Frequently Asked Questions on Anti-Money Laundering and Combating Financing of Terrorism

SECP

SECURITIES AND EXCHANGE
COMMISSION OF PAKISTAN

January 2019

SECP is pleased to publish this First version of SECP’s Frequently Asked Questions (FAQs) on AML/CFT aiming to provide clear and concise answers to basic questions that surfaced during our awareness sessions with the industry on AML/CFT Obligations under the SECP AML/CFT Regulations, 2018 and guidelines on Regulations, and in our discussions with investors, brokerage, NBFC and insurance industry, regulators, and others.

These FAQs aim to facilitate SECP’s regulated financial services industry and investors to comprehend and implement their obligations under the AML/CFT regime and to meet evolving regulatory expectations for anti-money laundering and sanctions compliance.

It includes information on a range of topics, such as KYC, CDD, risk assessments, sanctions compliance, and more information about how to comply with AML/CFT standards issued by the Financial Action Task Force (FATF).

The following questions and answers have been prepared for illustrative purposes only.

Section A- International Obligations

1. What are the international obligations concerning AML/CFT?

The United Nations through its Securities Council Resolution 1617 requires all UN Member States to implement FATF’s AML/CFT Recommendations. Pakistan is a member of UN and Asia Pacific Group (FATF Styled Regional Body) and therefore, is required to adopt FATF standards as per membership obligations.

2. What obligations are placed on RPs?

Basic obligations imposed on reporting entities include:

i. Assessing the money laundering and financing of terrorism risk that it may reasonably expect to face in the course of its business;

ii. Establishing, implementing and maintaining an AML/CFT programme (procedures, policies and controls) to detect, manage and mitigate the risk of money laundering and the financing of terrorism;

iii. Customer due diligence (CDD) (identification and verification of identity) and ongoing CDD;

iv. Suspicious transaction reporting;

v. Record keeping.

Reporting entities have considerable flexibility within the limits prescribed by Regulations, in how they meet their obligations.

3. What are the stages of Money Laundering?

There are three stages involved in money laundering:

1. Placement: involves placing the proceeds of crime in the financial system;

2. Layering: involves converting the proceeds of crime into another form and creating complex layers of financial transactions to disguise the audit trail and the source and ownership of funds (e.g., the buying and selling of stocks, commodities or property);

3. Integration: involves placing the laundered proceeds back in the economy under a veil of legitimacy.

4. How are the requirements of AML/CFT applicable on Financial Institutions regulated by the SECP when money is routed through banking channels?

Financial institutions means any natural or legal person who conducts as a business one or more of the following activities or operations for or on behalf of a customer:

i. Acceptance of deposits and other repayable funds from the public;

ii. Lending;

iii. Financial leasing;

iv. Money or value transfer services;

v. Issuing and managing means of payment (e.g. credit and debit cards, cheques, traveller's cheques, money orders and bankers' drafts, electronic money);

vi. Financial guarantees and commitments;

vii. Trading in:

a. money market instruments (cheques, bills, certificates of deposit, derivatives etc.);

b. foreign exchange;

c. exchange, interest rate and index instruments;

d. transferable securities;

e. commodity futures trading.

viii. Participation in securities issues and the provision of financial services related to such issues;

ix. Individual and collective portfolio management;

x. Safekeeping and administration of cash or liquid securities on behalf of other persons;

xi. Otherwise investing, administering or managing funds or money on behalf of other persons;

xii. Underwriting and placement of life insurance and other investment related insurance;

xiii. Money and currency changing.

The risk of money laundering in Non-Bank Financial Institutions (NBFIs) may not lie in the placement stage but rather in the layering and integration stages of money laundering. The National Risk Assessment has highlighted the vulnerabilities and threats in terms of both money laundering and terrorist financing in these sectors. Accordingly, NBFI is obliged to comply with FATF recommendations even if money is routed thorough the banking channel.

5. Are non-deposit taking financial institution exempt from the compliance of AML/CFT requirements?

No. The definition of Financial Institution includes lending business activity. Therefore, the Non-deposit taking financial institutions are required to comply with AML/CFT Regulations, 2018 in the same manner as applicable to the other Non-Banking Financial sector institutions.

Section B – AML/CFT Program

6. What is a risk assessment?

Reporting entities are required to assess the money laundering and financing of terrorism risk that they may reasonably expect to face in the course of their business. In making this assessment, the reporting entity is required to consider:

i. Nature, size and complexity of its business;

ii. Products and services it offers;

iii. Methods by which it delivers products and services to its customers;

iv. Types of customers it deals with;

v. Countries it deals with;

vi. Institutions it deals with;

vii. Any guidance material produced by supervisors;

viii. Any other factors that are set out in regulations.

Reporting entities also need to consider whether any of their products involve new or developing technologies that may favour customer anonymity.

7. How is customer risk assessment different from entity risk assessment?

Risk assessment is the identification and assessment of ML/TF risk faced by the regulated person in relation to the jurisdictions or countries its customers are from or in; the jurisdictions or countries the regulated person has operations or dealings in and products, services, transactions and delivery channels of the regulated person. Whereas KYC/CDD measures determine the risk profile of the customer only. Customers’ risk profiling is one of the facet used in the entity risk assessment.

8. What is risk-based approach in AML/CFT compliance?

Risk Based Approach means that financial institutions identify, assess, and understand the money laundering and terrorist financing risks to which the financial institution is exposed and implement the most appropriate mitigation measures. This approach enables financial institutions to focus their resources where the risks are higher.

9. What is an AML/CFT programme?

An AML/CFT programme sets out a reporting entity's internal policies, procedures and controls to detect money laundering and financing of terrorism and to manage and mitigate the risk of it occurring. The programme must be in writing and be based on its risk assessment. Certain elements of a programme are specifically required by the Regulations, including:

i. Vetting senior managers and AML staff;

ii. Training senior managers and AML staff;

iii. Customer due diligence, including enhanced CDD and simplified CDD;

iv. Reporting suspicious transactions;

v. Monitoring and record keeping;

vi. Monitoring and managing compliance with the AML/CFT programme.

Risk-based systems and controls should be based on the nature, size and complexity of a reporting entity's business, along with any money laundering and financing of terrorism risks it may face.

10. Can head of Internal Audit perform the role of Compliance Officer?

No. The regulated person should establish the three lines of defense to combat ML/TF namely Business Units, Compliance Officer and Internal Audit. Therefore, the scope of responsibilities will vary between compliance officer and internal audit functions. However, dual hatting is allowed for the role of Compliance Officer.

Section C – Customer Due Diligence

11. How is customer risk rating linked with CDD measures?

Customer risk rating (High, Low) is assigned based on ML/TF risk posed by each relevant factor (Customer, Geography, Product and Transaction Risk), whereas the level of due diligence (Simplified or Enhanced) is determined based on the ML/TF risk posed by the customer.

12. What is the requirement to apply CDD measures to existing customers?

Regulated Persons are required to apply CDD requirements to existing customers on the basis of materiality and risk, and to conduct due diligence on such existing relationships at appropriate times, taking into account whether and when CDD measures have previously been undertaken and the adequacy of data obtained.

13. What if there are deficiencies/discrepancies in documentation provided by the customer?

Where the regulated person is not able to complete required CDD measures, account shall not be opened or existing business relationship shall be terminated and consideration shall be given if the circumstances are suspicious to warrant the filing of an STR in relation to the customer. The basis of deciding whether an STR is to be filed or not shall be documented and kept on record together with all internal findings and analysis done in relation to a suspicion irrespective of the fact that the transaction is subsequently reported or not. (Section 14(6) of the SECP AML/CFT Regulations, 2018).

14. When can Simplified Due Diligence measures be applied?

Simplified due diligence is the lowest level of due diligence that can be conducted on a customer. This is appropriate where there is low risk of products/services or customer becoming involved in money laundering or terrorist financing.

15. What are the Simplified Due Diligence measure?

The SDD measures may include but are not limited to:

1. Adjusting the timing of CDD where the product or transaction sought has features that limit its use for ML/TF purposes, e.g.

i. Verifying the customer’s or beneficial owner’s identity during the establishment of the business relationship; or

ii. Verifying the customer’s or beneficial owner’s identity once transactions exceed a defined threshold or once a reasonable time limit has lapsed. Regulated person must make sure that:

    a) this does not result in a de facto exemption from CDD, that is, firms must ensure that the customer’s or beneficial owner’s identity will ultimately be verified;

    b) the threshold or time limit is set at a reasonably low level (although, with regard to terrorist financing, RP should note that a low threshold alone may not be enough to reduce risk);

    c) they have systems in place to detect when the threshold or time limit has been reached; and

    d) they do not defer CDD or delay obtaining relevant information about the customer where regulations requires that this information be obtained at the outset.

2. Adjusting the quantity of information obtained for identification, verification or monitoring purposes, for example by:

i. verifying identity on the basis of information obtained from one reliable document or data source only; or

ii. assuming the nature and purpose of the business relationship because the product is designed for one particular use only,

3. Adjusting the quality or source of information obtained for identification, verification or monitoring purposes;

4. Adjusting the frequency of CDD updates and reviews of the business relationship, for example carrying these out only when trigger events occur such as the customer looking to take out a new product or service or when a certain transaction threshold is reached; firms must make sure that this does not result in a de facto exemption from keeping CDD information up-to-date;

5. Adjusting the frequency and intensity of transaction monitoring, for example by monitoring transactions above a certain threshold only.

16. When Enhanced Due Diligence measures are applied? Enhanced due diligence measures are applied in situations that are flagged and assessed as high risk where there is an increased likelihood of money laundering or terrorist financing presented either by customers, service/ product; transaction and/or jurisdiction.

17. What can be an example of Customer Due Diligence measure for a housewife account? In relation to housewife accounts the regulated person may obtain a self-declaration for source and beneficial ownership of funds from the customer and perform further due diligence measures accordingly.

18. How often should the ongoing monitoring of business relationship be carried out? The regulated person’s policy and procedures should specify how often ongoing monitoring is to be conducted. A clear cycle should be indicated for each risk category or type of customer, for example at least once a year for high risk cases, at least once every two years for medium risk cases and every three years for low risk cases, or where a review is triggered by a defined event.

19. In case of Co-Insurance/Banc assurance, the leading company has direct access to customers, how should the reporting entity exercise the CDD procedures? Under section 12 of the SECP AML/CFT Regulation, 2018 the Regulated person may rely on a third party to conduct CDD on its behalf. However, it must satisfy itself that third party is regulated and has measures in place for compliance with CDD and record-keeping requirements in line with the regulations. However, the ultimate responsibility for CDD measures remains with the regulated persons relying on the third party.

Section D – Politically Exposed Persons

20. Is obtaining Politically Exposed Person (PEP) declaration sufficient to determine whether a customer is a PEP or not? In addition to obtaining declaration from the customer, the regulated person should perform screening, on risk sensitive basis, against information sources such as publically known information (list of members of the National Assembly, Senate, Political Parties, Senior Executives of State Owned Entities etc.) or commercial screening databases, to determine if the client is a PEP, its family member or a close associate.

21. At what level / grade / designation officers should be considered as PEP? Regulated person shall implement appropriate internal risk management systems, policies, procedures and controls to determine if any customer or a beneficial owner is a PEP. However, the regulated person should consider the nature of the prominent public function held by the PEP (e.g. level of seniority, access to or control of public funds and the nature of the position).

Regulated persons may develop a questionnaire with specific reference to criteria that identify PEPs including family members and persons known to be close associates of the PEP. Such a questionnaire may be made part of account opening form.

22. Is there a time limit to declassify a customer as PEP who is no longer a PEP? The entity should consider the level of influence that the individual could still exercise and whether the individual’s previous and current function are linked in any way (e.g., formally by appointment of the PEPs successor, or informally by the fact that the PEP continues to deal with the same substantive matters).

Section E – STR/CTR Filing

23. Can STR only be generated for a customer with whom business relation has been established? It is normal practice for an entity to turn away business that they suspect might be criminal in intent or origin. Where an applicant or a customer is hesitant/fails to provide adequate documentation (including the identity of any beneficial owners or controllers), consideration should be given to filing a STR.

24. Should STR only be generated for transactions that have been executed? No. STR should be generated where an attempted transaction gives rise to knowledge or suspicion of ML/TF. Such attempted transaction should be referred to the compliance officer for possible reporting to FMU.

25. Where can I find guidance on indicators of suspicious transactions? Refer to Annex 3 & 4 to the SECP AML and CFT Regulations Guidelines for ML/ TF and Proliferation Financing Warning Signs/ Red Flags.

26. What is CTR? CTR stands for Currency Transaction Report which has to be filed with the FMU. It is a threshold based report of cash transaction of two million rupees or above involving payment, receipt, or transfer of an amount by customers of a reporting entity. The guidelines for submitting a CTR can be accessed at FMU’s website http://fmu.gov.pk/docs/CTR_Guidance_Notes.pdf

Section F – UNSCR Screening

27. Who should be included in the screening of sanctions list? Sanctions list screening should be performed for the customer, beneficial owner of the customer and person(s) acting on behalf of a customer.

28. What happens if a customer’s name appears on sanctions list? If a customer’s name is matched with a name on a sanctions list, further checks will be needed to determine whether it is a true match . In case of a true match, the entity should freeze without delay the customer’s fund and block the transaction, reject the customer, lodge a STR with the FMU and notify the SECP and the Ministry of Foreign Affairs.

Section G- Non-resident customers/ High Net worth Individuals

29. How should a NICOP holding customer residing in Pakistan be categorized? The customer holding a valid NICOP may be effectively categorized as a non-resident irrespective of the place of residence.

30. How should the transactions from a non-resident customer through domestic account be treated?

The transaction through local bank account may be treated as a domestic transfer. However, the business relations with customers shall be monitored on an ongoing basis to ensure that the transactions are consistent with the regulated person’ knowledge of the customer, its business and risk profile and where appropriate, the sources of funds.

31. Is there a definition of High Net worth Individual?

There is no strict definition of High Net worth (HNW) Individuals. However, thresholds defined in SECP Circular No. 8/ 2017, Circular No. 9/2017, Circular 10/2017 may be used as reference. Further, risk posed by HNW Individuals needs to be assessed in accordance with other relevant risk factors.

Section – Sources of wealth/ Funds

32. When is the evidence for source of income required from customer?

In case of low risk customer, the regulated person should obtain information of source of income; however, no specific evidence is required. In case of high-risk customers, where EDD is required, evidence of source of income may be requested from the customer.

33. What can be the examples of source of wealth/ source of funds?

List of examples of appropriate information and/or supporting documentation required to establish source of wealth and funds is as follows (any one of the document may be obtained):

a) Employment Income:
 Last month/recent pay slip;
 Annual salary and bonuses for the last couple of years;  Confirmation from the employer of annual salary;  Income Tax Returns/ Wealth Statement. b) Company Profits / Dividends  Copy of latest audited financial statements;  Board of Directors approval c) Savings / deposits:
 Statement from financial institution
 Bank Statement d) Inheritance:
 Succession Certificate. e) Sale of Property:
 Copy of sale agreement/Title Deed f) Loan
 Loan agreement g) Gift:
 Gift Deed;
 Source of donor’s wealth;
 Certified identification documents of donor. h) Other income sources:
 Nature of income, amount, date received and from whom along with appropriate supporting documentation.
 Where there nature of income is such that no supporting documentation is available (for eg. Agricultural Income) Bank Statement may be obtained.
Note: The extent to documentation required for EDD would depend on the level of risk involved.