consultation
  Proposed amendments
  PROPOSED AMENDMENTS AND REGULATIONS
  PROPOSED AMENDMENTS AND REGULATIONS
  PROPOSED AMENDMENTS AND REGULATIONS

---

Appendix 1: Proposed amendments to Anti-Money Laundering and Sanctions Rules & Guidance (AML)

Appendix 1
Anti-Money Laundering and Sanctions Rules and Guidance (AML) *In this attachment underlining indicates new text and striking through indicates deleted text.

Appendix 1
3. INTERPRETATION AND TERMINOLOGY
…
3.2 Glossary for AML
…
3.2.1 The following terms and abbreviations bear the following meanings for the
purposes of these Rules.
… eKYC Means verification of customer identity by way of electronic means only. eKYC System Means the technology and associated processes used to undertake eKYC. Financial Crime Includes:
(a) fraud or dishonesty;
(b) misconduct in or misuse of information relating to a financial market; (c) handling the proceeds of crime; or (d) the financing of terrorism. (e) (f) (g) Non-Face-to-Face (NFTF) Where a customer is not physically present for a business operation or transaction with a Relevant Person. …
4. GENERAL COMPLIANCE REQUIREMENTS
4.1 General requirements
4.1.1 (1) A Relevant Person must establish and maintain effective Anti-Money
Laundering policies, procedures, systems and controls to prevent opportunities for money laundering, in relation to the Relevant Person and its activities. (2) A Relevant Person's Anti-Money Laundering policies, procedures, systems and controls must:
(a) ensure compliance with Federal AML Legislation; (b) enable suspicious Persons and Transactions to be detected and reported; (c) ensure the Relevant Person is able to provide an appropriate audit trail of a Transaction; and

Appendix 1
(d) ensure compliance with any other obligation in these Rules.
(3) A Relevant Person must take reasonable steps to ensure that its Employees comply with the relevant requirements of its Anti-Money Laundering policies, procedures, systems and controls. (4) A Relevant Person must review the effectiveness of its Anti-Money Laundering policies, procedures, systems and controls at least annually. (5) The review process may be undertaken:
(a) internally by its internal audit or compliance function; or (b) by a competent firm of independent auditors or compliance professionals. (6) The review process required under Rule 4.1.1(4) must cover at least the following:
(a) a sample testing of customer documentation relevant to an assessment of the adequacy of the customer risk assessment or CDD performed by the Relevant Person; (b) an analysis of all Suspicious Activity Reports to highlight any area where procedures or training may need to be enhanced; and (c) a review of the adequacy of the level of responsibility and oversight of the Relevant Person’s Governing Body and Senior Management in ensuring the Relevant Person has implemented and maintained adequate controls. Guidance Where appropriate, a Relevant Person should incorporate all material risks identified in the business risk assessment, such as a new business practice or introduction of new technology, within scope of the annual review under Rule 4.1.1(4). …
4.5 Record keeping
4.5.1 A Relevant Person must, where relevant, maintain the following records:
(a) a copy of all documents and information obtained in undertaking initial and on￾going CDD or due diligence on business partners; (b) records, consisting of the original documents or certified copies, in respect of the customer business relationship, including:
(i) business correspondence and other information relating to a customer’s account; (ii) sufficient records of transactions to enable individual transactions to be reconstructed; and (iii) internal findings and analysis relating to a transaction or any business,

Appendix 1
if the transaction or business appears unusual or suspicious, whether or not it results in a Suspicious Activity Report; (c) Internal Suspicious Activity Report notifications made under Rule 14.2.2; (d) Suspicious Activity Reports and any relevant supporting documents and information, including internal findings and analysis; (e) any relevant communications with the FIU; (f) the documents in Rule 4.6.1; and (g) any other matter that the Relevant Person is expressly required to record under these Rules, for at least six years from the date on which the notification or report was made, the business relationship ends or the Transaction is completed, whichever occurs last. Guidance A Relevant Person must comply with all applicable Rules on record keeping, regardless of whether or not it is outsourcing an element of its CDD process, see also Rule 9.3. This includes the obligation for the Relevant Person to maintain a copy of all documents obtained during initial and on-going CDD. Where using eKYC for CDD, the Relevant Person should maintain the necessary data concerning biometric authentication. …
6. BUSINESS RISK ASSESSMENT
6.1 Assessing business AML risks
6.1.1 A Relevant Person must:
(a) take appropriate steps to identify and assess money laundering risks to which its business is exposed, taking into consideration the nature, size and complexity of its activities; (b) when identifying and assessing the risks in (a), take into account, to the extent relevant, any vulnerabilities relating to:
(i) its type of customers and their activities; (ii) the countries or geographic areas in which it does business; (iii) its products, services and activity profiles; (iv) its distribution channels and business partners; (v) the complexity and volume of its Transactions; (vi) the development of new products and business practices including new delivery mechanisms, channels and partners;

Appendix 1
(vii) the use of new or developing technologies for both new and pre￾existing products and services; and (c) take appropriate measures to ensure that any risk identified as part of the assessment in (a) is taken into account in its day to day operations and is mitigated, including in relation to:
(i) the development of new products;
(ii) the taking on of new Customers customers; and (iii) changes to its business profile.
6.1.2 A Relevant Person must use the information obtained in undertaking its business risk
assessment to:
(a) develop and maintain its Anti-Money Laundering policies, procedures, systems and controls as required by Rule 6.2.1; (b) ensure that its Anti-Money Laundering policies, procedures, systems and controls adequately mitigate the risks identified as part of the assessment in Rule 6.1.1; (c) assess the effectiveness of its Anti-Money Laundering policies, procedures, systems and controls as required by Rule 6.2.1(c); (d) assist in the allocation and prioritisation of Anti-Money Laundering resources; and (e) assist in the carrying out of the customer risk assessment under Chapter 7.
6.1.3 Without limiting compliance with Rules 6.1.1 and 6.1.2 a Relevant Person must,
prior to launching any new product, service, business practice or using a new or developing technology, take reasonable steps to ensure that it has:
(a) assessed and identified the money laundering risks relating to the product, service, business practice or technology; and (b) taken appropriate steps to mitigate or eliminate the risks identified under (a). Guidance

1. Unless a Relevant Person understands the money laundering risks to which
   it is exposed, it cannot take appropriate steps to prevent its business being used for the purposes of money laundering. Money laundering risks vary from business to business depending on the nature of the business, the type of customers a business has, the nature of the products and services sold, and the geographical operations in which it operates.
2. Using the RBA, a Relevant Person should assess its own vulnerabilities to
   money laundering and take all reasonable steps to eliminate or manage such risks. The results of this assessment will also feed into the Relevant Person's risk assessment of its Customers customers under Chapter 7.
3. In addition to assessing risk arising from money laundering and terrorist financing,

Appendix 1
a business risk assessment should assess the potential exposure of a Relevant Person to other Financial Crime, such as fraud and the theft of personal data. The business risk assessment should also address the Relevant Person’s potential exposure to cyber security risk, as this risk may have a material impact on the Relevant Person’s ability to prevent Financial Crime.
34. A Relevant Person should, prior to launching any new product, service,
business practice pay specific attention to assessing the potential for risks associated with money laundering. all applicable aspects of Financial Crime. This is especially important given the innovative nature of any such new offering as the Relevant Person may be less familiar with the functioning of the offering, compared to existing offerings.
45. Similarly, in using a new or developing technology, such as those associated
with the Regulated Activity of Developing Financial Technology Services within the RegLab or when undertaking NFTF business, a Relevant Person should pay specific attention to assessing the potential for risks associated with money laundering Financial Crime that might arise as a result of implementing that innovative technology. For example, while the use of eKYC Systems may reduce the risk of impersonation fraud at customer on-boarding, NFTF interaction with the customer may increase the risk of Financial Crime after a business relationship has been established, through transaction fraud, money laundering or theft of digitally stored CDD documentation.
6. A business risk assessment under Rule 6.1.1(b) should include assessment of
the risks associated with the carrying on of NFTFbusiness, particularly the use of eKYC Systems. The assessment should consider incorporating any relevant mitigation measures identified by the Regulator, a competent authority of the U.A.E., FATF, and any other relevant bodies.
6.2 Anti-Money Laundering systems and controls
6.2.2 A Relevant Person must:
(a) establish and maintain effective policies, procedures, systems and controls to prevent opportunities for money laundering in relation to the Relevant Person and its activities; (b) ensure that its systems and controls in (a):
(i) include the provision to the Relevant Person's Senior Management of regular management information on the operation and effectiveness of its Anti- Money Laundering systems and controls necessary to identify, measure, manage and control the Relevant Person's money laundering risks; (ii) enable it to determine whether a customer or a Beneficial Owners is a PEP; (iii) enable the Relevant Person to comply with these Rules and Federal AML Legislation; and (iv) enable the Relevant Person to comply with the PenalCode of the United Arab Emirates; and

Appendix 1
(c) ensure that regular risk assessments are carried out on the adequacy of the Relevant Person's Anti-Money Laundering systems and controls to ensure that they continue to enable it to identify, assess, monitor and manage money laundering risk adequately, and are comprehensive and proportionate to the nature, scale and complexity of its activities. Guidance

1. In Rule 6.2.1(c) the regularity frequency of risk assessments will depend on the
   nature, size and complexity of the Relevant Person's business and also on when any material changes are made to its business. The risk assessments should also take into account a range of Financial Crimes, including fraud.
2. The risk assessment under Rule 6.2.1(c) should identify actions to mitigate
   risks associated with undertaking NFTF business generally, and the use of eKYC specifically. This is because, distinct risks are often likely to arise where business is conducted entirely in an NFTF manner, compared to when the business relationship includes a mix of face-to-face and NFTF interactions. The assessment should make reference to risk mitigation measures recommended by the Regulator, a competent authority of the U.A.E., FATF, and other relevant bodies. …
3. CUSTOMER DUE DILIGENCE
   8.1 Requirement to undertake Customer Due Diligence
   …
   8.1.2 (1) A Relevant Person must also apply CDD measures to each existing customer
   under Rules 8.3.1, 8.4.1 or 8.5.1 as applicable:
   (a) with a frequency appropriate to the outcome of the risk-based approach in relation to each customer; and (b) when the Relevant Person becomes aware that any of the circumstances relevant to its risk assessment for a customer has changed. (2) For the purposes of 8.1.2(1), in determining when it is appropriate to apply CDD measures in relation to existing customers, a Relevant Person must take into account, amongst other things:
   (a) any indication that the identity of the customer, or the customer’s Beneficial Owners, has changed; (b) any Transactions that are not reasonably consistent with the Relevant Person’s knowledge of the customer; (c) any change in the purpose or intended nature of the Relevant Person’s relationship with the customer; or (d) any other matter that might affect the Relevant Person’s risk assessment

Appendix 1
of the customer.
Guidance

1. A Relevant Person should undertake appropriate CDD in a manner
   proportionate to the customer's money laundering risks. This means that all customers are subject to CDD under Rule 8.3.1. However, for high-risk customers, additional Enhanced Customer Due Diligence measures should also be undertaken under Rule 8.4.1. For customers having a low-risk rating, the requirements under Rule 8.3.1 may be modified according to the assessed risk, in accordance with Rule 8.5.1.
2. The frequency for undertaking CDD for existing customers will be determined
   by the risk rating assigned to a particular customer. The Regulator expects that customers rated high risk for money laundering should be reviewed more frequently than customers rated lower risk for money laundering.
3. A Relevant Person also needs to know who its customers are to guard against
   a range of Financial Crime risks, including fraud (particularly impersonation fraud). …
   8.3 Customer Due Diligence requirements
   ….
   8.3.2 (1) For the purposes of Rule 8.3.1(1)(a), a Relevant Person must identify a
   customer and verify the customer’s identity in accordance with this Rule. (2) If a customer is a natural person, a Relevant Person must obtain and verify information about the person’s:
   (a) obtain and verify information about the person’s:
   (i) full name (including any alias);
   (bii) date of birth;
   (ciii) nationality; and
   (div) legal domicile; and.
   (e)(b) obtain the person’s current residential address (other than a post office box). …. (5) If a customer is a trust or other similar LegalArrangement, the Relevant Person must obtain and verify:
   (a) a certified copy of the trust deed or other documents that set out the nature, purpose and terms of the trust or arrangement; and (b) documentary evidence of the appointment of the trustee or any other

Appendix 1
person exercising powers under the trust or arrangement.
Guidance on CDD

1. The information required under 8.3.2(2)(a) and (b) should be obtained through a
   first-hand inspection review of an original current, valid passport or, where a customer does not own a passport, an official identification document which includes a photograph. For the purposes of Rule 8.2.3(2)(a)(i) and (ii) an official government identification document in digital form and issued by a governmental competent authority is considered valid.
2. A Relevant Person should ensure that any documents used for the purpose of
   identification are original documents, whichever format they are in, including digital.
3. The verification of a customer’s identity, including their address, should be based
   on official documents. Where that is not possible, a Relevant Person should consider using additional documents or information obtained from different independent sources to verify identity. Any lack of official documents and alternative means of verification should lead the Relevant Person to re-assess the customer’s risk classification and the associated level of due diligence to be undertaken.
4. For a customer who is a natural person, a Relevant Person should, to the extent
   possible, verify the current residential address as a matter of good business practice, for commercial reasons and to help verify the customer’s identity. Where a Relevant Person does not verify the current residential address, it should ensure doing so is consistent with its risk-based approach to AML and all applicable rules and laws. The Relevant Person must verify the address of a customer subject to Enhanced Customer Due Diligence under Rule 8.4.1.
5. Where personal identity documents, such as a passport, ID card or other
   identification documentation cannot be obtained reviewed in original form, for example because a Relevant Person has no physical contact with the Customer, the identification documentation provided should be certified as a true copy of the original document by any one of the following:
   a. a registered lawyer; b. a registered notary;
   c. a chartered accountant;
   d. a government ministry; e. a post office; f. a police officer; or g. an embassy or consulate. The individual or authority undertaking the certification should be contactable if necessary. Where a copy of an original identification document is made by a Relevant Person, the copy should be dated, signed and marked with 'original sighted'.

Appendix 1
6. Where a Relevant Person uses eKYC for CDD purposes appropriate measures
must be adopted to mitigate the risks that may arise from eKYC procedures and the use of an eKYC System. A Relevant Person must ensure that eKYC is secure and effective, includes an appropriate combination of authentication factors when verifying the identity of the customer and ensure it is at least as stringent as face￾to-face CDD. Measures should be in place to verify the authenticity of any official government identification document and the actual customer. A Relevant Person should also apply guidance on technical standards for biometric authentication issued by the Regulator or a competent authority of the U.A.E., as applicable.
7. When employing an eKYC System to assist with CDD, a Relevant Person should:
a. ensure that it has a thorough understanding of the eKYC System itself and the risks of eKYC, including those outlined by relevant guidance from FATF and other international standard setting bodies; b. comply with all the Rules of the Regulator relevant to eKYC including, but not limited to, applicable requirements regarding the business risk assessment, as per Rule 6.1, and outsourcing, as per Rule 9.3.
c. combine eKYC with transaction monitoring, anti-fraud and cyber-security
measures to support a wider framework preventing applicable Financial Crime; and d. take appropriate steps to identify, assess and mitigate the risk of the eKYC system being misused for the purposes of Financial Crime.
8. A Relevant Person should take reasonable steps to identify whether a customer
has more than one nationality. The existence of dual nationality may be a potential risk factor and should be considered as such in the customer risk assessment required by Rule 7.1.2. ….
8.3.6 (1) For the purposes of Rule 8.3.1(1)(b), a Relevant Person must identify the
Beneficial Owners of a customer that is a foundation or other Legal Arrangement similar to a foundation in accordance with this Rule. …. (4) Where any of the persons identified under (2)(a) to (ed) are a Body Corporate or Partnership, the Relevant Person must identify the Beneficial Owners of Body Corporate or Partnership in accordance with Rule 8.3.3 and Rule 8.3.4. Guidance on verification of the identity of Beneficial Owners

1. In determining whether an individual meets the definition of BeneficialOwners
   regard should be had to all the circumstances of the case, in particular the size of an individual's legal engagement or beneficial ownership in a Transaction.
2. For a retail investment fund that is widely-held and where the investors invest
   via pension contributions, the Regulator would not expect the manager of the

Appendix 1
fund to look through to any underlying investors where there are none with any material control or ownership of the fund. However, for a closely-held fund with a small number of investors, each having a large shareholding or other interest, the Regulator would expect a Relevant Person to identify and verify each of the Beneficial Owners, depending on the risks identified as part of its risk-based assessment of the customer. For a corporate health policy with defined benefits, however, the Regulator would not expect a Relevant Person to identify the Beneficial Owners.
3. An eKYC System may be used as part of the identification and verification of
Beneficial Owners. When determining whether to use an eKYC System to assist in the CDD of a Beneficial Owner, a Relevant Person should establish if the eKYC System used allows it to comply fully with the relevant Rules in relation to CDD. …
8.4 Enhanced Customer Due Diligence
8.4.1 Where a Relevant Person is required to undertake Enhanced CDD, having assigned
a customer a high risk rating or it or its Beneficial Owners is a PEP, then, in addition to CDD under Rule 8.3.1, it must:
…
(e) obtain the approval of Senior Management to commence a business relationship with the customer; and (f) require the first payment to be carried out through an account in the customer’s name with a financial institution that is subject to money laundering regulation and supervision in a jurisdiction that has standards equivalent to those set out in the FATF Recommendations.; and (g) for a customer who is a natural person, verify the current residential address (other than a post office box). …
9. ANTI-MONEY LAUNDERING COMPLIANCE AND THIRD-PARTIES
…
9.3 Outsourcing and agents
9.3.1 A Relevant Person which outsources anyone or more elements of its CDD to a service
provider (including those within its Group) remains responsible for compliance with, and liable for any failure to meet, such obligations. Guidance 9.3.1A Prior to appointing an outsourced a service provider to undertake CDD, a Relevant Person should must undertake due diligence an initial assurance assessment to assure itself of evaluate the suitability of the outsourced service provider and should must ensure that the outsourced service provider's obligations are clearly

Appendix 1
documented in a binding agreement.
9.3.1B After engaging a service provider the Relevant Person must undertake periodic assurance assessments to ensure that the services provided meet the obligations recorded in the binding agreement and allow it to meet all the requirements that it is subject to. Guidance

1. A Relevant Person’s use of a service provider’s eKYC System (enabling a
   Relevant Person to undertake eKYC) constitutes outsourcing for the purposes of Rule 9.3.1.
2. When undertaking an assurance assessment of an eKYC System for the
   purpose of Rule 9.3.1A, a Relevant Person should seek to establish that the eKYC System is reliable and independent, and allows the Relevant Person to comply with all applicable Rules of the Regulator. In addition, a Relevant Person should consider applying guidance on assurance standards issued by the Regulator, competent U.A.E. authorities, FATF, and other relevant standard setting bodies.
3. In limited circumstances, a Relevant Person may place reliance on the
   assurance assessment of the eKYC System conducted entirely by another entity. Such circumstances comprise the following:
   a. Where an assurance assessment of the eKYC System has been undertaken by a Related entity and specifically addresses the Rules and Regulations applicable to the Relevant Person. In such circumstance s, the Relevant Person remains responsible for the eKYC System’ s compliance with applicable Rules and Laws and it should maintain a copy of the assessment. b. Where the eKYC System has been authorised by a competent authority of the U.A.E. or a competent authority in a jurisdiction with Anti Money Laundering laws equivalent to the U.A.E. In such circumstances, the eKYC system should be authorised for use in CDD. Further, the Relevant Person should undertake its own review to ensure that any use of the relevant eKYC System is appropriate and enables compliance with all Rules and Regulations applicable to the Relevant Person.
   c. Where a Relevant Person chooses to employ a third party to assist in
   its own assurance assessment of the eKYC System, It should ensure that a competent and independent firm with relevant expertise and resources be employed. The Relevant Person remains wholly responsible for the eKYC System’ s compliance with, and any failure to meet, the Rules and Regulation applicable to the Relevant Person.
4. In complying with Rule 9.3.1, a Relevant Person should ensure that the
   service provider can be replaced with minimal disruption in the event the outsourcing arrangement is terminated.
5. An Authorised Person is also required to comply with the outsourcing
   obligations in GEN 3.3.31 and 3.3.32 and PRU 6.8. A Recognised Body is

Appendix 1
also required to comply with the outsourcing obligations in MIR 2.14. …
14. SUSPICIOUS ACTIVITY REPORTS
…
14.2 Internal reporting requirements
….
14.2.3 A Relevant Person must have policies and procedures to ensure that disciplinary
action can be taken against any Employee who fails to make such a report. Guidance

1. Circumstances that might give rise to suspicion or reasonable grounds for
   suspicion of money laundering include:
   …
2. CDD measures form the basis for recognising suspicious activity. Sufficient
   guidance must therefore be given to the Relevant Person's Employees to enable them to form a suspicion or to recognise when they have reasonable grounds to suspect that money laundering or terrorist financing is taking place. This should involve training that will enable relevant Employees to seek and assess the information that is required for them to judge whether a Person is involved in suspicious activity related to money laundering or terrorist financing.
3. Where appropriate, a Relevant Person should also utilise the methods
   described in paragraph 1 above to detect a range of Financial Crimes, including fraud. Bearing in mind the evolving nature of Financial Crime and the methods used to further it, a Relevant Person should apply best practice when determining which behaviours would constitute as suspicious and what measures are required to detect suspicious transactions. Such practices may include, but are not limited to, incorporating the analysis of customer behaviour metrics into the monitoring of suspicious transactions.
   3.4. The requirement for Employees to notify the Relevant Person's MLRO should
   include situations when no business relationship was developed because the circumstances were suspicious.
   4.5. A Relevant Person may allow its Employees to consult with their line
   managers before sending a report to the MLRO. The Regulator would expect that such consultation does not prevent making a report whenever an Employee has stated that he has knowledge, suspicion or reasonable grounds for knowing or suspecting that a Person may be involved in money laundering. Whether or not an Employee consults with his line manager or other Employees, the responsibility remains with the Employee to decide for himself whether a notification to the MLRO should be made.
   5.6. An Employee, including the MLRO, who considers that a Person is engaged
   in or engaging inactivity that he knows or suspects to be suspicious would not be expected to know the exact nature of the criminal offence or that the particular funds were definitely those arising from the crime of money

Appendix 1
laundering or terrorist financing.
6.7. A Transaction that appears unusual is not necessarily suspicious. Even
Customers customers with a stable and predictable Transaction profile will have periodic Transactions that are unusual for them. Many Customers customers will, for perfectly good reasons, have an erratic pattern of Transactions or account activity. So the unusual is, in the first instance, only a basis for further inquiry, which may in turn require judgement as to whether it is suspicious. A Transaction or activity may not be suspicious at the time, but if suspicions are raised later, an obligation to report it then arises.
7.8. Effective CDD measures may provide the basis for recognising unusual and
suspicious activity. Where there is a customer relationship, suspicious activity will often be one that is inconsistent with a customer's known legitimate activity, or with the normal business activities for that type of account or customer. Therefore, the key to recognising "suspicious activity" is knowing enough about the customer and the customer's normal expected activities to recognise when their activity is abnormal.
8.9. A Relevant Person may consider implementing policies and procedures
whereby disciplinary action is taken against an Employee who fails to notify the Relevant Person's MLRO. …

---

Appendix 2 : Proposed amendments to the General Rulebook (GEN)

Appendix 2
GENERAL RULEBOOK (GEN)
*In this attachment underlining indicates new text and striking through indicates deleted text.

Appendix 2
3. MANAGEMENT, SYSTEMS AND CONTROLS
…
3.3 Systems and controls
…
Fraud
3.3.38 An Authorised Person must establish and maintain effective systems and controls to:
(1) deter and prevent suspected fraud against the Authorised Person and its Customers; and (2) report suspected fraud and other Financial Crimes to the relevant authorities.
3.3.39 An Authorised Person must ensure that the systems and controls established and
maintained in accordance with Rule 3.3.38:
(1) enable it to identify, assess, monitor and manage Financial Crime risks, including Money Laundering Risk; and (2) are comprehensive and proportionate to the nature, scale and complexity of its activities.
3.3.40 In Rule 3.3.39(1), "Money Laundering Risk" is the risk that an Authorised Person may be
used to further money laundering. In identifying its Financial Crime risks and Money Laundering Risk and establishing the necessary systems and controls, an Authorised Person should consider a range of factors, including:
(1) its Customer, product and activity profiles; (2) its distribution channels; (3) the complexity and volume of its Transactions; (4) its processes and systems; and (5) its operating environment. Guidance Considering the evolving nature of Financial Crime, and the methods used to undertake it, an Authorised Person should apply best practice when establishing the systems and controls required under Rule 3.3.38. Such practices may include, but are not limited to, incorporating secure authentication, biometrics and the monitoring of customer behaviour metrics into anti-fraud and anti-Financial Crime systems and controls. …

---

Appendix 3: Proposed amendments to Glossary (GLO)

Appendix 3
GLOSSARY (GLO)
*In this attachment underlining indicates new text and striking through indicates deleted text.

Appendix 3

1. INTRODUCTION
   1.1 Application
   1.1.1 This Rulebook ("GLO") applies to every Person to whom any of the Rulebooks apply.
   1.2 Defined Terms
   1.2.1 In the Rulebooks:
   …
   Defined Terms Definitions eKYC Means verification of customer identity by way of electronic means only. eKYC System Means the technology and associated processes used to undertake eKYC. Non-Face-to-Face (NFTF) Where a customer is not physically present for a business operation or transaction with a Relevant Person. Suspicious Activity Report (SAR) Means a report in the prescribed format regarding suspicious activity (including a suspicious Transaction) made to the FIU. …

---

Appendix 4: Proposed amendments to AML (Miscellaneous Amendments)

Appendix 4
Anti-Money Laundering and Sanctions Rules and Guidance (AML) *In this attachment underlining indicates new text and striking through indicates deleted text.

Appendix 4
2. OVERVIEW AND PURPOSE OF THE AML RULEBOOK
Guidance
…
3. The AML Rulebook is not intended to be read in isolation from other U.A.E. relevant
legislation or developments in international policy and best practice and, to the extent applicable, Relevant Persons need to be aware of, and take into account, how these aforementioned matters may impact on the Relevant Person's day to day operations. This is particularly relevant when considering the list of terrorist organisations or persons issued under Article 63 of Federal Law No. 7 of 2014 on Combating Terrorism and the United Nations Security Council ("UNSC") Resolutions which apply in the ADGM, and Sanctions imposed by other jurisdictions which may apply to a Relevant Person depending on the Relevant Person's jurisdiction of origin, its business and/or customer base. … Sanctions
24. The U.A.E., as a member of the United Nations, is required to comply with all Sanctions
issued and passed by the UNSC. The U.A.E. periodically publicises its imposition of Sanctions. These UNSC obligations apply in the ADGM and their importance is emphasised by specific obligations contained in the AML Rulebook requiring Relevant Persons to establish and maintain effective systems and controls to make appropriate use of UNSC Sanctions and Resolutions (see Chapter 11). …

Appendix 4
3. INTERPRETATION AND TERMINOLOGY
…
3.2.1 The following terms and abbreviations bear the following meanings for the purposes
of these Rules.
…
Beneficial Owners Means, in relation to a customer, a natural Natural person Person who ultimately owns or controls the customer or a natural Natural person Person on whose behalf a transaction is conducted or a business relationship is established and includes:
(a) in relation to a body corporate, a person Person referred to in Rule 8.3.3(2); (b) in relation to a Partnership, a person Person referred to in Rule 8.3.4(2); (c) in relation to a trust or other similar Legal Arrangement, a person Person referred to in Rule
8.3.5 (2); and
(d) in relation to a foundation, a person Person referred to in Rule 8.3.6(2). Federal Decree by law No. 20 of 2018 Means U.A.E. Federal Decree by Law No. 20 of 2018 Oon Anti Money Laundering, Combating the Financing of Terrorism and Financing of Illegal Organisations. Federal Law No. 1 of Means U.A.E. Federal Law No. 1 of 2004 regarding Combatting Terrorism Offences. Federal Law No. 4 of Means U.A.E. Federal Law No. 4 of 2002 regarding the Criminalisation of Money Laundering. Regulated Financial Institution A person Person who does not hold a FSP but who is authorised in a jurisdiction other than the ADGM to carry on any financial service by another Financial Services Regulator. Sanctions Means any law executing foreign policy, security, sanction, trade embargo, or anti-terrorism objectives or similar restrictions imposed, administered or enforced from time to time by:

Appendix 4
(a) the U.A.E.;
(b) the United Nations Security Council;
(c) the European Union;
(d) H.M. Treasury of the United Kingdom;
(e) the Office of Foreign Assets Control (OFAC) of the U.S. Department of the Treasury; (f) any other relevant governmental authority; or (g) any relevant inter-governmental or supra-national authority; or (gh) any of their successors. Senior Management Means in relation to a Relevant Person every member of the Relevant Person's executive management and includes:
(ia) for an ADGM Entity, every member of the Relevant Person's Governing Body; (iib) for a Branch, the Person or Persons who control the day to day operations of the Relevant Person in the ADGM; or (iiic) for an auditor, every member of the Relevant Person's executive management in the U.A.E. Shareholder Means a Natural Person or legal entity governed by private or public law, who holds, directly or indirectly:
(a) Shares of the Issuer in its own name and on its own account; (b) Shares of the Issuer in its own name, but on behalf of another natural Natural person Person or legal entity; or (c) depository receipts, in which case the holder of the depository receipt shall be considered as the shareholder of the underlying Shares represented by the depository receipts. …

Appendix 4. GENERAL COMPLIANCE REQUIREMENTS
…
4.5.2 A Relevant Person must immediately provide to the Regulator, upon request, or a law
enforcement agency, pursuant to a valid and enforceable request or requirement, a copy of the record referred to in Rule 4.65.1. Guidance The Regulator expects that a Relevant Person will be able to ordinarily provide the records within one dayBusiness Day of a request from the Regulator. …

Appendix 4
6. BUSINESS RISK ASSESSMENT
6.1 Assessing business AML risks
6.1.1 …
(c) take appropriate measures to ensure that any risk identified as part of the assessment in (a) is taken into account in its day to day operations and is mitigated, including in relation to:
(i) the development of new products;
(ii) the taking on of new Customerscustomers; and (iii) changes to its business profile. …
6.1.3 Without limiting compliance with Rules 6.1.1 and 6.1.2 a Relevant Person must, prior
to launching any new product, service, business practice or using a new or developing technology, take reasonable steps to ensure that it has:
…
Guidance
…
2. Using the RBA, a Relevant Person should assess its own vulnerabilities to
money laundering and take all reasonable steps to eliminate or manage such risks. The results of this assessment will also feed into the Relevant Person's risk assessment of its Customerscustomers under Chapter 7. …
6.2 Anti-Money Laundering systems and controls
6.2.1 …
(b) ensure that its systems and controls in (a):
…
(ii) enable it to determine whether a customer or a Beneficial Owners is a PEP; …

Appendix 4
7. CUSTOMER RISK ASSESSMENT
…
7.1 Assessing customer Anti-Money Laundering risks
…
7.1.2 (1) …
(b) product, service, transaction or delivery channel risk factors, including whether:
…
(iii) the situation involves non face-to-faceNFTF business relationships or transactions, or lacks appropriate safeguards, such as electronic signatures or eKYC; …
7.2 Prohibition on Establishing Business Relationships with Certain customers
…
7.2.3 A Relevant Person must not knowingly establish or maintain an anonymous account,
an account in a fictitious name, or a nominee account which is held for the benefit of another person Person whose true identity has not been disclosed to the Relevant Person. …

Appendix 4
8. CUSTOMER DUE DILIGENCE
…
8.2.1 (1) For a Relevant Person that is an Authorised Person or Recognised Body:
…
(5) Where the Relevant Person, having relied on Rule 8.2.1(1)(b) or 8.2.1(3) is unable to complete the verification of the identity of a customer and any Beneficial Owners, within thirty days twenty Business Days of effecting a Transaction or occasional transaction it must:
…
8.4.1 Where a Relevant Person is required to undertake Enhanced CDD, having assigned
a customer a high risk rating or it or its Beneficial Owners is a PEP, then, in addition to CDD under Rule 8.3.1, it must:
…
Guidance
…
9. For Rule 8.4.1, circumstances where it may be applicable to require the first
payment made by a customer in order to open an account with a Relevant Person to be carried out through a bank account in the customer's name include:
(a) where, following the use of other Enhanced Customer Due Diligence measures, the Relevant Person is not satisfied with the results of that due diligence; or …
8.6.2 A Relevant Person shouldmust apply an intensified and on-going monitoring
programme with respect to higher risk Transactions and customers. ...

Appendix 4
10. CORRESPONDENT BANKING, WIRE TRANSFERS, ANONYMOUS ACCOUNTS
AND AUDIT
…
10.2 Correspondent banking
10.2.1 An Authorised Person proposing to have a correspondent banking relationship with a
respondent bank must:
…
(g) be satisfied that, in respect of any customers of the respondent bank who have direct access to accounts of the Authorised Person, the respondent bank:
(i) has undertaken CDD (including on-going CDD) at least equivalent to that in Rule 8.3.1 in respect of each Customercustomer; and ...
10.3.1 In this section:
(a) "beneficiary" means the naturalNatural or Legal Person or the Legal Arrangement that is identified by the originator as the receiver of the requested wire transfer; …

Appendix 4
11. SANCTIONS AND OTHER INTERNATIONAL OBLIGATIONS
…
Guidance

1. In Rule 11.1.1(1), taking reasonable measures to comply with resolutions or
   Sanctions may include, for example, a Relevant Person not undertaking a transaction for or on behalf of a Person without undertaking further due diligence in respect of a that Person. …
   11.2 Government, regulatory and international findings
   11.2.1 (1) A Relevant Person must establish and maintain systems and controls to
   ensure that on an ongoing basis it is properly informed as to, and takes reasonable measures to comply with, any findings, recommendations, guidance, directives, resolutions, Sanctions, notices or other conclusions issued by:
   …
   (4) A Relevant Person must immediately notify the Regulator in writing if it becomes aware of non-compliance by a Person with a finding, recommendation, guidance, directive, resolution, Sanction, notice or other conclusion and provide the Regulator with sufficient details of the person Person concerned and the nature of the non-compliance. …

Appendix 4
12. MONEY LAUNDERING REPORTING OFFICER
12.1 Appointment of a MLRO
…
Guidance

1. Authorised Persons are reminded that under GEN Rule 5.5.1 the MLRO
   function is a mandatory appointment. For the avoidance of doubt, the individual appointed as the MLRO of an Authorised Person, other than a Representative Office, is the same individual who holds the Recognised Function of MLRO of that Authorised Person. Authorised Persons are also reminded that the guidance under GEN Rule 5.5.2 sets out the grounds under which the Regulator will determine whether to grant a waiver from the residence requirements for an MLRO. The same guidance would apply by analogy is relevant to other Relevant Persons seeking a waiver from the MLRO residence requirements. …
   12.1.7 A Relevant Person may outsource the role of MLRO to an individual outside the
   Relevant Person provided that the individual under the outsourcing agreement is and remains suitable to perform the MLRO role. Guidance Where a Relevant Person outsources specific AML tasks of its MLRO to another individual or a third party provider, including the case where they are within it’s corporate Group, the Relevant Person remains responsible for ensuring that the duties undertaken by the MLRO ensure its compliance with the requirements in the AML Rulebook. The Relevant Person should satisfy itself of the suitability of anyone who acts for it in the role of MLRO.
   12.2 Qualities of an MLRO
   …
   12.3 Responsibilities of an MLRO
   …

Appendix 4
14. SUSPICIOUS ACTIVITY REPORTS
…
14.6 Freezing of assets
Guidance
It may also apply to ADGM Courts for an order restraining a Person from transferring or disposing of any assets suspected of relating to money laundering. In cases involving suspected money laundering, the FSRA Regulator will usually take such action in co-ordination with the FIU.

Appendix 4
15. DNFBP REGISTRATION AND SUPERVISION
Guidance
…
5. In determining if a Person is a DNFPB the Regulator will adopt a ‘substance
over form’ approach. That is, it will consider what business or profession is in fact being carried on, and its main characteristics, and not just what business or profession the personPerson purports, or is licensed, to carry on in the ADGM.
6. The Regulator considers that a “law firm, notary firm or other independent legal
business, includes any business or profession that involves a legal service, including advice or services related to laws in the U.A.E. The Regulator does not consider it necessary for the purposes of the definition that the:
(a) Person is licensed to provide legal services in the U.A.E.; or …
15.1.1 A person Person who is a DNFBP must not carry on any activities in or from the ADGM
unless that person Person is registered under AML 15.4 by the Regulator as a DNFBP.
15.1.2 The Regulator may delegate its powers for the registration, suspension and
cancellation of the a DNFBP’s registration of a DNFBP to the Registrar of Companies. …
15.3.1 A person Person may apply to the Regulator to be registered as a DNFBP by
completing and submitting the appropriate form.
…
15.3.4 Any person Person who is a DNFBP upon the making of this Chapter and was
previously a Relevant Person prior to the making of this Chapter:
…
15.6.2 (1) A DNFBP must notify the Regulator in writing at least fourteen days ten
Business Days in advance of it ceasing to carry on the business activities that establishes it as a DNFBP. …
15.9.1 (1) The Registrar of Companies shall not grant a person Person who is a DNFBP
a commercial licence to operate in the ADGM until the Regulator has confirmed to the Registrar of Companies that it intends to register the person Person as a DNFBP. …