SCB AML/CFT/CPF Activity Report 2021-2025

AML/CFT/CPF ACTIVITY The Commission’s first published Activity Report on its work to counter money laundering, terrorist financing and proliferation financing. 2021 - 2025 PUBLISHED DATE: 27 AUGUST 2026

Securities Commission of The Bahamas AML/CFT/CPF Activity Report Page 2 of 24 Securities Commission of The Bahamas All rights reserved. No part of this publication may be reproduced or distributed without the prior written permission of the publisher. This document does not constitute legal advice. This publication is available at www.scb.gov.bs. © Copyright 2026 Securities Commission of The Bahamas

Securities Commission of The Bahamas AML/CFT/CPF Activity Report Page 3 of 24 CONTENTS

1. FOREWORD................................................................................................................... 4
2. INTRODUCTION AND PURPOSE ...................................................................................... 4 2.1 LEGISLATIVE AND REGULATORY FRAMEWORK............................................................ 5 2.2 THE COMMISSION’S AML/CFT/CPF MANDATE ............................................................ 5 2.3 THE COMMISSION’S REPORTING SUITE...................................................................... 6
3. RISK-BASED APPROACH TO AML/CFT/CPF SUPERVISION................................................. 6 3.1 HOW THE COMMISSION BUILDS AND MAINTAINS ITS UNDERSTANDING OF RISK.......... 6 3.2 HOW RISK RATINGS AND SUPERVISORY INPUT SHAPE EXAMINATION COVERAGE ........ 7 3.3 HOW STR STATISTICS INFLUENCE EXAMINATION PRIORITIES...................................... 7 3.4 DATA RETURNS AND SUPERVISORY INFORMATION..................................................... 8
4. SUPERVISED POPULATION AND RISK PROFILE ................................................................ 8
5. AUTHORISATIONS AND MARKET ENTRY........................................................................... 9 5.1 DUE DILIGENCE REQUESTS ......................................................................................10
6. AML/CFT/CPF EXAMINATIONS AND SUPERVISORY ACTIVITY ...........................................10 6.1 AML/CFT/CPF FINDINGS AND GOOD PRACTICES.......................................................11 6.2 REMEDIATION .........................................................................................................12 6.3 MLRO AND COMPLIANCE OVERSIGHT.......................................................................12 6.4 DIGITAL ASSET SUPERVISION ...................................................................................13 6.5 EFFECT ON COMPLIANCE.........................................................................................14
7. ENFORCEMENT ............................................................................................................14 7.1 PROPORTIONALITY AND DISSUASIVENESS................................................................16
8. PROLIFERATION FINANCING .........................................................................................16
9. SUSPICIOUS TRANSACTION REPORTING........................................................................18
10. INTERNATIONAL AND DOMESTIC COOPERATION ..........................................................19
11. INDUSTRY ENGAGEMENT, GUIDANCE AND PUBLICATIONS............................................20
12. SUPERVISORY AND ENFORCEMENT PRIORITIES FOR 2026 AND BEYOND........................23 ANNEX A: STATISTICAL TABLES INDEX ...............................................................................24 ANNEX B: GLOSSARY AND ABBREVIATIONS .......................................................................24

Securities Commission of The Bahamas AML/CFT/CPF Activity Report Page 4 of 24

1. Foreword I am pleased to present the Securities Commission of The Bahamas’ first Activity Report on its work to counter money laundering, terrorist financing and proliferation financing, covering the years 2021 to 2025. This report is published as part of the Commission’s commitment to transparency and accountability. It sets out, in one place, what the Commission requires of the Financial Institutions (Fis) and Designated Non-Financial Businesses and Professions (DNFBPs) it regulates, how they assess their risk, what its examiners looked at and found, and what consequences followed. Publishing this record allows the public, the industry and our counterpart authorities, at home and abroad, to see how the Commission measures against regulators in other international financial centres, and how The Bahamas stands in the international arena. The five years this report covers were transformative. The Commission risk-rated its entire supervised population in every year of the period; brought the digital asset sector inside the supervisory perimeter and dealt with the consequences of a major exchange failure; more than doubled its annual examination output while building the team that delivers it; and moved from a remediation-led early period to an active penalty practice. Most importantly, the data shows a system that is changing behaviour: examiners are finding fewer deficiencies per examination each year, even as they examine more firms and test harder. This report is one of three, the Commission now publishes about its supervisory work, alongside the Examinations Report and the Digital Asset Supervision and Surveillance Report (to be published September 2026). Together, they are intended to keep the Commission in step with international best practices and to encourage continued progress towards greater effectiveness. The Commission intends to publish this Activity Report annually, at the end of the first quarter. Christina Rolle Executive Director 27 August 2026
2. Introduction and purpose This report sets out the Securities Commission of The Bahamas’ anti-money laundering, countering the financing of terrorism and countering proliferation financing (AML/CFT/CPF) supervisory and enforcement activity for the period 2021 to 2025 across its supervised population of licensees and registrants. This report is written for the Commission’s licensees and registrants and their compliance professionals, for the wider financial services industry and its advisers, for the Bahamian public, and for the Commission’s domestic and international counterparts. Licensees and registrants are encouraged to read the findings in this report against their own AML/CFT/CPF systems, to address any gaps they identify, and to strengthen their frameworks accordingly, the report also shows where

Securities Commission of The Bahamas AML/CFT/CPF Activity Report Page 5 of 24 examiners most often find deficiencies, and firms that act on that information should expect better examination outcomes. Statistics in this report cover the calendar years 2021 to 2025. The supervisory framework is described as it stands at publication, and instruments or programmes commencing in 2026 are expressly dated as such. Figures are drawn from the Commission’s departmental registers and reconcile to the Commission’s published reports; where a published figure is compiled on a different basis, the difference is footnoted where it appears. 2.1 Legislative and regulatory framework The Commission is defined as a Supervisory Authority under the Financial Transactions Reporting Act, 2018, being the agency designated by law for ensuring compliance with the AML/CFT/CPF obligations of the sectors it regulates, and supervises its licensees and registrants for compliance with their AML/CFT/CPF obligations under that Act, the Financial Transactions Reporting Regulations, the Proceeds of Crime Act, the Anti-Terrorism Act, the International Obligations (Economic and Ancillary Measures) Act, 1993 as amended, and the sector-level AML/CFT/CPF Rules the Commission administers for each of its regulatory statutes: the Securities Industry Act, 2024; the Investment Funds Act, 2019; the Financial and Corporate Service Providers Act, 2020; and the Digital Assets and Registered Exchanges Act, 2024. The Financial Transactions Reporting (Wire Transfers) Regulations, 2018 give domestic effect to the FATF travel rule. The reporting period spans a substantial modernisation of this framework. The Securities Industry Act, 2024 repealed and replaced the Securities Industry Act, 2011, and the Digital Assets and Registered Exchanges Act, 2024 replaced its 2020 predecessor, in each case strengthening the Commission’s inspection, information-gathering and sanctioning powers. Statistics in this report are presented on a continuous basis across the statutory transition. 2.2 The Commission’s AML/CFT/CPF mandate The Commission’s supervised population comprises licensees and registrants across the securities industry, investment funds, financial and corporate service providers and digital asset sectors. For the purposes of the FATF standards, licensees and registrants under the Securities Industry Act, the Investment Funds Act and the financial services limb of the Financial and Corporate Service Providers Act are supervised as financial institutions; registrants under the Digital Assets and Registered Exchanges Act are supervised as virtual asset service providers; and licensees under the corporate services limb of the Financial and Corporate Service Providers Act are supervised as designated non-financial businesses and professions in the trust and company service provider category, on a risk-based and proportionate basis. A licensee operating under both limbs is supervised across both in a single engagement. The Commission participates in the national AML/CFT/CPF architecture as a statutory member of the Identified Risk Framework Steering Committee alongside the Office of the Attorney-General, the Financial Intelligence Unit, the Royal Bahamas Police Force and fellow supervisory authorities.

Securities Commission of The Bahamas AML/CFT/CPF Activity Report Page 6 of 24 International supervisory cooperation is conducted through the Commission’s general statutory authority to exchange information with counterparts, the IOSCO multilateral and enhanced memoranda of understanding and the Commission’s bilateral arrangements for information exchange. 2.3 The Commission’s reporting suite This report forms part of a suite of publications through which the Commission reports on its supervisory and enforcement activity: this Activity Report, which carries the Commission’s AML/CFT/CPF supervisory record; the Examinations Report, which carries the full examination programme including non-AML/CFT/CPF findings; the Digital Asset Supervision and Surveillance Report, which carries the digital asset supervision and market surveillance record in depth; and the Enforcement Report (January 2024 – December 2025, published 1 July 2026), a summary report of enforcement activity across the Commission’s full mandate. Figures in this report reconcile to those publications and to the Commission’s source registers; where a figure also appears in the Examinations Report or the Digital Asset Supervision and Surveillance Report, that report’s treatment of its subject matter is the fuller one, while this report carries the fuller AML/CFT/CPF enforcement treatment alongside the summary Enforcement Report. 3. Risk-based approach to AML/CFT/CPF supervision The Commission operates an integrated risk-based supervisory model in which risk assessment, ongoing supervision, onsite examination and enforcement operate as distinct, yet connected functions, each informing the others through defined referral, reporting channels and information flows. The Commission’s risk analytics function maintains the risk assessment architecture; its supervision function conducts ongoing offsite supervision and desk-based reviews; its examinations function conducts onsite examinations selected and scoped by reference to risk; and its enforcement function administers discretionary sanctions and other enforcement tools. Entity risk ratings determine supervisory intensity; examination findings feed back into the risk model as the primary corroborating evidence of whether controls are effective in practice; and enforcement dispositions return to the risk model in the same way. Consistent with the FATF standards on risk￾based supervision, regarding technical compliance and effectiveness the model tests not only whether a regulated person has established the required policies, procedures and controls, but whether those controls are applied in practice and are effective in mitigating the risks identified. 3.1 How the Commission builds and maintains its understanding of risk The Commission has operated risk-based supervision since February 2018, when it risk-rated its entire supervised population for the first time; the architecture described here is the current generation of that framework. The Commission’s risk understanding is maintained at three connected tiers. At the entity tier, every licensee and registrant is assessed across risk dimensions spanning ML/TF/PF (including targeted financial sanctions), governance, operational, financial and prudential soundness, and conduct, combining inherent risk with an assessment of control

Securities Commission of The Bahamas AML/CFT/CPF Activity Report Page 7 of 24 effectiveness in which technical compliance and demonstrated effectiveness are scored separately and the lower rating governs. At the sectoral tier, the Commission conducts sectoral ML/TF/PF risk assessments for the securities and investment funds sector, the virtual asset sector and the financial and corporate services sector, applying the World Bank national risk assessment toolkit consistently with the FATF methodology and in alignment with the national risk assessment cycle. At the emerging and thematic tier, structured horizon scanning, quarterly emerging risk bulletins and thematic assessments capture risks that cross entities and sectors. Each licensee/registrant’s own self-risk assessment (the business-wide ML/TF/PF risk assessment required by section 5 of the Financial Transactions Reporting Act, 2018, and a Commission requirement since March 2019) is quality-assessed against published criteria on a four-point scale, and the quality of that assessment feeds directly into the Commission’s entity-level view of the licensee/registrant’s control environment. Guidance on how Commission licensees and registrants are expected to conduct self-risk assessments, with sector-specific annexes for digital assets, financial and corporate service providers, securities and fund services, was published in 2026. 3.2 How risk ratings and supervisory input shape examination coverage Risk-driven examination selection has a continuous record across the period: the Commission has published annual examination priorities informed by the preceding cycle’s risk ratings since January 2019, with AML/CFT/CPF consistently among the leading priorities. Examination selection is now methodology-governed and keyed to the entity risk architecture. Beginning January 2026, the Commission operates a two-stream examination model: focused AML/CFT/CPF and CRS examinations are scheduled on their own cycle keyed to each entity’s ML/TF/PF risk rating, so that anti-money laundering coverage is driven by financial crime risk specifically rather than by composite risk alone; full-scope examinations are keyed to the entity’s overall priority tier. Under the current methodology, minimum examination frequencies are set by rating band, with higher-risk entities scheduled materially more frequently and the first fully risk-keyed cycle running on the current ratings; a capacity reserve is held for, for-cause examinations arising from supervisory intelligence, complaints handled under the Commission’s complaints handling framework, and referrals. Deferrals and overrides are documented, and deferral of an entity in the highest intensity tier requires Executive Director approval. The supervision function contributes a pre-examination scoping memorandum for each scheduled examination, with final scope resting with the examinations function. 3.3 How STR statistics influence examination priorities The Commission receives suspicious transaction reporting data from the Financial Intelligence Unit under a memorandum of understanding, both periodically and on request. Suspicious transaction reporting data informs supervision at two levels. At the population level, aggregate STR statistics, disaggregated by identified risk type, inform the Commission’s sectoral risk understanding and the weighting of examination priorities. At the entity level, the Commission analyses each regulated person’s reporting behaviour against expectations adjusted for the nature and composition of its

Securities Commission of The Bahamas AML/CFT/CPF Activity Report Page 8 of 24 business: reporting patterns inconsistent with an entity’s risk profile, including a failure to report where the profile indicates reporting would be expected, bear on the Commission’s assessment of the effectiveness of the entity’s controls, influence examination prioritisation and may trigger off￾cycle reassessment. The Commission treats the underlying reporting data with absolute confidentiality; supervisory records and findings refer to reporting behaviour in general terms only. Structured recording of STR-informed examination selection in the examinations register commenced in October 2025, so that the influence of reporting intelligence on selection is itself auditable going forward. 3.4 Data returns and supervisory information Risk-based supervision is fed by structured data collection, a practice as old as the framework itself: the Commission has gathered risk data from its full population since its March 2018 survey and operated an electronic risk platform from 2019 until its supersession by the current risk analytics framework, whose data flows are being consolidated into the data warehouse under the Commission’s regulatory technology and data programme. The Commission’s current instruments include the annual information filing; the Risk Data Return, introduced in 2026 with a first-cycle return across the supervised population and an annual return thereafter, which supplies the inherent-risk, control and operational data on which entity risk ratings are computed; the quarterly Travel Rule Compliance Return (Form TRR-1) for digital asset registrants, introduced in 2026 with a baseline series covering 2022 to the first quarter of 2026; and production of registrants’ self-risk assessments on request. For the digital asset population, these returns are complemented by the Commission’s blockchain analytics capability, applied on a screening basis across the registered population. The regulatory technology and data programme, spanning a supervisory portal, a data warehouse and business intelligence capability, and a supervisory platform, will consolidate these flows and support risk rating, monitoring and evidence retention at scale. 4. Supervised population and risk profile Every licensee and registrant within the Commission’s AML/CFT/CPF remit carries a current risk rating, and the Commission rated the full population at each year end of the period. The population grew in 2021, as the digital asset sector entered the perimeter (the first registrants were licensed under the digital asset regime in the final quarter of 2021 and rated from 2022) and the distribution is heavily concentrated in the medium band, with a small high-risk cohort receiving the most intensive supervisory attention and the low band reflecting entities with limited activity or exposure. Investment funds are risk-assessed at sector level through their administrators and managers rather than rated individually. Table 4.1: Risk-rated population by rating band (as at 31 December) Rating band 2021 2022 2023 2024 2025 High 0 11 0 3 5 Medium 462 456 526 533 507

Securities Commission of The Bahamas AML/CFT/CPF Activity Report Page 9 of 24 Low 0 33 5 3 15 Total 462 500 531 539 527 Source: Risk Analytics Department population and risk extract. Digital asset registrants were first licensed in Q4 2021 and rated from 2022; the Commission assesses investment funds at sector level through their administrators and managers, and they are not included in entity counts. Figure 4.1: Risk-rated population by rating band, 2021–2025 Source: Table 4.1. High-rated entities numbered 0, 11, 0, 3 and 5 at successive year ends. 5. Authorisations and market entry Market entry decisions across the period show that authorisation operated as a genuine control on entry to the market. Between 2021 and 2025 the Commission concluded over 2,600 authorisation decisions across its four regimes. A material share of approvals, including a majority of securities￾sector approvals in some years, were granted subject to conditions, and twenty applications were refused over the period, nineteen of them on fit-and-proper grounds, concentrated in the earlier years of the period. No applications were recorded as withdrawn, during due diligence checks. Refusal cases over the period included applications declined based on beneficial ownership deficiencies and sanctions or adverse media screening grounds identified through the Commission’s due diligence checks. Table 5.1: Authorisation decisions concluded Decision 2021 2022 2023 2024 2025 Approved 692 429 426 257 200 Approved with conditions 212 252 143 20 57 Refused 6 9 4 1 0 of which on fit-and-proper grounds 6 9 4 0 0

Securities Commission of The Bahamas AML/CFT/CPF Activity Report Page 10 of 24 Source: Supervision Department applications summary, by year of decision, across the DARE, FCSP, IFA and SIA regimes. Withdrawals: nil recorded across the period. 5.1 Due diligence requests The Commission exchanges due diligence information with domestic and foreign counterparts in support of authorisation and fitness-and-propriety assessments, including verification of beneficial ownership information, regulatory standing and disciplinary history. Across 2021–2025 the Commission handled 399 due diligence requests (274 issued to counterparts and 125 received) including 23 relating to virtual asset service providers. Median substantive response times ranged between 14 and 22 business days across the period. Table 5.2: Due diligence requests Category 2021 2022 2023 2024 2025 Requests issued by the Commission 42 89 60 30 53 Requests received by the Commission 24 26 27 20 28 of which VASP-related (issued and received) 4 11 2 0 6 Median response time (business days) 16 16 14 22 14 Source: Supervision Department due diligence requests register, by year of request. A further 50 requests were handled between January and July 2026. 6. AML/CFT/CPF examinations and supervisory activity The Commission’s onsite examination typology comprises routine examinations scheduled by risk, for-cause examinations prompted by adverse information or credible intelligence, and thematic reviews focused on specific risks or obligations; the supervision function conducts desk-based reviews as part of ongoing offsite supervision. Onsite examination activity resumed in 2021 following the COVID-19 pandemic, and grew materially through the period (240 examinations were concluded between 2021 and 2025, with annual output more than doubling from 31 in 2021 to 76 in 2025) and examination capacity was built alongside it. Of these, 172 were routine, 4 for-cause and 64 thematic. The 240 examinations concluded in the period reached 240 distinct licensees and registrants, a deliberately breadth-first coverage strategy that carried onsite examination across a wide span of the rated population within a single five-year window, with recurrence now governed by the risk￾keyed cycle under the current methodology. Digital asset registrants received onsite examinations in 2023; onsite coverage of the sector in 2024 and 2025 was provided through an externally commissioned focused review of the digital asset sector, and the focused AML/CFT/CPF and CRS examination stream carries the sector from 2026. Examination selection tracked the risk profile of the population: in 2024 and 2025, the number of examinations of High-rated entities matched the number of entities rated High in the corresponding year-end population, three and five respectively.

Securities Commission of The Bahamas AML/CFT/CPF Activity Report Page 11 of 24 Table 6.1: Examinations concluded Examination type 2021 2022 2023 2024 2025 Routine on-site 31 31 40 60 10 Thematic 0 64 For-cause 0 1 1 0 2 Total 31 32 41 60 76 of which entities rated High at selection 0 3 1 3 5 Source: Examinations Department examinations register, by year concluded. The 2025 thematic figure reflects the thematic review programme conducted in that year. 6.1 AML/CFT/CPF findings and good practices Across the period, the most common AML/CFT/CPF findings clustered in eight areas: (i) identification, verification and initial due diligence, including individual and corporate identity verification, address verification and due diligence at onboarding; (ii) ongoing monitoring, including monitoring of account activity against stated purpose, risk-based monitoring intensity, transaction record maintenance and the currency of due diligence data for higher-risk relationships; (iii) MLRO and compliance officer arrangements, including qualifications, internal reporting procedures, registration of the MLRO with the Financial Intelligence Unit, notification obligations in respect of outsourcing, and physical presence requirements; (iv) training, including annual training obligations, employee awareness of the legislative framework and understanding of internal procedures; (v) disclosure obligations in respect of terrorist property, including quarterly reporting; (vi) customer risk ratings and risk assessments, including the conduct and documentation of the business-wide risk assessment and pre-launch assessments for new products; (vii) policies, procedures and controls, including proportionality to the nature and size of the business and coverage of complex and unusual transactions; and (viii) the treatment of politically exposed persons, including identification systems, source of funds and wealth measures, senior management approval and enhanced ongoing monitoring. Table 6.2: AML/CFT/CPF breaches identified, by category Breach category 2021 2022 2023 2024 2025 TFS / sanctions screening 8 81 74 104 105 CDD: identification and verification 17 36 71 20 36 FIU disclosure / STR obligations 1 21 23 26 24 Policies, procedures and controls 3 28 18 26 17 Risk assessment and risk rating 19 20 9 15 19 Training 12 18 10 23 21 Ongoing monitoring 14 12 5 24 12 MLRO / compliance function 4 23 6 17 7

Securities Commission of The Bahamas AML/CFT/CPF Activity Report Page 12 of 24 Politically exposed persons 4 6 5 11 7 Total categorised AML/CFT/CPF breaches 82 245 221 266 248 Source: Examinations Department breaches register, by year identified. Targeted financial sanctions and sanctions screening, tested against the country-specific orders under the International Obligations (Economic and Ancillary Measures) Act and the Anti-Terrorism Act, and including the annual filing obligations under those orders, is the most frequently identified category across the period, reflecting the intensity with which those obligations are examined. 6.2 Remediation Remediation and enforcement operate as concurrent and independent processes: following the issue of an examination report, licensees and registrants are expected to remediate all identified deficiencies within specified timelines, irrespective of whether enforcement action is taken. Remediation operates on a two-track, severity-driven model administered by a dedicated remediation function. High severity findings require a containment and risk-mitigation plan within thirty days and full remediation within up to ninety days, with monthly progress reporting; Medium severity findings must be remediated within up to one hundred and eighty days, and Low severity findings within up to three hundred and sixty days, each with quarterly reporting. The Commission grants extensions only on written application and with management-level approval, with High severity extensions reported to the Executive Director. Closure is not administrative: the Commission verifies remediation against an evidence-based standard before closing a finding, and follow-up examinations validate remediation where warranted, with failed validation treated as a repeat finding. The remediation record is complete for 2021 through 2024 and current for 2025. A remediation letter was issued to every licensee and registrant examined, covering each finding identified, and every AML/CFT/CPF finding identified between 2021 and 2024 has been fully remediated, with no finding escalated to enforcement for non-remediation. Findings identified in 2025 remain within their prescribed remediation timelines, verified on closure under the rolling regime instituted in October 2025. Table 6.3: AML/CFT/CPF remediation outcomes Measure 2021 2022 2023 2024 2025 Findings subject to remediation 82 245 221 266 248 Findings fully remediated 82 245 221 266 Within timelines Remediation rate 100% 100% 100% 100% – 6.3 MLRO and compliance oversight The Commission’s supervisory expectations distinguish clearly between the responsibilities of the governing body, the board of directors or, in entities not structured with a board, the body charged with governance, and those of the appointed officers. Ultimate responsibility for AML/CFT/CPF

Securities Commission of The Bahamas AML/CFT/CPF Activity Report Page 13 of 24 compliance rests with the board of directors or equivalent governing body and senior management: the board approves the self-risk assessment, the risk tolerance and the AML/CFT/CPF policies and procedures, ensures adequate resources, systems and expertise, receives and challenges regular management information on the operation of the control framework, and satisfies itself that deficiencies are remediated. Neither outsourcing, reliance on third parties, group arrangements nor technology failures relieve the board or senior management of these duties. Every regulated person must appoint a Compliance Officer and a Money Laundering Reporting Officer and register those appointments, the roles being combinable only where proportionate and free of impairing conflict. The MLRO must have sufficient seniority, independence and authority, unfettered access to records and systems, direct access to the board, and freedom from business￾line influence, and is responsible for assessing internal suspicion reports, determining and overseeing STR filings, and maintaining complete records including reasoned decisions not to file. The Compliance Officer operates the day-to-day programme and serves as the principal point of contact with the Commission. The programme must be subject to periodic independent testing on a cycle commensurate with risk, with findings reported to the board and tracked to remediation. These expectations, and the practical evidence the Commission looks for against each of them, are set out in full in the Commission’s consolidated AML/CFT/CPF Guidance Notes; MLRO-related examination findings over the period are reported within section 6.1. 6.4 Digital asset supervision Registrants under the Digital Assets and Registered Exchanges Act, 2024 are supervised as virtual asset service providers under FATF Recommendation 15. Their supervision combines the standing architecture described in this report with capabilities specific to the sector. Market entry applies the Commission’s fit-and-proper and beneficial ownership controls to a statutorily defined set of digital asset activities. The registered population is risk-rated on the entity model, and blockchain analytics are applied on a screening basis across the entire registered population on an annual baseline cycle, supplemented by event-driven screening within defined trigger periods; analytics outputs are treated as intelligence requiring corroboration, never as findings in themselves. Travel rule compliance is monitored through a dedicated programme with quarterly returns and tested onsite within the focused examination stream. The custody regime, including the statutory register of positions and quarterly independent proof-of-reserve reporting for relevant registrants, is examined onsite. The Commission also operates perimeter surveillance for unlicensed digital asset activity, supported by a public Investor Alert List confined to verifiable regulatory status. A wallet declaration framework was issued for public consultation in 2026. The fuller treatment of the Commission’s digital asset supervision and market surveillance record, including the surveillance statistics, is carried in the Digital Asset Supervision and Surveillance Report; the figures in this report reconcile to it.

Securities Commission of The Bahamas AML/CFT/CPF Activity Report Page 14 of 24 6.5 Effect on compliance The clearest quantitative indicator of strengthening compliance is the trend in findings per examination. From its 2022 peak, the number of categorised AML/CFT/CPF findings per examination concluded fell in every year of the remaining period (from 7.7 in 2022 to 5.4 in 2023, 4.4 in 2024 and 3.3 in 2025) over the same period in which annual examination output more than doubled and sanctions screening obligations were examined with increasing intensity. Fewer deficiencies are being found per examination even as examinations look harder, and every finding identified between 2021 and 2024 was fully remediated (section 6.2), so the declining findings curve measures a population that corrected what earlier examinations found. The 2021 figure (2.6) reflects the narrower scope of early-period examinations and is not comparable. Figure 6.1: Examination output and findings intensity, 2021–2025 Sources: Tables 6.1 and 6.2. The 2021 findings-per-examination value (open marker) reflects the narrower scope of early-period examinations and is not comparable with later years. The Commission instituted systematic tracking of repeat findings and remediation verification in the examinations register in October 2025, enabling repeat-finding trend measurement from the current cycle forward; in the first partial cycle, forty deficiencies were assessed for remediation, eight were verified closed against the evidence-based standard, and none required escalation to enforcement for non-remediation. 7. Enforcement The shape of the enforcement record over the period reflects the Commission’s deliberately graduated model rather than any absence of consequence. In the early years of the period, identified AML/CFT/CPF deficiencies were addressed principally through binding remediation obligations, supervisory directions and public notices, with the Commission’s penalty schedule (published since 2019 under the Group of Financial Services Regulators’ harmonisation initiative) setting the tariff in

Securities Commission of The Bahamas AML/CFT/CPF Activity Report Page 15 of 24 reserve. From 2024, with the quantification methodology and settlement framework fully operational, the Commission moved decisively to administrative penalties: sixty-eight AML/CFT/CPF penalties were concluded in 2024–2025, a majority resolved by settlement and a substantial minority proceeding through appeal, itself evidence that penalties are contested because they bite. The progression from remediation-led supervision to an active penalty practice was the designed operating path of the framework, and the remediation obligation continues to run concurrently and independently of every enforcement outcome. Matters reach enforcement through examination escalation, through complaints assessed under the Commission’s complaints handling framework, and through referrals and supervisory intelligence, so that every intake channel connects to the same graduated consequence architecture; the register records examination referral as the origin of the substantial majority of AML/CFT/CPF enforcement matters, with market surveillance and other channels supplying the remainder. Table 7.1: AML/CFT/CPF enforcement actions and penalties Measure 2021 2022 2023 2024 2025 Administrative penalties: number 0 43 25 Administrative penalties, value imposed (BSD) – – – 221,570,600 142,650 of which single largest settlement (BSD) – – – 221,100,000 – Public notices 10 6 5 10 5 Other measures (directives, revocations) 0 2 1 Sources: Enforcement Department register. Figure 7.1: AML/CFT/CPF enforcement actions by year Source: Table 7.1, register basis. Public notices ran throughout the period; administrative penalties commenced in 2024 under the operationalised penalty framework.

Securities Commission of The Bahamas AML/CFT/CPF Activity Report Page 16 of 24 7.1 Proportionality and dissuasiveness Enforcement sits at the top of a graduated architecture: remediation obligations apply to every deficiency; supervisory measures and automatic administrative penalties address defined contraventions; discretionary administrative penalties, settlements and disciplinary proceedings address more serious misconduct; and criminal conduct is referred to the Royal Bahamas Police Force. Settlements are, in practice, the primary resolution route, and every approved settlement is published alongside final decisions. The largest settlement of the period, concluded with the joint official liquidators of a digital asset exchange and published on the Commission’s website, subordinates the Commission’s penalty claim in favour of the entity’s customers and creditors in the liquidation, consistent with the subordination of claims by other international regulators in the same proceedings. Transparency about sanctions predates the current methodology: the Commission has issued its AML/CFT/PF penalty schedule, developed as part of the Group of Financial Services Regulators’ initiative to harmonise penalty standards across the domestic financial sector, to licensees and registrants and published it on its website since 2019, alongside the Commission’s policy standards for the assessment of administrative penalties. Discretionary penalties are now administered under a structured quantification methodology designed to ensure that sanctions are effective, proportionate and dissuasive: the benefit derived from the contravention is disgorged first, with interest; the punitive element is then set by banding the seriousness of the contravention against the applicable statutory maximum, adjusted for aggravating and mitigating factors and for deterrence, with ability to pay operating only in reduction; and staged settlement discounts and quantified cooperation credit apply to the punitive element only, never to disgorgement. Individual accountability is considered in every matter involving a firm. Penalty proceeds are ring-fenced by statute and expendable only on public education, charitable objectives or specified capital projects, so that sanctions serve the public interest rather than the Commission’s revenues. 8. Proliferation financing The Commission treats proliferation financing risk, consistently with the FATF standards, as the risk of breach, non-implementation or evasion of the targeted financial sanctions obligations relating to proliferation. Countering that risk is embedded at every tier of the framework rather than held in a standalone silo. Designation updates are disseminated to the supervised population under a standing dissemination procedure operated by the Commission, against a registrant contact list verified quarterly. Every registrant’s self-risk assessment must address proliferation financing as a fundamental element, an assessment that omits it cannot be rated better than Weak on the Commission’s published criteria. At the entity tier, sanctions exposure informs inherent risk and targeted financial sanctions screening is tested within control effectiveness; at the examination tier, the focused AML/CFT/CPF programme carries a core test on targeted financial sanctions, freezing without delay and proliferation financing; suspicious transaction reporting is disaggregated to identify PF-related reports; and the enforcement toolkit expressly covers targeted financial sanctions and proliferation financing contraventions. Industry-facing tooling reinforces the reporting

Securities Commission of The Bahamas AML/CFT/CPF Activity Report Page 17 of 24 leg of the regime: standardised targeted financial sanctions reporting forms, harmonised across the Group of Financial Services Regulators, were issued with accompanying guidance in 2025, together with guidelines on countering proliferation financing published in the same year. Examination outcomes reinforce the same picture: targeted financial sanctions obligations, including the annual filing obligations under the country-specific orders, are the most intensively examined and most frequently cited area in the Commission’s AML/CFT/CPF examinations, as Table 6.2 records. The Commission’s dissemination record evidences this in practice. Between January 2021 and the end of 2025, the Commission transmitted 93 United Nations Security Council designation notices to its supervised population, with a further 15 transmitted in the first seven months of 2026. Classified against the United Nations sanctions committee records, nine of these were proliferation financing designations under the DPRK regime established by resolution 1718 (2006), and the record is complete: the Commission transmitted every list amendment issued by the 1718 Committee in the period, with the nil years reflecting committee inactivity rather than any transmission gap. Proliferation financing notices were disseminated in an average of under three calendar days from United Nations publication; across all regimes, the median time to dissemination was three calendar days, with 78 of 108 notices transmitted within five. Table 8.1: UNSC designation notices transmitted to the supervised population Measure 2021 2022 2023 2024 2025 Designation notices transmitted 20 21 22 19 11 of which proliferation financing (DPRK 1718 regime) 0 3 2 4 0 Median calendar days to dissemination 4 1 2 5 6 Source: Commission transmission record, classified against United Nations sanctions committee press-release records. The 1718 Committee issued no list amendments in 2021 or 2025; the Commission transmitted all nine amendments issued in the period, in an average of under three calendar days. A further 15 notices were transmitted between January and July 2026, none of which related to the DPRK regime. Remaining notices relate to the ISIL (Da’esh) and Al-Qaida and other United Nations sanctions regimes; the regime-level attribution of the full series is maintained in the Commission’s classified transmission register.

Securities Commission of The Bahamas AML/CFT/CPF Activity Report Page 18 of 24 Figure 8.1: UNSC designation notices transmitted, 2021–2025 Source: Table 8.1. Every DPRK-regime (1718 Committee) amendment issued in the period was transmitted; nil PF years reflect committee inactivity. 9. Suspicious transaction reporting Suspicious transaction reports filed by the Commission’s supervised population totalled 1,327 across the period. The series is strongly event-driven: the 2022 figure reflects the collapse of a single digital asset exchange, to which 330 of that year’s reports related. That entity was at the time the second largest digital asset exchange globally, and measured against the scale of its transaction volumes the reporting level was proportionate rather than abnormal. Beyond that concentration, the growth in 2024 and 2025 reflects both the expansion of the supervised digital asset population and intensified supervisory attention to reporting obligations. Table 9.1: Suspicious transaction reports filed, by sector Sector 2021 2022 2023 2024 2025 Digital asset registrants 4 342 34 164 206 Securities industry firms 53 78 33 111 280 Corporate service providers 6 5 1 5 3 Financial service providers 0 1 0 0 1 Total 63 426 68 280 490 Source: Financial Intelligence Unit quarterly statistics, stated for calendar years. Of the 2022 digital asset sector reports, 330 related to a single exchange. Corporate and financial service providers are both licensed under the Financial and Corporate Service Providers Act, 2020 and are distinguished here per the source series.

Securities Commission of The Bahamas AML/CFT/CPF Activity Report Page 19 of 24 Figure 9.1: Suspicious transaction reports filed, 2021–2025 Source: Table 9.1. The 2022 figure includes 330 reports relating to the collapse of a single digital asset exchange. 10. International and domestic cooperation The Commission provides constructive and timely assistance to foreign counterparts, principally under the IOSCO Multilateral Memorandum of Understanding and, for the most expansive assistance, the Enhanced MMoU; where a counterpart is not a signatory, assistance may be provided under the Commission’s information-sharing authority in the Securities Industry Act, 2024 (also mirrored in the Investment Funds Act, 2019, the Financial Corporate Service Providers Act, 2020 and the Digital Assets and Registered Exchanges Act, 2024). Between 2021 and 2025 the Commission handled 80 international cooperation requests: 76 received from foreign authorities and four made by the Commission to counterparts. Thirty of the eighty related to virtual asset service providers, concentrated in the digital asset market events of 2022. No request handled during the period related to proliferation financing, consistent with the jurisdiction’s proliferation risk assessment. Of the requests received, 70 were completed, two were declined on the ground that they fell outside the scope of the IOSCO MMoU, three were withdrawn by the requesting authority, and one remained open at period end. Against the Commission’s benchmarks of two to fourteen days for initial response and ninety days for completion, requests were acknowledged within a median of three business days, with 94 percent acknowledged within benchmark. Where completion extended beyond the benchmark, the additional time was attributable to the requesting authority’s own supplementary requests following transmission of the initial information, requests for further clarification, or the need to obtain assistance from third parties; in no instance did an extended timeframe arise from an inability or unwillingness on the Commission’s part to provide the assistance sought, and requesting authorities were kept informed of progress throughout.

Securities Commission of The Bahamas AML/CFT/CPF Activity Report Page 20 of 24 The practical value of the assistance provided is directly evidenced, as requesting authorities regularly submitted follow-up requests building on the information supplied, and sought the Commission’s consent to use or onward-share that information, including in enforcement and criminal proceedings, consent was granted in six matters during the period. The Commission issues a feedback form on the closure of every completed incoming request. The Commission also received spontaneous disclosures and made unsolicited exchanges where information warranted it, and cooperates domestically with the Royal Bahamas Police Force the Financial Intelligence Unit and fellow regulators, including assistance to law enforcement investigations that resulted in the issue of public warning notices. Table 10.1: Cooperation requests Category 2021 2022 2023 2024 2025 International requests received 14 22 11 15 14 International requests issued 2 1 1 0 0 of which VASP-related (all international) 8 13 5 3 1 Median initial-response time (business days) 3 Domestic cooperation requests 2 1 2 1 4 Source: Office of Legal Counsel international and domestic cooperation registers, by year received or sent. International channels across the period: 66 matters under the IOSCO MMoU and 17 under the Enhanced MMoU (including 2026 to date). Benchmarks: two to fourteen days for initial response (75 of 80 requests (94 percent) acknowledged within benchmark) and ninety days for completion. PF-related requests: nil, consistent with the jurisdiction’s proliferation risk assessment; one TF-related request (2022); fourteen requests handled on an urgent or expedited basis. A further three international and four domestic requests were handled between January and July 2026. 11. Industry engagement, guidance and publications The Commission promotes a clear understanding of AML/CFT/CPF obligations and risks through published guidance, consultation and structured outreach. The current guidance architecture includes the Guidance Note on Self-Risk Assessments with sector-specific annexes for digital assets, financial and corporate service providers, and securities and fund services; the Travel Rule Guidance Note and accompanying industry notice and return; and consolidated Guidance Notes on AML/CFT/CPF (scheduled to be published in September 2026) including the treatment of politically exposed persons, structured around statements of the Commission’s expectations so that regulated persons can see the practical evidence supervision will look for. The Commission consults publicly where new obligations are proposed (including the 2026 consultations on self-risk assessments at the authorisation stage and on the wallet declaration framework) and publishes questions and answers of general application arising from its returns. A structured outreach calendar engages each sector in turn, and the Commission publishes plain-language statements of its supervisory and examination approach so that regulated persons know how they will be supervised.

Securities Commission of The Bahamas AML/CFT/CPF Activity Report Page 21 of 24 Structured engagement predates the reporting period (the Commission has published annual examination priorities since 2019 and delivered compliance workshops, industry briefings and agent training through 2019 and 2020) and the period record continues that practice. The Commission’s communications register records 182 stakeholder engagements between 2021 and 2025 (69 local and 113 international) counted per interaction and therefore including the Commission’s standing participation in international committees and working groups, which accounts for 89 register entries across the IOSCO Committee on Regulation of Market Intermediaries, the Committee on Enforcement and the Exchange of Information, the Inter-American Regional Committee, the Fintech Task Force and the Assessment Committee, alongside membership of the Global Financial Innovation Network since 2020 and co-chairmanship of the IFIE Americas Chapter Caribbean Working Group from 2023. Local engagement intensified markedly across the period, quadrupling from six engagements in 2021 to twenty-four in 2025. Where attendance was recorded, individual engagements drew substantial audiences: an industry update on the digital asset regime drew over four hundred participants, sector briefings on the investment funds and securities frameworks drew over two hundred each, and two general industry briefings in 2025 drew over two hundred and forty each. AML/CFT/CPF-specific engagement ran through the period: the Commission presented its virtual asset risk-assessment experience at a World Bank workshop in 2022 and an IMF roundtable in 2023, presented on enhancing AML risk assessments at an ACAMS session in 2024, hosted compliance￾community sessions with the Bahamas Association of Compliance Officers in 2023 and 2024, and in 2025 delivered authorised agent training, participated in the Central Bank’s financial literacy seminar and expo, and held two general industry briefings on international priorities and initiatives. Figure 11.1: Stakeholder engagements by year Source: Commission communications register, counted per interaction including standing committee participation.

Securities Commission of The Bahamas AML/CFT/CPF Activity Report Page 22 of 24 Table 11.1: Engagement and publications summary Measure 2021 2022 2023 2024 2025 Engagements: total 28 33 43 38 40 of which local 6 9 10 20 24 of which international 22 24 33 18 16 of which AML/CFT/CPF￾specific 0 3 1 1 5 Publications issued 7 5 2 5 4 Source: Commission communications register, counted per interaction, including standing committee and working-group participation. AML/CFT/CPF obligations additionally feature as standard elements within broader engagements, including agent training and general industry briefings. The Commission also carried its supervisory experience outward: it participated in the Toronto Centre and IOSCO risk-based supervision programme in 2023, co-hosted the D3 Bahamas digital assets conference in 2023, and presented its supervisory experience of the digital asset exchange collapse at international fintech fora in 2024 and 2025. A sustained investor-protection media campaign ran through 2025, with repeated radio engagements on investment fraud and scams, public education of the kind to which penalty proceeds are statutorily directed. Beyond individual engagements, the Commission maintains standing international participation: service on the IOSCO Board and its committees, membership of the Global Financial Innovation Network since 2020, and co-chairmanship of the IFIE Americas Chapter Caribbean Working Group from 2023. A significant investment in the jurisdiction’s own capacity is the Commission’s partnership, formalised in October 2023, with the University of Cambridge and the University of The Bahamas to deliver the FinTech and Regulatory Innovation programme, a twelve-week, tutor-led programme powered by the Cambridge Centre for Alternative Finance at Cambridge Judge Business School and delivered locally by the University of The Bahamas. The programme trains Bahamian financial, legal and compliance professionals and regulators in the technologies and business models transforming financial services and in the regulatory responses to them, contextualised with Bahamian case studies and coverage of the jurisdiction’s own digital asset framework, with graduates certified under the insignia of both universities. The first cohort completed the programme in 2024, a second followed in 2025, and the collaboration continues with further certificated digital asset and fintech courses in 2026, building, within the jurisdiction, the professional expertise on which effective regulation and compliant industry alike depend. The Commission’s publications over the period, twenty-three in the register, include its annual examinations, supervisory and enforcement priorities; consultation papers preceding new obligations, including the digital asset AML/CFT rules; the published summary of national risk assessment findings and the national AML strategy circulated to industry in 2024; and, in 2025, the Group of Financial Services Regulators’ targeted financial sanctions reporting forms with accompanying guidance, and guidelines on countering proliferation financing. The directive requiring the conduct of self-risk assessments was reissued to industry in July 2021, and in August

Securities Commission of The Bahamas AML/CFT/CPF Activity Report Page 23 of 24 2026 the Commission issued its consolidated self-risk assessment instrument suite to industry for consultation. 12. Supervisory and enforcement priorities for 2026 and beyond The Commission publishes its supervisory priorities annually, and its 2026 priorities are published in full in the Commission’s 2026 Priorities statement. The AML/CFT/CPF elements of that programme, and the direction of travel beyond 2026, are summarised here. The year is anchored by the Fifth Round Mutual Evaluation of The Bahamas, and the standard against which the Commission has organised its work is demonstrated effectiveness, not the existence of a framework, but evidence that it changes behaviour. In supervision, 2026 is the first year in which the full examination programme runs on the risk-keyed cycle under the current methodology: focused AML/CFT/CPF examinations have operated as a separate stream on their own schedule since January, the Commission draws selections against current entity risk ratings computed from the first-cycle Risk Data Return, and digital asset registrants and higher-risk financial and corporate service providers are prioritised. A thematic AML/CFT/CPF review will run across all four of the Commission’s regimes, focusing on the conduct and quality of self-risk assessments, the risk-based approach to monitoring, know-your-customer performance, record maintenance, the treatment of politically exposed persons, complaints handling, training, and compliance with reporting obligations. Desk-based reviews will carry AML/CFT/CPF compliance testing into the offsite programme, with dedicated attention to newly licensed entities in their first twelve to eighteen months of operation, and the Commission’s sectoral risk assessments will be updated alongside work on emerging risks, including cybersecurity, decentralised finance and the misuse of artificial intelligence. In enforcement, the consequence framework escalates. From 2026, the Commission is enforcing financial penalties for cited AML/CFT/CPF breaches on an extrapolated basis: where sample-based examination testing identifies breaches, the results will be extrapolated to the licensee’s full client population and penalties assessed accordingly, a deliberate strengthening of dissuasion directed at recurring deficiencies. Penalty collection, referral of criminal conduct for prosecution, and continued investment in investigative capability, including online investigations and asset recovery, complete the enforcement programme. The capability investments continue in parallel: the examinations function is being grown to thirty members by the end of 2026, supervision capacity is being expanded, the consolidated self-risk assessment instrument suite completes consultation in September 2026, and the Commission’s data warehouse will consolidate its supervisory data flows. The repeat-findings series instituted in October 2025 will mature into a published effectiveness measure, and the Commission will report against these priorities in the next edition of this report.

Securities Commission of The Bahamas AML/CFT/CPF Activity Report Page 24 of 24 Annex A: Statistical tables index Tables: Table 4.1, Risk-rated population by rating band (as at 31 December); Table 5.1, Authorisation decisions concluded; Table 5.2, Due diligence requests; Table 6.1, Examinations concluded; Table 6.2, AML/CFT/CPF breaches identified, by category; Table 6.3, AML/CFT/CPF remediation outcomes; Table 7.1, AML/CFT/CPF enforcement actions and penalties; Table 8.1, UNSC designation notices transmitted to the supervised population; Table 9.1, Suspicious transaction reports filed, by sector; Table 10.1, Cooperation requests; Table 11.1, Engagement and publications summary. Figures: Figure 4.1, Risk-rated population by rating band, 2021–2025; Figure 6.1, Examination output and findings intensity, 2021–2025; Figure 7.1, AML/CFT/CPF enforcement actions by year; Figure 8.1, UNSC designation notices transmitted, 2021–2025; Figure 9.1, Suspicious transaction reports filed, 2021–2025; Figure 11.1, Stakeholder engagements by year. Each figure is generated from the table it accompanies. Annex B: Glossary and abbreviations Term Meaning AML/CFT/CPF Anti-money laundering, countering the financing of terrorism and countering proliferation financing BO Beneficial ownership CDD Customer due diligence CRS Common Reporting Standard DARE Digital Assets and Registered Exchanges Act, 2024 DPRK Democratic People’s Republic of Korea FCSP Financial and corporate service provider (Financial and Corporate Service Providers Act, 2020) FIU Financial Intelligence Unit IFA Investment Funds Act, 2019 IFIE International Forum for Investor Education IOSCO International Organization of Securities Commissions MLRO Money Laundering Reporting Officer MMoU / EMMoU IOSCO Multilateral Memorandum of Understanding / Enhanced Multilateral Memorandum of Understanding PF Proliferation financing SIA Securities Industry Act, 2024 STR Suspicious transaction report TFS Targeted financial sanctions UNSC United Nations Security Council VASP Virtual asset service provider