Procedure for the Management by Payment and Settlement Organizations of the Risk of Circumvention of International Sanctions

ANNEX

Approved by
Decision No. 25-N of the Board of the Central Bank of the Republic of Armenia dated 30 January 2026

PROCEDURE FOR THE MANAGEMENT BY PAYMENT AND SETTLEMENT ORGANIZATIONS OF THE RISK OF CIRCUMVENTION OF INTERNATIONAL SANCTIONS

CHAPTER 1. MANAGEMENT OF THE RISK OF CIRCUMVENTION OF INTERNATIONAL SANCTIONS

1. This Procedure shall apply to payment and settlement organizations that have obtained a money transfer license, as well as an e-money issuance and servicing permit, within the territory of the Republic of Armenia (hereinafter referred to as the Company).

2. The Company shall have risk-based internal control systems and procedures for managing the risk of circumvention of international sanctions, which shall include, at a minimum, mechanisms for the assessment of risks related to the circumvention of international sanctions, as well as for their mitigation, monitoring, testing of the control system, and accountability. Moreover, for the purposes of this Procedure, international sanctions shall mean any economic, financial, trade or other restrictive measures applied by international organizations or states, including the freezing or blocking of property, restrictions on access to funds or economic resources, sectoral financing or investment restrictions, trade, export or import controls, prohibitions on services, and measures aimed at combating the circumvention of the aforementioned restrictions, with the exception of the lists of persons related to terrorism or the proliferation of weapons of mass destruction established by the Law “On Combating Money Laundering and Terrorism Financing,” in respect of which the relevant regulations are established by other relevant laws and secondary regulatory legal acts. For the purposes of this Procedure, the risk of circumvention of international sanctions shall mean the probability of the Company incurring losses as a result of the circumvention of international sanctions.

3. The Company shall, depending on its business activity, scale, complexity and risk exposure, follow only those regulations on international sanctions established by countries or international organizations that may, directly or indirectly, have an impact on the Company’s activity.

4. The Company shall have such internal control system processes as will make it possible to fully and effectively detect, assess, suspend or reject transactions bearing the risk of circumvention of international sanctions.

5. For the purposes of this Procedure, the internal control system is a complex of the Company’s internal organizational structure, business processes, risk management system, accountability, as well as measures for exercising control over them. The internal control system is aimed at safeguarding the Company’s assets, ensuring the continuity of the Company’s activity, the timely identification, assessment and continuous management of risks inherent to the Company’s activity, ensuring the compliance of accounting and financial reporting with the standards in force, increasing the effectiveness of the operations carried out, and ensuring the compliance of the Company’s activity with the legislation in force and the Company’s internal legal acts.

6. The Board of the Company, and in the absence of a Board, the person responsible for decision-making, as provided by the company’s charter, shall:

1. approve the procedures for internal control and screening related to the management of the risk of circumvention of international sanctions and review them at least annually, or more frequently in the event of material changes occurring at the Company or in the market,
2. approve the action plan aimed at remedying the deficiencies, failures and omissions of the process of managing the risk of circumvention of international sanctions, as set forth in sub-point 2 of point 20 of this Procedure, and review it at least annually, or more frequently in the event of material changes occurring in the process of managing the risk of circumvention of sanctions,
3. approve the budget necessary for carrying out the process of managing the risk of circumvention of international sanctions,
4. approve the Company’s risk appetite, which the Company can and is willing to assume without undermining its financial stability and normal operations.

7. The executive body of the Company shall:

1. ensure the implementation of the requirements set forth in point 2 of this Procedure and their effective execution,
2. define the duties and scope of responsibility of the person responsible for carrying out the function of managing the risk of circumvention of international sanctions (hereinafter also referred to, for the purposes of this Chapter, as the Responsible Person), appoint the Responsible Person, who shall be an executive already registered with the Central Bank, as well as, where necessary, other persons responsible for managing the risk of circumvention of international sanctions, while excluding the likelihood of a conflict of interest,
3. ensure the availability of sufficient technological, expert and other resources for performing the day-to-day work necessary for managing the risk of circumvention of international sanctions,
4. ensure the implementation of the action plan aimed at remedying the deficiencies, failures and omissions of the process of managing the risk of circumvention of international sanctions, as set forth in sub-point 2 of point 20 of this Procedure.

8. The Responsible Person shall, at a minimum:

1. develop the methodologies and procedures for managing the risk of circumvention of international sanctions and submit them for approval by the Board,
2. identify and assess the risks related to the circumvention of international sanctions by the Company, exercise control and monitoring over the identified risk of circumvention of international sanctions, and ensure its effective management,
3. develop the action plan aimed at remedying the deficiencies, omissions and failures of the process of managing the risk of circumvention of international sanctions,
4. perform other functions related to the management of risks of circumvention of international sanctions.

9. The Company shall have a methodology for assessing the risks of circumvention of international sanctions and, on the basis thereof, shall carry out an assessment of the risk of circumvention of international sanctions at least once a year, with a view to identifying possible deficiencies and problems.
10. The assessment of the risk of circumvention of international sanctions shall include an assessment of the inherent risk, its management, and the residual risk.
11. In the process of assessing the risk of circumvention of international sanctions, the assessment of the inherent risk shall, at a minimum, include:

1. assessment of customer risk,
2. assessment of geographic location risk,
3. assessment of the risk of the services offered, including transactions,
4. assessment of the risk of counterparties and intermediaries,
5. assessment of the risk of the service delivery chain.

12. The Company shall assess the relevant set of tools aimed at mitigating the inherent risks forming part of the process of managing the risk of circumvention of international sanctions, and the effectiveness of their application.
13. The Company shall assess the residual risk of circumvention of international sanctions, which is determined as a result of assessing the level of inherent risk of the Company’s operations and the adequacy and effectiveness of its management.
14. Problems and deficiencies identified in other control processes, such as monitoring, testing and internal audit, shall also be included in the results of the assessment of the risk of circumvention of international sanctions.
15. The Company’s internal control systems and processes shall, at a minimum, make it possible to:

1. carry out proper due diligence of the Company’s customer, the customer’s counterparties and the Company’s counterparties, as well as all parties to transactions,

2. carry out an assessment of the risk of circumvention of international sanctions by customers and counterparties,

3. carry out screening of transactions,

4. monitor the activity of customers and counterparties on the basis of information available to the Company,

5. assess the process of assessing the risk of circumvention of international sanctions,

6. collect and retain information identified in the process of managing the risk of circumvention of international sanctions.

16. The Company shall ensure that the relevant employees involved in operations related to the management of the risk of circumvention of international sanctions are informed of the procedures for managing the risk of circumvention of international sanctions implemented at the Company and of updates thereto.
17. The Company shall have a process for monitoring the effectiveness of the process of managing the risk of circumvention of international sanctions.
18. The Company shall carry out testing of the control and key processes of the process of managing the risk of circumvention of international sanctions, by means of which it shall, at a minimum, verify that the screening systems are functioning properly, and shall also periodically assess their effectiveness from the standpoint of risk management.
19. The Company shall ensure that, in the event problems are identified in the internal control systems aimed at managing the risk of circumvention of international sanctions, it is possible to take prompt and effective action aimed at mitigating and remedying the risk.
20. At least on a semi-annual basis, the Responsible Person shall submit to the Board and the executive body reports on, at a minimum, the following:

1. the process of managing the risk of circumvention of international sanctions, its components, the progress of its implementation, and all risks relating to the circumvention of international sanctions,
2. the identified deficiencies, failures and omissions of the process of managing the risk of circumvention of international sanctions,
3. the results of the assessment of the risk of circumvention of international sanctions,
4. possible violations of regulations on international sanctions, as well as measures aimed at remedying them.

21. The Company shall have appropriate procedures that shall make it possible for cases of deficiencies, failures and omissions identified in the internal control system relating to the management of the risk of circumvention of international sanctions to be promptly reported to the Responsible Person, and for effective measures aimed at mitigating and remedying the risk of circumvention of international sanctions to be taken.
22. The Company shall have procedures and automated tools implemented for the screening of international sanctions, commensurate with its size, complexity, risk exposure and current operations, which shall make it possible to carry out a detailed examination of the Company’s operations, including transactions, for the purpose of

identifying and effectively managing the risks of circumvention of international sanctions. The procedures set forth in this point shall be reviewed on an annual basis or in the event of a material change occurring at the Company or in the market.
23. The Company, taking into account the particularities of the regulations on international sanctions, shall, in the screening process, take into account, at a minimum:

1. geographic factors, including countries, cities, regions, that are subject to the strictest and most extensive regulation of international sanctions,
2. the main keywords related to international sanctions,
3. the sources of origin of the goods, services, software and technologies forming part of the transaction,
4. organizations and entities belonging to, or interconnected with, parties subject to international sanctions, which are suspected of circumventing international sanctions,
5. the data used for the identification of the financial institutions to which the international sanctions apply.

24. The Company shall, at a minimum, screen:

1. customers and counterparties,
2. the Company’s participants, employees involved in the execution of transactions, or the Company’s management bodies, at least on an annual basis,
3. the currencies of transactions,
4. the place where the operations are carried out.

25. When carrying out the screening of customer data set forth in this Chapter, the Company shall, at a minimum, take into account persons interconnected with the person concerned who have already been identified by the Company, including persons with direct and indirect significant participation, beneficial owners, directors, authorized persons, guarantors, the customer’s business relationships, and, in the case of natural persons, also the citizenship, actual place of residence and main country of taxation, and in the case of legal persons, the place of location and activity.
26. Where services are regularly rendered to financial institutions operating outside the territory of the Republic of Armenia or falling outside the scope of this regulation, the Company shall continuously assess and document the process of managing the risk of circumvention of international sanctions of the financial institution concerned.
27. The screening of customer data set forth in this Chapter shall be carried out when establishing a business relationship with the customer and shall be continuous in nature. Moreover, in the event of any change or update in the international sanctions lists or in the customer’s data, the Company shall carry out screening within one business day following the change or update.
28. Data on transactions carried out by the Company shall be subject to screening prior to the execution and confirmation of the transaction.
29. The Company shall periodically test the effectiveness of the international sanctions screening tools and systems, which shall, at a minimum:

1. be carried out on the basis of the criteria established by the Company for screening, the analyses performed, and the reports,
2. include verification of the reliability and completeness of the data on the management of the risk of circumvention of international sanctions.

30. The Company shall document the international sanctions screening tools, and shall also ensure the transparency of the system’s limitations or risk-based decisions that are not detected by the screening control mechanisms.
31. In addition to the control mechanisms for screening international sanctions, the Company shall also implement an appropriate methodology, including transaction monitoring scenarios, to detect cases of evasion or circumvention of sanctions. The scenarios shall be reviewed and assessed periodically to ensure that the methodology remains adequate for cases of evasion or circumvention of international sanctions.