Central Bank of Lebanon Decision No. 13386 Amending Decision No. 12837 on Combating Money Laundering and Terrorist Financing

Circular No. 603

to Financial Intermediation Institutions

We enclose herewith a copy of Central Bank Decision No. 13386 dated 23/12/2021 concerning the amendment of the fundamental Decision No. 12837 dated 26/6/2018 regarding the combating of money laundering and terrorist financing, subject of the fundamental Circular No. 1.

Beirut, on 23 December 2021

Governor of the Central Bank of Lebanon

Riad T. Salam

Central Bank Decision No. 13386

Amendment of Fundamental Decision No. 12837 dated 26/6/2018

The Governor of the Central Bank of Lebanon,

Having regard to the provisions of Law No. 44 dated 24/11/2015 combating money laundering and terrorist financing, particularly Article 4 thereof,

Having regard to the provisions of Law No. 234 dated 10/6/2000 regarding the regulation of the financial intermediation profession,

Having regard to the provisions of Law No. 161 dated 17/8/2011 regarding capital markets,

Having regard to Fundamental Decision No. 7818 dated 18/5/2001 and its amendments regarding the system for monitoring financial and banking operations to combat money laundering and terrorist financing,

Having regard to the Code of Conduct for Financial Markets issued on 10/11/2016 by the Capital Market Authority of Lebanon,

Having regard to the recommendations of the "Financial Action Task Force" (FATF),

Having regard to the decision of the Central Council of the Central Bank of Lebanon taken in its meeting held on 15/12/2021,

Decides as follows:

Article 1: The numbering of "Article 2" and "Article 3" of Fundamental Decision No. 12837 dated 26/6/2018 is amended so that they become respectively "Article 16" and "Article 17".

Article 2: The text of "Article 1" of Fundamental Decision No. 12837 dated 26/6/2018 is repealed and replaced by the following text:

"The following terms are defined as:

• 'Client': Any natural or legal person, whether a company or institution regardless of its type or any legal structure (Legal Arrangement) such as a Trust, or a body, organization, or non-profit association (mutual funds, cooperatives, social care homes, charitable associations, clubs, etc.).
• 'Beneficial Owner': Any natural person who ultimately, directly or indirectly, owns or controls the 'Client' and/or the natural person acting on their behalf. Indirect ownership and/or control includes situations where ownership and/or control is exercised through a chain of ownership or through indirect means of control."

-2-

Article 3: The following articles are added to Fundamental Decision No. 12837 dated 26/6/2018:

"Article 2: Financial intermediation companies, each in respect of its own activities, must refrain from maintaining anonymous accounts or accounts in fictitious names, must adopt clear procedures for opening accounts, and must apply due diligence procedures regarding the Client and the Beneficial Owner regardless of the transaction value. These procedures include verifying the identity of both permanent and occasional clients, residents and non-residents, determining the nature of their business, understanding how the legal person is structured and/or controlled, understanding and determining the purpose of the transaction and/or account opening, and the type thereof, and where necessary obtaining information related to this purpose. They must also identify the 'Beneficial Owner', the source of funds, and monitor transactions on an ongoing basis, particularly in the following cases:

• Before or when conducting transactions or opening any type of accounts.
• Money transfer operations via all electronic means.
• When executing one or multiple related transactions whose total amount reaches or exceeds $10,000 USD or its equivalent.
• When there is suspicion that a Client is attempting money laundering or terrorist financing."

"Article 3: When identifying the 'Beneficial Owner': First: The 'Beneficial Owner' must be identified for Clients that are legal persons, and necessary measures must be taken to know the identity of these persons as follows:

1. Identify the identity of every natural person who owns, directly or indirectly, 20% or more of the capital of the legal person.
2. In case of doubt as to whether the natural person(s) identified according to point 1) of this paragraph are the Beneficial Owner, or in case no natural person owns 20% or more of the Client's capital, the identity of natural persons exercising control over the legal person through other means (majority ownership, voting rights, appointment rights, or the right to dismiss the majority of the board of directors or supervisory board members of a related person) must be determined.
3. In case no natural person is identified as specified in points 1) and 2) of the 'First' paragraph, necessary measures must be taken to identify and determine the identity of persons holding senior management positions.

Second: The 'Beneficial Owner' must be identified for Clients that are legal arrangements, and necessary measures must be taken to know the identity of these persons as follows:

1. Regarding Trusts, the identity of each of the following must be determined:

• The Settlor.
• The Trustee.
• The Protector.
• The Beneficiary; and in case their identity is not determined or identified, the categories of persons for whom the Legal Arrangement was established.
• Any other natural person exercising actual control over the Trust through direct or indirect ownership or through other means.

The definitions provided in the glossary attached to Recommendation 40 issued by the Financial Action Task Force shall be relied upon to determine what is mentioned in point 1) of this paragraph.

2. Regarding other types of legal arrangements, including Trust-like structures, the identity of persons holding positions similar to those specified in point 1) of the 'Second' paragraph of this article must be determined.

Third: When identifying the 'Beneficial Owner', the same due diligence procedures required for the Client must be applied, including those issued by the 'Special Investigation Commission'."

-3-

"Article 4: In order to verify the identity of the 'Client' and the 'Beneficial Owner', the employee responsible for executing the transaction must request the Client to provide the following official documents or data:

• a. If the Client is a natural person: a copy of the passport or identity card, or a personal status record or residence permit.
• b. If the Client is a legal person, whether a company, institution, or legal arrangement: a certified copy of the Articles of Association, registration certificate, ownership structure chart, a list showing how shares or quotas are distributed (directly or indirectly), and a list of authorized signatories, in addition to a copy of the identity of the legal representative, directors, and natural persons who own, directly or indirectly, a percentage entitling them to actual control over the company's management, in addition to the 'Beneficial Owner' statement submitted to the Ministry of Finance and the Commercial Register.
• c. If the transaction is conducted through an agent: presentation of the original or a certified copy of the power of attorney, in addition to presenting copies of documents related to the identity of the agent and the principal. Due diligence procedures, as stipulated in Article 2 above, must also be applied to non-professional agents.

-4-

"Article 5: The financial intermediation company must retain information about the 'Client' and 'Beneficial Owner' (Owner Beneficial), particularly their full name, place of residence address, and registered office address for legal persons (or main place of business if different), their profession, financial status, and copies of all documents relied upon for the above verification, and account files for a period of at least five years after closing the account or ending the business relationship, and all documents related to all transactions, including commercial correspondence and results of any analysis performed, for a period of at least five years after the completion of the transaction, such that these records may constitute evidence for prosecution and investigation in case of any criminal activity."

"Article 6: If it is impossible to perform the due diligence procedures stipulated in Article 2 above to the satisfaction of the Client and Beneficial Owners, the account should not be opened, business should not begin, the transaction should not be executed, or the business relationship should not be continued. Consideration should also be given to reporting to the 'Special Investigation Commission'."

"Article 7: Financial intermediation companies must apply due diligence procedures continuously to all their clients in order to update or add any information on the approved Customer Knowledge Form (Form KYC) resulting from any variables that may affect the status of the 'Client', particularly in case of doubt regarding the validity or accuracy of previously declared information, identity, or in case of genuine changes in the 'Client' or the 'Beneficial Owner'. For this purpose, each company must prepare a specific action plan with deadlines to implement these obligations."

"Article 8: Financial intermediation companies must:

1. In case of suspicion that the 'Client' is not the 'Beneficial Owner' or if the Client states that the Beneficial Owner is a third party, request the Client to provide a written declaration identifying the 'Beneficial Owner' (Actual Beneficiary), specifying particularly their name, surname, place of residence, profession, and information about their financial status, and retain a copy of this declaration and the identity of the 'Beneficial Owner' for the period mentioned in Article 5 above. Suspicion regarding the identity of the 'Beneficial Owner' arises in the following cases, by way of illustration and not limitation:

• a. When granting power of attorney to a non-professional person (not a lawyer, general agent, or financial intermediary), it appears from the circumstances that the relationship with the principal does not justify the power of attorney.
• b. When dealing through institutions or companies that constitute front companies.
• c. If the Client's financial status is known to the employee executing the transaction, and the value of the intended transaction is disproportionate to their financial status.
• d. If the Company notices any other suspicious indicators within the framework of its business activities.

-5-

2. Immediately notify the Governor of the Central Bank of Lebanon as President of the 'Special Investigation Commission' if there are confirmations or suspicions, based on reasonable or objective grounds, that the transaction or attempt to execute it relates to money laundering or predicate crimes associated with it, or terrorist financing or terrorist acts or terrorist organizations. Also, in cases where there is suspicion of money laundering or terrorist financing by the Company and it believes there are logical reasons that executing due diligence procedures will alert the Client, it is permitted not to continue these procedures, provided that the 'Special Investigation Commission' is notified 'immediately'.

"Article 9: Financial intermediation companies must:

1. Take appropriate steps to identify, assess, and understand their money laundering and terrorist financing risks, and adopt a risk-based approach to classify Clients and transactions according to risk levels: low risk, medium risk, and high risk. Client risk, country risk, and service risk are taken into consideration, by way of illustration and not limitation.
2. Put in place risk-based control measures and perform, at a minimum, regarding Clients, Beneficial Owners, and Politically Exposed Persons (PEPs) as defined by the Financial Action Task Force and their family members and close associates, and transactions classified as 'high risk' according to risk scoring, by adopting the following enhanced risk management and mitigation measures:

• a. Strict monitoring and giving priority to continuous enhanced monitoring of the business relationship.
• b. Obtaining more detailed information about the Client and Beneficial Owners (Increased KYC Level), particularly determining the source of their wealth.
• c. Obtaining senior management approval to enter into or continue the business relationship with the Client and to execute transactions commensurate with the determined risk level.
• d. Conducting periodic review of the relationship with the Client.
• e. Conducting continuous comparison with similar approved classifications (Peer Comparison).
• f. Putting in place a suitable system to determine if the 'Client' or 'Beneficial Owner' is a Politically Exposed Person (PEP).

3. Take into consideration the time period of the establishment of the relationship with the Client and how well they are known.

-6-

4. Rely on information programs to perform necessary controls according to the approved classification.
5. Adopt a specific policy by senior management, based on the obligations stipulated in this article, for risk classification and management and determining the control measures to be implemented by those concerned.
6. Document risk assessment results, update them as necessary, and retain them to provide to regulatory authorities when necessary."

"Article 10: Financial intermediation institutions must establish and adopt an effective internal control system (Internal Control System) including the appointment of a Compliance Officer at the management level, who must possess sufficient expertise in combating money laundering and terrorist financing. Their duties are as follows:

1. Develop a manual of procedures for combating money laundering and terrorist financing, taking into account the obligations in this Decision. This manual must consider the company's structure and existing divisions, be developed as needed, and include the Customer Knowledge Form (Form KYC) subject of Article 7 above, and submit them to senior management for approval and adoption.

2. Audit transactions throughout the duration of the business relationship with the Client to ensure that transactions executed are consistent with what the Company knows about the Client, their activity pattern, and the risks they represent, and if necessary, the source of funds.

3. Ensure that documents, data, or information obtained through due diligence procedures are continuously updated and appropriate by reviewing existing records, particularly for high-risk Client categories, and documenting their work with necessary periodic reports and submitting them to senior management.

4. Apply due diligence procedures to existing business relationships at appropriate times and based on relative importance and risk, taking into consideration whether these procedures were previously taken, the timing of their adoption, and the adequacy of the obtained data.

5. Verify the proper application and effectiveness of procedures followed for combating money laundering and terrorist financing and monitor accounts (using specialized information programs if necessary showing money laundering and terrorist financing indicators) to confirm the absence of suspicious transactions, and document their work with necessary periodic reports and submit them to senior management.

6. Apply enhanced due diligence procedures, commensurate with the risk level, to business relationships and transactions with natural and legal persons (including financial institutions) from countries for which the Financial Action Task Force recommends taking such measures. For this purpose, the website of this group must be reviewed periodically, especially after each of its general meetings.

-7-

7. Verify the application of money laundering and terrorist financing prevention programs at the level of the financial group as a whole, including all branches and subsidiaries in which the group holds a majority stake. These programs must include the following measures:

• a. Policies and procedures for exchanging information related to due diligence towards Clients and money laundering and terrorist financing risks.
• b. Obligation to provide information regarding Clients, accounts, and transactions from branches and subsidiaries at the group level when necessary for combating money laundering and terrorist financing, including analytical reports and reports on unusual activities. Branches and subsidiaries must also receive such information from the Compliance Officer at the group level, in compliance with risk levels, and analyze information and reports on unusual activities.
• c. Obligation to provide sufficient guarantees regarding confidentiality and the use of exchanged information, including guarantees against informing or alerting the 'Client'."

"Article 11: Financial intermediation companies must not enter into or continue a correspondent banking relationship with a shell bank. When establishing relationships with a foreign correspondent bank, it must be verified that it has a physical presence supported by obtainable documentary evidence, in addition to not dealing with shell banks, having a good reputation, being subject to good supervision, and verifying whether it has undergone investigation regarding money laundering or terrorist financing or regulatory action. It must adopt adequate and effective measures to combat money laundering and terrorist financing.

In addition to the above, the Company must apply the following procedures:

• Obtain approval from senior executive management before establishing relationships with correspondent banks.
• Verify the nature of the activity of the foreign bank ('Respondent Bank') it deals with.
• Determine the responsibility of both the Company and the foreign bank ('Respondent Bank') it deals with.
• Take steps that enable self-satisfaction regarding payment accounts ('Accounts Through Payable') opened by foreign correspondent banks, that these banks have fulfilled their due diligence obligations towards Clients who have direct access to the correspondent bank's accounts, and verify the ability of the latter to provide relevant due diligence information upon request."

-8-

"Article 12: Financial intermediation companies must organize a centralized database for aggregated information related to money laundering and terrorist financing transactions, including at least the names disseminated by the 'Special Investigation Commission' and the names of suspected account holders reported by the Company, and update this database continuously."

"Article 13: Financial intermediation companies, each in respect of its own activities, are requested to do the following:

1. Continuously review any updates on the website of the General Directorate of Internal Security (lb.gov.isf.www) regarding the names of specified persons listed on the national list concerning natural and legal persons and entities involved in terrorism or terrorist financing, through available information programs, and immediately apply decisions regarding the freezing of funds, accounts, or transactions, including those attempted, or other assets belonging to or controlled by these names, if found in any form (directly or indirectly, jointly...), and provide the 'Special Investigation Commission' within a maximum period of 48 hours with confirmation that it has done so and with the information available to it on this matter.
2. Notify the 'Special Investigation Commission' in case of similarity between the name of one of its Clients and a name and specific details listed on the national list mentioned in point 1) of this article."

"Article 14: Financial intermediation companies must:

1. Keep a special register of the names of persons who open or move accounts through a power of attorney, including the determination of the relationship between the principal and the agent.
2. Impose high standards of integrity, probity, and competence when hiring human resources.
3. Train employees continuously and involve relevant officials and employees in workshops, seminars, and lectures related to this topic to stay permanently updated on methods of combating money laundering and terrorist financing.
4. Request employees, under penalty of liability, not to inform the Client when the 'Special Investigation Commission' requests or audits their operations, unless a decision from the 'Commission' states otherwise.

-9-

5. Adopt, at a minimum, for branches and subsidiaries operating abroad in which Lebanese intermediation companies hold a majority stake, the procedures stipulated in this Decision. In case this is impossible due to conflict with the laws and systems applicable in the location of the branch or subsidiary, the Company must apply additional appropriate measures for managing money laundering and terrorist financing risks and inform the 'Special Investigation Commission' thereof.
6. Ensure when dealing with a third party that it is subject to regulation and supervision and meets the Financial Action Task Force standards regarding due diligence and record-keeping procedures, and ensure the ability to obtain immediately and without delay from them any information to identify the 'Client' and 'Beneficial Owner', understand the nature of the business, and obtain copies of Client identification data and documents related to due diligence procedures. In all cases, the entity dealing with the third party bears the ultimate responsibility for due diligence measures, whether the third party is in Lebanon or abroad, taking into consideration risk mitigation measures, particularly those related to countries that do not apply or inadequately apply Financial Action Task Force recommendations.
7. Identify and assess money laundering and terrorist financing risks that may arise from developing new products and new professional practices, including new means of service delivery and those arising from the use of new or developing technologies regarding both new and previously existing products. An risk assessment must be conducted before launching these products, practices, or technologies or using them, and appropriate measures must be taken to manage and mitigate these risks.
8. Apply Recommendation 7 of the Financial Action Task Force to perform necessary reviews and immediate freezing of funds, accounts, or transactions related thereto, including those attempted, or other assets, and provide the 'Special Investigation Commission' within a maximum period of 48 hours with confirmation that it has done so and with the information available to it on this matter, and in case of similarity, notify the 'Special Investigation Commission' and assess the associated risks.

-10-

"Article 15: Financial intermediation companies must take into consideration the indicators listed below, by way of illustration and not limitation, which indicate, if not justified, the possibility of money laundering or terrorist financing operations:

• Rapid withdrawal of funds after depositing them for a short period in the account.
• Transferring funds to financial or banking institutions other than those from which the funds were initially transferred, particularly those located in different countries.
• The 'Client' buying financial instruments at a high price and then selling them at a large loss.
• The 'Client's' financial operations indicate a pattern of continuous losses.
• Activation of a dormant account after a long period without a clear justification.
• No clear economic justification for the 'Client's' operations.
• The 'Client's' desire to invest in a product without knowledge of the product's specifications and performance.
• Investment in long-term products, followed by account liquidation shortly thereafter regardless of fees or penalties.
• Sudden change in the 'Client's' account activity inconsistent with their usual activity.
• The 'Client' opening multiple accounts for several companies over which they exercise control."

Article 4: This Decision shall enter into force upon its issuance.

Article 5: This Decision shall be published in the Official Gazette.

Beirut, on 23 December 2021

Governor of the Central Bank of Lebanon

Riad T. Salam