Anti-Money Laundering and Combating the Financing of Terrorism Instructions for Microfinance Companies No. (2020/8)

In the name of Allah, the Most Gracious, the Most Merciful

[Logo of the Central Bank of Jordan]

Number: 12/28/4496
Date: 11/8/1442 AH
Corresponding to: 28/8/2020 AD

Anti-Money Laundering and Combating the Financing of Terrorism Instructions for Microfinance Companies No. (2020/8)

Issued pursuant to the provisions of Article (18/b) of the Anti-Money Laundering and Combating the Financing of Terrorism Law No. (46) of 2007 and its amendments, and Article (26/z) of the Microfinance Companies System No. (5) of 2015.

Article (1): These Instructions shall be known as "Anti-Money Laundering and Combating the Financing of Terrorism Instructions for Microfinance Companies" and shall come into force from the date of their issuance.

Article (2): Definitions a. The words and expressions used in these Instructions shall have the meanings assigned to them in the prevailing Anti-Money Laundering and Combating the Financing of Terrorism Law unless the context indicates otherwise. b. The following words and expressions shall have the meanings specified below wherever they appear in these Instructions unless the context indicates otherwise:

• The Central Bank: The Central Bank of Jordan.
• The Law: The prevailing Anti-Money Laundering and Combating the Financing of Terrorism Law.
• The System: The Microfinance Companies System No. (5) of 2015 or any other legislation replacing it.
• The Unit: The Anti-Money Laundering and Combating the Financing of Terrorism Unit established pursuant to the provisions of the Law.
• The Company: A microfinance company licensed in accordance with the provisions of the System.
• The Board: The Board of Directors or the Executive Committee of the Company.
• Business Relationship: The relationship arising between the Company and the Client concerning the activities and services provided by the Company to its clients.
• Ongoing Business Relationship: A business relationship that is expected, at the time of its establishment, to extend for an indefinite period and to involve multiple transactions.
• Client: Any natural or legal person, legal arrangement, or non-profit entity receiving or dealing in one of the financial services with the Company. Anyone who has started receiving or dealing in one of those services is also considered a client.
• Occasional Client: A client who does not have an ongoing business relationship with the Company.
• Politically Exposed Persons (PEPs) and Foreign Risk Representatives: Individuals who hold or have held prominent public functions in a foreign country, such as: head of state or government, judge, military officer, or senior political position; or were prominent politicians or prominent figures in a political party or senior executives in companies owned by that state. This includes their family members up to the first degree as a minimum, or persons closely associated with them, or any persons acting on their behalf or holding power of attorney issued by them. This definition does not apply to individuals holding medium or lower positions in the categories mentioned above.
• Local Politically Exposed Persons (PEPs) and Risk Representatives: Individuals who hold or have held prominent public functions in the Kingdom, such as: head of government, judge, military officer, or senior political position; or were prominent politicians or prominent figures in a political party or senior executives in state-owned companies. This includes their family members up to the first degree as a minimum, or persons closely associated with them, or any persons acting on their behalf or holding power of attorney issued by them. This definition does not apply to individuals holding medium or lower positions in the categories mentioned above.
• Senior Managing Officials (Foreign or Local): Individuals who hold or have held prominent functions in international organizations, including directors, deputy general managers, or deputy regional managers holding equivalent positions, and their family members up to the first degree as a minimum, or persons closely associated with them, or any persons acting on their behalf or holding power of attorney issued by them. This definition does not apply to individuals holding medium or lower positions in the categories mentioned above.
• Control: The direct or indirect ability to exercise effective influence over the actions and decisions of another person.
• Controlling Interest: Control of no less than (10%) of the capital of a legal person.
• Beneficial Owner: The natural person who ultimately owns or controls the business relationship for their benefit or on their behalf, or who has full or effective control over a legal person or legal arrangement, or has the right to carry out legal acts on behalf of either.
• Reporting Manager: An official from the Senior Management of the Company (who may be the Compliance Monitoring Manager) responsible for notifying the Unit of operations suspected to be related to money laundering or terrorist financing.
• Senior Management: Includes the General Manager of the Company or Regional Director, Deputy General Manager or Deputy Regional Director, Assistant General Manager or Assistant Regional Director, Financial Manager, Operations Manager, Risk Management Manager, Internal Audit Manager, Compliance Monitoring Manager, plus any employee in the Company who has executive authority parallel to any of the aforementioned and is functionally linked directly to the General Manager/Regional Director.
• Financial Group: A group consisting of a parent company or any other legal person owning controlling shares and coordinating tasks with other group members to apply or execute group-wide supervision alongside branches and/or subsidiaries subject to anti-money laundering and combating the financing of terrorism policies and procedures at the group level.
• Shell Bank: A bank that exhibits any of the following characteristics:
  • It has no physical presence in the country where it was established and licensed. Physical presence means having a real office and actual management within a country; merely having a local agent or employees of low functional rank does not constitute physical presence.
  • It does not keep records of its transactions.
  • It is not subject to supervision by a competent regulatory authority, whether in the country where it was established or in any other country.
  • It does not belong to any financial services group subject to effective unified supervision.
    The definition of Shell Bank does not apply to a bank without a fixed headquarters if it is affiliated with a licensed bank that has physical presence and is subject to effective supervision.
• Shell Company: A company used as a vehicle to pass transactions through without holding any assets or conducting specific operational activities even if registered.
• Subsidiary Company: A company in which a person or group of persons united by a common interest owns no less than (50%) of its capital, or in which this person or group holds a controlling interest allowing control over its administration or general policy.
• Non-Profit Entity: Any legal person, legal arrangement, or institution established in accordance with relevant laws to collect or spend funds for charitable, religious, cultural, educational, social, or other similar purposes, without its activity targeting profit generation, distribution, or personal benefit, including foreign branches of international non-profit organizations and entities.
• Legal Arrangements: Relationships arising under a contract between two or more parties that do not result in the creation of a legal personality, such as direct trusts or similar legal arrangements.
• Trusts: Legal relationships arising - inter vivos or upon death - by a person or trustee, where assets have been placed under the control of the person or trustee for the benefit of a beneficiary or for a specific purpose, such that the assets are independent funds and not part of the trustee's estate, and the right to the trustee's assets remains in the name of the settlor or another person on behalf of the settlor.
• Non-Resident: A natural or legal person who resides or usually has their headquarters outside the Kingdom, or who does not complete a year of residence inside the Kingdom, regardless of this person's nationality, except for families and individuals who have an economic center or interest and permanent economic activity and permanent residence inside the Kingdom, even if they reside there intermittently.
• Risks: Money laundering and/or terrorist financing risks.
• High-Risk Countries: Countries listed by the Financial Action Task Force (FATF) as high-risk countries or those lacking adequate anti-money laundering and combating the financing of terrorism procedures, posing a risk to the global financial system, or for which the Kingdom has information indicating they are high-risk countries.

Article (3): Scope of Application
The provisions of these Instructions apply to all of the following:
a. Microfinance companies operating in the Kingdom. b. Branches of companies and their subsidiaries abroad, to the extent permitted by the laws and systems in force in the countries where they operate, while applying the strictest standards possible in case of differences between the anti-money laundering and combating the financing of terrorism requirements in the host country versus the home country. The Company must notify the Central Bank of any obstacles or restrictions that may limit or prevent the application of these Instructions.
c. Subsidiaries of companies operating in the Kingdom, unless these companies are subject to the supervision of another regulatory authority in the Kingdom that has issued specific instructions on anti-money laundering and combating the financing of terrorism.

Article (4): Risk-Based Approach a. Risk Management

1. The scope and intensity of the risk management function must be commensurate with the nature, size, and complexity of the Company's operations and activities, and its level of money laundering and terrorist financing risks.
2. The money laundering and terrorist financing risk management function in the Company must align and integrate with the overall risk management level of the Company.

b. Risk Assessment

1. The Company must conduct a comprehensive assessment of money laundering and terrorist financing risks at least annually, or whenever a need arises due to a fundamental change in the nature of risks faced by the Company. This assessment aims to identify, evaluate, and understand money laundering and terrorist financing risks regarding clients, countries, geographic areas, products, services, operations, and service delivery channels, according to a methodology approved by the Company's Board of Directors or the Regional Management of the foreign branch. The assessment must include the Company's branches and subsidiaries within and outside the Kingdom, and the assessment processes must be documented, taking into account all relevant risk factors before determining the overall risk level and the appropriate level of risk mitigation measures to be applied.
2. The assessment must include at least the following:
   a. Results of monitoring activities conducted by the Company, such as the Company's exposure level to money laundering and terrorist financing risks, risk classification by main activities and client categories. b. Details of significant internal or external risk events and their impact on the Company.
   c. Any recent changes in instructions or circulars regulating anti-money laundering and combating the financing of terrorism and their impact on the Company.
3. The Company must provide the Central Bank at least annually with the following:
   a. The approved assessment methodology and any modifications introduced to it. b. The assessment results submitted to Senior Management and the Board.
   c. A report from the Company's Internal Auditor outlining recommendations and intended measures to mitigate high risks identified as a result of the assessment.

c. Risk Mitigation and Control

1. The Company must take all measures to effectively monitor and control money laundering and terrorist financing risks, ensuring it has at least the following:
   a. Policies, controls, and procedures approved by Senior Management and the necessary foundations for managing, evaluating, monitoring, and reducing identified risks. b. Internal control and audit systems capable of managing risks.
   c. Verification of the effectiveness of internal control and audit systems put in place to manage specific risks.
   d. Monitoring the implementation of these policies, controls, and procedures on the ground by the Company's Internal Audit and strengthening them if necessary.
2. The Company must regularly update its IT system scenarios and adopt information management systems to detect suspicious operations based on trends and methods of money laundering and terrorist financing.
3. Provide appropriate mechanisms to supply identified risks to competent authorities upon request.
4. Take enhanced risk management measures to manage and mitigate high risks.

d. Client Classification

1. The Company must classify its clients according to the nature of their money laundering and terrorist financing risks, updating this classification periodically in alignment with the nature and level of those risks for each client, considering the following factors:
   a. Resident or non-resident. b. Client type (natural person, legal person, legal arrangement, non-profit entity).
   c. Occasional client.
   d. Ownership structure of the legal person. e. Types of politically exposed persons/risk representatives. f. Geographic location. g. Nature of activity. h. Country of origin of the client.
   i. Products, services, operations, or service delivery channels.
   j. Any other information indicating the client is high-risk.
2. Risk mitigation measures applied by the Company must be commensurate with the nature of the client's risks.
   e. The Guideline [Appendix (1)] includes cases where the Company's risk assessment is high as a minimum.

Article (5): Due Diligence Requirements a. General Rules

1. Customer due diligence refers to identifying the client's identity, legal status, purpose, and nature of the business relationship, identifying the beneficial owner (if any), verifying all of the above, and continuous monitoring of transactions carried out within the ongoing business relationship by any means specified in relevant legislation. It also includes identifying the nature and purpose of future relationships between the Company and the client. Due diligence procedures to be taken by the Company include:
   a. Obtaining information about the identity of clients (permanent or occasional, whether natural persons, legal persons, legal arrangements, or non-profit entities) and their legal status, and verifying it using original documents, data, or information from a reliable and independent source. b. Comparing the client's name against names of persons and entities listed on blocking lists issued by United Nations Security Council resolutions.
   c. Understanding the client's activity and comprehending the purpose and nature of the business relationship with the Company, obtaining information related thereto.
   d. If a person acts on behalf of the client, verification must be made that they are authorized to do so, along with identifying and verifying their identity. e. Identifying the beneficial owner and taking reasonable steps to verify their identity using a document issued by a government authority, such that the Company becomes convinced it knows the identity of the beneficial owner. f. Obtaining any other information related to indicators assessing the client's risk. g. If the client is a legal person, legal arrangement, or non-profit entity, the Company must ascertain the nature of the client, control over it, ownership structure, and board of trustees. h. Verifying sources of payment within transactions carried out with the Company.
2. The Company must apply all due diligence measures towards clients stipulated in Clause (1) of this Article, defining the scope of those measures using the risk-based approach referred to in Article (4) of these Instructions.

b. The Company is prohibited from dealing with anonymous accounts or fictitious name accounts, including digital ones, including dealing or entering into a business relationship with unidentified persons, persons with pseudonyms or fictitious names, or with shell banks or shell companies.

c. The Company must take due diligence measures regarding the client and the beneficial owner (if any) in the following cases:

1. At and during the establishment of the business relationship with the client.
2. When there is doubt about the accuracy and sufficiency of data previously obtained regarding client identification.
3. If the Company suspects that a transaction is suspected to be related to money laundering or terrorist financing, regardless of its value or the applicability of simplified due diligence procedures.
4. When carrying out transactions for occasional clients where the value of a single transaction or multiple seemingly connected transactions exceeds (5,000) JOD.

d. If the Company cannot fulfill due diligence procedures regarding clients, it must not enter into any business relationship with the client and must immediately notify the Unit if there is suspicion of connection to money laundering or terrorist financing, according to the form or method approved by the Unit for this purpose.

e. Timing of Client and Beneficial Owner Identity Verification

1. The Company must verify the identity of the client and the beneficial owner before and during the business relationship or when executing transactions for occasional clients from reliable and neutral sources.
2. The Company may defer some identity verification procedures for the client and beneficial owner until after the establishment of an ongoing business relationship, provided they are completed within a period not exceeding (10) working days from the date of relationship creation; otherwise, the relationship must be terminated and the Unit notified immediately if there is suspicion of connection to money laundering or terrorist financing, according to the form or method approved by the Unit for this purpose. Deferral is permitted only if:
   a. Deferring verification is essential to maintain normal business operations and does not result in money laundering or terrorist financing risks. b. The Company has taken necessary measures to control money laundering or terrorist financing risks regarding the deferred case, including setting limits on the number and type of transactions that can be executed before completing verification procedures, and incorporating this into the Company's approved work procedures.
   c. The Company completes these procedures as soon as possible.
3. If the Company suspects money laundering or terrorist financing and reasonably believes that completing due diligence procedures might alert the client, the Company is allowed not to complete the transaction but must immediately notify the Unit of the operation suspected to be related to money laundering or terrorist financing, according to the form or method approved for this purpose.
4. If the Company enters into an ongoing relationship with the client before completing due diligence procedures and cannot meet those requirements at a later date, it must terminate such relationship and notify the Unit if there are any suspicious transactions related to money laundering or terrorist financing, according to the form or method approved for this purpose.
5. If the Company cannot fulfill due diligence procedures regarding clients, it must not enter into any business relationships with clients and must immediately notify the Unit if there is suspicion of connection to money laundering or terrorist financing, according to the form or method approved for this purpose.

f. The Company must exercise due diligence towards existing clients dealing with it, according to relative importance and risk, at the following times:

1. When entering into business relationships involving relatively large amounts or when the client uses new products.
2. When a significant change occurs in the client's identity data or if it becomes apparent that the available data about an existing client is insufficient.
3. When the client's data update date arrives or the Company realizes it lacks sufficient information about one of these clients. This must be done at least every two years in the case of ongoing transactions.

g. Data Updating
The Company must take due diligence measures continuously regarding the business relationship, including:

1. Auditing transactions performed throughout the period of dealing with the client to ensure consistency of these transactions with what the Company knows about the client, their activity pattern, the risks they pose, and their source of funds when necessary, comparing this with peers in the same activity or those falling within the same risk degree, and recording and retaining all data related thereto in accordance with the provisions of these Instructions.
2. Ensuring that documents, data, or information obtained under due diligence procedures are continuously updated by reviewing existing records, particularly for high-risk client categories, with updates occurring at least every two years.
3. The Company may rely on identity determination and verification procedures already performed unless it has doubts about the validity of that information or in case of suspicion of money laundering or terrorist financing or a fundamental change in how the client manages their account that does not align with the client's activity.
4. If the client does not respond to the Company's request to update their data as the Company deems appropriate, the Company may gradually suspend some operations and services provided to such a client until they update their data properly, provided that awareness tools and campaigns are activated for clients regarding the consequences of failing to update their data and urging them to update whenever necessary.

h. Reliance on Third Parties

1. The Company may engage a third party to complete the application of due diligence procedures and enhanced due diligence procedures regarding clients as stated in these Instructions, whether by fulfilling necessary data or verifying submitted data, provided the following requirements are met:
   a. The Company must obtain from the third party immediately the necessary information and documents related to the due diligence measures stipulated in this Article. b. The Company must ensure that the third party is subject to supervision by a competent authority and has implemented policies and procedures to comply with due diligence requirements, including client identification, record retention, and anti-money laundering and combating the financing of terrorism programs contained in these Instructions.
   c. The Company must take appropriate steps to ensure that copies of client identification data and other documents related to due diligence requirements towards clients will be provided by the third party upon request without delay.
   d. The relationship between the Company and the third party must be governed by an agreement specifying the duties and responsibilities of each party to the agreement.
2. The ultimate responsibility for meeting due diligence requirements remains with the Company and not on the third party.
3. The Company may rely on third parties that are part of the same financial group to complete the application of due diligence procedures regarding clients, whether by fulfilling necessary data or verifying submitted data, provided that the financial group applies due diligence requirements towards clients - including risk-exposed persons - and retains records and anti-money laundering and combating the financing of terrorism programs in accordance with the provisions of these Instructions specifically, with the application of these requirements supervised by regulatory authorities in the home country and the host country.
4. The Company must take into consideration the risk assessment degree of the country where the member financial institution or the third party from outside the financial group is located, taking enhanced due diligence measures if it is a high-risk country, and sufficiently mitigating any high risks specific to countries via the financial group's policies related to anti-money laundering and combating the financing of terrorism.

Article (6): Procedures for Customer and Beneficial Owner Identification and Verification

A. The Company shall put in place systems to identify the customer and verify their identity in accordance with the requirements stipulated in Article (5) of these Instructions.

B. The Company shall examine the original official documents to identify the customer and retain a copy of the same documents signed by the authorized person in the Company certifying that it is a true copy.

C. The Company shall take the necessary steps to verify the data obtained from the customer by referring to reliable and neutral sources, which includes - where possible - contacting the authorities that issued those official documents, and verifying available electronic sources such as the website of the Companies Control Department, the Ministry of Industry, Trade and Supply, and the websites of the document-issuing authorities. The following shall be observed in the identification procedures for natural persons:

1. Identification data for the customer shall include: full name, date and place of birth, national ID number and all information related to the identity document for Jordanians, passport number and personal ID for non-Jordanians, nationality, annual residence permit issued by the Ministry of Interior or a valid work permit issued by the competent authority in case the customer is expatriate labor, nature of their work, permanent residence address, phone numbers, purpose and nature of the business relationship, and any other information the Company deems necessary to complete the customer identification process.

2. Obtain original official documents or certified copies thereof as per regulations, which prove the validity of the proxy in case any person or entity deals with the Company on behalf of the customer, while retaining a copy thereof. Additionally, it is necessary to identify and verify the identity of the customer and their proxy in accordance with the customer identification and verification procedures.

3. Obtain a commitment from the customer to update their data immediately upon any changes or upon the Company's request.

4. In case a person deals with the Company as an agent, it must be ensured that there is a valid judicial power of attorney or authorization endorsed by the Company, with the power of attorney or a certified copy thereof or the authorization retained in accordance with clause (B) of this Article. Additionally, it is necessary to identify the agent's identity in accordance with the customer identification procedures stipulated in clause (C) of this Article.

D. The following shall be observed in the identification procedures for legal persons or legal arrangements:

1. Identification data shall include the name of the legal person or legal arrangement, legal form, purpose and nature of the business relationship, type of activity, registration date and number, national ID of the establishment, tax number, names and addresses of owners, ownership shares, names of persons authorized to sign who hold senior management positions, headquarters address, phone number, names of authorized signatories, their nationalities, phone numbers, and any other information or documents the Company deems necessary for the identification process, keeping them updated at all times.

2. Obtain official documents or certified copies thereof as per regulations, which prove the establishment of the legal person or legal arrangement, its legal entity status, and the names of owners and authorized signatories by verifying their registration with the competent authorities and the necessary documents and information to prove this, such as the articles of association, memorandum of association, certificates issued by the Ministry of Industry, Trade and Supply, Companies Control Department, and certificates issued by Chambers of Commerce and Industry. Additionally, it is necessary to obtain an official certificate issued by the competent authorities in case the legal person or legal arrangement is registered abroad.

3. Obtain documents indicating the authorization from the legal person or legal arrangement to the natural persons authorized to represent them and the nature of their relationship. Additionally, it is necessary to identify the identity of the authorized person for dealing in accordance with the identification procedures for natural persons stipulated in these Instructions, verify that there is no legal impediment to dealing with them, and obtain samples of their signatures.

4. Obtain information regarding the provisions governing the work of the legal person or legal arrangement, including the ownership structure and controlling management, and the provisions governing the authority to make binding decisions for the legal person. Public joint stock companies are exempted from providing data related to the names, addresses, and ownership shares of shareholders whose shareholding percentage is less than (10%) of the company's capital, with a commitment obtained from the authorized signatories to provide the Company with data on any shareholders whose shareholding falls within this percentage.

5. The following shall also be observed in identifying the identity of the legal arrangement:
   a. The Company must be aware of the nature of the customer, ownership structure, and board of trustees. b. It is necessary to identify the authorized signatories and controlling persons in accordance with the customer identification procedures stipulated in these Instructions.

E. The following shall be observed in the identification procedures for non-profit entities:

1. Identification data shall include: the name of the non-profit entity, legal form, national ID of the entity (if available), headquarters address, type of activity, establishment date, names of persons authorized to operate the account, their nationalities, phone numbers, purpose of dealing, sources of income or funding, names of persons holding senior management positions in the non-profit entity, and any other information the Company deems necessary to obtain.

2. Obtain documents indicating the authorization from the non-profit entity to the natural persons authorized to operate the account. Additionally, it is necessary to identify the identity of the authorized person for dealing in accordance with the customer identification procedures stipulated in clause (C) of this Article.

F. The following shall be observed in identifying the beneficial owner:

1. The Company shall request a written declaration from each customer identifying the beneficial owner of the business relationship to be established (in cases requiring this), such that the declaration includes at least the customer identification information.

2. The Company shall identify the beneficial owner and take reasonable steps to verify this identity in accordance with the customer's risk level, which includes relying on data or information obtained from official documents and data, such that the Company is convinced that it is aware of the beneficial owner's identity.

G. The following shall be observed in identifying the beneficial owner in the case of a legal person:

1. The identity of the natural person(s) (if any) who has effective controlling ownership share in the legal person.

2. In case of doubt regarding the identity of the natural person or inability to identify them in accordance with item (1) above, the Company shall identify the natural person who has control within the legal person through other means.

3. In case no natural person is identified under the application of items (1) and (2) above, the Company shall determine and take reasonable steps to verify the identity of the relevant natural person holding a senior administrative position within the legal person.

H. The following shall be observed in identifying the beneficial owner if the customer is a legal arrangement:

1. Trusts: Identify the identity of the settlor, trustee, or guardian (as appropriate) and the beneficiaries or class of beneficiaries for each other natural person exercising effective and public control over the trust.

2. Other types of legal arrangements: Identify the identity of persons holding positions equivalent to those mentioned above or similar thereto.

Article (7): Simplified Due Diligence Procedures

A. The Central Bank may, by orders issued, decide on the cases or transactions requiring simplified due diligence measures when identifying and verifying the customer and beneficial owner, which determine examples of low-risk customers and any international controls or local requirements in this regard.

B. Simplified due diligence measures shall not be taken in case of suspicion of money laundering or terrorist financing or in case of circumstances involving high risks.

Article (8): Enhanced Due Diligence Procedures

A. The Company shall take enhanced due diligence measures when the customer's risk classification for money laundering and terrorist financing is "high", as follows:

1. Obtain approval from the Company's General Manager / Regional Manager or their delegate from senior executive management before establishing or continuing the relationship with these customers. This approval must also be obtained upon discovering that the risk of one of the customers or beneficial owners has become within this category.

2. Take sufficient measures to verify the source of funds of customers and beneficial owners classified within this risk category.

3. Monitor the transactions of these customers with the Company closely and continuously, exercising enhanced due diligence for business relationships and transactions conducted with any of them, while continuing to take enhanced due diligence measures and monitoring for those relationships.

4. Take necessary measures to ascertain the background circumstances of any business relationships and transactions conducted with any of the customers classified within this category and their purposes, in case the Company determines that any of them is not based on clear economic justifications, and make a decision regarding them while retaining the results in their records.

B. Cases requiring enhanced due diligence:

1. Foreign Politically Exposed Persons (PEPs):
   a. The Company shall put in place a suitable risk management system to determine if any of its customers or beneficial owners fall into this category. b. In case any of the Company's customers or beneficial owners are identified within this category, the Company shall take enhanced due diligence measures as outlined in Article (8/A) above.

2. Local Politically Exposed Persons (PEPs):
   a. The Company shall take reasonable measures to determine if the customer or beneficial owner falls into this category. b. In case any of the Company's customers or beneficial owners are identified within this category, the Company shall assess the level of money laundering and terrorist financing risks involved in the business relationship with this customer.
   c. In case the Company assesses the customer's risk as high, the Company shall take enhanced due diligence measures as outlined in Article (8/A) above. The Company may suffice with due diligence measures if the customer's risk is assessed otherwise.
   The Company shall apply the requirements stipulated in items (1) and (2) above to the families of Politically Exposed Persons or persons closely associated with them.

3. Non-face-to-face transactions, especially transactions conducted using modern technological techniques such as the internet or using electronic payment means. In these cases, the Company must work on the following:
   a. Identify money laundering and terrorist financing risks associated with developing new products and new professional practices, including new means of providing services, and those arising from the use of new or developing technologies regarding all new and previously existing products. b. Conduct a risk assessment before launching products, practices, or technologies or using them.
   c. Take appropriate measures to manage and mitigate those risks and inform the Central Bank thereof.

4. Unusual Transactions
   a. The following are considered unusual transactions:

   1. Large or unusually complex transactions compared to the customer's transactions and activity, or several low-value transactions that appear interconnected such that they form a single transaction with an unusual pattern in total.
   2. Any other transaction with an unusual pattern that does not appear to have a clear economic justification or does not match the nature of the customer's risk and activity.
      b. The Company shall exercise enhanced due diligence regarding unusual transactions, as well as when there is doubt about the validity or accuracy of customer identification data after establishing a business relationship, by conducting the necessary analysis and studies and any other necessary measures to verify the source of funds and the nature of the transaction. It is necessary to keep special records regarding them regardless of the decision taken regarding them, and include in the Company's compliance policy and/or work procedures examples of additional enhanced due diligence requirements for such transactions.

E. Other Cases
The Company must also exercise enhanced due diligence in the following cases in proportion to the risk level:
a. Doubt about the validity or accuracy of customer or beneficial owner identification data after establishing a business relationship. b. When cash amounts or checks are paid into an existing loan/financing account by a person(s) who do not represent the account holder under a judicial power of attorney or authorization endorsed by the Company.
c. When conducting transactions for non-resident customers.
d. Cases where the Company determines the customer's risk to be high, as indicated in the Guideline [Annex No. (1)]. e. Business relationships or transactions conducted by natural or legal persons from countries classified as high-risk and/or not applying the recommendations of the Financial Action Task Force (FATF).

Article (9): Financial Group, Branches, and Foreign Subsidiaries

A. In case the Company is part of a financial group, the group shall be required to apply anti-money laundering and counter-terrorist financing programs at the group level, which shall apply as appropriate to all branches and subsidiaries in which the group owns a majority, and these measures shall include the following:

1. Preparing suitable policies, procedures, internal controls, and arrangements regarding the following:
   a. Compliance monitoring management (including appointing a compliance monitoring officer at the management level). b. Suitable screening procedures to ensure high competence standards when appointing employees.
2. Establishing a continuous employee training program.
3. Creating an independent audit unit to test the system.
4. Establishing policies and procedures for exchanging required information for due diligence purposes regarding customers and managing money laundering and terrorist financing risks.
5. Providing information related to customers and transactions from branches and subsidiaries to compliance monitoring, audit, and/or anti-money laundering and counter-terrorist financing functions at the group level, which may include analysis of unusual transactions or activities, and may also indicate that a notice was sent to the unit regarding the transaction when necessary for anti-money laundering and counter-terrorist financing purposes and risk management purposes.
6. Providing sufficient guarantees regarding confidentiality and the use of exchanged information, including guarantees against tipping-off.

B. If the host country does not allow the appropriate implementation of anti-money laundering and counter-terrorist financing measures consistent with the Kingdom's procedures, the financial group shall apply additional suitable measures to manage money laundering and terrorist financing risks and inform the Central Bank thereof.

Article (10): Internal System

The Company must put in place a suitable internal system comprising policies, internal controls, and sufficient and effective procedures based on the Company's understanding of money laundering and terrorist financing risks. This system shall include the following:

A. A clear anti-money laundering and counter-terrorist financing policy approved by the Board of Directors or the Regional Manager for foreign company branches, with continuous updates, such that this policy includes at minimum all the requirements stipulated in these Instructions.

B. Detailed written procedures for anti-money laundering and counter-terrorist financing, observing precise identification of duties and responsibilities in accordance with the approved policy and instructions issued by the Central Bank in this regard.

C. Allocating an independent and qualified staff within the internal audit department and equipped with sufficient resources to test compliance with policies, internal controls, and procedures for anti-money laundering and counter-terrorist financing.

D. A suitable mechanism to verify compliance with the instructions, policies, and procedures for anti-money laundering and counter-terrorist financing by internal audit and the reporting manager, observing coordination in the field of determining authorities and responsibilities between them.

E. Establishing procedures that ensure internal audit performs its role of examining internal control systems to ensure their effectiveness in combating money laundering and terrorist financing, with the necessity of reviewing them periodically to complete any deficiencies, update them, and develop them to increase their efficiency and effectiveness.

Article (11): Training and Qualification

A. The Company shall put in place continuous training plans and programs in the field of anti-money laundering and counter-terrorist financing for employees in the Company. These programs shall include money laundering and terrorist financing methods, how to detect and report them, and how to deal with suspected customers. Records of all training programs conducted during a period of not less than five years shall be retained, including: names of trainees, their job titles, and the entity that conducted the training, whether within or outside the Kingdom. All new employees shall be subjected to training courses in the field of anti-money laundering and counter-terrorist financing during the first year of their appointment.

B. The Company shall adopt policies, procedures, and controls to ensure the highest standards when appointing employees, specifically to verify the suitability of senior executive management, reporting managers, and other employees involved in anti-money laundering and counter-terrorist financing.

C. Allocate an independent budget from the Company's Board of Directors or the Regional Management of the foreign company to fund training, qualification, and attendance of seminars and workshops related to anti-money laundering and counter-terrorist financing for employees in the Company, and to provide systems that help the compliance monitoring department perform its duties. The Company shall provide the Central Bank at the end of each year with statistics showing the training programs and workshops that employees were subjected to during the year.

D. Retain records related to training programs and all data related to them for at least (5) years from the date of training.

E. The Company must inform its employees of the necessary information regarding:

1. The effective law and regulations and instructions issued pursuant to any of them.
2. Patterns suspected to fall under money laundering and terrorist financing operations and contained in the Suspicious Money Laundering and Terrorist Financing Indicators Guide [Annex (2)], and using these indicators as a tool to educate employees in the Company and take them into account in cases of suspicion.
3. Procedures for reporting to the Reporting Manager about transactions that the employee suspects are related to money laundering or terrorist financing.
4. The internal policies, controls, and procedures followed by the Company to combat money laundering and terrorist financing according to the risk level.

Article (12): Reporting on Transactions Suspected to be Related to Money Laundering or Terrorist Financing

A. The Company must determine the name of the Reporting Manager and their deputy and inform the Unit and the Central Bank in case either changes, ensuring that each possesses appropriate qualifications.

B. The Reporting Manager's authorities shall include at least what enables them to exercise their competencies independently and ensure the confidentiality of information received and procedures undertaken. To this end, they shall have access to the records and data necessary for their work, including the following:

1. Receiving information and reports on unusual transactions or those suspected to be related to money laundering or terrorist financing, examining them, and making the appropriate decision regarding reporting to the Unit immediately or retaining them, with the retention decision being justified. Necessary documents regarding retained reports shall be retained for a period of not less than five years.
2. Preparing periodic statistical reports for the Board of Directors on transactions suspected to be related to money laundering or terrorist financing.

C. In case any employee in the Company suspects that a transaction under execution is related to money laundering and terrorist financing, they must inform the Reporting Manager.

D. The Reporting Manager must immediately inform the Unit of all transactions suspected (or where there are reasonable grounds for suspicion) to be related to money laundering or terrorist financing, whether these transactions were completed or not, and regardless of the value of the transaction, using the means or form approved by the Unit.

E. The Reporting Manager shall provide the Unit and competent authorities with data related to transactions suspected to be related to money laundering or terrorist financing and any other data requested from them according to the means approved by these authorities, and facilitate their access to relevant records and information for the purpose of performing their duties.

F. It is prohibited for any employee to disclose, directly or indirectly, by any means whatsoever, any reporting to the Unit or other official authorities regarding transactions, or any of the reporting procedures taken regarding transactions suspected to be related to money laundering or terrorist financing, or any of the information related thereto.

G. It is prohibited for anyone who becomes aware or learns, directly or indirectly, or by virtue of their position or work, to disclose any information provided, exchanged, or disclosed in any form whatsoever, except for the purposes of implementing the law and these Instructions.

Article (13): Retention of Records and Documents

A. Each Company shall develop an integrated information system to retain the records, documents, and information mentioned below, enabling it to make all records related to customers and transactions available upon request from the Unit and competent official authorities in an integrated and rapid manner within the specified period. The records must be sufficient to allow the reconstruction of individual transactions and provide evidence for prosecution against criminal activity. This shall include the following:

1. Records and documents related to local and international business relationships and transactions, including those related to the due diligence and enhanced due diligence requirements stipulated in these Instructions.
2. Records related to suspected transactions, including copies of reports on transactions sent to the Unit and the data and documents related thereto.
3. Reports on unusual transactions and evidence of the review of these reports.
4. Records and documents supporting business relationships and transactions, correspondence, and results of any analysis conducted.

B. The aforementioned records must include original documents, printed copies, scanned copies, stored copies, or any other form acceptable in courts under the legislation in force in the Kingdom.

C. The Company must retain records and documents securely and keep backup copies in another location.

D. The retention of the aforementioned records and documents shall be for a period of at least five years from the date of transaction completion or termination of the business relationship, whichever applies, including the date of termination of the occasional transaction.

E. The Company must prepare special files for transactions suspected to be related to money laundering and terrorist financing, in which copies of reports on these transactions and the data and documents related thereto are kept. These files shall be retained for a period of not less than five years from the date of reporting or until a final judicial ruling is issued regarding these transactions, whichever is longer.

Article (14): Subject to the provisions of instructions issued based on the provisions of the Law, the Company shall implement the obligations stipulated in relevant international decisions that are mandatory for enforcement, including all decisions issued under Chapter VII of the United Nations Charter, without delay.

Article (15): Final Provisions

A. The Company must include in the agreement signed between it and the external auditor a requirement for them to ensure that the Company applies the Law and these Instructions and the adequacy of the Company's policies and procedures related thereto, and include the results thereof in their report submitted to management. It is necessary to inform the Central Bank immediately upon discovering any violation of these Instructions.

B. It is prohibited for any employee to manage any accounts as an agent for any customer, except for the spouse and first-degree relatives, and only after obtaining approval from the General Manager / Regional Manager.

C. Subject to the provisions and requirements of the Law and other instructions issued by the Central Bank, companies operating in the Kingdom shall provide the Central Bank with all reports issued by internal and external regulatory bodies if they include references to violations or observations related to anti-money laundering or counter-terrorist financing procedures.

D. Companies operating in the Kingdom shall provide the Anti-Money Laundering and Counter-Terrorist Financing Unit within the specified period with any additional information, reports, or statistics requested for the purpose of implementing the provisions of the Law, regulations, and instructions issued pursuant thereto.

E. The Company shall refer to the methodology issued by the Financial Action Task Force (FATF) regarding the application of the methodology for assessing compliance with FATF recommendations and the effectiveness of anti-money laundering and counter-terrorist financing systems, and any matters not stipulated in these Instructions.

F. The Company shall adopt the following policies to limit money laundering and terrorist financing operations:

1. Know Your Customer (KYC) policy.
2. Anti-money laundering and counter-terrorist financing policies and procedures used to identify the true identity of the customer and beneficial owner, the type of accepted activity, and to detect unusual customer activity.

Article (16): Without prejudice to any harsher penalty stipulated therein, anyone who violates the provisions of these Instructions shall be punished with the penalties stipulated in the Law and/or the Regulation.

Article (17): The two attached Guidelines are considered an integral part of these Instructions.

Governor
Dr. Ziad Friez

Attachments:

• Annex (1) Guideline for Cases where the Company's Assessment of Money Laundering and Terrorist Financing Risks is High at a Minimum.
• Annex (2) Guide to Suspicious Money Laundering and Terrorist Financing Indicators.

---

[Page 27]
Annex (1)
Guideline for Cases where the Company's Assessment of Money Laundering and Terrorist Financing Risks is High at a Minimum

Factors

Cases

Factors related to customer risks

- Conducting business under unusual circumstances (for example: unjustified large geographical distance between the Company and the customer).<br>- Non-resident customers.<br>- Cases where the legal person or legal arrangement is a special purpose entity.<br>- Unjustified complexity in ownership structure compared to the nature of the Company's work.<br>- Customers belonging to areas known for high crime rates (for example: countries known for drug production, transportation, or smuggling).<br>- Customers belonging to or present in countries that do not apply the recommendations of the Financial Action Task Force (FATF) or do not apply them sufficiently.<br>- Activities classified by the Financial Action Task Force (FATF) as "high-risk" activities for money laundering and terrorist financing.<br>- Customers who meet the risk indicators specified by the Company.

---

[Page 28]

Factors	Cases
Factors related to risks of products, services, processes, or distribution channels	- Operations conducted by unidentified persons (which may involve the use of cash).<br>- Business relationships or operations not conducted face-to-face.<br>- Repayments made on behalf of the client from unknown sources or from a third party with no clear relationship to the client.
Factors related to risks of countries and geographical areas	- When determining factors related to risks for countries and geographical areas, the company may refer to credible sources such as: mutual evaluation reports, follow-up reports, and any other relevant reports published by international organizations such as: the United Nations and the Financial Action Task Force (FATF).<br>- Countries suffering from political or security conditions that hinder their compliance with FATF recommendations.<br>- Countries where terrorist organizations are present.<br>- Geographical areas considered to be funding terrorism or supporting criminal activities.<br>- Countries suffering from high levels of corruption or other criminal activities.<br>- Countries subject to sanctions, embargoes, or any other measures issued by the United Nations.<br>- Countries lacking sufficient systems to combat money laundering and terrorist financing or not applying FATF recommendations adequately.

---

[Page 29]
Appendix (2)
Guide to Indicators of Suspicion for Money Laundering and Terrorist Financing

First: Customer Behaviors
A. The customer with a volatile temperament who refuses to provide the company with necessary identity verification documents and provide any detailed information about themselves, which are conditions for completing the transaction.
B. The customer who shows dissatisfaction and reluctance to complete the process procedures and avoids legal violations regarding it by stating that it requires notifying relevant authorities of its details.
C. The customer who inquires with the company about the company's records, systems, and instructions, with the aim of obtaining sufficient information about money laundering operations and avoiding legal violations regarding them.
D. The customer providing false or misleading information to the company that is difficult to verify, such as providing an unused phone number.
E. The customer providing unjustified gifts or bribes to company employees and attempting to persuade the employee not to verify identity documents and other documents.
F. The suspected customer or their representative requesting the cancellation of the transaction as soon as a company employee attempts to obtain the missing important information.
G. The customer being controlled by another person upon their presence at the company, where the customer is unaware of what they are doing, or an elderly customer accompanied by another person who has no relation to them during the execution of the transaction.
H. The customer presenting suspicious or forged identity documents and refusing to provide the company with their personal information.
I. The customer providing the company with a permanent address located outside the company's service area or outside the Kingdom.
J. The customer whose home phone, work phone, or mobile phone is disconnected.
K. The customer who refuses to disclose details of their work-related activities.
L. The customer frequently changing their residential address.
M. The beneficial owner belonging to an area known for criminal activity or security disturbances.
N. A company employee knowing that the customer has a criminal record, or from reliable sources such as (media) that the customer is involved in illegal activities.
O. Signs of anxiety and confusion appearing on the customer or their representative during the execution of the transaction.

---

[Page 30]
P. The customer attempting to cancel the financial transaction after learning that the information provided by them will be audited or expressing dissatisfaction with the procedures or systems used by the company.
Q. The customer avoiding (fearing) meeting a company employee face-to-face and resorting to using alternative methods.
R. The customer or their representative unexpectedly making early debt repayments before the scheduled time suddenly without a clear and reasonable explanation for the source of the repayment.
S. The customer's nationality and profession being inconsistent with their name, external appearance, or beliefs.
T. The customer making a sudden large debt repayment without a clear and reasonable explanation for the source of the repayment.
U. The level of activity of the customer to be financed being inconsistent with the customer's known level.
V. The loan being repaid through a loan obtained from a bank, company, or any entity with no relation to the customer.

Second: Employee Behaviors
A. A noticeable and sudden increase in the employee's standard of living and spending level that is inconsistent with their monthly income and without a clear justification.
B. The employee failing to provide the company with a certificate of no criminal record issued by the Ministry of Justice.
C. The employee not taking their annual leave or frequently visiting the company during their leave.
D. The employee assisting in executing operations where the beneficial owner or counterparty is not fully known.
E. The employee repeatedly bypassing supervisory procedures and adopting an evasive policy in performing their work.
F. The employee assisting in completing operations where the customer is not fully known.
G. The employee exaggerating the credibility, ethics, financial sources, and solvency of the customer.
H. The employee participating in a large number of exceptions related to transaction processing.
I. The employee exploiting the powers granted to them or their position to execute actions that do not comply with the Code of Conduct.