Securities and Exchange Commission of Pakistan (Anti Money Laundering and Countering Financing of Terrorism) Regulations, 2018

Page 1 of 21 Government of Pakistan Securities and Exchange Commission of Pakistan -.-.- Islamabad, the 13th June, 2018 NOTIFICATION S. R. O. 770 (I)/2018. In exercise of the powers conferred under section 40 read with clause (w) of sub-section (4) of section 20 of the Securities and Exchange Commission of Pakistan Act, 1997 (XLII of 1997), upon recommendation of Financial Monitoring Unit established under section 6 of the Anti Money Laundering Act, 2010 (VII of 2010) and in consultation with the Policy Board, the Securities and Exchange Commission of Pakistan is pleased to make the following regulations, the same having being previously published in the official Gazette vide S.R.O. 557(I)/2018, dated April 26, 2018 as required under sub-section (2) of said section 40, namely:- CHAPTER I PRELIMINARY

1. Short Title and Commencement.- These regulations shall be called the Securities and Exchange Commission of Pakistan (Anti Money Laundering and Countering Financing of Terrorism) Regulations, 2018. (2) They shall come into force at once.
2. Definitions.- (1) In these regulations, unless there is anything repugnant in the subject or context,- (a) “AML Act” means Anti Money Laundering Act, 2010 (VII of 2010); (b) “AML/CFT” means Anti-Money Laundering and Countering Financing of Terrorism; (c) “Annexure” means annexures appended to these regulations; (d) “beneficial owner” in relation to a customer of a regulated person means, the natural person who ultimately owns or control a customer or the natural person on whose behalf a transaction is being conducted and includes the person who exercise ultimate effective control over a person or a legal arrangement; (e) “beneficiary” for the purposes of these regulation shall include,- (i) in case of trust, is the person or persons who are entitled to

Page 2 of 21 the benefit of any trust arrangement; (ii) in the context of life insurance/takaful, life-contingent annuity contracts or another investment linked insurance/takaful policy, is a natural or legal person, or a legal arrangement, or category of persons, who will be paid the policy proceeds when or if an event occurs, which is covered by the policy; (f) “business relations” means provision of any service by the regulated person regulated by the Commission under the administered legislation; (g) “Commission” means Securities and Exchange Commission of Pakistan established under section 3 of the Securities and Exchange Commission of Pakistan Act, 1997; (h) “control” shall have the same meaning as assigned to it in clause (xiii) of sub-regulations (1) of regulation 2 of Securities Act, 2015 (III of 2015); (i) “correspondent relationship” means a relationship between the regulated person (Correspondent), or any party acting on its behalf and processing orders on behalf of the regulated person, and an intermediary (Respondent) which is regulated and supervised by a supervisory authority, transmitting orders on behalf of its underlying customers; (j) “Currency Transaction Report or CTR” has the same meaning as assigned to it clause (c) of section 2 of AML Act; (k) “Financing of Terrorism” means financing of terrorist acts, and of terrorists and terrorist organizations; (l) “Financial group” means a group that consists of a parent company or of any other type of legal person exercising control and coordinating functions over the rest of the group for the application of group supervision, together with branches and/or subsidiaries that are subject to anti-money laundering and counter financing of terrorism policies and procedures at the group level; (m) “FMU” means Financial Monitoring Unit established under section 6 of the AML Act; (n) “Insurer” shall have the same meaning as assigned to it in the Insurance Ordinance, 2000 (XXXIX of 2000); (o) “Legal arrangements” means express trusts or other similar legal

Page 3 of 21 arrangements; (p) “Legal persons” means entities other than natural persons or a legal arrangement that can establish a permanent customer relationship with a regulated person or otherwise own property and include companies, bodies corporate, foundations, partnerships, or associations and other relevantly similar entities; (q) “Non-Banking Finance Companies or NBFCs” shall have the same meaning as assigned to it in Part VIII A of the Companies Ordinance, 1984 (XLVII of 1984); (r) “Offense of Money laundering” (ML) has the same meaning as assigned to it in the AML Act; (s) “Person” shall have the same meaning as assigned to it clause (o) of section 2 of AML Act; (t) “Politically exposed persons” or “PEPs” includes- (i) foreign PEPs, individuals who are or have been entrusted with prominent public functions by a foreign country, for example Heads of State or of government, senior politicians, senior government, judicial or military officials, senior executives of state owned corporations, important political party officials; (ii) domestic PEPs, individuals who are or have been entrusted domestically with prominent public functions, for example Heads of State or of government, senior politicians, senior government, judicial or military officials, senior executives of state owned corporations, important political party officials; (iii) persons who are or have been entrusted with a prominent function by an international organization, means members of senior management and members of the board or equivalent functions: Provided that middle ranking or more junior individuals in the above referred categories are not included in the definition of PEPs; (u) “regulated person” for the purposes of these regulations means securities brokers, commodities brokers, Insurers, Takaful Operators, NBFCs and Modarabas; (v) “risk based approach or RBA” means applying measures to prevent or mitigate money laundering and terrorist financing risks that are commensurate with the risks identified; (w) “Risk” refers to risk associated with money laundering and financing

Page 4 of 21 of terrorism; (x) “senior management” includes, chief executive officer/ managing director, deputy managing director, chief operating officer, company secretary, chief financial officer, chief compliance officer and chief regulatory officer or holder of such positions by whatever name called; and (y) “Suspicious Transaction Report or STR” shall have the same meaning as assigned to it in clause (y) of section 2 of AML Act. 2. The words and expressions used in these regulations but not defined shall have the same meaning as assigned to them under the AML Act, Securities and Exchange Commission of Pakistan Act, 1997 and administered legislation thereunder. CHAPTER II PROCESS FOR RISK ASSESSMENT AND CUSTOMER DUE DILIGENCE 3. Risk Assessment.- (1) A regulated person shall take appropriate steps to identify, assess and understand, its money laundering and terrorism financing risks in relation to- (a) its customers; (b) the jurisdictions or countries its customers are from or in; (c) the jurisdictions or countries the regulated person has operations or dealings in; and (d) the products, services, transactions and delivery channels of the regulated person. (2) The appropriate steps referred to in sub-regulation (1), shall include- (a) documenting the regulated person risk assessments; (b) considering all the relevant risk factors before determining the level of overall risk and the appropriate type and extent of mitigation to be applied; (c) keeping the risk assessments up-to-date; (d) categorizing the overall entity level risk as high, medium or low based on the result of risk assessment; and (e) having appropriate mechanisms to provide its risk assessment information to the Commission. 4. Risk Mitigation and Applying Risk Based Approach.- A regulated person shall- (a) develop and implement policies, procedures and controls, which are approved by its board of directors, to enable the regulated person to effectively manage and mitigate the risks that are identified in the risk assessment of ML/TF or notified to it by the Commission;

Page 5 of 21 (b) monitor the implementation of those policies, procedures and controls and enhance them if necessary; (c) perform enhanced measures where higher risks are identified, to effectively manage and mitigate those higher risks; and (d) have an independent audit function to test the system. 5. New Products, Practices and Technologies.- A regulated person shall- (a) identify and assess the money laundering and terrorism financing risks that may arise in relation to- (i) the development of new products and new business practices, including new delivery mechanisms; and (ii) the use of new or developing technologies for both new and pre￾existing products; (b) undertake the risk assessments, prior to the launch or use of such products, practices and technologies, and shall take appropriate measures to manage and mitigate the risks. (c) in complying with the requirements of clauses (a) and (b), pay special attention to any new products and new business practices, including new delivery mechanisms; and new or developing technologies that favor anonymity. 6. Customer Due Diligence.- (1) No regulated person shall open or maintain anonymous account or an account in fictitious name. (2) Regulated person shall apply CDD measures when establishing business relationship with a customer and when there is doubt about the veracity or adequacy of previously obtained customer identification data. (3) Customer due diligence (CDD) in broader term include- (a) identifying the customer or beneficial owner and verifying the customer’s/beneficial owner’s identity on the basis of documents, data or information obtained from customer and/or from reliable and independent sources; (b) understanding and, as appropriate, obtaining information on the purpose and intended nature of the business relationship; and (c) monitoring of accounts/transactions on ongoing basis to ensure that the transactions being conducted are consistent with the regulated person knowledge of the customer, the customer’s business and risk profile, including, the source of funds and, updating records and data/ information to take prompt action when there is material departure from usual and expected activity through regular matching with information

Page 6 of 21 already available with regulated person. (4) Regulated person shall obtain such documents from different types of customers as provided in Annexure–I. (5) Regulated person should verify the identity of the customer and beneficial owner before or during the course of establishing a business relationship or may complete verification after the establishment of the business relationship, provided that- (a) this occurs as soon as reasonably practicable; (b) this does not interrupt the normal conduct of business; and (c) the ML/TF risks are effectively managed. (6) Regulated person shall adopt risk management procedures concerning the conditions under which a customer may utilize the business relationship prior to verification. The types of circumstances where the regulated person permits completion of verification after the establishment of the business relationship should be recorded in their CDD policies. (7) For all persons, regulated person should determine whether the person is acting on behalf of a customer and should take reasonable steps to obtain- (a) evidence to determine authority of such person to act on behalf of the customer, which shall be verified through documentary evidence including specimen signature of the customer; (b) identification and verification of the person purporting to act on behalf of the customer; (c) identification and verification of the customer; (8) Each customer shall be categorized as high or low risk, depending upon the outcome of the CDD process; (9) Regulated person will maintain a list of all such customers/accounts where the business relationship was refused or needed to be closed on account of negative verification; (10) Regulated person are required to apply CDD requirement to its existing customers on the basis of materiality and risk and should conduct due diligence on existing relations at appropriate times, taking into account whether and when CDD measures have previously been undertaken and the adequacy of data obtained; (11) Where regulated person are not able to satisfactorily complete

Page 7 of 21 required CDD measures, account shall not be opened or any service provided and consideration shall be given if the circumstances are suspicious so as to warrant the filing of an STR and where CDD of an existing customer is found unsatisfactory, the relationship should be treated as high risk and reporting of suspicious transaction be considered in accordance with regulation 14; (12) Where regulated person forms a suspicion of money laundering or terrorist financing, and it reasonably believes that performing the CDD process will tip-off the customer, it may not pursue the CDD process, and instead should file an STR in accordance with regulation 14. (13) Government entities accounts shall not be opened in the personal names of the government officials and account which is to be operated by an officer of the Federal or Provincial or Local Government in his/her official capacity, shall be opened only on production of a special resolution or authority from the concerned administrative department or ministry duly endorsed by the Ministry of Finance or Finance Department/Division of the concerned Government. The regulated person shall also take into account any rules, regulations or procedures prescribed in the governing laws of such entities relating to opening and maintaining of their bank accounts. Explanation:- For the purposes of this regulation the expression “Government entities” includes a legal person owned or controlled by a Provincial or Federal Government under Federal, Provincial or local law. 7. Beneficial Ownership of Legal Persons and Legal Arrangements.- (1) Where the customer is a legal person, in addition to other measuresthe regulated person shall- (a) understand the nature of the customer’s business and its ownership and control structure; (b) identify and verify the identity of the natural persons (whether acting alone or together) who ultimately own the legal person by obtaining relevant information from the customer as per Annexure-I; (c) where there is doubt under clause (b) as to whether the natural persons who ultimately own the legal person are the beneficial owners or where no natural persons ultimately own the legal person, identify the natural persons (if any) who ultimately control the legal person or have ultimate effective control of the legal person; and (d) where no natural persons are identified under clause (b) or (c), identify the natural persons having executive authority in the legal person, or in equivalent or similar positions. (2) Where the customer is a legal arrangement, the regulated person shall- (a) for trusts, identify and verify the identity of the settlor, the trustee,

Page 8 of 21 the protector (if any), the beneficiaries (including every beneficiary that falls within a designated characteristic or class), and any natural person exercising ultimate ownership, ultimate control or ultimate effective control over the trust (including through a chain of control or ownership); and (b) for other types of legal arrangements, identify and verify the identity of persons in equivalent or similar positions, as those described under clause (a). 8. Identification of Beneficiary for Life Insurance or Takaful Policies.- (1) In addition to all other requirements of these regulations, an insurer/ takaful operator shall conduct the following CDD measures for the beneficiary of life insurance or takaful and other insurance or takaful related policies as soon as beneficiary of such policy is identified or designated- (a) for a beneficiary that is identified as specifically named natural person, legal person or legal arrangement, obtain the full name and identity, of such beneficiary; (b) for a beneficiary that is designated by characteristics, class or other means and is known to the regulated person, obtain sufficient information concerning the beneficiary to satisfy that it will be able to establish the identity of the beneficiary at the time of payout; (c) for both the above cases, the verification of the identity of the beneficiary should occur at the time of the payout; (2) An insurer/ takaful operator shall take reasonable measures at the time of the payout, to determine whether the beneficiaries and/or, where applicable, the beneficial owner of the beneficiary are politically exposed persons and where higher risks are identified, an insurer or takeful operator should be required to inform senior management before the payout of the policy proceeds, to conduct enhanced scrutiny of the whole business relationship with the policyholder, and to consider making a suspicious transaction report. (3) An insurer/ takaful operator shall include the beneficiary of a life insurance policy as a relevant risk factor in determining whether enhanced due diligence (EDD) measures are applicable under regulation 9 and where an insurer/ takaful operator determines that a beneficiary who is a legal person or a legal arrangement presents a higher risk, it shall take enhanced measures, which include reasonable measures to identify and verify the identity of the beneficial owner of the beneficiary, at the time of payout. 9. Enhanced Due Diligence.- (1)Regulated person shall implement appropriate internal risk management systems, policies, procedures and controls to determine if any customer presents high risk of ML/TF. (2) For the purposes of sub-regulation (1), circumstances where a customer presents high risk of ML/TF include but are not limited to the following-

Page 9 of 21 (a) customers/ policy holders belonging to countries which are non￾compliant with anti-money laundering regulations according to FATF; (b) such body corporate, partnerships, associations and legal arrangements including non-governmental organizations or not-for￾profit organizations which receive donations; and (c) legal persons or arrangements with complex ownership structures. (3) Regulated person shall perform appropriate enhanced due diligence (EDD) measures with customers that are identified as high risk by the regulated person or are notified as such by the Commission. (4) EDD measures include but are not limited to the following- (a) obtain approval from regulated person senior management to establish or continue business relations with such customers; (b) establish, by appropriate means, the sources of wealth and/or funds or beneficial ownership of funds, as appropriate; including regulated person’ own assessment to this effect; and (c) conduct during the course of business relations, enhanced monitoring of business relations with the customer. 10. Politically Exposed Persons (PEPs).- (1) In relations to foreign and domestic PEPs, regulated person shall implement appropriate internal risk management systems, policies, procedures and controls to determine if any customer or a beneficial owner is a PEP. (2) In case of foreign PEPs, regulated person shall perform EDD in accordance with sub-regulation (4) of regulation 9, in addition to other requirements of these regulations. (3) In case of domestic PEPs, where business relationship poses higher risk, regulated person shall carry out EDD in accordance with sub-regulation (4) of regulation 9, in addition to other requirements of these regulations. (4) The requirements of sub-regulations (2) and (3) are also applicable on family members and close associates of foreign and domestic PEPs. 11. Simplified Due Diligence.- (1) Where low risk is identified through adequate analysis of risk or where adequate checks and controls exist, regulated person may apply simplified or reduced Customer Due Diligence / Know Your Customer measures. (2) The decision to rate a customer as low risk shall be justified in writing by the regulated person and low risk cases may include but are not limited to the following-

Page 10 of 21 (a) regulated person and banks provided they are subject to requirements to combat money laundering and terrorist financing consistent with the FATF recommendations and are supervised for compliance with those requirements; (b) public listed companies that are subject to regulatory disclosure requirements to ensure adequate transparency of beneficial ownership; (c) insurance policies for pension schemes if there is no early surrender option and the policy cannot be used as collateral; (d) life insurance policies where the premium is low i.e. an annual premium of less than Rs.100,000 or a single premium of less than Rs. 250,000; (e) group insurance policies; (f) pension superannuation or similar scheme that provides retirement benefits to employees, where contributions are made by way of deduction from wages, and the scheme rules do not permit the assignment of a member’s interest under the scheme; and (g) financial products or services that provide appropriately defined and limited services to certain types of customers, so as to increase access for financial inclusion purposes. (2) Subject to sub-regulations (2), low risk for Simplified Due Diligence measures are limited to the following- (a) reducing the frequency of customer identification updates; (b) reducing the degree of on-going monitoring and scrutinising transactions, based on a reasonable monetary threshold; and (c) not collecting specific information or carrying out specific measures to understand the purpose and intended nature of the business relationship, but inferring the purpose and nature from the type of transaction or business relationship established: Provided that Simplified CDD measures are not acceptable whenever there is a suspicion of money laundering or terrorist financing, or where specific higher-risk scenarios apply. 12. Reliance on Third Parties.- (1) Regulated person may rely on a third party to conduct CDD on its behalf provided that the regulated person shall- (a) obtain immediately, the necessary information relating to identification

Page 11 of 21 of the customer, identification of the beneficial owner and/or the nature of business of the customer; (b) take steps to satisfy itself that copies of identification data and other relevant documentation relating to CDD requirements will be made available from the third party upon request without delay; (c) satisfy itself that the third party is regulated, and supervised or monitored for, and has measures in place for compliance with, CDD and record￾keeping requirements in line with these regulations; and (d) maintain data/ information confidentiality and non-disclosure agreement with the third party. (2) When determining in which countries the third party that meets the conditions can be based, regulated person should have regard to information available on the level of country risk. (3) For regulated person that rely on a third party that is part of the same financial group: (a) the group should apply CDD and record-keeping requirements and programmes against money laundering and terrorist financing, in accordance with these regulations; and (b) any higher country risk should be adequately mitigated by the group’s AML/CFT policies. (4) The regulated person shall be responsible for ongoing monitoring of its customers and notwithstanding the reliance upon a third party, the regulated person shall ultimately remain responsible for its AML/CFT obligations and shall carry out ongoing monitoring of such customer itself. 13. Ongoing Monitoring.- (1) All business relations with customers shall be monitored on an ongoing basis to ensure that the transactions are consistent with the regulated person’ knowledge of the customer, its business and risk profile and where appropriate, the sources of funds. (2) Regulated person shall obtain information and examine, as far as possible the background and purpose of all complex and unusual transactions, which have no apparent economic or visible lawful purpose and the background and purpose of these transactions shall be inquired and findings shall be documented with a view of making this information available to the relevant competent authorities when required. (3) Regulated person shall periodically review the adequacy of customer information obtained in respect of customers and beneficial owners and ensure that the information is kept up to date, particularly for higher risk categories of customers and the review period and procedures thereof should be defined by regulated person in their

Page 12 of 21 AML/CFT policies, as per risk based approach. (4) In relation to sub-regulation (3), customers’ profiles should be revised keeping in view the spirit of Know Your Customer/CDD and basis of revision shall be documented and customers may be consulted, if necessary. (5) Where regulated person files an STR on reasonable grounds for suspicion that existing business relations with a customer are connected with ML/TF and the regulated person considers it appropriate to retain the customer- (a) the regulated person shall substantiate and document the reasons for retaining the customer; and (b) the customer’s business relations with the regulated person shall be subject to proportionate risk mitigation measures, including enhanced ongoing monitoring. (6) Regulated person shall not form business relationship with entities/individuals that are: (a) proscribed under the United Nations Security Council Resolutions and adopted by the Government of Pakistan; (b) proscribed under the Anti Terrorism Act, 1997(XXVII of 1997); and (c) associates/facilitators of persons mentioned in (a) and (b). (7) The regulated person should monitor their relationships on a continuous basis and ensure that no such relationship exists directly or indirectly, through ultimate control of an account and where any such relationship is found, the regulated person shall take immediate action as per law, including freezing the funds and assets of such proscribed entity/individual and reporting to the Commission. 14. Reporting of Transactions (STRs/CTRs).- (1) Regulated person shall comply with the provisions of the AML Act and rules, regulations and directives issued there under for reporting suspicious transactions/currency transactions in the context of money laundering or financing of terrorism. (2) Regulated person shall implement appropriate internal policies, procedures and controls for meeting their obligations under the AML Act. (3) Regulated person shall pay special attention to all complex and all unusual patterns of transactions, which have no apparent economic or visible lawful purpose. The background and purpose of such transactions shall, as far as possible, be examined, the findings established in writing, and be available to assist the relevant authorities in inspection and investigation. (4) The transactions, which are out of character, are inconsistent with the history,

Page 13 of 21 pattern, or normal operation of the account or are not commensurate with the level of income of a customer shall be viewed with suspicion, be properly investigated and referred to Compliance Officer for possible reporting to FMU under the AML Act. (5) Regulated person should note that STRs, including attempted transactions, should be reported regardless of the amount of the transactions; and, the CTRs should be reported for the transactions of rupees two million and above as per requirements of AML, Act. (6) The basis of deciding whether an STR is being filed or not shall be documented and kept on record together with all internal findings and analysis done in relation to a suspicion irrespective of the fact that transaction is subsequently reported or not. (7) The employees of regulated person are strictly prohibited to disclose the fact to the customer or any other quarter that a STR or related information is being or has been reported to any authority, except if required by law. (8) Regulated person without disclosing the contents of STRs, shall intimate to the Commission on bi-annual basis the number of STRs reported to FMU and the regulated person shall ensure that status report (indicating No. of STRs only) shall reach the AML Department within seven days of close of each half year. CHAPTER III MISCELLANEOUS 15. Record Keeping.- (1) Regulated person shall maintain all necessary records on transactions, both domestic and international, including the results of any analysis undertaken (e.g. inquiries to establish the background and purpose of complex, unusual large transactions) for a minimum period of five years from completion of the transaction: Provided that regulated person may retain those records for longer period where transactions, customers or accounts involve litigation or it is required by court or other competent authority. (2) The records shall be sufficient to permit reconstruction of individual transactions including the nature and date of the transaction, the type and amount of currency involved and the type and identifying number of any account involved in the transactions so as to provide, when necessary, evidence for prosecution of criminal activity and the transactions records may be maintained in paper or electronic form, provided it is admissible as evidence in a court of law. (3) The records of identification data obtained through CDD process like copies of identification documents, account opening forms, Know Your Customer forms, verification documents and other documents along with records of account files and business correspondence, shall be maintained for a minimum period of five years after termination of the business relationship.

Page 14 of 21 (4) Regulated person shall ensure, to timely make available, all CDD and transaction records to the Commission, FMU and law enforcement agencies whenever required. 16. Foreign Branches and Subsidiaries.- (1) Regulated person shall pay particular attention to their branches and subsidiaries located in countries which do not or insufficiently comply with FATF Recommendations (as determined by FATF) and ensure that their AML/ CFT policy is observed by branches and subsidiaries in those countries. (2) Regulated person shall apply their AML/ CFT policies to all of their branches and subsidiaries outside Pakistan to the extent that laws and regulations of the host country permit. (3) Where the AML/CFT requirements in the host country or jurisdiction differ from those in Pakistan, regulated person shall require their overseas branches or subsidiaries to apply the higher of the two standards, to the extent that the law of the host country or jurisdiction so permits. (4) Where the law of the host country conflicts with the AML/ CFT requirements of Pakistan so that the overseas branch or subsidiary is unable to fully observe the higher standards, the regulated person shall report this to the Commission and comply with such further directions as may be issued. 17. Correspondent Relationship.- (1) A regulated person shall perform the following measures, in addition to other measures prescribed in these regulations, when forming a correspondent relationship- (a) assess the suitability of the respondent financial institution by taking the following steps- (i) gather adequate information about the respondent financial institution to understand fully the nature of the respondent financial institution’s business, including making appropriate inquiries on its management, its major business activities and the countries or jurisdictions in which it operates; (ii) determine from any available sources the reputation of the respondent financial institution and the quality of supervision over the respondent financial institution, including whether it has been the subject of money laundering or terrorism financing investigation or regulatory action; and (iii) assess the respondent financial institution’s AML/CFT controls and ascertain that they are adequate and effective, having regard to the AML/CFT measures of the country or jurisdiction in which the respondent financial institution operates;

Page 15 of 21 (b) clearly understand and document the respective AML/CFT responsibilities of the financial institution and the respondent financial institution; (c) assess the respondent financial institution in the context of sanctions/embargoes and Advisories about risks; and (d) obtain approval from the financial institutions’ senior management before providing correspondent services to a new financial institution. (2) Regulated person shall document the basis for its satisfaction that the requirements of this regulations are met. (3) Regulated person shall pay special attention when establishing or continuing correspondent relationship with financial institutions which are located in jurisdictions that have been identified or called for by FATF for inadequate and poor AML/CFT standards in the fight against money laundering and financing of terrorism. (4) No regulated person shall enter into or continue correspondent relationship with another financial institution that does not have adequate controls against money laundering or terrorism financing activities, is not effectively supervised by the relevant authorities or is a shell financial institution. Explanation:- For the purposes of this regulation the expression “shell financial institution” means a financial institution incorporated, formed or established in a country or jurisdiction where the financial institution has no physical presence and which is unaffiliated with a financial group that is subject to effective consolidated supervision. (5) A regulated person shall also take appropriate measures when establishing a Correspondent Relationship, to satisfy itself that its respondent financial institutions do not permit their accounts to be used by shell financial institutions. 18. Appointment of Compliance Officer.- Regulated person shall- (a) appoint a management level officer as compliance officer, who shall report directly to the board of directors or to another equivalent executive position or committee; (b) ensure that the compliance officer, as well as any other persons appointed to assist him, has timely access to all customer records and other relevant information which they may require to discharge their functions; (c) the compliance officer shall primarily be responsible for the areas including, but not limited to-

Page 16 of 21 (i) the regulated person effective compliance with the relevant provisions of these Regulations, the AML Act, the Anti-Money Laundering Rules, 2008, the Anti-Money Laundering Regulations, 2015 and other directions and guidelines issued under the aforementioned regulations and laws, as amended from time to time; (ii) ensuring that the internal policies, procedures and controls for prevention of ML/TF are approved by the board of directors of the regulated person and are effectively implemented; (iii) monitoring, reviewing and updating AML/CFT policies and procedures, of the regulated person; (iv) providing assistance in compliance to other departments and branches of the regulated person; (v) timely submission of accurate data/ returns as required under the applicable laws; (vi) monitoring and timely reporting of Suspicious and Currency Transactions to FMU; and (vii) such other responsibilities as the regulated person may deem necessary in order to ensure compliance with these regulations. 19. Financial Groups.- Financial groups should implement group-wide programmes against ML/TF, which should be applicable, and appropriate to, all branches and majority-owned subsidiaries of the financial group and these should include the measures set out in in these regulations and also- (a) policies and procedures for sharing information required for the purposes of CDD and ML/TF risk management; (b) the provision, at group-level compliance, audit, and/or AML/CFT functions, of customer, account, and transaction information from branches and subsidiaries when necessary for AML/CFT purposes; and (c) adequate safeguards on the confidentiality and use of information exchanged. 20. Screening and Training.- Regulated person shall - (a) develop and implement a comprehensive employee due diligence policy and procedure to be implemented/ carried out at the time of hiring all employees permanent, contractual, or through outsourcing. This shall include but not limited to verification of antecedents and screening procedures to verify that person being inducted/ hired has a clean history; and (b) chalk out and implement suitable training program for relevant employees on annual basis, in order to effectively implement the regulatory requirements and regulated person own policies and

Page 17 of 21 procedures relating to AML/ CFT. The employees training shall enable them to understand new developments, money laundering and financing of terrorism techniques, methods and trends. The training should also include their responsibilities relating to AML/ CFT. 21. Penalty.- (1) Any person who contravenes or fails to comply with any provision of these regulation made shall be liable to pay such sum as provided in section 40 of the Securities and Exchange Commission of Pakistan Act, 1997 (XLII of 1997), in addition to any penalty provided under AML Act. 22. Repeal.- The following .- (1) The following circulars and notifications, hereinafter referred to as repealed instruments, are hereby repealed: (1) Circular No. 28 of 2017; (2) Circular No 12, and 29 of 2009; and (3) SRO 20(I)/2012 dated . (2) Anything done, actions taken, orders passed, registration granted, notifications issued, proceedings initiated and instituted, prosecutions filed, processes or communications issued and powers conferred, assumed or exercised by the Commission under the repealed instruments, shall, on the coming into operation of these regulations, be deemed to have been validly done, taken, passed, granted, issued, initiated or instituted, filed, conferred, assumed and exercised and every action, prosecution or proceeding instituted and every order, directive, notification, circular etc. issued by the Commission shall be deemed to have been initiated, instituted or issued under these regulations and shall be proceeded with to completion and be enforced and have effect accordingly.

Page 18 of 21 Annex I S No. Type of Customer Information/Documents to be Obtained

1. Individuals A photocopy of any one of the following valid identity documents; (i) Computerized National Identity Card (CNIC) issued by NADRA. (ii) National Identity Card for Overseas Pakistani (NICOP) issued by NADRA. (iii) Pakistan Origin Card (POC) issued by NADRA. (iv) Alien Registration Card (ARC) issued by National Aliens Registration Authority (NARA), Ministry of Interior (local currency account only). (v) Passport; having valid visa on it or any other proof of legal stay along with passport (foreign national individuals only).
2. Sole proprietorship (i) Photocopy of identity document as per Sr. No. 1 above of the proprietor. (ii) Copy of registration certificate for registered concerns. (iii) Copy of certificate or proof of membership of trade bodies etc, wherever applicable. (iv) Declaration of sole proprietorship on business letter head. (v) Account opening requisition on business letter head. (vi) Registered/ Business address.
3. Partnership (i) Photocopies of identity documents as per Sr. No. 1 above of all the partners and authorized signatories. (ii) Attested copy of ‘Partnership Deed’. (iii) Attested copy of Registration Certificate with Registrar of Firms. In case the partnership is unregistered, this fact shall be clearly mentioned on the Account Opening Form. (iv) Authority letter from all partners, in original, authorizing the person(s) to operate firm’s account. (v) Registered/ Business address.
4. Limited Companies/ Corporations (i) Certified copies of: (a) Resolution of Board of Directors for opening of account specifying the person(s) authorized to open and operate the account; (b) Memorandum and Articles of Association; (c) Certificate of Incorporation;

Page 19 of 21 (d) Certificate of Commencement of Business, wherever applicable; (e) List of Directors on ‘Form-A/Form-B’ issued under Companies Act, 2017, as applicable; and (f) Form-29, wherever applicable. (ii) Photocopies of identity documents as per Sr. No. 1 above of all the directors and persons authorized to open and operate the account; 5. Branch Office or Liaison Office of Foreign Companies (i) A copy of permission letter from relevant authority i-e Board of Investment. (ii) Photocopies of valid passports of all the signatories of account. (iii) List of directors on company letter head or prescribed format under relevant laws/regulations. (iv) A Letter from Principal Office of the entity authorizing the person(s) to open and operate the account. (v) Branch/Liaison office address. 6. Trust, Clubs, Societies and Associations etc. (i) Certified copies of: (a) Certificate of Registration/Instrument of Trust (b) By-laws/Rules & Regulations (ii) Resolution of the Governing Body/Board of Trustees/Executive Committee, if it is ultimate governing body, for opening of account authorizing the person(s) to operate the account. (iii) Photocopy of identity document as per Sr. No. 1 above of the authorized person(s) and of the members of Governing Body/Board of Trustees /Executive Committee, if it is ultimate governing body. (iv) Registered address/ Business address where applicable. 7. NGOs/NPOs/Charities (i) Certified copies of: (a) Registration documents/certificate (b) By-laws/Rules & Regulations (ii) Resolution of the Governing Body/Board of Trustees/Executive Committee, if it is ultimate governing body, for opening of account authorizing the person(s) to operate the account. (iii) Photocopy of identity document as per Sr. No. 1 above of the authorized person(s) and of the members of Governing Body/Board of Trustees /Executive Committee, if it is ultimate governing body. (iv) Any other documents as deemed necessary including its annual accounts/ financial statements or disclosures in any form which may help to ascertain

Page 20 of 21 the detail of its activities, sources and usage of funds in order to assess the risk profile of the prospective customer. (v) Registered address/ Business address. 8. Agents (i) Certified copy of ‘Power of Attorney’ or ‘Agency Agreement’. (ii) Photocopy of identity document as per Sr. No. 1 above of the agent and principal. (iii) The relevant documents/papers from Sr. No. 2 to 7, if agent or the principal is not a natural person. (iv) Registered/ Business address. 9. Executors and Administrators (i) Photocopy of identity document as per Sr. No. 1 above of the Executor/Administrator. (ii) A certified copy of Letter of Administration or Probate. (iii) Registered address/ Business address. 10. Minor Accounts (i) Photocopy of Form-B, Birth Certificate or Student ID card (as appropriate). (ii) Photocopy of identity document as per Sr. No. 1 above of the guardian of the minor. Note: (i) The photocopies of identity documents shall be validated through NADRA verisys. (ii) In case of a salaried person, in addition to CNIC, an attested copy of his service card or certificate or letter on letter head of the employer will be obtained. (iii) In case of an individual with shaky/immature signatures, in addition to CNIC, a passport size photograph of the new account holder will be obtained. (iv) In case of expired CNIC, account may be opened on the basis of attested copies of NADRA receipt/token and expired CNIC subject to condition that regulated person shall obtain copy of renewed CNIC of such customer within 03 months of the opening of account. For CNICs which expire during the course of the customer’s relationship, regulated person shall design/ update their systems which can generate alerts about the expiry of CNICs at least 01 month before actual date of expiry and shall continue to take reasonable measures to immediately obtain copies of renewed CNICs, whenever expired. In this regard, regulated person are also permitted to utilize NADRA Verisys reports of renewed CNICs and retain copies in lieu of valid copy of CNICs. However, obtaining copy of renewed CNIC as per existing instructions will continue to be permissible. (v) In case the CNIC does not contain a photograph, regulated person shall obtain following- (a) a duly attested copy of either driving license, service card, nikkah nama, birth certificate, educational degree/certificate, pension book, insurance certificate. (b) a photograph duly attested by gazetted officer/Administrator/ officer of the regulated person.

Page 21 of 21 (c) a copy of CNIC without photograph duly attested by the same person who attested the photograph. (vi) The condition of obtaining Board Resolution is not necessary for foreign companies/entities belonging to countries where said requirements are not enforced under their laws/regulations. However, such foreign companies will have to furnish Power of Attorney from the competent authority for establishing Business Relationship to the satisfaction of the regulated person. (vii) The condition of obtaining photocopies of identity documents of directors of Limited Companies/Corporations is relaxed in case of Government/Semi Government entities, where regulated person should obtain photocopies of identity documents of only those directors and persons who are authorized to establish and maintain Business Relationship. However, regulated person shall validate identity information including CNIC numbers of other directors from certified copies of ‘Form-A/Form-B’ and ‘Form 29’ and verify their particulars through NADRA Verisys. The Verisys reports should be retained on record in lieu of photocopies of identity documents. Explanation:- For the purpose of this Annexure I the expression “NADRA” means National Database and Registration Authority established under NADRA Act, (VIII of 2000). [File No. SY/SECP/8/13]