Draft Investment Funds (Anti-Money Laundering, Countering Financing of Terrorism and Countering Financing of Proliferation) Rules, 2026

FOR CONSULTATION: Securities Commission of The Bahamas Draft Investment Funds (Anti-Money Laundering, Countering Financing of Terrorism and Countering Financing of Proliferation) Rules, 2026 PUBLIC CONSULTATION DRAFT INVESTMENT FUNDS (ANTI-MONEY LAUNDERING, COUNTERING FINANCING OF TERRORISM AND COUNTERING FINANCING OF PROLIFERATION) RULES, 2026 CONSULTATION PERIOD: MONDAY 10 AUGUST 2026 - MONDAY 31 AUGUST 2026

FOR CONSULTATION: Securities Commission of The Bahamas Draft Investment Funds (Anti-Money Laundering, Countering Financing of Terrorism and Countering Financing of Proliferation) Rules, 2026 DRAFT INVESTMENT FUNDS (ANTI-MONEY LAUNDERING, COUNTERING FINANCING OF TERRORISM AND COUNTERING FINANCING OF PROLIFERATION) RULES, 2026 The Securities Commission of The Bahamas (“the Commission”) in exercise of its powers conferred by section 160 of the Investment Funds Act, 2019 (No. 2 of 2019), has issued the draft Investment Funds (Anti-Money Laundering, Countering Financing of Terrorism and Countering Financing of Proliferation) Rules, 2026 (the “Rules”) for public consultation. The draft Rules can be found on the Commission’s website at: scb.gov.bs/legislative-framework/consultation-documents/. Summary The draft Rules is subsidiary to the Investment Funds Act 2020 (the Act) and provides a legislative anti￾money laundering (AML), countering the financing of terrorism (CFT) and countering the financing of proliferation (CFP) framework for investment funds under the Investment Funds Act, 2019. Investment funds were previously covered under the Securities Industry (Anti Money Laundering and Countering the Financing of Terrorism) Rules, 2015. The proposed Rules seek to provide a clear, standalone framework for AML, CFT and CFP requirements applicable to entities licenced under the Investment Funds Act 2020 (the IFA). The Rules: (i) establish a risk rating framework for regulated persons; (ii) prescribe internal control procedures, including suspicious transaction reporting; (iii) set out requirements for verification of customer identity; (iv) establish a framework for the implementation of targeted financial sanctions; and (v) implement record keeping requirements. Scope These Rules would apply to all regulated persons under the Investment Funds Act, 2019. Consultation period Commences: Monday 10 August 2026 Ends: Monday 31 August 2026 Reply to: Please submit any comments to IFAconsultation@scb.gov.bs. Or alternatively, to: Executive Director Securities Commission of The Bahamas Poinciana House North Building 2 nd Floor, 31A East Bay Street P.O. Box N-8347 Nassau, The Bahamas Tel: (242) 397-4100 Email: info@scb.gov.bs

FOR CONSULTATION: Securities Commission of The Bahamas Draft Investment Funds (Anti-Money Laundering, Countering Financing of Terrorism and Countering Financing of Proliferation) Rules, 2026 Page 2 of 19 DRAFT INVESTMENT FUNDS (ANTI-MONEY LAUNDERING, COUNTERING FINANCING OF TERRORISM AND COUNTERING FINANCING OF PROLIFERATION) RULES, 2026 Arrangement of Sections

1. Citation. ........................................................................................................................................ 3
2. Interpretation. .............................................................................................................................. 3
3. Application................................................................................................................................... 3 PART II – RISK RATING DUTY OF REGULATED PERSON ……………………………………………………4
4. Designation of AML/CFT/CPF responsibility ................................................................................... 4
5. Duty of regulated person to implement risk rating framework. 4 PART III – INTERNAL CONTROLS………………………………………………………………………………….5
6. Duty of the regulated person concerning internal controls ............................................................ 5
7. Money Laundering Reporting Officer. ............................................................................................ 6
8. Outsourcing .................................................................................................................................. 6
9. Suspicious transaction reporting................................................................................................. 7
10. Implementation of Targeted Financial Sanctions. ....................................................................... 7 PART IV – VERIFICATION OF CUSTOMER IDENTITY………………………………………….…………7
11. Due diligence measures............................................................................................................... 7
12. Simplified due diligence measures................................................................................................. 7
13. Enhanced due diligence measures................................................................................................. 8
14. Verification of customer identity ................................................................................................... 9
15. Required Information .............................................................................................................. 10
16. Politically exposed persons.......................................................................................................... 13
17. Reliance on third party verification procedures............................................................................ 14
18. Suspension or termination of activity or business. ....................................................................... 15
19. Exemption from verification of identity.................................................................................... 15
20. Ongoing monitoring................................................................................................................. 15 PART V – RECORD KEEPING………………………………………………………………………………………16
21. Maintenance of records. ............................................................................................................. 16
22. Transactions records................................................................................................................ 17
23. Other records. ......................................................................................................................... 17 PART VI – MICELLANEOUS 17
24. Education and training. ............................................................................................................... 17

FOR CONSULTATION: Securities Commission of The Bahamas Draft Investment Funds (Anti-Money Laundering, Countering Financing of Terrorism and Countering Financing of Proliferation) Rules, 2026 Page 3 of 19 INVESTMENT FUNDS ACT, 2019 DRAFT INVESTMENT FUNDS (ANTI-MONEY LAUNDERING, COUNTERING FINANCING OF TERRORISM AND COUNTERING FINANCING OF PROLIFERATION) RULES, 2026 The Securities Commission of The Bahamas, in exercise of the powers conferred by section 160 of the Investments Funds Act 2019 (No. 2 of 2019) makes the following Rules —

1. Citation. These Rules may be cited as the Investment Funds (Anti-Money Laundering, Countering Financing of Terrorism and Countering Financing of Proliferation) Rules, 2026.
2. Interpretation. (1) In these Rules — “Act” means the Investment Funds Act, 2019 (No. 2 of 2019); “beneficial owner” has the meaning specified in the Register of Beneficial Ownership Act, 2018 (No. 38. of 2018); “Commission” means the Securities Commission of The Bahamas as continued under Part II of the Securities Industry Act, 2011 (No. 10 of 2011); “financial institution” has the meaning specified in the Financial Transaction Reporting Act, 2018 (No. 5 of 2018); “financing of proliferation” means the financing of proliferation of weapons of mass destruction specified in section 9 of the Anti-Terrorism Act, 2018 (No. 27 of 2018); “identified risks” has the meaning specified in the Proceeds of Crime Act (No. 4 of 2018) and the Financial Transaction Reporting Act (No. 5 of 2018); “investment fund” or “fund” has the meaning specified in the Investments Funds Act, 2019 (No.2 of 2019); “Money Laundering Reporting Officer” or “MLRO” means the person appointed pursuant to regulation 5 of the Financial Intelligence (Transactions Reporting) Regulations, 2001 (S.I. No. 7 of 2001); “occasional transaction” has the meaning specified in the Financial Transactions Reporting Regulations, 2018 (S.I. No. 7 of 2001); “regulated investment fund” has the meaning specified in the Investments Funds Act, 2019 (No.2 of 2019) “regulated person” has the meaning specified in the Investments Funds Act, 2019 (No.2 of 2019); “senior management” means an officer or employee of a regulated person with sufficient knowledge and seniority to make decisions affecting the regulated person’s risk exposure and need not involve a member of the board or directors and includes a person responsible for compliance or duly authorised to bind the regulated person;
3. Application. These Rules apply to all regulated investment funds or any other person designated by the

FOR CONSULTATION: Securities Commission of The Bahamas Draft Investment Funds (Anti-Money Laundering, Countering Financing of Terrorism and Countering Financing of Proliferation) Rules, 2026 Page 4 of 19 Commission as having anti-money laundering, countering the financing of terrorism or countering of proliferation financing responsibility in respect of an investment fund. PART II – RISK RATING DUTY OF REGULATED PERSON 4. Designation of AML/CFT/CFP responsibility. A regulated person shall have designated in writing the person responsible for establishing, implementing and maintaining policies, procedures and controls — (a) to deter the use of a facility for activities associated with identified risks; (b) to ensure the timely detection and reporting of suspicious activity; and (c) for the prompt investigation of suspicious activities. 5. Duty of regulated person to implement risk rating framework. (1) Every regulated person shall implement a risk rating framework which assesses and identifies — (a) the risk profile of each customer; (b) its own risk profile in relation to the countries or jurisdictions in which it operates; (c) the risk profile associated with its own business practices, products, services, transactions and delivery channels; (d) the nature and extent of risks related to the regulated person's non-face-to-face business relationships; and (e) the nature and extent of risks related to the regulated person's business activities that permit customers to receive payments from unknown or un-associated third parties. (2) The risk rating framework shall be approved by the regulated person's senior management based on the scope of the regulated person's activities, and shall be designed to— (a) take appropriate measures to continuously identify, measure, manage, and mitigate identified current and emerging risks; (b) take account of any risk assessment carried out at the national level and any regulatory guidance issued by the Commission; (c) categorize customer relationships and products to identify the level of risk associated with each customer relationship or product; (d) categorize customer relationships and products to take account of risk factors related to the particular customer relationship or product, including— (i) customer type or profession; (ii) country of domicile; (ii) complexity of ownership; (iv) complexity of legal structure; (v) source of business; (vi) type of assets; (vii) type, size and volume of transactions; (viii) level of cash transactions; (ix) non-face-to-face Know Your Customer document submission; and (x) adherence to customer activity profile;

FOR CONSULTATION: Securities Commission of The Bahamas Draft Investment Funds (Anti-Money Laundering, Countering Financing of Terrorism and Countering Financing of Proliferation) Rules, 2026 Page 5 of 19 (e) address which level of management can approve a decision for the regulated person to enter into customer relationships at the various levels of risk rating categories; (f) establish Know Your Customer and due diligence information requirements appropriate for the risk profile of the customer relationship or product; (g) require the periodic review of the customer relationship or product to— (i) ensure that the categorizations are current and appropriate; and (ii) enable the regulated person to determine whether any adjustment should be made to the risk rating; (h) require the re-categorization of a customer relationship or product offered by the regulated person in the event of a change in the risk profile of a customer relationship or product; (i) require the documentation of the basis for the risk rating applied to a customer relationship or product and of any changes in the risk rating of particular customer relationship or product; (j) mitigate any additional risks due to the cross-border nature of a transaction, particularly where the transaction takes place in a jurisdiction which could reduce the regulated person’s ability of oversight and the application of effective anti￾money laundering, countering the financing of terrorism and countering the financing of proliferation controls; (3) A regulated person shall assess the risk profile of each new customer and carry out a risk assessment of each new product, business practice or technology prior to establishing a business relationship with such customer or introducing such product, business practice or technology. (4) The outcome of each customer or product risk assessment conducted shall be documented and retained as part of the regulated person’s document keeping requirements. (5) A regulated person’s risk rating framework shall be subject to review by the Commission. PART III – INTERNAL CONTROLS 6. Duty of the regulated person concerning internal controls. (1) A regulated person shall implement internal control policies and procedures for the prevention, detection, and disclosure of identified risks, in accordance with the Financial Transactions Reporting Act, 2018 and— (a) have a MLRO approved by the Commission; and (b) verify, on a regular basis, compliance with internal policies, procedures, and controls relating to identified risks. (2) A regulated person shall comply with the provisions of the Financial Transactions Reporting (Wire Transfers) Regulations, 2018 and ensure proper internal controls are in place. (3) A regulated person shall ensure it understands its operating processes and procedures, regularly verifies their integrity, and accounts for identified money laundering and the financing of terrorism and the financing of proliferation risk.

FOR CONSULTATION: Securities Commission of The Bahamas Draft Investment Funds (Anti-Money Laundering, Countering Financing of Terrorism and Countering Financing of Proliferation) Rules, 2026 Page 6 of 19 7. Money Laundering Reporting Officer. (1) A MLRO shall — (a) if an individual, be sufficiently senior in the organizational structure of the regulated person's business operations to exercise the necessary authority to carry out their functions and duties; (b) if a legal person, is approved under the Act to provide outsourced services as a MLRO; (c) have responsibility for overseeing and managing the making of suspicious transaction reports promptly regarding a transaction or any proposed transaction relating to the proceeds of criminal conduct or which constitutes an offence under the Proceeds of Crime Act, 2018 (No. 4 of 2018), or which is an identified risk.; (2) A regulated person shall submit the name of the person proposed to be the MLRO to the Commission, and where the person is approved and appointed as the MLRO, the regulated person shall— (a) register the name of the MLRO with the Financial Intelligence Unit; (b) ensure that the MLRO or any person appointed to assist the MLRO has timely access to systems, customer records and all relevant information required to perform their duties; and (c) submit a statement that the MLRO is a fit and proper person. 8. Outsourcing. (1) A regulated person may outsource the role of the MLRO. (2) Prior to outsourcing the regulated person shall— (a) notify the Commission of the particulars and regulatory status of the proposed MLRO, including whether that person is an employee of a parent company or a company affiliated with the regulated person; (b) satisfy the Commission that the proposed MLRO has the relevant qualifications, knowledge, experience, managerial resources and operational capacity to meet the obligations of a Compliance Officer; and (c) provide the Commission with a copy of the executed outsourcing contract with the MLRO. (3) The outsourcing arrangement must permit the Commission access to any records and information held by the MLRO relating to the activities carried out in relation to the regulated person, as if those records and information were held by the regulated person. (4) Notwithstanding paragraph (1), a regulated person shall retain ultimate responsibility for ensuring compliance with the provisions of the Financial Intelligence (Transactions Reporting) Regulations (Ch. 367). (5) The Commission may, by notice to the regulated person, object to the proposed appointment or to the continued use of a MLRO and the regulated person shall terminate the appointment promptly after receipt of such notice from the Commission.

FOR CONSULTATION: Securities Commission of The Bahamas Draft Investment Funds (Anti-Money Laundering, Countering Financing of Terrorism and Countering Financing of Proliferation) Rules, 2026 Page 7 of 19 9. Suspicious transaction reporting. (1) A regulated person shall implement policies and procedures to facilitate an employee exercising their duty to report their knowledge or suspicions that a customer is or may be engaged in activities associated with identified risks to the MLRO. (2) It shall be the responsibility of the MLRO to assess the sufficiency of the information contained in a report referred to in paragraph (1). 10. Implementation of Targeted Financial Sanctions. (1) A regulated person shall comply with the Anti-Terrorism Act, 2018, including the procedures for implementing the United Nations Security Council Resolutions. (2) A regulated person shall without delay and without prior notice: (a) freeze all of the funds it holds in the name of a designated person or entity; (b) inform the Attorney General and Financial Intelligence Unit that it holds the funds of a designated person or entity and provide details; (c) inform the designated person or entity that any funds held have been frozen. (3) The freezing shall extend to: (a) all funds that are owned or controlled by the designated person or entity; (b) funds that are wholly or jointly owned or controlled, directly or indirectly, by designated persons or entities; (c) funds derived or generated from funds or other assets owned or controlled directly or indirectly by designated persons or entities; and (d) funds of persons and entities acting on behalf of, or at the direction of designated persons or entities. (4) A regulated person shall not make any funds available, directly or indirectly, to or for the benefit of a designated person or entity. PART IV – VERIFICATION OF CUSTOMER IDENTITY 11. Due diligence measures. (1) Except where specifically exempted by any Rules issued by the Commission, the customer due diligence measures implemented by the regulated person shall use independent and reliable source documents, data or information (whether or not electronically sourced). (2) The risk rating framework of a customer shall be applied by a regulated person to its due diligence measures. (3) Once a business relationship has been established with a customer, the regulated person shall take reasonable steps to ensure that due diligence measures are periodically reviewed and kept up to date on the basis of materiality and risk, at appropriate times, taking into account the adequacy of data obtained when previous customer due diligence measures were undertaken. 12. Simplified due diligence measures. (1) Where a regulated person determines, on the basis of its risk assessment that a client presents a lower risk, the regulated person may apply simplified due diligence measures

FOR CONSULTATION: Securities Commission of The Bahamas Draft Investment Funds (Anti-Money Laundering, Countering Financing of Terrorism and Countering Financing of Proliferation) Rules, 2026 Page 8 of 19 to verify the identity of that client, provided that such measures are not applied where there is a suspicion of identified risks. (2) Where the regulated person intends to utilise a simplified due diligence procedure— (a) the regulated person shall submit to the Commission a written outline of the regulated person's risk rating procedure and proposed simplified due diligence process; (b) the Commission shall review the proposed simplified due diligence process and, where satisfied that the process is appropriate and consistent with these Rules, approve the regulated person to proceed with the verification of the client utilising due diligence measures appropriate to the client's level of risk. 13. Enhanced due diligence measures. (1) Enhanced due diligence measures shall be applied by a regulated person for categories of customers, business relationships, or transactions that may present a higher risk for money laundering, or the financing of terrorism or the financing of proliferation based on the risk profile developed relative to the customer, business relationship or transaction, which measures shall include taking additional verification measures. (2) A customer may present a higher risk in relation to identified risks if, without limitation, a customer— (a) is involved in operations (either directly or indirectly through relationships with third parties) that take place in a high-risk jurisdiction; (b) is unable to produce the required Know Your Customer information and documentation; (c) uses anonymous or randomly generated email addresses or a temporary email service; (d) persistently avoids Know Your Customer thresholds through smaller transactions; (e) is a politically exposed person as defined in rule 13. (3) A transaction may present a higher risk for activities associated with identified risks if, without limitation it is a peer-to-peer transaction; (4) Enhanced due diligence measures may include— (a) corroborating the identity information received from the customer with information in third party databases or other reliable sources; (b) for non- face to face Know Your Customer verification — (i) video conferencing with the proposed customer (ii) requiring identification documentation to be certified by a notary public or equivalent; (iii) verifying with the customer, additional aspect of their identity (or biometric data which is held electronically; (c) corroborating activity information consistent with the customer’s transaction Profile; (d) obtaining additional information on the source of funds and source of wealth of the customer;

FOR CONSULTATION: Securities Commission of The Bahamas Draft Investment Funds (Anti-Money Laundering, Countering Financing of Terrorism and Countering Financing of Proliferation) Rules, 2026 Page 9 of 19 (e) obtaining information on the reasons for the intended or performed transaction; (f) enhanced monitoring of the business relationship and transactions; (g) requesting data relating to transaction and trading history. (5) Where an investor is introduced through an intermediary, nominee or omnibus platform, the regulated person shall assess whether it has timely access to underlying investor and beneficial ownership information and shall apply enhanced due diligence and ensure such information is available in accordance with these Rules. 14. Verification of customer identity. (1) A regulated person shall not enter into a business relationship or execute an occasional transaction with any person without applying customer due diligence measures to verify the identity of the person, including any beneficial owner(s). (2) When verifying the identity of a person referred to in paragraph (1), the regulated person shall — (a) satisfy itself that the prospective customer is who the customer claims to be by applying the customer due diligence measures referred to in rules 8 to 10; (b) ensure that sufficient information is obtained and documented — (i) on the nature and purpose of the business that the customer intends to undertake; and (ii) concerning any expected or predictable volume and pattern of transactions and activities; and (c) satisfy itself that any independent and reliable source documents, data or information (whether or not electronically sourced) sufficiently verifies a customer’s identity. (3) Where a prospective customer fails or is unable to provide adequate evidence of identity, or a regulated person is not satisfied that a new transaction with an existing customer is legitimate, the regulated person shall — (a) determine whether — (i) other steps should be taken to verify the customer’s identity; (ii) it is appropriate to proceed or continue with the business relationship; and (b) file a suspicious transaction report with the Financial Intelligence Unit. (4) Regulated persons shall have a clear policy regarding the escalation of decisions to senior management concerning the acceptance or continuation of high-risk business relationships. (5) When verifying the identity of a customer, a regulated person shall only accept either — (a) original document;

FOR CONSULTATION: Securities Commission of The Bahamas Draft Investment Funds (Anti-Money Laundering, Countering Financing of Terrorism and Countering Financing of Proliferation) Rules, 2026 Page 10 of 19 (b) certified copies of documents from a prospective customer where submission of original documents is impractical or impossible. (c) Independent and reliable source documents, data or other information (whether or not electronically sourced) which sufficiently verifies a customer’s identity; or (d) Photographed or scanned copies of identifying documents provided that the regulated person has adequate internationally recognized tools to verify the authenticity of the documents. (6) Notwithstanding any provision of these Rules, a regulated person shall in all cases verify the identity of a customer, prospective or existing, where the regulated person knows or suspects activities associated with identified risks or knowledge is confirmed, shall make a report to the Financial Intelligence Unit. 15. Required Information. (1) Every regulated person shall obtain independent and reliable source documents, data or other information (whether or not electronically sourced) appropriate to the nature and structure of the proposed customer when verifying the proposed customer's identity, which shall include, but is not limited to the following, in the case of — (a) a natural person — (i) full and correct name(s); (ii) at least two current means of contact which may include — (aa) personal email address; (bb) business email address; (cc) personal mobile telephone number; (dd) personal landline number; (ee) business landline number; (ff) personal mailing address, which must include where applicable, the street, post office box number, city, state or province, postal or zip code, landline telephone contact, and country; (gg) business mailing address, which must include where applicable, the street, post office box number, city, state or province, postal or zip code, landline telephone contact, and country; (hh) residential mailing address, which must include where applicable street, post office box number, city state or province, postal or zip code, landline telephone contact, and country; or (iii) date of birth; (iv) country of domicile; and (v) the purpose of the account and nature of the business relationship; (b) corporate customer —

FOR CONSULTATION: Securities Commission of The Bahamas Draft Investment Funds (Anti-Money Laundering, Countering Financing of Terrorism and Countering Financing of Proliferation) Rules, 2026 Page 11 of 19 (i) the original or a certified copy of the certificate of incorporation, registration or the equivalent; (ii) certificate of good standing or the equivalent evidence that the company has not been or is not about to be struck off the register or wound up; (iii) a copy of the relevant board resolution authorizing the establishment of the business relationship, or authorizing the opening of an account and conferring permission on any person authorized to undertake transactions; (iv) satisfactory evidence of the identity of all persons authorized to undertake transactions and details of their relationship with the company; and (v) satisfactory evidence of identification of each natural person having a beneficial interest of ten percent or more of the company, or having principal control over the company's assets or otherwise exercising control over the management of the company; (c) a partnership or unincorporated business — (i) a copy of the partnership agreement or document establishing the partnership agreement, or document establishing the partnership or unincorporated business; (ii) a mandate authorizing the establishment of the business relationship or the opening of an account, and conferring permission on any person authorized to undertake transactions; (iii) satisfactory evidence of the identity of all partners and controllers of the firm or business; and (iv) satisfactory evidence of the identity of all persons authorized to undertake transactions; (d) other legal structures and fiduciary arrangements, such as trusts, fiduciary or nominee structures — (i) the applicable documents establishing the legal structure or fiduciary or nominee arrangement; (ii) all applicable documents, identifying persons exercising effective control over the legal structure or fiduciary or nominee arrangement, including the power to direct, withhold, consent to or veto the exercise of any power related to the legal structure or fiduciary or nominee arrangement; (iii) satisfactory identification evidence of all persons providing funds or assets to the structure;

FOR CONSULTATION: Securities Commission of The Bahamas Draft Investment Funds (Anti-Money Laundering, Countering Financing of Terrorism and Countering Financing of Proliferation) Rules, 2026 Page 12 of 19 (iv) all applicable documents, identifying the known beneficiaries of the trust; (v) all applicable documents, identifying all beneficiaries of a fiduciary or nominee structure; (vi) all applicable documents, appointing and identifying any signatory powers in relation to the legal structure or fiduciary or nominee arrangement; and (vii) satisfactory evidence of the identity of all persons authorized to undertake transactions; (e) a foundation — (i) the foundation Charter; (ii) the foundation's certificate of registration issued by the Registrar General, or the foreign equivalent; (iii) the source of funds, and where a person other than the founder provides funds for the foundation, verification of the identity of the third party providing the funds or for whom the founder may be acting; (iv) identification evidence of each founder, officer, and council member of the foundation as may be signatories for the accounts of the foundation; (v) identification evidence of beneficiaries that hold a vested interest in the foundation; and (vi) satisfactory evidence of the identity of all persons authorized to undertake transactions; (f) a non-profit association or charity — (i) identification evidence of at least two signatories, and anyone authorized to give instructions on behalf of the entity; (ii) the nature of the proposed association's or charity's purpose and operations; (iii) the source of funds; and (iv) satisfactory evidence of the identity of all persons authorized to undertake transactions; (g) powers of attorney — (i) identification of each done; (ii) identification evidence of the donor; (iii) proof of any third party mandates; and

FOR CONSULTATION: Securities Commission of The Bahamas Draft Investment Funds (Anti-Money Laundering, Countering Financing of Terrorism and Countering Financing of Proliferation) Rules, 2026 Page 13 of 19 (iv) satisfactory evidence of the identity of all persons authorized to undertake transactions. (2) A regulated person shall, in the case of services being provided to the estate of a deceased person, obtain identification evidence of each personal representative of the said estate. (3) A regulated person shall review its records periodically to ensure that the identification and other information kept by it is current and reflects the existing facts related to a customer, and in all cases when there have been changes to — (a) person authorized to undertake transactions; (b) board resolutions or mandates authorizing the opening of an account and authorizing any person to undertake transactions; (c) partners, controllers, trustees, fiduciaries or nominees; and (d) the corporate structure of a customer. (4) Where there has been a change to any of the items specified in paragraph (3), the regulated person shall undertake the verification process in compliance with the provisions of this paragraph. (5) Where a regulated person offers the service specified in paragraph (5), the regulated person shall independently verify the identity of the proposed facility holder and any beneficial owner(s) through reliable and independent source documents, data, or information. (6) In all cases, a regulated person shall maintain adequate documentation to evidence the implementation of due diligence measures and shall ensure that the verification of identification procedures implemented, are appropriate to the nature and structure of the proposed customer being verified. (7) A regulated person shall, as part of due diligence measures, implement procedures for the periodic reverification of customers, which at the minimum, shall require re-verification to occur where— (a) during the course of the business relationship, the regulated person has reason to doubt the identity of the customer; (b) there is a material change in the way transactions are undertaken; or (c) there is a reasonable suspicion that any transaction carried out by the customer might have breached the law concerning the activities associated with identified risks. 16. Politically exposed persons. (1) A regulated person shall, in addition to applying enhanced due diligence measures, develop clear procedures and controls for the identification and verification of a politically exposed person when— (a) establishing a business relationship with that politically exposed person, or a legal person in which any politically exposed person — (i) is a director, officer, founder or council member; (ii) is a partner or trustee; (iii) is a signatory or person authorized to undertake transactions; (iv) has a beneficial interest of ten per cent or more in the legal person; (v) has principal control over the legal person's assets; (vi) exercises control over the management of the legal person; or

FOR CONSULTATION: Securities Commission of The Bahamas Draft Investment Funds (Anti-Money Laundering, Countering Financing of Terrorism and Countering Financing of Proliferation) Rules, 2026 Page 14 of 19 (b) the regulated person is continuing a business relationship with a customer who has become a politically exposed person, after the establishment of the business relationship. (2) For the purposes of this rule the terms set out below are defined as follows — “international organization” means an entity established by a formal political agreement equivalent in status to an international treaty, made between, and recognized by law, in member countries, and which is not treated as a resident institutional unit of the country in which it is located; “politically exposed person” means— (a) an individual who is or has been entrusted with— (i) a prominent public function within The Bahamas, inclusive of a head of state or government, senior politician, senior government, judicial or military official, senior executive of a state-owned corporation, or an important political party official; (ii) a prominent public function by a foreign jurisdiction, inclusive of, a head of state or government, senior politician, senior government, judicial or military official, senior executive of a state-owned corporation, or senior political party official; or (iii) a prominent function within an international organization, including directors, deputy directors, members of the board, members of senior management, or individuals who have been entrusted with equivalent functions; (b) an individual who is related to a politically exposed person, including a parent, child, spouse or sibling; (c) an individual who is closely associated to a politically exposed person either socially, or professionally and includes a person who can conduct substantial domestic or international financial transactions on behalf of the politically exposed person; (d) any corporation, business or other entity formed by or for the benefit of a head of state, head of government or individuals referred to in paragraph (a) above. 17. Reliance on third party verification procedures. (1) A regulated person may rely on the customer due diligence procedures implemented by another financial institution, provided that the financial institution is a regulated entity subject to anti-money laundering, countering the financing of terrorism and countering the financing of proliferation obligations and is an entity located in a country which is not the subject of any list issued by an international organization relative to the issues associated with identified risks, and is able to— (a) provide written confirmation that it has verified the identity of the relevant customer; and (b) confirm the existence of the account or facility provided to the customer by the virtual asset service provider or financial institution. (2) Notwithstanding paragraph (1), a regulated person shall only rely on the due diligence measures implemented by another virtual asset service provider or financial institution with respect to those categories of transactions, services, or products which that other

FOR CONSULTATION: Securities Commission of The Bahamas Draft Investment Funds (Anti-Money Laundering, Countering Financing of Terrorism and Countering Financing of Proliferation) Rules, 2026 Page 15 of 19 virtual asset service provider or financial institution provides to the customer, and in all other circumstances, must undertake its own verification procedures. 18. Suspension or termination of activity or business. A regulated person shall— (a) suspend activity on the account of a prospective customer, if reasonable efforts have been made to directly verify the prospective customer's identity without success; and (b) terminate the business relationship with a prospective customer where it is unable to obtain the relevant information and documentation from the eligible introducer within thirty days of receiving the eligible introducer's confirmation. 19. Exemption from verification of identity. A regulated person shall not be required to verify the identity of a prospective customer where that customer is— (a) financial institution licensed or registered by the Central Bank of The Bahamas, the Securities Commission of The Bahamas, The Insurance Commission of The Bahamas, or the Gaming Board for The Bahamas; (b) financial institution which— (i) is subject to anti-money laundering, countering the financing of terrorism and countering the financing of proliferation obligations; (ii) is under supervision for compliance with the obligations referred to subparagraph (i) and; (iii) has adequate procedures for compliance with customer due diligence and record keeping requirements; (c) any central or local government agency or statutory body; (d) a publicly traded company listed on The Bahamas International Stock Exchange or any other marketplace registered by the Commission and specified in the Schedule to the Financial Transactions Reporting Regulations, 2018. 20. Ongoing monitoring. (1) A regulated person shall, after the verification procedures have been concluded and a business relationship has been established— (a) monitor the conduct of the business relationship periodically; and (b) ensure, on an ongoing basis, that the business relationship is consistent with the risk profile and nature of the business stated when the relationship was established. (2) Ongoing monitoring of business relationships includes, without limitation— (a) scrutiny of transactions undertaken throughout the course of the relationship (including, where necessary, the source of funds) to ensure that the transactions are consistent with the regulated person’s knowledge of the customer, their business and risk profile;

FOR CONSULTATION: Securities Commission of The Bahamas Draft Investment Funds (Anti-Money Laundering, Countering Financing of Terrorism and Countering Financing of Proliferation) Rules, 2026 Page 16 of 19 (b) ensuring that the source documents, data or other information obtained for the purposes of applying due diligence are kept up to date; (c) analysing similar transactions in line with a risk-based approach including, without limitation, taking into account the nature of the regulated person’s business and whether it is appropriate to use such analysis for all transactions; (d) where large volumes of transactions occur on a regular basis, using automated systems to monitor transactions provided that flagged transactions are subject to human expert analysis to determine whether such transactions are suspicious. PART V – RECORD KEEPING 21. Maintenance of records. (1) A regulated person shall, in compliance with all relevant laws, prepare and maintain records of its business relationships and transactions that enable— (a) competent third parties to assess the regulated person's compliance with anti￾money laundering, countering the financing of terrorism and countering the financing of proliferation policies and procedures; (b) transactions effected through the regulated person to be reconstructed; (c) the regulated person to satisfy court orders or enquiries from the Commission or appropriate authorities; and (d) the identification of customers. (2) A regulated person shall keep all records required to be maintained by these Rules, for a period of seven years from the date that the customer ceases to be a facility holder. (3) For the purpose of paragraph (2), a person ceases to be a facility holder from the date of— (a) the carrying out of a one-off transaction or the last transaction in a series of transactions; (b) the closing of the account(s) or the ending otherwise of the business relationship; or (c) the commencement of proceedings to recover debts payable on insolvency. (4) The seven-year period referred to in paragraph (2) commences on the date of the completion of the last transaction where formalities to end a business relationship have not been undertaken but a period of seven years has elapsed since the date of the last transaction. (5) Where the regulated is a company that is being liquidated, the liquidator shall retain the relevant records of the regulated person for the balance of the prescribed period remaining at the date of dissolution. (6) A regulated person may maintain records in the form of original documents or other electronic media provided— (a) there are appropriate internal controls in place to guard against the risk of loss, damage, destruction or falsification; (b) such method provides a means to furnish promptly to the Commission upon request legible, true and complete copies of those records; and (c) the regulated person has suitable back-up and disaster recovery programs.

FOR CONSULTATION: Securities Commission of The Bahamas Draft Investment Funds (Anti-Money Laundering, Countering Financing of Terrorism and Countering Financing of Proliferation) Rules, 2026 Page 17 of 19 22. Transactions records. A regulated person shall maintain transaction records containing— (a) a description of the nature of the transaction; (b) details of the transaction, including the amount of the transaction and the denomination of the currency; (c) the date on which the transaction was conducted; (d) the identification verification details of the parties to the transaction; (e) the public keys (or equivalent identifiers) of relevant parties; (f) where applicable, information on the facility through which the transaction was conducted and any other facility directly involved in the transaction; and (g) the files, business correspondence, and records connected to the facility. 23. Other records. A regulated person shall maintain records of— (a) suspicions raised internally by the Money Laundering Reporting Officer, but not disclosed to the relevant authorities; (b) suspicions which the Financial Intelligence Unit, the Commissioner of Police, or the relevant supervisory authority have advised are of no interest; and (c) findings of inquiries conducted by the regulated person into unusual activity. PART VI – MICELLANEOUS 24. Education and training. (1) A regulated person shall take appropriate measures to ensure that every employee is aware of— (a) the policies and procedures put in place to detect and prevent money laundering, to counter the financing of terrorism and to counter the financing of proliferation, including those for the identification, record keeping, detection of unusual and suspicious transactions and internal reporting; and (b) the anti-money laundering, countering the financing of terrorism and countering the financing of proliferation legislative framework. (2) A regulated person shall ensure that— (a) the relevant staff members and key personnel are trained on an ongoing basis to— (i) identify, prevent, detect and disclose financial crime risks; (ii) recognise and handle suspicious transactions; (b) its key personnel possess the adequate knowledge, skills, experience and capability to understand the regulated persons’ business and customer needs; (c) key personnel and staff are aware of their obligations to comply with policies and procedures.

FOR CONSULTATION: Securities Commission of The Bahamas Draft Investment Funds (Anti-Money Laundering, Countering Financing of Terrorism and Countering Financing of Proliferation) Rules, 2026 Page 18 of 19