General Requirements for Programs to Counter the Legalization (Money Laundering) of Proceeds from Crime, Terrorism Financing and Financing of Proliferation of Weapons of Mass Destruction

1 Registered with the Ministry of Justice of the Republic of Tajikistan on August 21, 2026, No. 1429 Approved by the Resolution of the Board of the National Bank of Tajikistan of July 21, 2026, No. 82 General Requirements for Programs to Counter the Legalization (Money Laundering) of Proceeds from Crime, Terrorism Financing and Financing of Proliferation of Weapons of Mass Destruction

General Requirements for Programs to Counter the Legalization (Money Laundering) of Proceeds from Crime, Terrorism Financing and Financing of Proliferation of Weapons of Mass Destruction (hereinafter referred to as these Requirements) are developed in accordance with part 6 of Article 23 of the Law of the Republic of Tajikistan "On Countering the Legalization (Money Laundering) of Proceeds from Crime, Terrorism Financing and Financing of Proliferation of Weapons of Mass Destruction" (hereinafter referred to as the Law), and establish general requirements for accountable subjects regarding internal control programs to counter the legalization (money laundering) of proceeds from crime, terrorism financing and financing of proliferation of weapons of mass destruction.

1. GENERAL PROVISIONS
2. The following main concepts are used in these Requirements:

• accountable subjects – subjects provided for in Article 6 of the Law;
• staff – employees of accountable subjects;
• authorized body – the body for countering the legalization (money laundering) of proceeds from crime, terrorism financing and financing of proliferation of weapons of mass destruction;
• supervisory bodies – competent bodies entrusted with supervision or control functions in the field of countering the legalization (money laundering) of proceeds from crime, terrorism financing and financing of proliferation of weapons of mass destruction, aimed at ensuring compliance by accountable subjects with the requirements of the Law;
• internal control program – internal measures, rules, control procedures and systems applied by accountable subjects for the effective implementation of the requirements of the legislation of the Republic of Tajikistan in the field of countering the legalization (money laundering) of proceeds from crime, terrorism financing and financing of proliferation of weapons of mass destruction;
• risk – a combination of threats and vulnerabilities to the legalization (money laundering) of proceeds from crime, terrorism financing and financing of proliferation of weapons of mass destruction and their associated consequences for the state, state bodies and/or accountable subjects;
• internal control service – a structural subdivision or responsible employee (compliance specialist) and persons replacing him, responsible for implementing programs and internal control rules in the field of countering the legalization (money laundering) of proceeds from crime, terrorism financing and financing of proliferation of weapons of mass destruction;
• impeccable business reputation – the presence of facts confirming professionalism, integrity, absence of an unexpunged or unpardoned criminal record, including the absence of a court decision that has entered into legal force on the application of criminal punishment in the form of deprivation of the right to hold a managerial or other position in accountable subjects or to acquire a controlling share of participation (controlling participation in the capital) of an accountable subject.

2. Accountable subjects apply internal control programs to perform the following tasks and obligations:

• implementation of measures to identify (detect), assess, manage, reduce and document risks;
• implementation of customer due diligence measures;
• timely identification and submission to the authorized body of reports on suspicious transactions and operations, as well as information on operations subject to mandatory control;
• ensuring the storage of data and documents on operations (transactions), as well as information obtained as a result of customer due diligence;
• proper fulfillment of obligations to identify and freeze the property (funds) of persons included in sanctions lists;
• application of measures regarding countries and territories with increased risk;
• ensuring the confidentiality of information;
• ensuring the performance of other tasks and obligations provided for by the legislation of the Republic of Tajikistan in the field of countering the legalization (money laundering) of proceeds from crime, terrorism financing and financing of proliferation of weapons of mass destruction.

3. In organizing internal control, accountable subjects develop and implement internal control measures (rules and procedures) in accordance with the Law and these Requirements. Internal control measures must include the following programs:

• risk assessment program, including assessment of risks associated with new products, services and technologies;
• customer due diligence and data retention program;
• transaction (operation) monitoring program, identification of suspicious transactions (operations) and operations subject to mandatory control;
• employee selection and verification procedures upon hiring;
• internal control service organization program;
• staff training and education program, improving their qualifications;
• internal control measures application program at the group level (in case the accountable subject is part of a financial group);
• internal or external independent audit program to check the system of internal control measures.

4. Accountable subjects develop and apply internal control measures based on a risk-based approach in accordance with the legislation of the Republic of Tajikistan in the field of countering the legalization (money laundering) of proceeds from crime, terrorism financing and financing of proliferation of weapons of mass destruction.

5. To increase the effectiveness of implementing internal control measures, accountable subjects are recommended to use automated information systems that meet the requirements of the accountable subject's internal control program (rules and procedures).

6. The internal control program of an accountable subject must comply with the legislation of the Republic of Tajikistan in the field of countering the legalization (money laundering) of proceeds from crime, terrorism financing and financing of proliferation of weapons of mass destruction, and these Requirements, and must be developed and applied taking into account the specifics of the activity, staff size, client base and risk level of the accountable subject. Accountable subjects are obliged to monitor the application of the internal control program and strengthen it if necessary.

7. Accountable subjects attracting agents to perform their functions and conduct certain operations are obliged to ensure their application of the requirements of internal control programs and exercise control over their implementation.

8. Accountable subjects, depending on their organizational and legal form, establish the following control structure and its functions:

1. the highest management body or other authorized management body:

• determines policy in the field of countering the legalization (money laundering) of proceeds from crime, terrorism financing and financing of proliferation of weapons of mass destruction;
• approves the internal control program and other internal legal acts in the field of countering the legalization (money laundering) of proceeds from crime, terrorism financing and financing of proliferation of weapons of mass destruction, and exercises control over their implementation;
• determines measures to ensure the effective operation of the internal control service;
• provides its consent to the appointment and dismissal of the responsible employee (compliance specialist) of the internal control service and the person replacing him;
• reviews the conclusion of internal or external independent audit on the results of checking the system of internal control measures in the field of countering the legalization (money laundering) of proceeds from crime, terrorism financing and financing of proliferation of weapons of mass destruction and reports of the internal control service;
• determines measures aimed at eliminating deficiencies in the field of countering the legalization (money laundering) of proceeds from crime, terrorism financing and financing of proliferation of weapons of mass destruction identified by internal or external independent audit or indicated in the report of the internal control service, and controls their implementation;

2. executive body carrying out management of current activities:

• ensures the implementation of policy, programs and other internal legal acts in the field of countering the legalization (money laundering) of proceeds from crime, terrorism financing and financing of proliferation of weapons of mass destruction approved by the highest management body;
• ensures and controls the implementation of the legislation of the Republic of Tajikistan in the field of countering the legalization (money laundering) of proceeds from crime, terrorism financing and financing of proliferation of weapons of mass destruction;
• appoints and dismisses the responsible employee (compliance specialist) of the internal control service and the person replacing him (hereinafter referred to as the responsible person) with the consent of the highest management body;
• determines employees or subdivisions (subdivisions) whose competence includes issues of countering the legalization (money laundering) of proceeds from crime, terrorism financing and financing of proliferation of weapons of mass destruction;
• ensures training, preparation, qualification improvement and retraining of its staff on issues of countering the legalization (money laundering) of proceeds from crime, terrorism financing and financing of proliferation of weapons of mass destruction;
• ensures the implementation of measures aimed at eliminating deficiencies in internal acts, procedures and the internal control system, and ensures the conduct of internal or external independent audit.

9. In case the highest governing body of the accountable subject consists of a sole executive body, such person performs the functions provided for in subparagraphs 1) and 2) of paragraph 8 of these Requirements.

10. REQUIREMENTS FOR THE RISK ASSESSMENT PROGRAM

11. Accountable subjects are obliged to identify (detect), assess, document and constantly update their risks regarding the following subjects and objects:

• their clients;
• countries or geographical regions from which their clients originate or in which they are located;
• countries or geographical regions in which the accountable subject carries out its activities;
• products, services, operations and delivery channels of the accountable subject.

11. When assessing risks, accountable subjects take into account the results of national and sectoral risk assessments, as well as other documents and recommendations adopted by the authorized and supervisory bodies.

12. Accountable subjects are obliged to review the risk assessment on a regular basis, as well as upon changes in the description (data) of the client, implementation of new products, services or technologies.

13. Upon establishing increased risk, accountable subjects apply enhanced measures for risk management and reduction, and upon establishing low risk, they apply simplified measures for risk management and reduction. The volume of applied measures must be commensurate with the level of identified risk.

14. The application of simplified measures for risk management and reduction is not permitted in the presence of suspicions of legalization (money laundering) of proceeds from crime, terrorism financing or financing of proliferation of weapons of mass destruction.

15. REQUIREMENTS FOR THE CUSTOMER DUE DILIGENCE AND DATA RETENTION PROGRAM

16. To implement the requirements of the Law on customer due diligence, the accountable subject develops a customer due diligence program (their representatives) and beneficial owners.

17. Customer due diligence is conducted in the manner established by the Law and Instruction No. 257 "On Customer Due Diligence" (hereinafter referred to as Instruction No. 257), approved by the Resolution of the Board of the National Bank of Tajikistan of August 2, 2023, No. 85, registered with the Ministry of Justice of the Republic of Tajikistan on September 8, 2023, No. 1254.

18. The customer due diligence program includes:

• the procedure for accepting clients for service, including the procedure and grounds for refusal to establish business relations and/or conduct an operation, as well as termination of business relations;
• the procedure for identification and verification of the identity of the client (his representative) and beneficial owner, including the specifics of applying simplified and enhanced customer due diligence procedures;
• a description of measures aimed at identifying public officials among clients and beneficial owners being served or accepted for service;
• the procedure for checking the client (his representative) and beneficial owner for inclusion in sanctions lists;
• the specifics of conducting customer due diligence remotely (without the personal presence of the client or his representative);
• the specifics of exchanging information obtained during customer due diligence (his representative) within the framework of fulfilling group-level requirements to counter the legalization (money laundering) of proceeds from crime, terrorism financing and financing of proliferation of weapons of mass destruction (in case the accountable subject is part of a financial group);
• the specifics of interaction with other accountable subjects and third parties to obtain from them information necessary for the identification of the client (his representative) and beneficial owner, in case they are attracted for the purpose of conducting customer due diligence measures;
• requirements for the form, content and procedure for maintaining the client's questionnaire (file), updating the information contained in the questionnaire (file), indicating the frequency of updating information;
• the procedure for assessing the client's risk level, grounds for assessing such risk.

18. Accountable subjects are obliged to classify their clients taking into account risk criteria (high, medium and low). Depending on the client's risk level, the degree of measures carried out by the accountable subject is expressed in the application of standard, simplified or enhanced customer due diligence measures in accordance with the Law and Instruction No. 257.

19. The following persons, cases and objects may be referred to high-risk categories:

• a physical or legal entity residing or registered (carrying out activities) in countries and territories with increased risk, the list of which is determined by the authorized body, as well as the connection of the client's business relationship or one-time transaction with countries and territories with increased risk;
• client – non-resident;
• trusts and other foreign legal entities, their managers and trustees;
• legal entities without real activity since their state registration (shell companies);
• nominal holders and nominal directors;
• the structure and management of a legal entity is unreasonably complicated;
• client intermediaries/representatives acting on behalf of the client without an obvious connection or reason;
• the client was previously involved in a business relationship or operation (transaction) that, from the point of view of countering the legalization (money laundering) of proceeds from crime, terrorism financing and financing of proliferation of weapons of mass destruction, is suspicious;
• public officials, their close relatives and other persons affiliated with them, as well as legal entities whose beneficial owners are such persons;
• clients on whose accounts there are frequent and unexplained movements of funds, including having a cross-border nature to various financial institutions;
• the client carries out an operation (transaction) that is not typical for the client and does not correspond to his description (data), goals and nature of the established business relationship with the client;
• bearer securities (including bearer checks) that circulate during the business relationship or are the subject of a one-time transaction;
• cases when there are suspicions regarding the accuracy and adequacy of previously obtained identification data, including regarding information about the beneficial owner and the truthfulness of data associated with it;
• cases when it becomes known that the establishment of a business relationship with the client or the conduct of a transaction with him was rejected by other accountable subjects;
• cases when the client carries out large cash turnovers, business relationship or one-time transaction with a large cash turnover;
• complex financial schemes without obvious economic meaning;
• business relationship or one-time transaction (transaction) through such an account or in such a manner, by means of which no operation (transaction) was made in the last six months;
• carrying out an operation with products representing a high degree of confidentiality (digital assets, electronic wallets).

20. Internal legal acts of the accountable subject provide for other categories and requirements for high risks.

21. The following persons, cases and objects are referred to low-risk categories:

• state bodies of the Republic of Tajikistan, as well as organizations (enterprises, institutions) established by the state;
• joint-stock companies, the shares of which are traded on the stock exchange, and to which disclosure requirements apply according to stock exchange rules or legislation and/or by means of mandatory measures for execution, in accordance with which they are obliged to ensure proper transparency of the beneficial owner;
• accountable subjects effectively fulfilling the requirements of the legislation of the Republic of Tajikistan in the field of countering the legalization (money laundering) of proceeds from crime, terrorism financing and financing of proliferation of weapons of mass destruction, and regarding which proper control is exercised;
• clients – physical persons, operations with which have a proven reduced risk.

22. During customer due diligence by the accountable subject, a check is conducted for the presence of the client (client representative), his beneficial owner and counterparty (if any) in sanctions lists, as well as in other lists formed by the authorized body. The check for the presence of the client (client representative), his beneficial owner and counterparty (if any) in the specified lists does not depend on the client's risk level and is carried out as changes (updates) are made to these lists.

23. Information obtained in accordance with paragraphs 17, 18 and 22 of these Requirements is entered by the accountable subject into the client's questionnaire (file), which is stored (in paper or electronic form) throughout the entire period of business relations with the client and for at least five years after their termination.

24. The frequency of updating and/or the need to obtain additional information about the client (his representative) and beneficial owner is established taking into account the client's risk level and/or the degree of exposure to risks of the products and services of the accountable subject used by the client.

25. REQUIREMENTS FOR THE TRANSACTION (OPERATION) MONITORING PROGRAM, IDENTIFICATION OF SUSPICIOUS TRANSACTIONS (OPERATIONS) AND OPERATIONS SUBJECT TO MANDATORY CONTROL

26. Accountable subjects develop a program for monitoring and studying client operations and transactions in order to implement the requirements of the Law on identifying and sending reports to the authorized body about suspicious transactions and operations, as well as operations subject to mandatory control.

27. The program for monitoring and studying client operations includes:

• a list of signs of suspicious transactions and operations, compiled based on the register of signs of suspicious transactions and operations approved by the authorized body in accordance with part 4 of Article 18 of the Law, as well as those developed independently by the accountable subject;
• distribution of responsibilities between subdivisions (employees) of the accountable subject for updating previously obtained and/or obtaining additional information about the client (his representative) and beneficial owner in cases provided for by these Requirements;
• the procedure for identifying suspicious transactions (operations) and operations subject to mandatory control by subdivisions (employees) of the accountable subject, transferring information about them to the responsible person and/or internal control service;
• the procedure, grounds and deadline for the responsible person and employee of the internal control service to make a decision on recognizing the operation (transaction) as suspicious and sending reports to the authorized body;
• the procedure for recording (including methods of recording) and storing data on the results of studying and primary analysis of suspicious transactions and operations;
• the procedure for interaction between subdivisions (employees) of the accountable subject to identify clients and beneficial owners included in sanctions lists, as well as in other lists formed by the authorized body, as well as for the immediate freezing or temporary suspension of operations and transactions with funds and other property;
• the procedure for identifying by the responsible person and internal control service of the accountable subject operations subject to mandatory control and sending information about them to the authorized body;
• the procedure for conducting monitoring and studying of operations of high-risk clients.

27. Upon identification of suspicious transactions and operations, as well as operations subject to mandatory control, subdivisions (employees) of the accountable subject send reports about this to the internal control service or the responsible person in the manner, form and deadlines established by the internal documents of the accountable subject. One report contains information about several operations and transactions.

28. The degree of monitoring and study of client operations and transactions is determined by the accountable subject taking into account the client's risk level (group of clients) and/or the degree of exposure to risks of the services (products) of the accountable subject used by the client, as well as possible scenarios (schemes) of legalization (money laundering) of proceeds from crime,

12 by means, terrorism financing and financing of proliferation of weapons of mass destruction. 29. Accountable subjects study and analyze operations conducted by the client over a certain period of time in the event of assigning a high risk level to the client, as well as in the event of the client committing a suspicious operation.

5. REQUIREMENTS FOR PROCEDURES FOR SELECTION AND VERIFICATION OF EMPLOYEES UPON EMPLOYMENT (HIRING)

6. Accountable subjects, when hiring employees, require and verify their personal documents in accordance with Article 26 of the Labor Code of the Republic of Tajikistan.

7. Accountable subjects carry out verification of a person entering employment against sanctions lists, other lists formed by the authorized body, as well as for the presence or absence of a criminal record, by requesting a certificate of no criminal record.

8. REQUIREMENTS FOR THE ORGANIZATION OF AN INTERNAL CONTROL SERVICE

9. An internal control service is created or designated in the Accountable subject, taking into account the features of its activities, staff size, client base, and risk level of the accountable subject.

10. In the event that the staff size of the accountable subject consists of up to twenty people, the accountable subject has the right not to create an internal control service, but to appoint a person (compliance specialist) responsible for the implementation and compliance with the rules and programs of internal control, and a person replacing him (responsible person) from among the employees.

11. The structure of the internal control service is determined by the decision of the management of the accountable subject and must be reviewed taking into account the risk assessment and in accordance with the instruction (directive) of the relevant supervisory authority.

12. The functions of the responsible person and the internal control service must be independent from the operational activities of the accountable subject and must not be subordinate to subdivisions carrying out operational activities, except for cases provided for in paragraph 33 of these Requirements.

13 36. The head (including temporary) of the internal control service or the appointed responsible person during the period of performing functions in this position must meet high professional and ethical standards, have an impeccable business reputation, as well as have at least three years of work experience in the financial sector, in the field of compliance, internal control, audit or risk management, or another field of activity of the accountable subject. 37. The head of the internal control service is appointed to the position and dismissed from the position by the decision of the head of the accountable subject in agreement with the highest management body. The head of the internal control service, depending on the organizational and legal form of the accountable subject, must be directly accountable to the highest management body (supervisory board) and/or the highest executive body (chairman of the board) or the director (if there is a sole executive body) of the accountable subject. Employees of the internal control service are directly subordinate to the head of the internal control service. 38. The accountable subject is obliged to notify the authorized body and the supervisory body in writing of the appointment of the responsible person and the person replacing him no later than two working days from the date of appointment. The authorized body provides access to the reporting system of the authorized body to the responsible person and the person replacing him. 39. When hiring into the internal control service, in addition to paragraph 26 of these Requirements, the following qualification requirements are imposed on candidates:

• higher education;
• impeccable business reputation;
• knowledge of the legislation of the Republic of Tajikistan in the field of counteraction to the legalization (money laundering) of proceeds obtained by criminal means, terrorism financing and financing of the proliferation of weapons of mass destruction, as well as the rules of internal control of the accountable subject;
• knowledge of risks characteristic of the activities of the accountable subject.

40. Accountable subjects must ensure the continuity of activities, independence, impartiality and professional competence of the internal control service, as well as create conditions for the effective performance of its functions.

14 41. The internal control service ensures control over the compliance of conducted operations (transactions) with the requirements of the legislation of the Republic of Tajikistan in the field of counteraction to the legalization (money laundering) of proceeds obtained by criminal means, terrorism financing and financing of the proliferation of weapons of mass destruction. 42. The internal control service must perform the following functions:

• development and submission to the highest management body of the accountable subject of draft programs of internal control and other internal documents in the field of counteraction to the legalization (money laundering) of proceeds obtained by criminal means, terrorism financing and financing of the proliferation of weapons of mass destruction;
• monitoring the implementation and compliance with internal control programs;
• monitoring and analysis of client operations (transactions);
• making decisions on recognizing an operation (transaction) as suspicious, suspending or refusing to conduct operations (transactions) of clients and sending a report on a suspicious operation (transaction) to the authorized body;
• making decisions on establishing, continuing or terminating business relations with clients;
• organization and control of the submission to the authorized body of reports on operations subject to mandatory control in accordance with the legislation of the Republic of Tajikistan in the field of counteraction to the legalization (money laundering) of proceeds obtained by criminal means, terrorism financing and financing of the proliferation of weapons of mass destruction;
• assistance to the authorized body and supervisory bodies in performing tasks provided for by the legislation of the Republic of Tajikistan in the field of counteraction to the legalization (money laundering) of proceeds obtained by criminal means, terrorism financing and financing of the proliferation of weapons of mass destruction, including providing them with information and documents upon request;
• assistance to authorized representatives of supervisory bodies in conducting inspections of the activities of the accountable subject regarding compliance with the legislation of the Republic of Tajikistan in the field of counteraction to the legalization (money laundering) of proceeds obtained by criminal means, terrorism financing and financing of the proliferation of weapons of mass destruction;
• informing the head of the accountable subject about identified violations of the rules and programs of internal control;
• taking measures to improve the risk management system and internal control;
• taking measures to ensure the confidentiality of information obtained when implementing measures to counteract the legalization (money laundering) of proceeds obtained by criminal means, terrorism financing and financing of the proliferation of weapons of mass destruction;
• submission to the highest management body of the accountable subject of a written report on the results of the implementation of internal control programs.

43. The internal control service must have the following rights:

• obtain access to all premises of the accountable subject, information systems, telecommunications facilities, documents and files, within the limits allowing it to perform its functions in full, and in the manner provided for by the internal documents of the accountable subject;
• give instructions to subdivisions of the accountable subject regarding the conduct of an operation (transaction), including suspending operations (transactions);
• ensure the confidentiality of information obtained in the course of performing its functions;
• ensure the preservation of documents and files received from subdivisions of the accountable subject;
• perform other actions in accordance with the internal documents of the accountable subject.

44. Employees of the internal control service and responsible persons, including temporary ones, are obliged to:

• ensure the preservation and return of documents received from the accountable subject;
• observe the confidentiality of information obtained in the course of performing their functions and not disclose the transfer of information to the authorized body.

15 45. Employees of the accountable subject must assist the internal control service in performing its functions in accordance with these Requirements and the internal documents of the accountable subject. 46. Employees of the accountable subject who become aware of a violation of the legislation of the Republic of Tajikistan in the field of counteraction to the legalization (money laundering) of proceeds obtained by criminal means, terrorism financing and financing of the proliferation of weapons of mass destruction in the accountable subject are obliged to immediately report this to their supervisor and the internal control service.

7. REQUIREMENTS FOR THE TRAINING AND STAFF PREPARATION PROGRAM, THEIR QUALIFICATION IMPROVEMENT
8. Accountable subjects develop a training and staff preparation program, their qualification improvement in the field of counteraction to the legalization (money laundering) of proceeds obtained by criminal means, terrorism financing and financing of the proliferation of weapons of mass destruction (hereinafter – training program) taking into account the requirements of legislation in the relevant field, as well as the features of activities of accountable subjects and their clients.
9. The training program should be aimed at achieving the following goals:

• ensuring the formation of knowledge and skills in employees necessary for them to comply with the requirements of normative legal acts;
• increasing their level of professional training;
• identification and prevention of operations related to the legalization (money laundering) of proceeds obtained by criminal means, terrorism financing and financing of the proliferation of weapons of mass destruction, as well as minimizing corresponding risks and ensuring the effective functioning of the internal control system.

49. The training and staff preparation program must include:

• employee training procedures, including the topic of training, methods, timing of conduct and the subdivision responsible for conducting training;
• a list of subdivisions whose employees undergo training;
• procedure for conducting and storing training results;

16

• procedure and forms of checking employees' knowledge on issues of counteraction to the legalization (money laundering) of proceeds obtained by criminal means, terrorism financing and financing of the proliferation of weapons of mass destruction.

50. Training, preparation and qualification improvement of employees of the accountable subject is carried out in accordance with the training plan developed by the accountable subject. The accountable subject is obliged to ensure that the employee undergoes training no less than once every two years. Training, preparation and qualification improvement of staff are conducted in the forms of conducting seminars, round tables, other training events, as well as periodic exams and tests, including remotely, and contain:

• study of normative legal acts of the Republic of Tajikistan in the field of counteraction to the legalization (money laundering) of proceeds obtained by criminal means, terrorism financing and financing of the proliferation of weapons of mass destruction;
• study of international standards in the field of counteraction to the legalization (money laundering) of proceeds obtained by criminal means, terrorism financing and financing of the proliferation of weapons of mass destruction;
• study of rules, procedures and programs of internal control of the accountable subject, other internal documents on issues of counteraction to the legalization (money laundering) of proceeds obtained by criminal means, terrorism financing and financing of the proliferation of weapons of mass destruction;
• study of typologies, schemes and methods of legalization (money laundering) of proceeds obtained by criminal means, terrorism financing and financing of the proliferation of weapons of mass destruction, as well as signs of suspicious operations and transactions;
• other issues in the field of counteraction to the legalization (money laundering) of proceeds obtained by criminal means, terrorism financing and financing of the proliferation of weapons of mass destruction.

51. Unscheduled training is conducted by the accountable subject in the following cases:

• upon entry into force of new or amendments and additions to existing normative legal acts of the Republic of Tajikistan in the field of counteraction to the legalization (money laundering) of proceeds obtained by criminal means, terrorism financing and financing of the proliferation of weapons of mass destruction;
• upon approval of new or amendments and additions to existing rules and procedures of internal control of the accountable subject;
• upon hiring a new employee, his transfer to another permanent job in the accountable subject, including the appointment of a responsible person and the person replacing him, in the event that their knowledge and skills in the field of counteraction to the legalization (money laundering) of proceeds obtained by criminal means, terrorism financing and financing of the proliferation of weapons of mass destruction are insufficient for the performance of duties assigned to them.

52. Accountable subjects keep a record of employees' training and store it for at least 5 years.

53. REQUIREMENTS FOR THE PROGRAM FOR APPLYING INTERNAL CONTROL MEASURES AT THE GROUP LEVEL

54. Accountable subjects ensure the development and implementation of group (corporate) internal control programs by their branches and representative offices, as well as subsidiary and affiliated enterprises (societies) operating on the territory of the Republic of Tajikistan and a foreign state.

17 54. In the event that the legislation of the country where the branches, subsidiaries or affiliated enterprises (societies) are located does not allow the application of group (corporate) internal control programs and the requirements of the legislation of the Republic of Tajikistan in the field of counteraction to the legalization (money laundering) of proceeds obtained by criminal means, terrorism financing and financing of the proliferation of weapons of mass destruction, branches and representative offices, as well as subsidiary and affiliated enterprises (societies) of the accountable subject apply necessary measures for risk management and report this to the relevant supervisory authority of the Republic of Tajikistan. 55. For proper client verification and risk management within the framework of group (corporate) programs, information exchange is ensured about clients, beneficial owners, accounts, operations (transactions), including reports on suspicious operations (transactions), about risks and typologies between the main company, branches, representative offices, subsidiaries and affiliated enterprises (societies) of the accountable subject. 56. Within the framework of group (corporate) programs, independent audit and control at the level of the financial group are carried out regarding the implementation of the requirements of internal control programs, and measures are applied to reduce identified risks. 57. Accountable subjects that are a financial group, having their own branches and representative offices, as well as subsidiary and affiliated enterprises (societies), develop and apply group (corporate) internal control programs at all levels of the group, including internal procedures for exchanging any information within the financial group, ensuring the transfer, storage and protection of confidential information from unauthorized access, destruction, alteration, use or disclosure.

9. REQUIREMENTS FOR THE PROGRAM FOR CONDUCTING INTERNAL OR EXTERNAL INDEPENDENT AUDIT TO CHECK THE SYSTEM OF INTERNAL CONTROL MEASURES
10. Accountable subjects must conduct an internal or external independent audit on a regular basis, but no less than once a year, which includes the following:

• assessment of the effectiveness of internal measures, procedures and the internal control system of the accountable subject regarding counteraction to the legalization (money laundering) of proceeds obtained by criminal means, terrorism financing and financing of the proliferation of weapons of mass destruction;
• assessment of risk assessment measures applied;
• assessment of software used to control operations and transactions and to identify suspicious operations and transactions, as well as operations subject to mandatory control;
• selective testing of the activities of the internal control service, including the software used;
• verification of the compliance of reports of the internal control service and employee training programs of the accountable subject;
• assessment of measures applied by the management of the accountable subject to eliminate shortcomings and violations of the legislation of the Republic of Tajikistan in the field of counteraction to the legalization (money laundering) of proceeds obtained by criminal means, terrorism financing and financing of the proliferation of weapons of mass destruction.

18 59. The audit is conducted by internal auditors or a person/subdivision responsible for the audit of the accountable subject, and in their absence - by external auditors (individual auditor) and/or audit organizations. 60. For the purpose of conducting a qualitative and comprehensive independent audit, the auditor conducts consultations with the internal control service to obtain information about internal measures, procedures and control systems in the field of counteraction to the legalization (money laundering) of proceeds obtained by criminal means, terrorism financing and financing of the proliferation of weapons of mass destruction, as well as existing problems. The auditor must have access to all materials and reports of the accountable subject. 61. As a result of the conducted independent audit, the auditor presents an audit opinion (report) in the established form, which includes the following information:

• risks of legalization (money laundering) of proceeds obtained by criminal means, terrorism financing and financing of the proliferation of weapons of mass destruction;
• cases of violation of internal control programs and other internal documents of the accountable subject in the field of counteraction to the legalization (money laundering) of proceeds obtained by criminal means, terrorism financing and financing of the proliferation of weapons of mass destruction;
• cases of violation of the legislation of the Republic of Tajikistan in the field of counteraction to the legalization (money laundering) of proceeds obtained by criminal means, terrorism financing and financing of the proliferation of weapons of mass destruction;
• recommended measures necessary to eliminate and prevent identified violations and shortcomings.

62. Accountable subjects do not conduct internal or external independent audit in the following cases:

• the accountable subject consists of one person (is an individual entrepreneur);
• the number of clients of the accountable subject served during the year is no more than 50 physical and legal persons.

19 10. FINAL PROVISIONS 63. Supervisory bodies exercise control over the compliance of these Requirements by accountable subjects.