Iraqi Securities Commission: Requirements for Accreditation of Back Office Systems at Brokerage Companies

Iraqi Securities Commission
Requirements for Accreditation of Back Office Systems at Brokerage Companies

First. General Requirements:

1. Compliance with the provisions of the Securities Law, the Anti-Money Laundering and Terrorist Financing Law, and the instructions, regulations, and bylaws issued thereunder.
2. The system must define user permissions based on function and the principle of least privilege and conflict of interest prevention, including the separation of transaction entry, review, and approval.
3. The system must include the segregation of investors' funds and securities from those of the brokerage company.
4. The system shall save trading and settlement documents and records electronically only if an authorized electronic signature exists; otherwise, all documents, records, and negotiations must be saved in original copies with live signatures.
5. The system must allow the regulatory authority access to documents, records, and data.

Second. Investor Orders, Authorizations, and Their Modifications Through the System:

1. Documentation and confirmation of investor authorization for purchase or sale, including the investor's name, security, order type, quantity, price, validity, date, time, and method of receiving the authorization.
2. Each trade must be linked to its specific authorization and saved in paper or electronic form; the post-session statement serves as confirmation of execution, not as a substitute for the prior authorization.
3. If the possibility exists to modify the authorization, the modification mechanism and authorized permissions must be clarified, with the entire process recorded in the audit log to ensure knowledge of the user who made the modification, the time of modification, the previous value, and the modified value.
4. Any modification process must not affect the integrity or sequence of data associated with the original order.

Third. Receipt of Trading Session and Data Integrity

1. The session is received from the market via a temporary API interface or a dedicated and approved connection, or a structured file issued by market systems and secured with encryption and digital signature or an approved electronic verification means.
2. Excel or CSV files or any manual transfer media are not accepted as direct or reliable sources for migrating trading session data.
3. The trading file must contain at a minimum (date, number, security symbol, investor account, selling and buying broker, quantity, price, total value, execution time, and status).
4. The system undertakes the verification of the file's validity, source, and completeness, rejecting modified, incomplete, or duplicated files, and preventing duplicate loading of the session.
5. Manual modification of trading session content before loading is prohibited, and the system issues a notification indicating the receipt time and acceptance or rejection status.
6. Trades are not corrected or cancelled except upon an official message issued by the market or the authorized entity and linked to the original trade.

Fourth. System Operation and Settlements:

1. The system adopts a unified operational database for orders, trades, settlements, and entries, using unique numbers for sessions, trades, and entries.
2. The system automatically migrates trading data to cash and securities accounts according to accounting systems, as well as commissions.
3. The system must indicate the status of the trade and settlement.
4. Daily matching is performed between official trading data, the system's order and trade register, securities balances at the Depository Center, and cash movement at the settlement entity.
5. Closing the working day with unexplained differences is prohibited; every difference, its cause, the person responsible for handling it, and the action taken regarding it must be recorded.

Fifth. Accounting Requirements:

1. The double-entry accounting system is adopted according to approved accounting requirements.
2. The system creates an automatic accounting entry for each trade, settlement, commission, or fee, linking the entry to the process and supporting document.
3. The system matches investor accounts and subsidiary accounts with the general ledger on a daily basis.
4. Modification or deletion of a session or accounting entry after migration is prohibited, even with the permissions of the system manager or database administrator.
5. Errors are corrected with a reversing entry and a correct alternative entry, linked to the original entry, recording the reason, originating document, reviewer, and timing of the action.
6. Migration to a closed accounting period is prohibited, and the system generates the trial balance, general ledger, journal, and statements of investor accounts, cash, securities, fees, and commissions.

Sixth. Mechanism for Applying the Anti-Money Laundering and Terrorist Financing Law and Due Diligence Instructions:

1. The system must be linked to an AML and terrorist financing supervisory system according to Law No. 39 of 2015 and its issued bylaws, including its basic functions.
2. The system performs automatic daily screening of all active investors upon account opening or data change by matching them with international and local lists issued by the Anti-Money Laundering and Terrorist Financing Office and any other lists regarding this matter.
3. The system supports Arabic and English names, alternative spellings, and approximate search, in addition to using national ID or passport, date of birth, and nationality when available.
4. The system classifies investors according to risk, and enhanced due diligence is applied to high-risk cases, beneficial owners, and PEPs.
5. The system monitors unusual or disproportionate trades and cash/securities movements relative to the investor profile and generates automatic alerts regarding them.
6. Deletion or closure of an AML alert without a reasoned and recorded decision is prohibited, and support must be provided for escalating or sending it to the AML officer and the competent authority.

Seventh. Provider Requirements and Acceptance Testing:

1. The system provider must have documented experience in capital market, trading, settlement, and accounting systems.
2. Provision of a qualified support team in addition to system manuals, data building, migration and matching rules, permissions, and service continuity plan.
3. Return of data and records to the brokerage company, and the system allows full export in open format; unauthorized access is prohibited.
4. Testing must include a correct session, a missing/duplicated/modified message, an attempt to delete an entry, a settlement discrepancy, backup restoration, and AML match appearance.
5. Actual operation is not permitted before successful testing and resolution of significant observations.
6. Any additional requirements determined by the Commission.

Eighth. Regulatory and Operational Reports:

1. Trading reports: Negotiations and executed trades, and unmigrated, stuck, cancelled, or corrected trades.
2. Settlement and accounting reports: Investor balances, segregation of client assets, market/depository center/settlement entity matches, discrepancies, reversing and corrective entries.
3. Supervision reports: User permissions, deletion and modification attempts, audit trail impact, daily screening results, AML alerts, and missing or expired documents.
4. Any additional reports determined by the Commission.

Ninth. Technical Requirements:

1. The system must be capable of direct and effective connection with the trading system of the Iraq Stock Exchange, according to the connection mechanism approved by the market, and must be compatible with related market systems, based on the recommendation submitted by the market to the Commission regarding the trading file.
2. The mechanism for dealing with disconnection situations and the mechanism for restoring and synchronizing data after connection returns must be clarified.
3. Broker systems must be on local servers (On-Premises), and cloud hosting (Cloud) must not be relied upon as a primary option unless asset approval is obtained.
4. Details of the infrastructure and servers hosting the system, and their security mechanism for the broker and management, must be provided.
5. The system must include a complete record of operations and events (Audit Trail / Event Logs), where all operations and procedures performed through the system are recorded without exception, including struck or cancelled transactions with the ability to display and refer to them. The log must contain at a minimum (user data who performed the operation, date and time of execution, type of operation, and data entered or modified).
6. It must be ensured that audit trail/event logs can be deleted or modified by system users while ensuring they are saved securely to allow reference and retrieval when needed for auditing, supervision, or investigation purposes.
7. All of the above mentioned auditing or review is subject to an independent and approved third party.

Tenth. Cybersecurity:

1. Systems connected to the Iraq Stock Exchange systems must undergo cybersecurity tests and penetration testing by an independent and approved third party, commensurate with the nature of the system and its degree of connection to market systems.
2. Providing the Commission with test results and security reports and the mechanism for addressing observations and vulnerabilities discovered before system accreditation, after endorsement by the Iraq Stock Exchange of the report.
3. Adherence to the requirements and controls contained in the Information Security Policies and Standards document approved by the Commission regarding systems, data, and communications related to the market.

Eleventh: Integration with Other Systems:

1. If the possibility exists to interlock or integrate the system with other systems, a detailed explanation of the integration mechanism, interfaces used, data exchanged, and entities that can access it must be provided, with market endorsement of the mechanism's acceptance.
2. Any connection or integration process with the Iraq Stock Exchange systems or the electronic signature system must be subject to prior market approval according to approved procedures and controls.

Twelfth: Database and Information Protection:

1. The type and database management system used by the broker and its management and security mechanism must be stated.
2. Statement of mechanisms to protect the database from unauthorized access, backup and restoration mechanisms, and ensuring data integrity and non-tampering.
3. Signing a non-disclosure agreement between the market and the provider.

Thirteenth: Standards and References:

1. Accounting: Local effective Financial Reporting Standards, policies, and accounting instructions.
2. Anti-Money Laundering: Anti-Money Laundering and Terrorist Financing Law, local instructions, and relevant FATF recommendations.
3. Information Security: To the extent defined by the market, according to the nature of the system and hosting, and subject to Commission authentication.
4. Any other standards or references determined by the Commission.

Fourteenth: Final Approval Decision:

1. System accreditation is by a recommendation raised from the market to the Commission for final ratification, and the Commission's approval is required by market recommendation when making any fundamental change in the system, provider, database, connection interfaces, data storage location, or any other changes deemed necessary by the Commission.
2. Accreditation may be suspended by a recommendation raised from the market and subject to Commission ratification, or directly by the Commission, in the following cases (deletion of entries or sessions, loading data from an unapproved source, existence of unhandled fundamental discrepancies, disabling audit trail effect, preventing regulatory access) or any other cases the Commission deems necessary.

Faisal Al-Haimas
Chairman of the Securities Commission
11/10/2026