Government of Pakistan
Securities and Exchange Commission of Pakistan

Islamabad, Dated 28th September 2020

S.R.O. 921 (I)/2020. - In exercise of the powers conferred by section 6A of the Anti Money Laundering Act, 2010 (VII of 2010), the Securities and Exchange Commission of Pakistan, is pleased to make the following regulations, namely:-

CHAPTER I

PRELIMINARY

1. Short Title and Commencement- These regulations shall be called the Securities and Exchange Commission of Pakistan (Anti Money Laundering and Countering Financing of Terrorism) Regulations, 2020.

2. They shall come into force at once.

3. Definitions- (1) In these regulations, unless there is anything repugnant in the subject or context,-

(a) “AML Act” means Anti Money Laundering Act, 2010 (VII of 2010);

(b) “Act” means Securities and Exchange Commission of Pakistan Act, 1997 (XLII of 1997);

(c) “administered legislation” shall have the same meaning as assigned to it in clause (aa) of sub-section (1) of section 2 of the Act;

(d) “AML/CFT” means Anti-Money Laundering and Countering Financing of Terrorism;

(e) “Annex” means annexures appended to these regulations;

(f) “beneficiary” for the purposes of these regulation shall include-

(i) a natural or legal person or arrangement who are entitled to the benefit of any trust arrangement.

(ii) in the context of life insurance or takaful, life-contingent annuity contracts or another investment linked insurance or takaful policy,

is a natural or legal person, or a legal arrangement, or category of persons, who will be paid the policy proceeds when or if an event occurs, which is covered by the policy;

(g) “close associate” of a PEP means— (i) an individual known to have joint beneficial ownership of a legal person or a legal arrangement or any other close business relations with a PEP; (ii) any individual(s) who have beneficial ownership of a legal person or a legal arrangement which is known to have been set up for the benefit of a PEP; (iii) an individual who is reasonably known to be closely connected with the PEP for any other reason, including socially or professionally.

(h) “Commission” means Securities and Exchange Commission of Pakistan established under section 3 of the Act;

(i) “correspondent relationship” means a relationship between the regulated person (Correspondent), or any party acting on its behalf and processing orders on behalf of the regulated person, and an intermediary (Respondent) which is regulated and supervised by a supervisory authority, transmitting orders on behalf of its underlying customers;

(j) "customer" means any natural person, legal person or legal arrangement to whom financial services have been extended by a regulated person;

(k) “dormant or in-operative account” means the account in which no transaction or activity or financial service has been extended by the regulated person from last five years;

(l) “enhanced due diligence” or “EDD” means taking additional CDD and may include the information set out in section 21(2).

(m) “family member” of a politically exposed person includes— (i) a spouse of the PEP; (ii) lineal ascendants and descendants and siblings of the PEP.

(n) “Insurer” shall have the same meaning as assigned to it in the Insurance Ordinance, 2000 (XXXIX of 2000);

(o) “ML” means money laundering

(p) “Non-Banking Finance Companies” or “NBFCs” shall have the same meaning as assigned to it in Part VIII A of the Companies Ordinance, 1984 (XLVII of 1984);

(q) “Politically exposed persons” or “PEPs” means an individual who is or has been entrusted with a prominent public function either domestically or by a foreign country, or in an international organization and includes but not limited to:

(i) for foreign PEPs, Heads of State or of government, senior politicians, senior government, judicial or military officials, senior executives of state-owned corporations and political party officials;

(ii) for domestic PEPs, Heads of State or of government, senior politicians, senior government, judicial or military officials, senior executives of state-owned corporations, political party officials;

(iii) for international organization PEPs, members of senior management or individuals who have been entrusted with equivalent functions.

Provided that middle ranking or more junior individuals in the above referred categories are not included in the definition of PEPs;

(r) “regulated person” means securities brokers, futures brokers, Insurers, Takaful Operators, NBFCs and Modarabas regulated by SECP under the administered legislation;

(s) ‘reasonable measures’ means appropriate measures which are commensurate with the money laundering or terrorist financing risks;

(t) “senior management” means an officer or employee of the reporting entity with sufficient knowledge of the reporting entity’s risk exposure, and of sufficient authority, to take decisions affecting its risk management and mitigation, including chief executive officer/ managing director, deputy managing director, chief operating officer, company secretary, chief financial officer, chief compliance officer and chief regulatory officer and any holder of such positions by whatever name called; and

(u) “simplified due diligence” or “SDD” means taking reduced CDD measures and may include the measures set out in section 23 (3).

(v) “TF” means financing of terrorism

(w) “Third Party” means any reporting entity or as may be notified by the Commission.

(2) The definitions in the AML Act shall also apply to these Regulations. The words and expressions used in these regulations but not defined shall have the same meaning as assigned to them under the Act and administered legislation thereunder.

CHAPTER II

RISK ASSESSMENT AND MITIGATION

4. Risk Assessment - The regulated person shall take appropriate steps in accordance with section 7F of the AML Act to identify, assess and understand its money laundering, and terrorism financing risks for customers, countries or geographic areas and products, services, transactions or delivery channels. The regulated person shall:

(a) document their risk assessments;

(b) consider all the relevant risk factors before determining what is the level of overall risk and the appropriate level and type of mitigation to be applied;

(d) categorize its own overall entity level risk as high, medium or low based on the result of risk assessment; and

(e) have appropriate mechanisms to provide risk assessment information to the Commission.

5. Risk Mitigation and Applying Risk Based Approach - The regulated person shall:

(a) have policies, controls and procedures, which are approved by its board of directors, to enable them to manage and mitigate the risks that have been identified in its own risk assessment and any other risk assessment publicly available or provided by the Commission;

(b) monitor the implementation of those policies, controls and procedures and to enhance them if necessary; and

Explanation:- For the purposes of this regulation the expression “risk based approach” means applying measures to manage and mitigate money laundering and terrorist financing risks that are commensurate with the risks identified.

6. The regulated person may take simplified measures to manage and mitigate risks, if lower risks have been identified. Simplified measures should not be permitted whenever there is a suspicion of ML/TF.

7. New Products, Practices and Technologies - The regulated person shall:

(a) identify and assess the ML and TF risk that may arise in the development

of new products, businesses and practices, including new delivery mechanism, and the use of new and pre-existent technology.

(b) prior to the launch or use of product, practice or technology, shall undertake the risk assessment and take appropriate measures to manage and mitigate the risks.

CUSTOMER DUE DILIGENCE (CDD) AND BENEFICIAL OWNERSHIP

8. Customer Due Diligence- (1) The regulated person shall conduct CDD in the circumstances and matters set out in section 7A(I) and 7(E) of the AML Act.

(2) For the purposes of conducting CDD as required under section 7A (2) of the AML Act every regulated person shall comply with sections 9-25 of these Regulations.

(3) The regulated person shall categorize each customer’s risk depending upon the outcome of the CDD process.

9. The regulated person shall:

(a) identify the customer; and

(b) verify the identity of that customer using reliable and independent documents, data and information as set out in Annex 1.

10. Where the customer is represented by an authorized agent or representative, the regulated person shall:

(a) identify every person who acts on behalf of the customer,

(b) verify the identity of that person in using reliable and independent documents, data and information as set out in Annex 1; and

11. The regulated person shall also identify the beneficial owner and take reasonable measures to verify the identity of the beneficial owner by using reliable and independent document, data or sources of information as set out in Annex 1, such that the regulated person is satisfied that it knows who the beneficial owner is.

12. (I) For customers that are legal persons or legal arrangements, the regulated person shall identify the customer and verify its identity by obtaining the following information in addition to the information required in Annex 1:

(a) name, legal form and proof of existence;

(b) the powers that regulate and bind the legal person or arrangement, as well as the names of the relevant persons having a senior management position in the legal person or arrangement; and

(2) For customers that are legal persons or legal arrangements, the financial institution should be required to understand the nature of the customer’s business and its ownership and control structure.

13. (1) For customers that are legal persons, the regulated person shall identify and take reasonable measures to verify the identity of beneficial owners by:

(a) identifying the natural person(s) (if any) who ultimately has a controlling ownership interest (as defined under relevant laws) in a legal person; and

(b) to the extent that there is doubt under (a) as to whether the person(s) with the controlling ownership interest is the beneficial owner(s) or where no natural person exerts control through ownership interests, the identity of the natural person(s) (if any) exercising control of the legal person or arrangement through other means; and

(c) where no natural person is identified under (a) or (b) above, the identity of the relevant natural person who holds the position of senior managing official.

14. For customers that are legal arrangements, the regulated person shall identify and take reasonable measures to verify the identity of beneficial owners as follows:

(a) for trusts, the identity of the settlor, the trustee(s), the protector (if any), the beneficiaries or class of beneficiaries, and any other natural person exercising ultimate effective control over the trust (including through a chain of control/ownership);

(b) for waqfs and other types of legal arrangements, the identity of persons in equivalent or similar positions as specified in (a).

(c) Where any of the persons specified in (a) or (b) is a legal person or arrangement, the identity of the beneficial owner of that legal person or arrangement shall be identified.

15. An insurer or takaful operator shall:

(1) At the time at which the beneficiary of the life insurance policy or takaful is identified or designated:

(a) if the beneficiary is a specifically named natural person, legal person or legal arrangement, obtain the full name of the beneficiary;

(b) if the beneficiary is designated by characteristics, class or other means and is known to the regulated person, obtain sufficient information concerning the beneficiary to satisfy itself that it will be able to establish the identity of the beneficiary at the time of payout.

(2) for both the above cases, verify the identity of the beneficiary at the time of payout.

16. The regulated person should verify the identify the customer and beneficial owner before establishing a business relationship or during the course of establishing a business relationship.

17. (1) The regulated person may complete verification of a customer or beneficial owner’s identity after the establishment of the business relationship, provided that-

(a) this occurs as soon as reasonably practicable;

(b) this is essential not to interrupt the normal conduct of business; and

(2) The types of circumstances where the regulated person permits completion of verification after the establishment of the business relationship should be recorded in the CDD policies.

18. The regulated person shall adopt risk management procedures concerning the conditions under which a customer may utilize the business relationship prior to verification.

19. Ongoing Monitoring - (1) The regulated person shall conduct ongoing due diligence on the business relationship, including:

(a) scrutinizing transactions undertaken throughout the course of that relationship to ensure that the transactions being conducted are consistent with the regulated person’s knowledge of the customer, their business and risk profile, including where necessary, the source of funds;

(b) obtaining information and examining, as far as possible, the background and purpose of all complex and unusual transactions which have no apparent economic or visible lawful purpose. The background and purpose of these transactions shall be inquired and findings shall be documented with a view of making this information available to the relevant competent authorities when required.

(c) undertaking reviews of existing records and ensuring that documents, data or information collected for the CDD purposes is kept up-to-date and relevant, particularly for higher risk categories of customers.

(2) In relation to sub-regulation (b), customers’ profiles should be revised keeping in view the CDD and basis of revision shall be documented.

(3) The regulated person shall implement the measures as set out in 7D of the AML Act.

(4) The regulated person shall comply with the provisions of the AML Act and rules, regulations and directives issued thereunder for reporting suspicious transactions/currency transactions in the context of money laundering or financing of terrorism.

(5) Where regulated person files an STR with respect to a customer with whom it has an existing business relationship, and if the regulated person considers it appropriate to retain the customer, then the regulated person shall:-

(a) substantiate and document the reasons for retaining the customer; and

(b) subject the business relationship to proportionate risk mitigation measures, including enhanced ongoing monitoring.

(6) The basis of deciding whether an STR is being filed or not shall be documented and kept on record together with all internal findings and analysis done in relation to a suspicion irrespective of the fact that transaction is subsequently reported or not.

20. Existing Customers – (1) The regulated person is required to apply CDD requirement to its existing customers on the basis of materiality and risk and should conduct due diligence on existing relations at appropriate times, taking into account whether and when CDD measures have previously been undertaken and the adequacy of data obtained.

(2) For existing customers who opened accounts with old NICs, the regulated person shall ensure that attested copies of identity documents shall be present in the regulated person record. The regulated person shall block accounts without identity document (after serving one-month prior notice) for all withdrawals, until the subject regulatory requirement is fulfilled. However, upon submission of attested copy of identity document and verification of the same from NADRA or biometric verification, the block from the accounts shall be removed.

(3) For customers whose accounts are dormant or in-operative, withdrawals shall not be allowed until the account is activated on the request of the customer. For activation, the regulated person shall conduct NADRA Verisys or biometric verification of the customer and obtain attested copy of customer’s valid identity document (if already not available) and fulfill the regulatory requirements.

21. Enhanced Due Diligence (EDD) - (1) Regulated person shall implement appropriate internal risk management systems, policies, procedures and controls to determine if any customer presents high risk of ML/TF. The regulated person shall apply EDD where a customer presents high risk of ML/TF including but not limited to the following circumstances:

(a) business relationships and transactions with natural and legal persons when the ML/TF risks are higher;

(b) business relationships and transactions with natural and legal persons from countries for which this is called for by the FATF;

(2) EDD measures include but shall not be limited to the following measures:

(a) Obtaining additional information on the customer (e.g. volume of assets, information available through public databases, internet, etc.), and updating more regularly the identification data of customer and beneficial owner; (b) Obtaining additional information on the intended nature of the business relationship;

(d) Obtaining information on the reasons for intended or performed transactions.

(e) Obtaining the approval of senior management to commence or continue the business relationship;

(f) Conducting enhanced monitoring of the business relationship, by increasing the number and timing of controls applied, and selecting patterns of transactions that need further examination.

(3) An insurer/ takaful operator shall include the beneficiary of a life insurance policy as a relevant risk factor in determining whether EDD measures are applicable under subsection (1). where an insurer/ takaful operator determines that a beneficiary who is a legal person or a legal arrangement presents a higher risk, it shall take EDD measures and take reasonable measures to identify and verify the identity of a beneficial owners of the beneficiary of a life insurance policy or takaful at the time of payout.

(4) In relation to 21(1)(c), the regulated person shall implement appropriate internal risk management systems, to determine if a customer or a beneficial owner is a PEP or a close associate or family member of a PEP, both prior to establishing a business relationship or conducting a transaction, and periodically throughout the course of business relationship. The regulated person shall apply, at minimum the following EDD measures:

(a) obtain approval from senior management to establish or continue a business relationship where the customer or a beneficial owner is a PEP, close associate or family member of a PEP or subsequently becomes a PEP, close associate and family member of a PEP;

(b) take reasonable measures to establish the source of wealth and the source of funds of customers and beneficial owners identified as a PEP, close associate or family member of a PEP; and

(c) conduct enhanced ongoing monitoring of business relations with the customer or beneficial owner identified as a PEP, close associate and family member of a PEP.

(5) An insurer/ takaful operator shall take reasonable measures at the time of payout of a life insurance policy to determine whether the beneficiaries and/or, where applicable, the beneficial owner of the beneficiary are politically exposed persons.

(6) Where higher risks are identified under subsection (5), an insurer or takaful operator must inform senior management before the payout of the policy proceeds, to conduct enhanced scrutiny of the whole business relationship with the policyholder, and to consider making a suspicious transaction report.

22. Counter Measures against high risk countries. – Regulated persons shall apply the

countermeasures including but not limited to, enhance due diligence proportionate to the risk as indicated by the Federal Government, pursuant to recommendations by the National Executive Committee and when called upon to do so by the FATF.

23. Simplified Due Diligence - (1) The regulated person may apply SDD only where low

risk is identified through adequate analysis through its own risk assessment and any other risk assessment publicly available or provided by the Commission in accordance with section 6 of these regulations and commensurate with the lower risk factors.

(2) The decision to rate a customer as low risk shall be justified in writing by the regulated person.

(3) SDD measures include the following measures:

(a) Verifying the identity of the customer and the beneficial owner after the establishment of the business relationship;

(b) Reducing the degree of on-going monitoring and scrutinizing transactions, based on a reasonable monetary threshold as prescribed or as set out by the Commission;

(c) Not collecting specific information or carrying out specific measures to understand the purpose and intended nature of the business relationship, but inferring the purpose and nature from the type of transactions or business relationship established.

(4) The regulated person shall not apply any simplified CDD whenever there is a suspicion of money laundering or terrorist financing.

24. Reliance on Third Parties - (1) Any regulated person may rely on a third party to

conduct CDD on its behalf as set out in provisions 8-23 of these regulations, provided that the regulated person shall-

(a) remain liable for any failure to apply such indicated CDD measures above;

(b) immediately obtain from the Third Party the required information concerning CDD;

(c) take steps to satisfy itself that copies of identification data and other relevant documentation relating to CDD requirements will be made available from the third party upon request without delay;

(d) keep that copies of identification; and

(e) satisfy itself that the Third Party is supervised by an AML/CFT regulatory authority or an equivalent foreign authority and has measures in place for compliance with AML Act obligation of CDD and record keeping.

(2) Where a regulated person relies on a third party that is part of the same corporate group, the regulated person may deem the requirements of subsection 24(1) to be met if:

(a) the corporate group applies CDD and record-keeping requirements in accordance with the AML Act and its associated regulations;

(b) the implementation of the requirements in paragraph (a) is supervised by an AML/CFT regulatory authority or an equivalent foreign authority; and

(3) In addition to subsection 24(1), when determining in which country a third party may be based, the regulated person shall have regard to available information on the level of country risk

(4) Notwithstanding any reliance upon a third party, the regulated person shall ultimately remain responsible for its AML/CFT obligations, including generating STRs and shall carry out ongoing monitoring of such customer itself.

TFS Obligations

25. (1) The regulated person shall undertake TFS obligations under the United Nations (Security Council) Act 1948 and/or Anti-Terrorism Act 1997 and any regulations made there under, including:

(a) develop mechanisms, processes and procedures for screening and monitoring customers, potential customers and beneficial owners/associates of customers to detect any matches or potential matches with the stated designated/proscribed persons in the SROs and notifications issued by MoFA, NACTA and MoI.

(b) If during the process of screening or monitoring of customers or potential customers the regulated person finds a positive or potential match, it shall immediately:

i. freeze the relevant funds and assets without delay the customer’s fund/policy or block the transaction, without prior notice if it is an existing customer in accordance with the respective SRO.

ii. prohibit from making any funds or other assets, economic resources, or financial or other related services and funds in accordance with the respective SRO

iii. Reject the transaction or attempted transaction or the customer, if the relationship has not commenced.

(c) In all cases referred to in (b), the regulated person shall file a suspicious transaction report to the FMU in case that person is designated under United Nations Security Council Resolutions, or proscribed under the Anti-Terrorism Act, 1997 and simultaneously notify the Commission in the manner as may be instructed from time to time by the Commission.

(d) implement any other obligation under the AML Act 2010, United Nations (Security Council) Act 1948 and Anti-Terrorism Act 1997 and any regulations made there under.

(2) The regulated person is prohibited, on an ongoing basis, from providing any financial services to proscribed/ designated entities and persons or to those who are known for their association with such entities and persons, whether under the proscribed/ designated name or with a different name. The regulated person should monitor their business relationships with the entities and individuals on a continuous basis and ensure that no such relationship exists directly or indirectly, through ultimate control of an account and where any such relationship is found, the regulated person shall take immediate action as per law, including reporting to the FMU.

Explanation:- For the purposes of this section the expression associates means persons and entities acting on behalf of, or at the direction, or for the benefit, of proscribed/ designated entities and individuals that may be determined on the basis of appropriate screening of sanctions lists, disclosed nominee/beneficiary information, publicly known information, Government or regulatory sources or reliable media information, etc

CHAPTER III

Record Keeping

26. Record Keeping.- (1) The records maintained by regulated person as set out in section 7C of the AML Act shall be sufficient to permit reconstruction of individual transactions including the nature and date of the transaction, the type and amount of currency involved and the customer involved in the transactions so as to provide, when necessary, evidence for prosecution of criminal activity.

(2) Where transactions, customers or instruments are involved in litigation or where relevant records are required by a court of law or other competent authority, the regulated person shall retain such records until such time as the litigation is resolved or until the court of law or competent authority indicates that the records no longer need to be retained.

(3) The records of identification data obtained through CDD process including copies of identification documents, account opening forms, Know Your Customer forms, verification documents, other documents and result of any analysis along with records of account files and business correspondence, shall be maintained for a minimum period of five years after termination of the business relationship.

(4) The regulated person will maintain a list of all such customers/accounts where the business relationship was refused or needed to be closed on account of negative verification.

(5) The regulated person shall provide, upon request, from the Commission, investigating or prosecuting agency and FMU, any record within 48 hours after the request has been made or such time as may be instructed by the relevant authority.

Compliance Programs

27. Compliance Program (1) In order to implement compliance programs as set out in 7G of the AML Act, the regulated person shall implement the following internal policies, procedures and controls:

(a) compliance management arrangements, including the appointment of a compliance officer at the management level, as the individual responsible for the regulated person’s compliance with these Regulations, the AML Act and other directions and guidelines issued under the aforementioned regulations and laws;

(b) screening procedures when hiring employees to ensure the integrity and conduct, skills, and expertise of such employees to carry out their functions effectively;

(d) an independent audit function to test the system.

(2) For purposes of (a) the regulated person shall ensure that the compliance officer:

(a) reports directly to the board of directors or chief executive officer or committee;

(b) has timely access to all customer records and other relevant information which they may require to discharge their functions, as well as any other persons appointed to assist the compliance officer;

i. ensuring that the internal policies, procedures and controls for prevention of ML/TF are approved by the board of directors of the regulated person and are effectively implemented;

ii. monitoring, reviewing and updating AML/CFT policies and procedures, of the regulated person;

iii. providing assistance in compliance to other departments and branches of the regulated person;

iv. timely submission of accurate data/ returns as required under the applicable laws;

v. monitoring and timely reporting of Suspicious and Currency Transactions to FMU; and

vi. such other responsibilities as the regulated person may deem necessary in order to ensure compliance with these regulations.

28. In the case of a corporate group, in addition to the obligations established in section 27, the regulated person shall implement:

(a) policies and procedures for sharing information required for the purposes of CDD and risk management;

(b) the provision, at group-level compliance, audit, and/or AML & CFT functions, of customer, account, and transaction information from branches and subsidiaries when necessary for AML & CFT purposes.

(c) adequate safeguards on the confidentiality and use of information exchanged, including safeguards to prevent tipping-off.

29. The regulated person shall ensure that their foreign branches and majority-owned subsidiaries apply AML & CFT measures consistent with Pakistan requirements where the minimum AML & CFT requirements are less strict than Pakistan, to the extent that host country laws. If the foreign country does not permit the proper implementation of AML/CFT measures consistent with that of Pakistan requirements, financial groups should to apply appropriate additional measures to manage the risks, and inform the Commission.

30. Correspondent Relationship- (1) A regulated person shall perform the following measures, in addition to other measures prescribed in these regulations, when forming a correspondent relationship-

(a) assess the suitability of the respondent financial institution by taking the following steps-

i. gather adequate information about the respondent financial institution to understand fully the nature of the respondent financial institution’s business, including making appropriate inquiries on its management, its major business activities and the countries or jurisdictions in which it operates;

ii. determine from any available sources the reputation of the respondent financial institution and the quality of supervision over the respondent financial institution, including whether it has been the subject of money laundering or terrorism financing investigation or regulatory action; and

iii. assess the respondent financial institution’s AML/CFT controls and ascertain that they are adequate and effective, having regard to the AML/CFT measures of the country or jurisdiction in which the respondent financial institution operates.

(b) clearly understand and document the respective AML/CFT responsibilities of the financial institution and the respondent financial institution;

(d) obtain approval from the financial institutions’ senior management before

providing correspondent services to a new financial institution.

(2) Regulated person shall document the basis for its satisfaction that the requirements of this regulations are met.

(3) Regulated person shall pay special attention when establishing or continuing correspondent relationship with financial institutions which are located in jurisdictions that have been identified or called for by FATF for inadequate and poor AML/CFT standards in the fight against money laundering and financing of terrorism.

(4) No regulated person shall enter into or continue correspondent relationship with another financial institution that does not have adequate controls against money laundering or terrorism financing activities, is not effectively supervised by the relevant authorities or is a shell financial institution.

Explanation:- For the purposes of this regulation the expression “shell financial institution” means a financial institution incorporated, formed or established in a country or jurisdiction where the financial institution has no physical presence and which is unaffiliated with a financial group that is subject to effective consolidated supervision.

(5) A regulated person shall also take appropriate measures when establishing a Correspondent Relationship, to satisfy itself that its respondent financial institutions do not permit their accounts to be used by shell financial institutions.

Penalties

31. Penalty.- (1) Any contravention of these regulations shall be cognizable by the Commission in accordance with section 6A of the AML Act and liable to sanction provided in the AML/CFT Sanctions Rules, 2020 and imposed by the Commission according to Clause (h) of Sub-section (2) of Section 6A of AML Act.

32. Repeal.- The following .- (1) The following notifications, hereinafter referred to as repealed instruments, are hereby repealed,

(a) Securities and Exchange Commission of Pakistan (Anti Money Laundering and Countering Financing of Terrorism) Regulations, 2018 vide S. R. O. 770(I)/2018 dated June 13, 2018.

(2) Provided that repeal of the repealed instrument shall not-

(a) revive anything not in force at the time at which the repeal take effect; or

(b) affect the previous operation of the repealed instruments or anything duly done or suffered thereunder; or

(c) affect any right, privilege, obligation or liability acquired, accrued or incurred under the said repealed instruments; or

(d) affect any penalty imposed, forfeiture made or punishment incurred in respect of any offence or violations committed against or under the repealed instrument; or

(e) affect any inspection, investigation, prosecution, legal proceeding or remedy in respect of any obligation, liability, penalty, forfeiture or punishment as aforesaid, and any such inspection, investigation, prosecution, legal proceedings or remedy may be made, continued or enforced and any such penalty, forfeiture or punishment may be imposed, as if these regulations has not been notified.

(3) Anything done, actions taken, orders passed, registration granted, notifications issued, proceedings initiated and instituted, prosecutions filed, processes or communications issued and powers conferred, assumed or exercised by the Commission under the repealed instruments, shall, on the coming into operation of these regulations, be deemed to have been validly done, taken, passed, granted, issued, initiated or instituted, filed, conferred, assumed and exercised and every action, prosecution or proceeding instituted and every order, directive, notification, circular etc. issued by the Commission shall be deemed to have been initiated, instituted or issued as if the repealed instruments have not been repealed and shall be proceeded with to completion and be enforced and have effect accordingly.

Annex 1

S No.	Type of Customer	Minimum Documents required for CDD
1.	Individuals	A photocopy of any one of the following valid identity documents: (i) Computerized National Identity Card (CNIC)/Smart National Identity Card (SNIC) issued by NADRA. (ii) National Identity Card for Overseas Pakistani (NICOP/SNICOP) issued by NADRA. (iii) Form-B/Juvenile card issued by NADRA to children under the age of 18 years. (iv) Pakistan Origin Card (POC) issued by NADRA. (v) Alien Registration Card (ARC) issued by National Aliens Registration Authority (NARA), Ministry of Interior (local currency account only). (vi) Valid Proof of Registration (POR) Card issued by NADRA (vii) Passport; having valid visa on it or any other proof of legal stay along with passport (foreign national individuals only).
2.	Joint Account	(i) A photocopy of any one of the documents mentioned at Serial No. I; (ii) In the case of joint accounts, CDD measures on all of the joint account holders shall be performed as if each of them is individual customers of the RP.
3.	Sole proprietorship	(i) Photocopy of identity document as per Sr. No. 1 above of the proprietor. (ii) Attested copy of registration certificate for registered concerns. (iii) Sales tax registration or NTN, wherever applicable (iv) Account opening requisition on business letter head. (v) Registered/ Business address.
4.	Partnership	(i) Photocopies of identity documents as per Sr. No. 1 above of all the partners and authorized signatories. (ii) Attested copy of ‘Partnership Deed’ (iii) Attested copy of Registration Certificate with Registrar of Firms. In case the partnership is unregistered, this fact shall be clearly mentioned on the Account Opening Form (iv) Authority letter from all partners, in original, authorizing the person(s) to operate firm’s account. (v) Registered/ Business address.
5.	Limited Liability Partnership (LLP)	(i) Photocopies of identity documents as per Sr. No. 1 above of all the partners and authorized signatories. (ii) Certified Copies of: (a) ‘Limited Liability Partnership Deed/Agreement. (b) LLP-Form-III having detail of partners/designated partner in case of newly incorporated LLP.
		(c) LLP-Form-V regarding change in partners/designated partner in case of already incorporated LLP. (iii)Authority letter signed by all partners, authorizing the person(s) to operate LLP account.
6.	Limited Companies/ Corporations	(i) Certified copies of: (a) Resolution of Board of Directors for opening of account specifying the person(s) authorized to open and operate the account; (b) Memorandum and Articles of Association; (ii) Certified copy of Latest ‘Form-A/Form-B’. (iii)Incorporate Form II in case of newly incorporated company and Form A / Form C whichever is applicable; and Form 29 in already incorporated companies (iv)Photocopies of identity documents as per Sr. No. 1 above of all the directors and persons authorized to open and operate the account; (v) Photocopies of identity documents as per Sr. No. 1 above of the beneficial owners.
7.	Branch Office or Liaison Office of Foreign Companies	(i) A copy of permission letter from relevant authority i-e Board of Investment. (ii) Photocopies of valid passports of all the signatories of account. (iii) List of directors on company letter head or prescribed format under relevant laws/regulations. (iv) Certified copies of (v) Form II about particulars of directors, Principal Officer etc. in case of newly registered branch or liaison office of a foreign company (vi) Form III about change in directors, principal officers etc. in already registered foreign companies branch or liaison office of a foreign company (vii)A Letter from Principal Office of the entity authorizing the person(s) to open and operate the account. (viii) Branch/Liaison office address.
8.	Trust, Clubs, Societies and Associations etc.	(i) Certified copies of: (a) Certificate of Registration/Instrument of Trust (b) By-laws/Rules & Regulations (ii) Resolution of the Governing Body/Board of Trustees/Executive Committee, if it is ultimate governing body, for opening of account authorizing the person(s) to operate the account.
		(iii)Photocopy of identity document as per Sr. No. 1 above of the authorized person(s) and of the members of Governing Body/Board of Trustees /Executive Committee, if it is ultimate governing body. (iv)Registered address/ Business address where applicable.
9.	NGOs/NPOs/Charities	(i) Certified copies of: (a) Registration documents/certificate (b) By-laws/Rules & Regulations (ii) Resolution of the Governing Body/Board of Trustees/Executive Committee, if it is ultimate governing (iii)body, for opening of account authorizing the person(s) to operate the account. (iv)Photocopy of identity document as per Sr. No. 1 above of the authorized person(s) and of the members of Governing Body/Board of Trustees /Executive Committee, if it is ultimate governing body. (v) Any other documents as deemed necessary including its annual accounts/ financial statements or disclosures in any form which may help to ascertain the detail of its activities, sources and usage of funds in order to assess the risk profile of the prospective customer. (vi)Registered address/ Business address.
10.	Agents	(i) Certified copy of ‘Power of Attorney’ or ‘Agency Agreement’. (ii) Photocopy of identity document as per Sr. No. 1 above of the agent and principal. (iii)The relevant documents/papers from Sr. No. 2 to 7, if agent or the principal is not a natural person. (iv)Registered/ Business address.
11.	Executors and Administrators	(i) Photocopy of identity document as per Sr. No. 1 above of the Executor/Administrator. (ii) A certified copy of Letter of Administration or Probate. (iii)Registered address/ Business address.
12.	Minor Accounts	(i) Photocopy of Form-B, Birth Certificate or Student ID card (as appropriate). (ii) Photocopy of identity document as per Sr. No. 1 above of the guardian of the minor.

Note:

(i) For due diligence purposes, at the minimum following information shall also be obtained and recorded on KYC (Know Your Customer)/CDD form or account opening form:

(a) Full name as per identity document;

(b) Father/Spouse Name as per identity document;

(d) Identity document number along with date of issuance and expiry;

(e) Existing residential address (if different from CNIC);

(f) Contact telephone number(s) and e-mail (as applicable);

(g) Nationality-Resident/Non-Resident Status

(h) FATCA/CRS Declaration wherever required;

(i) Date of birth, place of birth;

(j) Incorporation or registration number (as applicable);

(k) Date of incorporation or registration of Legal Person/ Arrangement;

(l) Registered or business address (as necessary);

(m) Nature of business, geographies involved and expected type of counter-parties (as applicable);

(n) Type of account/financial transaction/financial service;

(o) Profession / Source of Earnings/ Income: Salary, Business, investment income;

(p) Purpose and intended nature of business relationship;

(q) Expected monthly turnover (amount and No. of transactions); and

(r) Normal or expected modes of transactions/ Delivery Channels.

(ii) The photocopies of identity documents shall be validated through NADRA verisys or Biometric Verification. The regulated person shall retain copy of NADRA Verysis or Biometric Verification (hard or digitally) as a proof of obtaining identity from customer.

(iii) In case of a salaried person, in addition to CNIC, a copy of his salary slip or service card or certificate or letter on letter head of the employer will be obtained.

(iv) In case of expired CNIC, account may be opened on the basis of attested copies of NADRA receipt/token and expired CNIC subject to condition that regulated person shall obtain copy of renewed CNIC of such customer within 03 months of the opening of account.

(v) For CNICs which expire during the course of the customer’s relationship, regulated person shall design/ update their systems which can generate alerts about the expiry of CNICs at least 01 month before actual date of expiry and shall continue to take reasonable measures to immediately obtain copies of renewed CNICs, whenever expired. In this regard, regulated person are also permitted to utilize NADRA Verisys reports of renewed CNICs and retain copies in lieu of valid copy of CNICs. However, obtaining copy of renewed CNIC as per existing instructions will continue to be permissible.

(vi) The condition of obtaining Board Resolution is not necessary for foreign companies/entities belonging to countries where said requirements are not enforced under their laws/regulations. However, such foreign companies will have to furnish Power of Attorney from the competent authority for establishing Business Relationship to the satisfaction of the regulated person.

(vii) The condition of obtaining photocopies of identity documents of directors of Limited Companies/Corporations is relaxed in case of Government/Semi Government entities, where regulated person should obtain photocopies of identity documents of only those directors and persons who are authorized to establish and maintain Business Relationship. However, regulated person shall validate identity information including CNIC numbers of other directors from certified copies of ‘Form-A/Form-B’ and verify their particulars through NADRA Verisys. The Verisys reports should be retained on record in lieu of photocopies of identity documents.

(viii) Government entities accounts shall not be opened in the personal names of a government official. Any account which is to be operated by an officer of the Federal or Provincial or Local Government in his/her official capacity, shall be opened only on production of a special resolution or authority from the concerned administrative department or ministry duly endorsed by the Ministry of Finance or Finance Department/Division of the concerned Government.

Explanation:- For the purposes of this regulation the expression “Government entities” includes a legal person owned or controlled by a Provincial or Federal Government under Federal, Provincial or local law.

Explanation:- For the purpose of this Annexure I the expression “NADRA” means National Database and Registration Authority established under NADRA Act, (VIII of 2000).

[File No. SY/SECP/8/13]

( Bilal Rasul )
Secretary to the Commission

Securities and Exchange Commission of Pakistan (Anti Money Laundering and Countering Financing of Terrorism) Regulations, 2020