FAQs on Anti-Money Laundering and Combating Financing of Terrorism (Second Version)

1. What are the KYC requirements for the accounts opened before 2012? The KYC/CDD requirements for the pre-existing accounts opened before 2012 is explained under Section 9b - Existing Customers (reproduced below) of the SECP Guidelines on AML, CFT and Proliferation Financing :

“RPs are required to apply CDD measures to existing customers on the basis of materiality and risk, and to conduct due diligence on such existing relationships at appropriate times, taking into account whether and when CDD measures have previously been undertaken and the adequacy of data obtained”.

2. Why are KYC documentation for Corporate Accounts such as Memorandum and Articles of Association, Trust Deeds, Certificate of Incorporation and Commencement required when the SECP website provides the status of the corporate entities? KYC documentation should be reviewed to understand the nature/size of business, purpose and intended nature of the business relationship, ownership and control structure of the entity.

3. Why are certain documents like Authority Resolutions’ and Directors’ CNICs required for KYC purposes in case of corporate entities? The individuals who are authorized to open and operate the accounts in case of corporate entities should also be subject to comprehensive CDD requirements. Therefore, documentation is required for identification and verification of person acting on behalf of the entity and its directors. In addition, the authority of such person to act on behalf of the customer shall be verified through documentary evidence including Resolution of Board of Directors.

4. Why isn’t there a standardized process to determine thresholds and investors’ categorization for enhanced due diligence (EDD)? ML/TF risk w.r.t risk categories, i.e. customers, countries or geographical locations, products and services, transactions and delivery channels are specific to each entity. Examples of high and low risk categories are given in section 18 of the SECP AML/CFT Guidelines 2018. It may be noted that EDD is mandatory for high risk customers and has to be done irrespective of any thresholds.

5. What are the documentation requirements for enhanced due diligence such as wealth statements, bank statements etc. and what can be the examples of source of wealth and/or source of funds? Please refer to FAQs on link https://www.secp.gov.pk/faq/ wherein the examples of source of wealth/ source of funds are provided.

6. Are corporate websites, newspapers, tax directories acceptable for KYC purposes? KYC/CDD process entails identifying the customer or beneficial owner; obtaining information on the purpose and intended nature of the business relationship; and monitoring of accounts/transactions on ongoing basis. Therefore, reliable and independent sources may be used for verification purposes.

7. What is the mechanism for on-going monitoring of accounts (in terms of thresholds, investor categories, period of relationship etc.). Ongoing monitoring is part of the customer due diligence and essentially consists of monitoring transactions for intended purpose of the customer. Section 10 of the SECP AML/CFT Guidelines 2018 explains the mechanism of ongoing monitoring of accounts. However, entity should formulate policies and procedures for on-going monitoring.

8. How should the regulated person respond to discrepancies (such as credit blocks, follow-up periodicity etc.) that may arise during on-going monitoring? SECP AML/CFT Regulations and guidelines are reproduced below which may be referred to for guidance:

SECP AML/CFT Regulations, 2018 Section 6 – Customer Due Diligence:

(11) “where regulated person is not able to satisfactorily complete required CDD measures, account shall not be opened or existing business relationship shall be terminated and consideration shall be given if the circumstances are suspicious so as to warrant the filing of an STR in relation to the customer”.

SECP AML/CFT Guidelines section 9(b) (iii) and (iv) – Existing Customers:

iii. An RP is entitled to rely on the identification and verification steps that it has already undertaken, unless it has doubts about the veracity of that information. Examples of situations that might lead an institution to have such doubts could be where there is a suspicion of money laundering in relation to that customer, or where there is a material change in the way that the customer’s account is operated, which is not consistent with the customer’s business profile.

iv. Where an RP is unable to complete and comply with CDD requirements as specified in the Regulations, it shall not open the account, commence a business relationship, or perform the transaction. If the business relationship has already been established, the RP shall terminate the relationship. Additionally, the RP shall consider making a STR to the FMU.

9. What are the KYC requirements for investors with long term banking relationships?

Section 12 of the SECP AML/CFT Regulations, 2018 provides detailed guidance on third party reliance. It may be noted that notwithstanding long term banking relationships and the investment of funds through banking channel the responsibility for ongoing monitoring of customers and reliance on third parties ultimately remains with the regulated person, including generation of STRs.

10. What is the closure mechanism for discrepant accounts?

Under SECP AML/CFT Guidelines 2018, section 9(b) (iv) – Existing Customers: iv. Where an RP is unable to complete and comply with CDD requirements as specified in the Regulations, it shall not open the account, commence a business relationship, or perform the transaction. If the business relationship has already been established, the RP shall terminate the relationship. Additionally, the RP shall consider making a STR to the FMU.

The customer should be is provided with fair opportunity to remove the discrepancies and in cases, where he is unable to comply with the relevant CDD measures, the business relationship should be terminated.

11. How to identify and verify the beneficiaries in case of trusts as required under Regulation (7)2 of SECP AML/CFT Regulations 2018?

In the case of “Trusts”, the regulated person should obtain:

a) Whether the Trust is a Public Trust or Private Trust;

b) Trust Deed whereby the Trust has been created;

c) Details of Settlor (this will also be available in the Trust Deed);

d) Objects of the trust (this will also be available in the Trust Deed);

e) Trustee of the trust (whether trustee is associated person of the settlor);

f) Description of each class or type of beneficiary (this information may also be checked from Trust Deed);

g) Details of any possibility of influence of any other person on trustee regarding management and control of trust property;

h) In the case of “Private Trust” if the beneficiary of a trust is also the beneficial owner of the trust, identification and verification of the beneficiary is required otherwise the name and CNIC of each beneficiary of a trust should be obtained. (verification of this information is not required).

For this purpose, the regulated person may obtain a declaration from Governing Body/Board of Trustees/Executive Committee/sponsors on ultimate control, purpose and source of funds etc. Further, the documents as per Sr. No. 1 of the Annex 1 of the SECP AML/CFT Regulations, 2018 can be used for identification and verification of settlor, the trustee, the protector (if any), the beneficiaries and any natural person exercising ultimate ownership, ultimate control or ultimate effective control over the trust under Regulation (7)2 of SECP AML/CFT Regulations 2018.

12. Annual risk assessment Framework and Compliance Assessment Checklist are required to be filed with SECP by June 30 of each Financial Year. What would be the cut-off date for data to be used for this risk and compliance assessment? The May 31 of each financial year may be taken as a cut-off date for data to conduct necessary assessment and subsequent filing to the SECP on June 30. However, the data for month of “June” shall be included in the subsequent annual filing.

13. Six monthly information/ data is required to be filed with SECP by June 30 and December 31 of each Financial Year. What would be the cut-off date for data to be used for each six monthly information/data submission? The first six monthly data along with annual risk assessment and annual compliance check list shall be submitted not later than 30th June based upon the data up to 31st May (hence the data period will be from 1 st December to 31st May) and for second six monthly information/data shall be submitted not later than 31st December based upon the data up to 30 November (hence the data period will be from 1st June to 30st November).