Implementing Regulation of Law on Combating Money Laundering and Financing of Terrorism Promulgated by Law No. 20 of 2019

Decree of the Council of Ministers No. (41) of 2019 Issuing the Implementing Regulation of the Law on Combating Money Laundering and Financing of Terrorism Promulgated by Law No. (20) of 2019

The Council of Ministers, Having reviewed the Constitution, And the Law on Combating Money Laundering and Financing of Terrorism Promulgated by Law No. (20) of 2019, And the Emiri Decree No. (29) of 1996 concerning Council of Ministers decisions submitted to the Emir for ratification and issuance, And upon the proposal of the Chairman of the National Committee for Combating Money Laundering and Financing of Terrorism, Has decided the following:

Article (1) The provisions of the Implementing Regulation of the Law on Combating Money Laundering and Financing of Terrorism referred to above, attached to this Decree, shall be applied.

Article (2) All competent authorities shall, each within their respective jurisdiction, implement this Decree. It shall be applied from the day following the date of its publication in the Official Gazette.

Abdullah bin Nasser bin Khalifa Al Thani Prime Minister

We ratify this Decree and issue it.

Tamim bin Hamad Al Thani Emir of the State of Qatar

Issued at the Diwan Amiri on: 1441/04/29 AH Corresponding to: 2019/12/26 AD

---

Implementing Regulation of the Law on Combating Money Laundering and Financing of Terrorism

Chapter One Definitions

Article (1) In the application of the provisions of this Regulation, the following words and phrases shall have the meanings indicated alongside each of them, unless the context requires otherwise:

The Law: The Law on Combating Money Laundering and Financing of Terrorism Promulgated by Law No. (20) of 2019.

Politically Exposed Persons: Individuals entrusted with or who have been entrusted with prominent public functions in the State or in a foreign country, such as Heads of State or Government, politicians, high-ranking government officials, judicial and military officials, senior executive officers in state-owned companies, members of parliamentary councils, and important officials of political parties, as well as senior management members including Directors, Deputy Directors, and Board of Directors members or equivalent positions in international organizations.

Beneficial Owner: The natural person who ultimately owns or controls the Customer on a final basis, through an ownership share or voting rights, or the natural person on whose behalf transactions are conducted, whether by agency, guardianship, trusteeship, or any other form of representation. It also includes the person who ultimately exercises effective and final control over a legal person or legal arrangement, including the person who exercises ultimate effective control by any means.

Correspondent Accounts: Correspondent accounts used directly by third parties to conduct commercial activity primarily for themselves.

Issuing Financial Institution: The financial institution that initiates the wire transfer and funds are transferred upon receipt of a wire transfer request on behalf of the originator.

Beneficiary Financial Institution: The financial institution that receives the wire transfer from the Issuing Financial Institution directly or through an intermediary financial institution, and makes the funds available to the beneficiary.

Intermediary Financial Institution: The financial institution that, in the chain or coverage of payment, receives and transfers the wire transfer on behalf of the Issuing Financial Institution and the Beneficiary Financial Institution or another intermediary financial institution.

False Declaration: Providing incorrect information about the value of currency or negotiable instruments for bearer, or precious metals or stones, being transported, or providing other incorrect information relevant to what is required in the declaration or by customs authorities, including failure to submit the declaration as required.

Agent of a Money or Value Transfer Service Provider: Any person who provides money or value transfer services on behalf of a Money or Value Transfer Service Provider, whether under a contract with them or under their management.

---

Chapter Two Activities, Operations, and Preventive Measures

Section One Activities and Operations of Financial Institutions

Article (2) The activities and operations conducted by a Financial Institution as a business include the following:

1. Accepting deposits and other payable funds from the public.

2. Lending, including consumer loans and mortgages, with or without recourse, and financing commercial operations, including the purchase of export documents and the purchase of debts, with or without recourse.

3. Financial leasing, except for financial leasing related to consumer products.

4. Money or value transfer services, excluding the provision of messages or other support systems to financial institutions for money transfer only.

5. Issuing or managing payment instruments, such as credit cards, debit cards, checks, traveler's checks, money orders, bank drafts, electronic money, payment orders, and bank promissory notes.

6. Financial guarantees and commitments.

7. Activities related to securities.

8. Trading in:

   • Money market instruments, such as checks, promissory notes, certificates of deposit, and financial derivatives.
   • Foreign exchange market.
   • Currency exchange instruments.
   • Interest rates and indices.
   • Transferable securities.
   • Commodity futures contracts.

9. Participation in the issuance of securities and providing financial services related to such issuance.

10. Individual or collective portfolio management.

11. Holding and managing funds or cash on behalf of or for the benefit of others.

12. Other operations for investing, managing, or operating funds or cash on behalf of or for the benefit of others.

13. Life insurance underwriting or savings, and other types of insurance related to investment, including those provided by insurance agents and brokers.

14. Exchange of cash or currencies.

15. Any other activity or operation determined by a Council of Ministers decision, upon the proposal of the Committee.

Section Two Preventive Measures

Article (3) Financial Institutions and specified Non-Financial Businesses and Professions must identify, report, and understand their money laundering and terrorist financing risks, in accordance with the nature of their business and size, as follows:

1. Documenting risk techniques and any underlying information so that they are able to display their causes, monitor them, and update them continuously.
2. Making the risk assessment report available to the competent regulatory authority periodically within the period specified, and upon request by this authority.
3. Considering all relevant risk factors before determining the risk mitigation procedures to be applied and the type of these procedures.

Article (4) Financial Institutions and specified Non-Financial Businesses and Professions, when determining their risks according to the previous Article, must consider the risks specified in the National Risk Assessment, in addition to the following factors:

1. Risk factors related to Customers, the Beneficial Owners of Customers, and the Beneficiaries of transactions conducted by Customers.

2. Risk factors related to countries and geographical areas.

3. Risk factors related to the products and services provided by Financial Institutions and specified Non-Financial Businesses and Professions, transactions, and delivery channels.

4. Risk factors related to the purpose of the Customer opening the account or establishing a business relationship.

5. Risk factors related to the level of deposits and the volume of operations.

6. Risk factors related to the duration of the relationship with the Customer and the frequency of operations.

Article (5) Financial Institutions and specified Non-Financial Businesses and Professions must identify and report money laundering and terrorist financing risks that may arise from the development of new products or professional practices, including new means of providing services or products or operations resulting from the use of new technologies or under development for new or previously existing products, before launching or using these products, practices, or technologies, and taking appropriate measures to manage and mitigate these risks.

Article (6) Financial Institutions and specified Non-Financial Businesses and Professions must establish anti-money laundering and counter-terrorist financing programs that include the necessary policies, procedures, and controls, taking into account risks and business size. These programs must include the following:

1. Appropriate compliance management arrangements, including the appointment of a compliance officer at the management level.
2. Taking appropriate screening measures to ensure high competence standards when appointing employees.
3. A continuous training program for employees.
4. An independent audit unit to test the anti-money laundering and counter-terrorist financing system.

Article (7) Financial Groups and specified Non-Financial Businesses and Professions must apply anti-money laundering and counter-terrorist financing programs to all branches and subsidiaries in which the Group holds a majority stake. These programs must include, in addition to the procedures stipulated in the previous Article, the following:

1. Applying policies and procedures for the exchange of information required for customer due diligence purposes and money laundering and terrorist financing risk management.
2. Providing necessary information to compliance, audit, and anti-money laundering and counter-terrorist financing officers at the Group level, regarding accounts, operations, branches, and subsidiaries, when necessary for anti-money laundering and counter-terrorist financing purposes, including information and analyses on transactions and activities that appear unusual or suspicious, and reports on suspicious transactions, their basic information, or information indicating the filing of a suspicious transaction report.
3. Providing the information mentioned in the previous item to branches and subsidiaries when appropriate, whenever it is suitable for risk management.
4. Applying sufficient guarantees regarding confidentiality and the use of exchanged information, including guarantees against tipping off.

Article (8)

1. Financial Groups, Financial Institutions, and specified Non-Financial Businesses and Professions must ensure that their foreign branches and majority-owned subsidiaries apply anti-money laundering and counter-terrorist financing measures in accordance with the requirements imposed in the State when the minimum anti-money laundering and counter-terrorist financing requirements in the host country are less stringent than those applied in the State, to the extent permitted by the laws and regulations of the host country.

2. If the host country does not allow the appropriate implementation of specific and sophisticated anti-money laundering and counter-terrorist financing measures consistent with the procedures applied by the State, Financial Groups, Financial Institutions, and specified Non-Financial Businesses and Professions must apply additional appropriate measures to manage money laundering and terrorist financing risks at foreign branches and majority-owned subsidiaries, and notify the competent regulatory authority in the State thereof.

3. If additional measures are insufficient, the competent authorities in the State must consider taking other supervisory measures, including imposing additional controls on Financial Groups, Financial Institutions, and specified Non-Financial Businesses and Professions, and requiring them, if necessary, to cease operations in the host country.

Article (9) Financial Institutions and specified Non-Financial Businesses and Professions must consider the relative importance, risks, and information regarding their existing Customers when applying due diligence measures in the cases stipulated in Articles (10) and (11) of the Law. These measures must be taken regarding existing business relationships in a timely manner, taking into account whether such measures have been taken previously, when they were taken, and the adequacy of the data obtained.

Article (10) Financial Institutions and specified Non-Financial Businesses and Professions must take due diligence measures when conducting occasional financial transactions equivalent to or exceeding fifty thousand Riyals (50,000). They must also take appropriate measures to detect transactions split into small amounts that equal in total the amount specified in the previous paragraph. Real estate brokers must apply the aforementioned measures to property buyers and sellers.

Article (11) Dealers in precious metals or precious stones are subject to the obligations stipulated in the Law when concluding cash transactions with their customers equivalent to or exceeding fifty thousand (50,000) Riyals.

Article (12) Financial Institutions and specified Non-Financial Businesses and Professions, when suspecting, during the establishment of a business relationship with a Customer or during the course of this relationship, or when conducting occasional transactions, that transactions are related to money laundering or terrorist financing, must do the following:

1. Identify and verify the identity of the Customer and the Beneficial Owner, whether the Customer is permanent or occasional, regardless of any exemption or threshold in effect.
2. Submit a suspicious transaction report to the Unit.

Article (13) Financial Institutions and specified Non-Financial Businesses and Professions must identify and verify the Customer's identity using original documents or data from a reliable and independent source, by collecting the following information as a minimum:

1. Regarding a natural person: Obtaining the full name of the person, as recorded in official proofs, the address of residence or local address, date and place of birth, and nationality.
2. Regarding a legal person or legal arrangement: Obtaining the name and legal form of the person, its founding deed, the powers and regulations governing the legal person or legal arrangement, the names of persons holding senior management positions, the registered office address, and the principal place of business if different from the registered office address. Financial Institutions and specified Non-Financial Businesses and Professions must, regarding Customers who are legal persons or legal arrangements, understand the Customer's ownership structure and control, and verify the identity of Beneficial Owners in accordance with the provisions of Articles (15) and (17) of this Regulation.

They must also collect any additional information and verify it, according to the degree of risk posed by a specific Customer. Financial Institutions and specified Non-Financial Businesses and Professions must, regarding all Customers, do the following:

1. Understand the nature of the Customer's business or pattern of activity.
2. Ensure that any person claiming to act on behalf of the Customer is authorized to do so, identifying and verifying their identity in accordance with the provisions of items (1) and (2) of the first paragraph of this Article.
3. Understand the purpose and nature of the business relationship, and where necessary, obtain information related to this purpose.
4. Apply continuous due diligence regarding the business relationship, including: a. Scrutinizing transactions throughout the duration of the relationship to ensure consistency with the Institution's knowledge of the Customer, their pattern of activity, and the risks they pose, and the source of funds if necessary. b. Ensuring that documents, data, or information obtained under due diligence measures are adequate and continuously updated, by reviewing existing records, especially for high-risk Customer categories.

Article (14) Financial Institutions and specified Non-Financial Businesses and Professions must, in cases where regulatory authorities allow the establishment of a business relationship before verifying the Customer's identity, adopt risk management procedures regarding the circumstances under which they can benefit from the business relationship.

Article (15) Financial Institutions and specified Non-Financial Businesses and Professions must, regarding Customers who are legal persons, identify the Beneficial Owner and take reasonable measures to verify their identity using relevant information or data derived from a reliable source, as follows:

1. Identify the natural person or natural persons to whom ultimate effective controlling ownership share of not less than (20%) of the shares or voting rights of the legal person accrues, and take reasonable measures to verify their identity.
2. In cases where the Beneficial Owner cannot be identified, or when there is suspicion that the natural person holding controlling shares is not the Beneficial Owner according to the previous item, or when no natural person exercises control through ownership, Financial Institutions and specified Non-Financial Businesses and Professions must identify the natural person or natural persons who exercise actual or legal control or supervision, by any means, directly or indirectly, over the legal person or legal arrangement or its executive bodies or general assembly, or over the conduct of the legal person or other control or supervision instruments.
3. In the event that no natural person is identified according to the provisions of the previous two items, Financial Institutions and specified Non-Financial Businesses and Professions must identify and verify the natural person holding an administrative position in the legal person.

Financial Institutions and specified Non-Financial Businesses and Professions must not accept a Customer, execute a transaction, or continue a business relationship if they are unable to identify at least one natural person meeting the requirements of this Article. In this case, they must terminate the business relationship with existing Customers and submit a suspicion report to the Unit.

Article (16) If the Customer, or the controlling shareholder, is a company listed on the stock exchange subject to disclosure requirements that ensure sufficient transparency in verifying the Beneficial Owner, or a subsidiary that holds a controlling stake in it, it is permissible not to identify or verify any shareholder or Beneficial Owner in such companies. Identity data may be obtained from publicly available records, from the Customer, or from any other documented source.

Article (17) Financial Institutions and specified Non-Financial Businesses and Professions must, regarding Customers who are investment funds, identify the Beneficial Owner and take reasonable measures to verify their identity by identifying the founder, trustee, and supervisor (if any), the beneficiaries, or the class of beneficiaries, and any other natural person who exercises ultimate effective and final control over the investment fund directly or indirectly. They must, regarding other legal arrangements, identify the natural persons holding equivalent positions. Financial Institutions and specified Non-Financial Businesses and Professions must also take necessary measures to determine whether the Customer acts as a trustee for an investment fund or holds an equivalent or similar position in another type of legal arrangement.

Article (18) In addition to the customer due diligence measures outlined in the Law and Regulation, Financial Institutions must apply the following additional due diligence measures regarding beneficiaries of life insurance policies and other investment insurance products, once these beneficiaries are identified or named:

1. Regarding a specifically named Beneficiary: Obtaining the name of the person, whether a natural person, legal person, or legal arrangement.
2. Regarding beneficiaries named by attribute, class, or other means: Obtaining sufficient information about the Beneficiary, to the extent that enables the Financial Institution to be convinced that they will be able to identify the Beneficiary at the time of payout.
3. Verifying the identity of the Beneficiary in both previous cases at the time of payout. In cases where Financial Institutions are unable to carry out the measures mentioned in this Article, they must submit a suspicion report to the Unit.

Article (19) Financial Institutions must consider the beneficiary of a life insurance policy as a risk factor when determining the extent to which enhanced customer due diligence measures apply. If they determine that the Beneficiary who is a legal person or legal arrangement poses a high risk, they must apply enhanced due diligence measures, which include reasonable measures to identify and verify the Beneficial Owner of the insurance policy at the time of payout.

Article (20) Financial Institutions and specified Non-Financial Businesses and Professions, when relying on third parties from Financial Institutions and specified Non-Financial Businesses and Professions to carry out the due diligence measures stipulated in the Law and Regulation, must do the following:

1. Immediately obtain the necessary information related to the mentioned measures.
2. Ensure that the third party will provide without delay copies of customer identification data and other documents related to these measures upon request.
3. Verify that the third party is subject to regulation, supervision, or oversight, and complies with customer due diligence measures and record-keeping in accordance with the Law and Regulation.
4. Consider the available information regarding the level of money laundering and terrorist financing risks in the countries where the relied-upon third parties are located.

Article (21) When Financial Institutions and specified Non-Financial Businesses and Professions rely on a third party that is part of the same Group, the State or the host country may consider the requirements mentioned in the previous Article to be met in the following cases:

1. The Group applies customer due diligence measures and record-keeping, and anti-money laundering and counter-terrorist financing programs, in accordance with the Law and Regulation.
2. Supervision by competent authorities to verify the Group's application of these measures and programs.
3. Adequate reduction of high country-specific risks through the Group's policies on combating money laundering and terrorist financing.

Article (22) Financial Institutions and specified Non-Financial Businesses and Professions must apply enhanced due diligence measures proportional to the degree of risk to business relationships and transactions with Customers, including Financial Institutions and specified Non-Financial Businesses and Professions from countries that the Financial Action Task Force calls for taking such measures against, and which the Committee publishes on its website on the Internet.

Article (23) Financial Institutions and specified Non-Financial Businesses and Professions must take other measures in implementation of Article (13) of the Law, including counter-measures proportional to the degree of risk specified in instructions issued by regulatory authorities, based on Financial Action Task Force data, or measures determined independently by the Committee.

Article (24) The Committee issues instructions related to weaknesses in anti-money laundering and counter-terrorist financing systems in other countries. The Committee is responsible for informing regulatory authorities and competent authorities of these instructions and publishing them on its website on the Internet. Regulatory authorities are responsible for informing the Financial Institutions and specified Non-Financial Businesses and Professions under their jurisdiction thereof.

Article (25) Financial Institutions and specified Non-Financial Businesses and Professions must, to the greatest extent possible and reasonably, study the background and purpose of all complex or unusual operations, and all patterns of unusual operations that have no clear economic or legal purpose. When money laundering or terrorist financing risks are high, Financial Institutions and specified Non-Financial Businesses and Professions must apply enhanced due diligence measures, consistent with the identified risks. In particular, they must increase the level of monitoring of the business relationship to identify unusual or suspicious activities or operations. Enhanced due diligence measures specifically include:

1. Obtaining additional information about the Customer, including profession, asset size, and information available through public databases and open sources, and regularly updating Customer and Beneficial Owner identification data.
2. Obtaining additional information about the nature of the expected business relationship.
3. Obtaining information about the source of funds or the Customer's wealth.
4. Obtaining information about the reasons for the expected or conducted transactions.
5. Obtaining senior management approval to initiate or continue a business relationship.
6. Applying intensive monitoring of the business relationship by increasing the number and duration of supervision and selecting operation patterns that require more examination and review.
7. Making the initial payment through an account in the Customer's name at a bank subject to similar due diligence standards.

Article (26) If money laundering or terrorist financing risks are low, Financial Institutions and specified Non-Financial Businesses and Professions may, based on what the regulatory authority determines, apply simplified due diligence measures that take into account the nature of these risks and are proportional to low-risk factors, including the following:

1. Verifying the identity of the Customer and the Beneficial Owner after establishing the business relationship, such as in account operations if the amount exceeds the threshold determined for the business relationship.
2. Reducing the frequency of Customer identity updates.
3. Reducing the degree of continuous due diligence and transaction scrutiny, based on a reasonable amount determined.
4. Not collecting specific information or executing specific procedures regarding the nature of the business relationship or its purpose, relying instead on inferring it from the type of transactions conducted or the existing business relationship. Simplified measures may relate only to Customer acceptance or continuous monitoring. These measures must not be applied when there is suspicion of money laundering or terrorist financing, or when specific high-risk circumstances are established.

Article (27) Financial Institutions and specified Non-Financial Businesses and Professions must establish appropriate risk management systems to determine whether the Customer or Beneficial Owner is a Politically Exposed Person, a member of their family, or a close associate. They must also take the following additional due diligence measures regarding them:

1. Obtaining senior management approval before establishing or continuing a business relationship, regarding existing Customers.
2. Taking reasonable measures to know the source of wealth and funds of Customers and Beneficial Owners who are Politically Exposed Persons, members of their families, or close associates.
3. Applying intensive and continuous monitoring of their business relationship.

Article (28) The family members of a Politically Exposed Person include any natural person related to them by blood or marriage up to the second degree.