Central Bank of Sudan

Guidance Manual for Microfinance Companies and Institutions on Combating Money Laundering and Terrorist Financing

June 2022

First: Introduction:

Within the framework of the Central Bank of Sudan's efforts to combat money laundering and terrorist financing, and further to the Circular of Regulatory and Supervisory Controls for Combating Money Laundering and Terrorist Financing 8/2014, it has been decided to issue these guidelines to assist microfinance companies/institutions in applying the obligations related to combating money laundering and terrorist financing issued by the Central Bank of Sudan regarding combating the crimes of money laundering and terrorist financing, and to assist in developing internal policies, procedures and controls for combating money laundering and terrorist financing, which must be adopted by boards of directors, which contributes to ensuring compliance with legal obligations that are consistent with international standards (the recommendations of the Financial Action Task Force), which would preserve the integrity and reputation of the banking system.

Second: Interpretations:

Money laundering concept:

The goal of most criminal acts is to achieve profit for the individual or group carrying out these acts, and to achieve this goal, money laundering works to conceal the illegal origin of criminal proceeds. This process is of great importance to the person because it enables him to enjoy these profits without exposing the source to detection. Usually, when criminal activity generates substantial profits, criminals try to find a way to control the funds without drawing attention to the underlying activity or to persons connected with the crime. Criminals do this by concealing the sources of the funds, changing the form, or transferring the funds to a place that reduces the possibility of attracting attention to them.

Terrorist financing concept:

We can explain the concept of terrorist financing as the process of providing funds to commit a terrorist crime or for the benefit of a terrorist entity in any form. This is consistent with the law's definition of the perpetrator of the crime of terrorist financing as: any person who intentionally, or encourages by any means, directly or indirectly, provides funds from a legitimate or illegitimate source, or collects them with the intention of using them, or with knowledge that they will be used in whole or in part to commit a terrorist act, or by a terrorist organization or a terrorist person.

The various methods used in money laundering are essentially consistent with those methods and techniques used to conceal the source of terrorist financing. We find that the funds used to support terrorism may originate from legitimate sources, criminal activities, or both. However, disguising the source of terrorist financing is important regardless of whether its source is legitimate or illegitimate. It is important for terrorists to conceal the uses of the funds so that the financing activity remains undiscovered.

Money laundering and Terrorist financing Risks:

It is of great importance in combating crime to prevent criminals from legitimizing the proceeds of their criminal activities by converting funds from "dirty money" into "clean money." The ability of criminals to launder the proceeds of criminal activity through the financial system is an important element for the success of their schemes and for benefiting from the proceeds of their activities. If criminals succeed in using financial systems for this purpose, this has the capacity to harm the financial institutions that are exploited for this purpose, and ultimately the entire financial sector.

The increasing integration of financial systems in the world, the freedom of movement of capital, and the expansion of electronic banking services have enhanced the ease of money laundering and terrorist financing operations and increased the complexity of tracking these operations. Given that the long-term success of any of the financial sectors in the world depends on its ability to attract and retain funds obtained legitimately, funds acquired illegitimately or directed to terrorism may harm the reputation and integrity of banking systems and may also affect the ability of financial institutions to attract clean funds. It can also expose an institution that may become involved in these operations, or that does not combat them effectively, to legal risks and operational risks that may harm the institution and its long-term continuity.

Money laundering Stages:

1- Placement stage:

Placement includes the process of introducing funds generated from an illegal source into the financial system, and this is achieved through cash deposits, depositing checks, or purchasing financial assets.

2- Layering stage:

It usually consists of a set of operations aimed at concealing the source of the illegal funds, through converting, exchanging, or transferring the funds under the appearance of carrying out a legitimate activity such as commercial investment.

3- Integration stage:

It usually includes reintroducing the funds into the legitimate economic system, and this is done through several means that may include purchasing assets, shares, or precious goods, and investments in real estate and projects.

The most important international frameworks in the field of combating money laundering and terrorist financing

(International frameworks in (AML/CFT) :

1) FATF Financial Action Task Force recommendations:

The Financial Action Task Force is an intergovernmental body established in 1989. It aims to set standards and promote the effective implementation of legal, regulatory and operational measures to combat money laundering and terrorist financing, by issuing a series of recommendations known as the international standards for combating money laundering, terrorist financing and the proliferation of weapons of mass destruction. They were first issued in 1990. The Financial Action Task Force recommendations were amended in 1996, 2001 and 2003, the last of which was in 2012. The recommendations are also subject to continuous revision. The group meets three times during the year.

2) United Nations Convention against Illicit Traffic in Narcotic Drugs and Psychotropic Substances 1988:

The Convention was signed on 20/12/1988 in Vienna. It focused on further cooperation among states to tighten the means of confrontation, and to resist the production and smuggling of drugs and psychotropic substances. It also addresses many aspects that define the paths and methods of international combating, especially newly emerging ones such as: confiscation of revenues obtained from drug crimes, extradition of criminals, and others.

3) United Nations Convention for the Suppression of the Financing of Terrorism 1999:

The International Convention for the Suppression of the Financing of Terrorism is a United Nations treaty aimed at criminalizing acts of financing terrorism. It was approved in 1999. The Convention also seeks to enhance the role of police and judicial cooperation to prevent the financing of such acts. As of August 2013, the treaty has been ratified by 186 states.

4) United Nations Convention against Transnational Organized Crime 2000:

It is a treaty adopted by a resolution of the United Nations General Assembly on 15 November 2000 and is called (the Palermo Convention). The primary purpose of the Convention is to promote international cooperation in the field of preventing and combating transnational organized crime more effectively.

5) United Nations Convention against Corruption 2003:

The United Nations Convention against Corruption was adopted on 31/10/2003, and entered into force on 14/12/2005. Its primary purpose is to combat corruption in both its financial and administrative aspects, which affects developed and developing countries alike, and results in severe damage to public funds, which is reflected negatively on the economic development rates of countries.

6) UN Security Council Resolutions:

Resolution No. 1267/1999 and related resolutions:

States should apply targeted financial sanctions regimes in accordance with UN Security Council resolutions related to preventing and suppressing terrorism and its financing. These resolutions obligate states to freeze without delay the funds of any person or entity or their other assets, and to ensure that no funds or other assets are made available, directly or indirectly, to any person or entity or for their benefit, whether that person or entity is:

a. Designated under Chapter VII of the UN Charter by the Security Council.

b. Designated by this state under Resolution 1373 (its authority, including in accordance with Resolution 1267 (2001)).

The most important national frameworks in the field of combating money laundering and terrorism financing National frameworks in (AML/CFT):

1) Anti-Money Laundering and Terrorism Financing Act of 2014:

The Anti-Money Laundering and Terrorism Financing Act of 2014 specifies the duties of each entity with regard to combating, and specifies the supervisory and regulatory authorities for the financial and non-financial sectors. According to the law, the supervisory and regulatory authorities issue regulations and circulars for the entities under their supervision.

2) Central Bank of Sudan circulars:

The Central Bank of Sudan paid attention to the issue of combating money laundering and terrorism financing early on, since the beginning of the twenty-first century, as the Central Bank issued the first circular on combating money laundering and terrorism financing in 2002, which is Circular No. (2/2002), under which banks operating in Sudan and their branches abroad were obligated to comply with anti-money laundering and terrorism financing controls. In response to global developments in this field, the aforementioned circular was cancelled and Circular No. (9/2007) on combating money laundering and terrorism financing crimes was issued, which was reviewed after the issuance of the Anti-Money Laundering and Terrorism Financing Act at the beginning of 2010, and Circular No. (10/2010) was issued to keep pace with the law.

After the update of the recommendations of the Financial Action Task Force (FATF) in 2012, the regulatory controls were reviewed and Circular No. (2/2014) was issued in March of that year, and then the circular was updated with No. 8/2014, as the circular met all the updated standards issued by the Financial Action Task Force in accordance with the new methodology.

Third: Application of the risk-based approach:

1. The risk-based approach is the process of understanding, identifying, assessing and monitoring the money laundering and terrorism financing risks to which the institution is exposed on a periodic basis, while implementing and establishing internal policies and procedures consistent with the risk results, and sending the risk assessment after each update, at least annually, to the Central Bank of Sudan.

2. The objective of adopting the risk-based approach is to identify the risks facing financial institutions and then manage them more effectively, by distributing available resources, organizing structures and establishing internal controls according to the priorities of the risks to which they are exposed, and in accordance with the level of those risks. To achieve this, institutions apply (enhanced, medium, or simplified) measures commensurate with the degree of risk identified in the assessment process, which constitutes the basis for the risk-based approach.

3. The company/institution must take into consideration all types of risks, including: the results of the national risk assessment, patterns and typologies reports issued by the financial intelligence unit, the size of

the company/institution (number of branches and subsidiary companies/institutions), the nature, size and diversity of the company's/institution's products and services and its customer base, including the number of customers identified as high-risk customers, in addition to the markets in which it operates, the channels for providing services and products, and any supervisory observations or those issued by the internal audit department of the company/institution that could affect the risk assessment, as well as sanctions lists issued locally or by the United Nations or by other countries, and electronic databases that provide such information to identify the extent to which customers are listed on negative lists, and this assessment must be appropriately documented, retained and shared with relevant employees.

4. When identifying and assessing money laundering and terrorism financing risks and establishing a system for managing and monitoring them, the company/institution must take into account the following risk categories:

Risks related to customers.

Risks related to specific geographic areas.

Risks related to products and services.

Risks of channels for providing services and products.

a- Customer risk factors

Customer-specific risk factors include risks related to identifying the identity of the customer or the beneficial owner (the real beneficiary) or their transactions or activities. All transactions that meet the characteristics listed below are classified as "high risk". If the institution wishes to adopt a different classification, it must explain in the risk assessment the rationale for the different classification with regard to the specificity of its business model:

1. Difficulties in identifying the beneficial owner due to the complexity of the ownership structure of legal persons.

2. Non-resident customers.

3. Customers for whom the institution has negative information about their reputation or previous dealings (for example, through the media or other open information sources).

4. Politically exposed persons and their close associates and family members.

5. Customers who do not deal face-to-face with the institution.

6. Stakeholders who control the legal person without controlling its ownership.

b- Geographic risk factors:

Given the specificity of the work of microfinance institutions of a local nature, their geographic risks are represented in:

Risks related to the customer's place of residence or the nature of their work or the source or destination of their transactions, taking into account the results of the national risk assessment.

c- Risks related to products and services:

They include risks associated with the characteristics of products and services that can be exploited for money laundering or terrorism financing, such as products and services that do not allow direct dealing with the company, such as cooperative associations.

5. Simplified due diligence measures may be applied, in line with the results of the study prepared for the risk assessment.

6. When determining the bases for risk assessment under paragraph (3) above, companies/institutions must adopt the following risk variables:-

a) Assessing risk factors, including:

1. The purpose of establishing the business relationship.

2. The volume of transactions carried out by the customer.

3. The frequency of transactions or the duration of the business relationship.

b) Obtaining additional information about the customer and the real beneficiary of the transaction.

c) Establishing a risk pattern for classifying customers and transactions based on sufficient information about the customer, the expected business relationship with the company/institution, and the source of their funds and assets when necessary.

d) Applying enhanced or simplified due diligence measures according to the customer risk classification.

e) Any other measures that the company/institution deems necessary.

7. The company/institution must retain risk assessment records so that they serve as a reference for it and so that it can clarify the methodology applied when requested by the Central Bank of Sudan.

8. The company/institution must document both the risk assessment and the information related to it and any updates made thereto, and keep them for a period of no less than five years.

9. The company/institution must provide an appropriate mechanism for submitting information related to the risk assessment to the competent authorities.

10. The board of directors of the company/institution or the regional managers of branches of foreign companies/institutions must approve the risk assessment of the company/institution.

11. The company/institution must update the risk assessment annually or when the circumstances on which the assessment process was based change or when a new risk to which the company/institution is exposed appears.

12. To apply risk mitigation measures, the company/institution must develop and implement policies, procedures and internal control systems under the supervision of the executive management and approved by the board of directors of the company/institution, consistent with the results of the risk assessment.

Fourth: Customer Due Diligence:

1. The company/institution must exercise due diligence towards customers, which includes the following procedures:

Identifying and verifying the identity of the customer using original documents and reliable data or information from independent sources. According to each category.

Obtaining documents proving the identity of any person dealing with the company/institution on behalf of the customer, including obtaining documents confirming the validity of his authorization to act on his behalf.

Comparing the customer's name with persons and entities listed on the prohibition lists issued pursuant to United Nations Security Council resolutions or the prohibition lists issued by the Central Bank of Sudan.

Identifying the beneficial owner and taking reasonable measures to verify their identity.

Understanding the ownership and control structure of the customer who is a legal person or legal entity.

Understanding the intended purpose of the business relationship and its intended nature and obtaining information related to the nature of that relationship.

Maintaining a customer file that includes all data and information related to him and documenting it with documents, at a minimum as follows:

    1. Complete data on the customer's identity.

    2. The customer's dealings with other institutions, if any.

    3. References that can be referred to for additional information about the customer when needed.

    4. Reviewing the credit report on the customer at the inquiry agency and the credit classification.

    5. The purpose of the financing.

    6. The nature of the customer's activities.

    7. Knowing the sources of income and wealth.

8. Exercising ongoing due diligence regarding business relationships by using technical systems that monitor the relationship with the customer to identify the pattern of his dealings and detect any transactions inconsistent with this pattern or with what the company/institution knows about its customer, his activity and his risk profile.

t. Updating the information, data and documents collected within the framework of due diligence procedures periodically in accordance with the risk assessment.

2. The company/institution must determine the extent of application of due diligence procedures based on the risk-based approach.

3. The company/institution must take customer due diligence measures before establishing a business relationship with the customer.

4. It is prohibited to deal with new customers without their personal attendance at the company, including applications submitted via mail, the internet and telephone, except what is done by a legal agency in which authorization is stipulated to carry out all procedures for granting financing and receiving amounts, provided that it includes all personal information of the customer and the beneficial owner.

5. It is permitted not to complete due diligence procedures in cases where there is suspicion of money laundering or terrorist financing at the company/institution, and it believes for logical reasons that carrying out due diligence procedures will alert the customer, and in this case a suspicious transaction report must be submitted to the Financial Information Unit immediately.

6. The company/institution must, in the event that the customer due diligence procedures mentioned above are not fulfilled, do the following:

Not entering into any business relationship with the customer or executing any operations for his account.

Terminating the new or existing business relationship.

Considering submitting a notification to the Financial Information Unit thereof while retaining statistics.

Fifth: Identification and Verification Procedures:

1. The company/institution must rely on identification documents to identify the customer, while ensuring their validity and retaining a copy certified by the competent employee indicating that it is a true copy of the official document.

2. Identification and verification procedures for natural persons:

a. The identity of the natural person must be verified by relying on personal identification documents that contain the national number alongside other documents required when dealing with customers. Identity identification data must also include the customer's full name, nationality, date of birth, permanent residence address, phone numbers, work address, type of activity, purpose of dealing, names of authorized persons to deal and their data, and any other information that the company/institution deems necessary to obtain.

b. The company/institution must review the legal power of attorney and retain a certified copy thereof in the event that another person deals with the company/institution on behalf of the customer. The company/institution must also identify and verify the identity of this person in accordance with the identification procedures.

t. The company/institution must take the necessary measures to verify the validity of the data and information obtained from the customer.

3. Identification and verification procedures for legal persons:

a. The company/institution must identify the legal person, and the data must include the name of the legal person, legal form, address of headquarters, type of activity, capital, names of owners and their addresses and ownership shares, names of persons occupying executive management positions at the legal person or the three officers of associations and verification of their identity in accordance with identification procedures, names of authorized persons and their nationalities, phone numbers, purpose of dealing, and any other information that the company/institution deems necessary to obtain.

b. The company/institution must verify the identity of the legal person and obtain official documents proving its existence (registration certificate, or any other documents).

t. A copy of the documents indicating the existence of an authorization from the legal person to a specific person for the purpose of representing it or authorizing natural persons must be obtained, provided that verification of the identity of the authorized persons to deal is included in accordance with the identification procedures stipulated in this guide.

th. The company/institution must obtain a statement of the names and addresses of shareholders whose ownership shares exceed 10% of the capital of the legal person.

4. Identification and verification procedures for legal entities:

a. The company/institution must identify the legal entity, and it must include the name and address of headquarters, if any, the purpose of the entity, the name of the founder, the recommender, the beneficiaries and any other person exercising ultimate control over the legal entity, phone numbers, purpose of dealing, and any other information that the company/institution deems necessary to obtain.

b. The company/institution must obtain a copy of the documents indicating the existence of an authorization from the legal entity to a specific person for the purpose of representing it or authorizing natural persons, and verify the identity of the authorized persons to act in accordance with the identification procedures stipulated in this guide.

5. Identifying the identity of the beneficial owner

a. The company/institution must ask every client at the start of the relationship to sign a written declaration disclosing information that clarifies the beneficial owner of the business relationship, leading to verification of their identity and taking any other measures to determine the identity of the beneficial owner.

b. The identity of the beneficial owners of legal persons and legal entities shall be determined as follows:

The identity of every natural person responsible for managing the legal person must be determined, in addition to determining every natural person who owns or controls, directly or indirectly, more than 10% of the capital of the legal person. If it is not possible to ascertain that this person is actually the beneficial owner, or there is no natural person exercising control through ownership, then the identity of every natural person exercising control by other means must be determined. The company/institution is not required to determine the identity of shareholders or beneficial owners or verify their identity in the case of legal persons listed on the Khartoum Stock Exchange. This procedure does not exempt the company/institution from obtaining copies of the documents required to determine the identity of the legal person.

Sixth: Enhanced Due Diligence:

1. These measures must be carried out in cases where the company/institution has doubts about the accuracy or adequacy of the data previously obtained regarding the identification of clients, or whenever there is a suspicion of money laundering or terrorist financing.

2. The company/institution must investigate the background of complex, unusual, or transactions that have no clear economic or legal justification. When the risks of money laundering or terrorist financing are high, enhanced due diligence measures proportionate to the risks must be applied. The company/institution must increase the nature and level of monitoring of these business relationships to determine whether these transactions or activities are suspicious. Special records of these operations must be kept regardless of the decision taken regarding them and made available to the competent authorities.

3. In addition to normal due diligence measures, the company/institution must take enhanced due diligence measures towards high-risk business relationships through:

Requesting authentication of the documents provided by the client when establishing a business relationship.

Requesting additional documents to verify their identity or contact information, their wealth, the source of funds, and other elements.

Obtaining a recommendation from an independent third party to determine the identity of the client.

Conducting enhanced and ongoing monitoring of the business relationship to verify whether transactions appear unusual or suspicious.

4. The company's/institution's policies must include effective procedures regarding business relationships that are not conducted in the presence of the client, such that they are stringent in determining and verifying their identity.

Seventh: Other controls for establishing business relationships:

1. The company/institution is prohibited from dealing or entering into a business relationship with anonymous persons or those with pseudonyms, or with fictitious banks or companies/institutions.

2. No operation shall be executed for clients listed on local and international prohibition lists. If it is found that the client is on these lists, the Financial Information Unit must be notified immediately.

3. Approval of the branch manager or their delegate must be obtained when entering into a business relationship with any high-risk client.

4. No employee in any company/institution may manage any transactions on behalf of any client.

Eighth: Cases requiring special measures:

The company/institution must take special measures when dealing with the following cases:

Politically Exposed Persons:

1. The company/institution must establish an appropriate risk management system that determines whether the client or beneficial owner is a politically exposed person.

2. If the client or beneficial owner is a politically exposed person, whether Sudanese holding/has held a prominent position in Sudan or an international organization, or a foreigner who has held/holds a public position in a foreign country, the company/institution must:

Obtain approval of the executive management of the company/institution before establishing or continuing a business relationship with this person.

Take appropriate measures to determine the source of wealth and funds of the client.

c- Conduct ongoing enhanced monitoring of the business relationship to confirm whether transactions appear unusual or suspicious.

3. The same special procedures for politically exposed persons apply to close associates and family members.

4. New technologies:

The company/institution must identify, assess, and take appropriate measures to manage and mitigate the risks of money laundering and terrorist financing that may arise from the development of new products and professional practices as follows:

a. Development of new products and new business practices, including new delivery mechanisms for services.

b. Use of new or developing technologies for both new and pre-existing products.

c. When providing mobile payment services, the institution must, for example: ensure they obtain the information for transfers stipulated in this guide when using this service for money transfers.

d. Ensure the ability to stop the service in case of misuse and include this condition in the service contract.

e. Exercise ongoing monitoring of transactions and retrieve reports of unusual transactions resulting from the use of this service.

Ninth: Retention of records and documents:

Companies/institutions must retain records, data, and supporting evidence of business relationships, banking operations, due diligence procedures, and the results of examining unusual transactions, including original copies or copies of identity documents that are acceptable to courts in accordance with the law and legislation in Sudan. These records must be sufficiently detailed to allow the reconstruction of each individual transaction (including amounts and types of currencies used, if any). These records and information must be provided to the competent authorities in a timely manner.

The records and data include the following:

a. All records obtained through customer due diligence procedures, including documents proving the identity of customers and beneficial owners, accounting files, and business correspondence, for at least five years after the end of the business relationship or the date of the transaction conducted by the occasional client, whichever is longer.

b. Records and data of executed or attempted transactions, for at least five years from the date of the transaction or attempted transaction. These records must be detailed in a manner that allows the reconstruction of each individual transaction.

c. Records and information related to suspicious transaction reports submitted to the Financial Information Unit and related documents for at least five years after the date of notification to the Financial Information Unit, and records related to criminal cases until they are resolved, even if the legally specified record retention period has been exceeded.

d. Records related to risk assessment and any relevant information for five years from the date of assessment or update.

e. Documented records of all anti-money laundering and terrorist financing training programs that occurred during a period of not less than five previous years. These records must include the names of trainees, their qualifications, and their training institutions inside and outside the country.

Tenth: Reporting suspicious transactions:

1. The company/institution's compliance manager is the one responsible for notifying and reporting suspicious cases to the Financial Information Unit pursuant to Article (6) of the Law, in accordance with the reporting form prepared by the Financial Information Unit for this purpose.

2. The company/institution must immediately notify the Financial Information Unit of any transaction or attempted transaction whenever it suspects or has reasonable grounds to suspect that it is connected to or related to money laundering or terrorist financing.

3. Any of the company/institution's employees, upon suspecting that any operation is connected to money laundering or terrorist financing, must report that to the compliance manager, attaching all data and copies of documents related to that operation.

4. The compliance manager must provide the Financial Information Unit with the data and facilitate its access to records and information for the purpose of carrying out its tasks.

5. The company/institution, its managers and employees are prohibited from disclosing to any person, directly or indirectly, by any means, that a notification has been or will be submitted to the Financial Information Unit under the notification obligations, or any information related to the Financial Information Unit or any investigation into money laundering or terrorist financing. Exempted from this prohibition is disclosure or communication between the company/institution's managers and employees and the competent authorities and bodies and the Public Prosecution regarding these operations.

6. Civil, criminal and administrative liability is negated for any company or its managers or employees for breaching any prohibition on disclosing information imposed by contract or law, in the case of acting in good faith in carrying out the duty to notify the Financial Information Unit of any suspicious transaction or providing information or data about it.

Eleven: Internal Control System. The company/institution must do the following:

1. Establish an internal system to combat money laundering and terrorist financing proportionate to the risks it is exposed to, including policies, procedures, internal controls, compliance, appointment, training, and the tasks of internal and external audit over financial groups.

2. Establish and apply policies and procedures to combat money laundering and terrorist financing at the group level, provided that they include mechanisms for exchanging information and maintaining its confidentiality.

3. The internal system to combat money laundering and terrorist financing must include clear policies, procedures and internal controls to combat money laundering and terrorist financing, approved by the board of directors, and continuously updated.

4. Appoint a compliance manager - working under the supervision of the board of directors - and appoint a deputy in his absence from among those who have the appropriate academic qualifications and practical experience, and inform the Central Bank of Sudan of their details upon their appointment as well as in the event either of them changes.

5. Training:

a. Establish continuous training plans and programs for members of the board of directors, executive and supervisory management, and trainers.

b. The company/institution must prepare and implement regular training programs for its employees to enhance their knowledge of the regulations and rules on combating money laundering and terrorist financing, their understanding of these operations and their various patterns, and the internal instructions for combating them, including identifying suspicious transactions and the procedures for reporting them, customer identification and due diligence procedures, and familiarizing them with developments in this field.

c. The company/institution must have training programs for new employees, especially those who deal with customers directly.

d. The company/institution must ensure that the training programs provided to its employees include mechanisms for verifying data and the validity of identity and documenting that the image matches the original.

e. The company/institution must update the training programs from time to time in line with developments in this field.

f. The company/institution must establish appropriate plans, programs and financial budgets dedicated to training and qualifying its employees in the field of combating money laundering and terrorist financing operations.

g. Provide the Central Bank of Sudan with periodic reports showing the training programs and workshops that employees underwent during the year.

6. Internal Audit:

The internal audit department must examine the internal control and oversight systems to ensure their effectiveness, verify that employees and the compliance manager are carrying out their responsibilities, and assess the extent of adherence to the policies and procedures for combating money laundering and terrorist financing, include the results in its report submitted to management, and provide the financial and human resources necessary and sufficient for the internal audit tasks in this field.

7. The existence of an external audit mechanism whose task is to ensure the application of the directives of this guide and the adequacy of the policies and procedures related thereto, and to include the results of that in its report submitted to management.

8. The existence of precise examination and investigation procedures to ensure the availability of high standards of competence and integrity in selecting applicants when appointing new employees, provided that these procedures include applicants for jobs bringing the criminal record (criminal record certificate) and considering any other information useful to confirm the absence of a conflict of interest, dishonesty or fraud.

Management of Financial Institutions
General Administration for Organizing and Developing the Banking System