Securities and Exchange Commission of Pakistan Draft AML-CFT Regulations 2018

Government of Pakistan
Securities and Exchange Commission of Pakistan -.-.- Islamabad, the 26 th April, 2018 NOTIFICATION S. R. O. 557(I)/2018. Whereas the Financial Monitoring Unit established under section 6 of the Anti Money Laundering Act, 2010 in exercise of its powers conferred under clause (i) of subsection (4) of
section 6 has recommended Securities and Exchange Commission of Pakistan to frame regulations for the
reporting entities in the context of combating money laundering and financing of terrorism, including customer due diligence and ancillary record keeping that fall within the regulatory ambit of Securities and Exchange Commission of Pakistan. Now therefore, the Securities and Exchange Commission of Pakistan in exercise of the powers conferred under section under section 40 read with clause (w) of subsection (4) of
section 20 thereof, is pleased to issue draft Securities and Exchange Commission Anti Money Laundering
and Countering Financing of Terrorism (AML/CFT) Regulations, 2018 for the information of all the persons likely to be affected thereby and notice is hereby given that comments, if any, received within a period of thirty days shall be taken into consideration.
CHAPTER I
PRELIMINARY

1. Short Title and Commencement
   1.1.These regulations shall be called the Securities and Exchange Commission Anti Money Laundering and Countering Financing of Terrorism Regulations, 2018. 1.2.These shall come into force at once.
2. Definitions.-
   2.1 In these Regulations, unless there is anything repugnant in the subject or context,
   (a) “AML Act” means Anti Money Laundering Act, 2010 as amended from time to time; (b) “AML/CFT” means Anti-Money Laundering and Countering Financing of Terrorism; (c) “Beneficial owner” in relation to a customer of a Financial Institution means, the natural person(s) who ultimately own(s) or controls a customer or the person on whose behalf a transaction is being conducted and includes the person(s) who exercise(s) ultimate effective control over a person or a legal arrangement; (d) the term beneficiary depends on the context:
   (i) in case of trust, a beneficiary is the person or persons who are entitled to the benefit of any trust arrangement. A beneficiary can be a natural or legal person or arrangement. All trusts (other than charitable or statutory permitted non-charitable trusts) are required to have ascertainable beneficiaries. While trusts must always have some ultimately ascertainable

beneficiary, trusts may have no defined existing beneficiaries but only objects of a power until some person becomes entitled as beneficiary to income or capital on the expiry of a defined period, known as the accumulation period. This period is normally co-extensive with the trust perpetuity period which is usually referred to in the trust deed as the trust period. (ii) in the context of life insurance/takaful, life-contingent annuity contracts or another investment linked insurance/takaful policy, a beneficiary is the natural or legal person, or a legal arrangement, or category of persons, who will be paid the policy proceeds when/if an event occurs, which is covered by the policy. (e) “Business Relations” means provision of any service by the Financial Institutions regulated by the Commission under the administered legislation; (f) “Commission” means Securities and Exchange Commission of Pakistan established under section 3 of the Securities and Exchange Commission of Pakistan Act, 1997; (g) “Control” in relation to a legal person, means the power to exercise a controlling influence over the management or the policies of the undertaking, and, in relation to shares, means the power to exercise a controlling influence over the voting power attached to such shares; (h) “Currency Transaction Report or CTR” has the same meaning as ascribed under the AML Act; (i) “CNIC” means Computerized National Identity Card; (j) “EDD” means Enhanced Due Diligence; (k) “FATF” means Financial Action Task Force; (l) “Financial group” means a group that consists of a parent company or of any other type of legal person exercising control and coordinating functions over the rest of the group for the application of group supervision, together with branches and/or subsidiaries that are subject to AML/CFT policies and procedures at the group level; (m) “Financial Institution” means financial institutions regulated by the Commission i.e. Securities Brokers, Commodities Brokers, Insurers, Takaful Operators, NBFCs and Modarabas; (n) “FMU” means Financial Monitoring Unit established under the AML Act; (o) “Government entity” means a legal person owned or controlled by a provincial or federal government under federal, provincial or local law; (p) “Insurer” shall have the same meaning as defined in the Insurance Ordinance, 2000; (q) “KYC” means Know Your Customer; (r) “Legal arrangements” means express trusts or other similar legal arrangements. (s) “Legal persons” means entities other than natural persons that can establish a permanent customer relationship with a financial institution or otherwise own property. This can include companies, bodies corporate, foundations, anstalt, partnerships, or associations and other relevantly similar entities; (t) “NADRA” means National Database and Registration Authority; (u) “NICOP” means National Identity Card For Overseas Pakistanis; (v) “Non-Banking Finance Companies or NBFCs” has the same meaning as assigned to it in Part VIII A of
the Companies Ordinance, 1984; (w) offence of “Financing of Terrorism” has the same meaning as assigned to it in the Anti Terrorism Act, 1997; (x) offense of “Money laundering or ML” has the same meaning as assigned to it in the AML Act;

(y) “Person” has the same meaning as ascribed to it under the AML Act; (z) “POC” means Pakistan Origin Card; (aa)“Politically exposed persons” or PEPs shall have the following meaning:
Foreign PEPs means individuals who are or have been entrusted with prominent public functions by a foreign country, for example Heads of State or of government, senior politicians, senior government, judicial or military officials, senior executives of state owned corporations, important political party officials. Domestic PEPs means individuals who are or have been entrusted domestically with prominent public functions, for example Heads of State or of government, senior politicians, senior government, judicial or military officials, senior executives of state owned corporations, important political party officials. Persons who are or have been entrusted with a prominent function by an international organisation means members of senior management, i.e. directors, deputy directors and members of the board or equivalent functions. The definition of PEPs is not intended to cover middle ranking or more junior individuals in the foregoing categories. (bb) “Risk Based Approach or RBA” means applying measures to prevent or mitigate money laundering and terrorist financing risks that are commensurate with the risks identified; (cc) “Risk” refers to risk associated with money laundering and financing of terrorism; (dd) “Senior Management” includes, chief executive officer/ managing director, deputy managing director, chief operating officer, company secretary, chief financial officer, chief compliance officer and chief regulatory officer or holder of such positions by whatever name called; and (ee)“Suspicious Transaction Report or STR” has the same meaning as assigned to it under the AML Act.
2.2 Unless the context requires otherwise, the words and expressions used in these Regulations but
not defined herein shall have the same meaning as assigned to them under the AML Act and Securities and Exchange Commission of Pakistan Act, 1997 and administered legislation thereunder.
3. Risk Assessment.-
3.1 A Financial Institution shall take appropriate steps to identify, assess and understand, its money
laundering and terrorism financing risks in relation to:
(a) its customers;
(b) the jurisdictions or countries its customers are from or in; (c) the jurisdictions or countries the Financial Institution has operations or dealings in; and (d) the products, services, transactions and delivery channels of the Financial Institution.
3.2 The appropriate steps referred to in Regulation 3(1) shall include:
(a) documenting the Financial Institution’s risk assessments; (b) considering all the relevant risk factors before determining the level of overall risk and the appropriate type and extent of mitigation to be applied;

(c) keeping the risk assessments up-to-date;
(d) categorizing the overall entity level risk as high, medium or low based on the result of risk assessment; and (e) having appropriate mechanisms to provide its risk assessment information to the Commission.
4. Risk Mitigation and Applying Risk Based Approach.- A Financial Institution shall:
4.1 develop and implement policies, procedures and controls, which are approved by its board of
directors, to enable the Financial Institution to effectively manage and mitigate the risks that are identified in the risk assessment of ML/TF or notified to it by the Commission;
4.2 monitor the implementation of those policies, procedures and controls and enhance them if
necessary;
4.3 perform enhanced measures where higher risks are identified, to effectively manage and mitigate
those higher risks; and
4.4 have an independent audit function to test the system.
5. New Products, Practices and Technologies.- A Financial Institution shall:
5.1 identify and assess the money laundering and terrorism financing risks that may arise in relation
to:
(a) the development of new products and new business practices, including new delivery mechanisms; and (b) the use of new or developing technologies for both new and pre-existing products.
5.2 undertake the risk assessments, prior to the launch or use of such products, practices and
technologies, and shall take appropriate measures to manage and mitigate the risks.
5.3 in complying with the requirements of regulation (5.1) and (5.2), pay special attention to any new
products and new business practices, including new delivery mechanisms; and new or developing technologies that favor anonymity.
6. Customer Due Diligence.-
6.1 Customer due diligence or CDD in broader term include:
(a) identifying the customer or beneficial owner and verifying the customer’s/beneficial owner’s identity on the basis of documents, data or information obtained from customer and/or from reliable and independent sources; (b) monitoring of accounts/transactions on ongoing basis to ensure that the transactions being conducted are consistent with the Financial Institutions’ knowledge of the customer, their business and risk profile; (c) understanding and, as appropriate, obtaining information on the purpose and intended nature of the business relationship; and (d) monitoring of accounts/transactions on ongoing basis to ensure that the transactions being conducted are consistent with the Financial Institutions’ knowledge of the customer, their business and risk profile, including, where necessary, the source of funds and, updating records and data/ information to take prompt action when there is material departure from usual and expected activity through regular matching with information already available with Financial Institutions.

6.2 Financial Institutions shall apply CDD measures when establishing business relationship with a
customer and when there is doubt about the veracity or adequacy of previously obtained customer identification data.
6.3 Annexure–I’ provides range of documents which shall be obtained from different types of
customers.
6.4 Financial institutions should verify the identity of the customer and beneficial owner before or
during the course of establishing a business relationship or may complete verification after the establishment of the business relationship, provided that:
(a) this occurs as soon as reasonably practicable; (b) this does not interrupt the normal conduct of business; and (c) the ML/TF risks are effectively managed. Financial institutions shall adopt risk management procedures concerning the conditions under which a customer may utilize the business relationship prior to verification. The types of circumstances where the Financial Institution permits completion of verification after the establishment of the business relationship should be recorded in their CDD policies.
6.5 No Financial Institution shall open or maintain anonymous account or an account in fictitious
name.
6.6 For all persons, Financial Institutions should determine whether the person is acting on behalf of
a customer and should take reasonable steps to obtain:
(a) evidence to determine authority of such person to act on behalf of the customer, which shall be verified through documentary evidence including specimen signature of the customer; (b) identification and verification of the person purporting to act on behalf of the customer; and (c) identification and verification of the customer.
6.7 Each customer shall be categorized as high, normal or low risk, depending upon the outcome of
the CDD process.
6.8 The Financial Institutions will maintain a list of all such customers/accounts where the business
relationship was refused or needed to be closed on account of negative verification.
6.9 Financial Institutions are required to apply CDD requirement to its existing customers on the basis
of materiality and risk, and should conduct due diligence on existing relations at appropriate times, taking into account whether and when CDD measures have previously been undertaken and the adequacy of data obtained.
6.10 In case Financial Institutions are not able to satisfactorily complete required CDD measures,
account shall not be opened or any service provided and consideration shall be given if the circumstances are suspicious so as to warrant the filing of an STR. If CDD of an existing customer is found unsatisfactory, the relationship should be treated as high risk and reporting of suspicious transaction be considered in accordance with regulation 14.
6.11 In case where Financial Institution forms a suspicion of money laundering or terrorist financing,
and it reasonably believes that performing the CDD process will tip-off the customer, it may not pursue the CDD process, and instead should file an STR in accordance with regulation 14.
6.12 Government accounts shall not be opened in the personal names of the government official(s).
Government account which is to be operated by an officer of the Federal/Provincial/Local Government in his/her official capacity, shall be opened only on production of a special

resolution/authority from the concerned administrative department/ministry duly endorsed by the Ministry of Finance or Finance Department/Division of the concerned Government.
7. Beneficial Ownership of Legal Persons and Legal Arrangements.-
7.1 Where the customer is a legal person, in addition to other measuresthe Financial Institution shall:
(a) understand the nature of the customer’s business and its ownership and control structure; (b) identify and verify the identity of the natural persons (whether acting alone or together) who ultimately own the legal person by obtaining relevant information from the customer as per Annexure-I; (c) to the extent that there is doubt under 7. 1 (b) as to whether the natural persons who ultimately own the legal person are the beneficial owners or where no natural persons ultimately own the legal person, identify the natural persons (if any) who ultimately control the legal person or have ultimate effective control of the legal person; and (d) where no natural persons are identified under 7.1(b) or (c), identify the natural persons having executive authority in the legal person, or in equivalent or similar positions;
7.2 Where the customer is a legal arrangement, the Financial Institution shall:
(a) for trusts, identify and verify the identity of the settlor, the trustee, the protector (if any), the beneficiaries (including every beneficiary that falls within a designated characteristic or class), and any natural person exercising ultimate ownership, ultimate control or ultimate effective control over the trust (including through a chain of control or ownership); and (b) for other types of legal arrangements, identify and verify the identity of persons in equivalent or similar positions, as those described under regulation 7.2(a).
8. Identification of Beneficiary for Life Insurance/ Takaful Policies.- In addition to all other
requirements of these regulations, an insurer/ takaful operator shall conduct the following CDD measures at the time of payout, for the beneficiary of life insurance/takaful and other insurance/takaful related policies as soon as beneficiary of such policy is identified or designated:
8.1 for a beneficiary that is identified as specifically named natural person, legal person or legal
arrangement, obtain the full name and identity, of such beneficiary;
8.2 for a beneficiary that is designated by characteristics, class or other means and is known to the
Financial Institution, obtain sufficient information concerning the beneficiary to satisfy that it will be able to establish the identity of the beneficiary at the time of payout;
8.3 for both the above cases, the verification of the identity of the beneficiary should occur at the
time of the payout;
8.4 take reasonable measures to determine whether the beneficiaries and/or, where applicable, the
beneficial owner of the beneficiary, are politically exposed persons, at the time of the payout. Where higher risks are identified, financial institutions should be required to inform senior management before the payout of the policy proceeds, to conduct enhanced scrutiny on the whole business relationship with the policyholder, and to consider making a suspicious transaction report; and
8.5 Financial institutions shall include the beneficiary of a life insurance policy as a relevant risk factor
in determining whether EDD measures are applicable under regulation 9. If the financial institution determines that a beneficiary who is a legal person or a legal arrangement presents a

higher risk, it shall take enhanced measures, which include reasonable measures to identify and verify the identity of the beneficial owner of the beneficiary, at the time of payout.
9. Enhanced Due Diligence.-
9.1 Financial Institutions shall implement appropriate internal risk management systems, policies,
procedures and controls to determine if any customer presents high risk of ML/TF.
9.2 For the purposes of Regulation 9.1, circumstances where a customer presents high risk of ML/TF
include but are not limited to the following:
(a) customers/ policy holders belonging to countries which are non-compliant with anti-money laundering regulations according to FATF; (b) such body corporate, partnerships, associations and legal arrangements including non￾governmental organizations or not-for-profit organizations which receive donations; and (c) legal persons or arrangements with complex ownership structures.
9.3 Financial Institutions shall perform appropriate EDD measures before establishing Business
Relationship with customers that are identified as high risk by the Financial Institution or are notified as such by the Commission.
9.4 EDD measures include but are not limited to the following:
(a) obtain approval from Financial Institutions’ Senior Management to establish or continue business relations with such customers; (b) establish, by appropriate means, the sources of wealth and/or funds or beneficial ownership of funds, as appropriate; including Financial Institutions’ own assessment to this effect; and (c) conduct during the course of business relations, enhanced monitoring of business relations with the customer.
10. Politically Exposed Persons.-
10.1 In relations to foreign and domestic PEPs, Financial Institutions shall implement appropriate
internal risk management systems, policies, procedures and controls to determine if any customer or a beneficial owner is a PEP.
10.2 In case of foreign PEPs, Financial Institutions shall perform EDD in accordance with regulation 9.4
in addition to other requirements of these regulations.
10.3 In case of domestic PEPs, where business relationship poses higher risk, Financial Institutions shall
carry out EDD in accordance with regulation 9.4 in addition to other requirements of these regulations.
10.4 The requirements of regulation 10.2 and 10.3 above are also applicable on family members and
close associates of foreign and domestic PEPs.
11. Simplified Due Diligence.-
11.1 Where low risk is identified through adequate analysis of risk or where adequate checks and
controls exist, Financial Institutions may apply simplified or reduced CDD/ KYC measures. The decision to rate a customer as low risk shall be justified in writing by the Financial Institution. Low risk cases may include but are not limited to the following:

(a) financial institutions provided they are subject to requirements to combat money laundering and terrorist financing consistent with the FATF recommendations and are supervised for compliance with those requirements; (b) insurance policies for pension schemes if there is no early surrender option and the policy cannot be used as collateral; (c) pension superannuation or similar scheme that provides retirement benefits to employees, where contributions are made by way of deduction from wages, and the scheme rules do not permit the assignment of a member’s interest under the scheme; and (d) financial products or services that provide appropriately defined and limited services to certain types of customers, so as to increase access for financial inclusion purposes.
11.2 Relaxation for Simplified Due Diligence measures are limited to the following;
(a) reducing the frequency of customer identification updates; (b) reducing the degree of on-going monitoring and scrutinising transactions, based on a reasonable monetary threshold; and (c) not collecting specific information or carrying out specific measures to understand the purpose and intended nature of the business relationship, but inferring the purpose and nature from the type of transaction or business relationship established.
11.3 Simplified CDD measures are not acceptable whenever there is a suspicion of money laundering
or terrorist financing, or where specific higher-risk scenarios apply.
12. Reliance on Third Parties.-
12.1 Financial Institution may rely on a third party to conduct CDD on its behalf provided that the
Financial Institution shall:
(a) obtain immediately, the necessary information relating to identification of the customer, identification of the beneficial owner and/or the nature of business of the customer; (b) take steps to satisfy itself that copies of identification data and other relevant documentation relating to CDD requirements will be made available from the third party upon request without delay; (c) satisfy itself that the third party is regulated, and supervised or monitored for, and has measures in place for compliance with, CDD and record-keeping requirements in line with these regulations; and (d) maintain data/ information confidentiality and non-disclosure agreement with the third party.
12.2 When determining in which countries the third party that meets the conditions can be based,
Financial Institutions should have regard to information available on the level of country risk;
12.3 For financial institutions that rely on a third party that is part of the same financial group:
(a) the group should apply CDD and record-keeping requirements and programmes against money laundering and terrorist financing, in accordance with these regulations; and (b) any higher country risk should be adequately mitigated by the group’s AML/CFT policies.
12.4 The Financial Institutions shall be responsible for ongoing monitoring of its customers; and
12.5 Notwithstanding the reliance upon a third party, the Financial Institution shall ultimately remain
responsible for its AML/CFT obligations and shall carry out ongoing monitoring of such customer

itself.
13. Ongoing Monitoring.-
13.1 All business relations with customers shall be monitored on an ongoing basis to ensure that the
transactions are consistent with the Financial Institutions’ knowledge of the customer, its business and risk profile and where appropriate, the sources of funds.
13.2 Financial Institutions shall obtain information and examine, as far as possible the background and
purpose of all complex and unusual transactions, which have no apparent economic or visible lawful purpose. The background and purpose of these transactions shall be inquired and findings shall be documented with a view of making this information available to the relevant competent authorities when required.
13.3 Financial Institutions shall periodically review the adequacy of customer information obtained in
respect of customers and beneficial owners and ensure that the information is kept up to date, particularly for higher risk categories of customers. The review period and procedures thereof should be defined by Financial Institutions in their AML/CFT policies, as per risk based approach.
13.4 In relation to regulation 13.3, customers’ profiles should be revised keeping in view the spirit of
KYC/CDD and basis of revision shall be documented and customers may be consulted, if necessary.
13.5 Where Financial Institution files an STR on reasonable grounds for suspicion that existing business
relations with a customer are connected with ML/TF and the Financial Institution considers it appropriate to retain the customer:
(a) the Financial Institution shall substantiate and document the reasons for retaining the customer; and (b) the customer’s business relations with the Financial Institution shall be subject to proportionate risk mitigation measures, including enhanced ongoing monitoring.
13.6 Financial Institutions shall not form Business Relationship with entities/individuals that are:
(a) proscribed under the United Nations Security Council Resolutions and adopted by the Government of Pakistan; (b) proscribed under the Anti Terrorism Act, 1997; and (c) associates/facilitators of persons mentioned in regulation 13.6 (a) and (b). The Financial Institutionsshould monitor their relationships on a continuous basis and ensure that no such relationship exists directly or indirectly, through ultimate control of an account.
14. Reporting of Transactions (STRs/CTRs).-
14.1 Financial Institutions shall comply with the provisions of the AML Act and rules, regulations and
directives issued there under for reporting suspicious transactions/currency transactions in the context of money laundering or financing of terrorism.
14.2 Financial Institutions shall implement appropriate internal policies, procedures and controls for
meeting their obligations under the AML Act.
14.3 Financial Institutions shall pay special attention to all complex and all unusual patterns of
transactions, which have no apparent economic or visible lawful purpose. The background and purpose of such transactions shall, as far as possible, be examined, the findings established in writing, and be available to assist the relevant authorities in inspection and investigation.

14.4 The transactions, which are out of character, are inconsistent with the history, pattern, or normal
operation of the account or are not commensurate with the level of income of a customer shall be viewed with suspicion, be properly investigated and referred to Compliance Officer for possible reporting to FMU under the AML Act.
14.5 Financial Institutions should note that STRs, including attempted transactions, should be
reported regardless of the amount of the transactions; and, the CTRs should be reported for the transactions of rupees two million and above as per requirements of AML, Act.
14.6 The basis of deciding whether an STR is being filed or not shall be documented and kept on record
together with all internal findings and analysis done in relation to a suspicion irrespective of the fact that transaction is subsequently reported or not.
14.7 The employees of Financial Institutions are strictly prohibited to disclose the fact to the customer
or any other quarter that a STR or related information is being or has been reported to any authority, except if required by law.
14.8 Financial Institutions without disclosing the contents of STRs, shall intimate to the Commission
on bi-annual basis the number of STRs reported to FMU. The status report (indicating No. of STRs only) shall reach to the AML Department from the seven days of close of each half year.
15. Record Keeping.-
15.1 Financial Institutions shall maintain all necessary records on transactions, both domestic and
international, including the results of any analysis undertaken (e.g. inquiries to establish the background and purpose of complex, unusual large transactions) for a minimum period of ten years from completion of the transaction.
15.2 Financial Institutions shall, however, retain those records for longer period where transactions,
customers or accounts involve litigation or it is required by court or other competent authority.
15.3 The records shall be sufficient to permit reconstruction of individual transactions including the
nature and date of the transaction, the type and amount of currency involved and the type and identifying number of any account involved in the transactions so as to provide, when necessary, evidence for prosecution of criminal activity. The transactions records may be maintained in paper or electronic form, provided it is admissible as evidence in a court of law.
15.4 The records of identification data obtained through CDD process like copies of identification
documents, account opening forms, KYC forms, verification documents and other documents along with records of account files and business correspondence, shall be maintained for a minimum period of ten years after termination of the business relationship.
15.5 Financial Institutions shall ensure, to timely make available, all CDD and transaction records to
the Commission, FMU and law enforcement agencies whenever required.
16. Foreign Branches and Subsidiaries.-
16.1 Financial Institutions shall pay particular attention to their branches and subsidiaries located in
countries which do not or insufficiently comply with FATF Recommendations (as determined by FATF) and ensure that their AML/ CFT policy is observed by branches and subsidiaries in those countries.
16.2 Financial Institutions shall apply their AML/ CFT policies to all of their branches and subsidiaries

outside Pakistan to the extent that laws and regulations of the host country permit. Where the AML/CFT requirements in the host country or jurisdiction differ from those in Pakistan, Financial Institutions shall require their overseas branches or subsidiaries to apply the higher of the two standards, to the extent that the law of the host country or jurisdiction so permits.
16.3 Where the law of the host country conflicts with the AML/ CFT requirements of Pakistan so that
the overseas branch or subsidiary is unable to fully observe the higher standards, the Financial Institution shall report this to the Commission and comply with such further directions as may be issued.
17. Appointment of Compliance Officer.- Financial Institutions shall:
17.1 appoint a management level officer as compliance officer, who shall report directly to the board
of directors.
17.2 ensure that the compliance officer, as well as any other persons appointed to assist him, has
timely access to all customer records and other relevant information which they may require to discharge their functions.
17.3 the compliance officer shall primarily be responsible for the areas including, but not limited to:
(a) the Financial Institution’s effective compliance with the relevant provisions of the these Regulations, the Anti-Money Laundering Act, 2010; the Anti-Money Laundering Rules, 2008, the Anti-Money Laundering Regulations, 2015 and other directions issued under the aforementioned regulations and laws, as amended from time to time; (b) ensuring that the internal policies, procedures and controls for prevention of ML/TF are approved by the board of directors of the Financial Institution and are effectively implemented; (c) monitoring, reviewing and updating AML/CFT policies and procedures of the Financial Institutions; (d) providing assistance in compliance to other departments and branches of the Financial Institution; (e) timely submission of accurate data/ returns as required under the applicable laws; (f) monitoring and timely reporting of Suspicious and Currency Transactions to FMU; and (g) such other responsibilities as the Financial Institution may deem necessary in order to ensure compliance with these Regulations.
18. Financial Groups.- Financial groups should implement group-wide programmes against ML/TF, which
should be applicable, and appropriate to, all branches and majority-owned subsidiaries of the financial group. These should include the measures set out in in these regulations and also:
18.1 policies and procedures for sharing information required for the purposes of CDD and ML/TF risk
management;
18.2 the provision, at group-level compliance, audit, and/or AML/CFT functions, of customer,
account, and transaction information from branches and subsidiaries when necessary for AML/CFT purposes; and
18.3 adequate safeguards on the confidentiality and use of information exchanged.
19. Screening and Training.- Financial Institutions shall:

19.1 develop and implement a comprehensive employee due diligence policy and procedure to be
implemented/ carried out at the time of hiring all employees permanent, contractual, or through outsourcing. This shall include but not limited to verification of antecedents and screening procedures to verify that person being inducted/ hired has a clean history; and
19.2 chalk out and implement suitable training program for relevant employees on annual basis, in
order to effectively implement the regulatory requirements and Financial Institutions’ own policies and procedures relating to AML/ CFT. The employees training shall enable them to understand new developments, money laundering and financing of terrorism techniques, methods and trends. The training should also include their responsibilities relating to AML/ CFT.
20. Repeal.- The Circular No. 9 and 10 of 2009 and SRO 20(I)/2012 are hereby superseded.
Provided that supersession of the above circulars and SRO shall not- (i) revive anything not in force at the time at which the repeal take effect; (ii) affect the previous operation of the repealed Ordinance or anything duly done or suffered thereunder; (iii) affect any right, privilege, obligation or liability acquired, accrued or incurred under the said repealed Ordinance; (iv) affect any penalty imposed, forfeiture made or punishment awarded in respect of any offence committed under the repealed Ordinance; or (v) affect any inspection, investigation, prosecution, legal proceeding or remedy in respect of any obligation, liability, penalty, forfeiture or punishment as aforesaid, and any such inspection, investigation, prosecution, legal proceedings or remedy may be made, continued or enforced and any such penalty, forfeiture or punishment may be imposed, as if this Act has not been passed.
21. Penalty.-
21.1 Any financial institution who contravenes or fails to comply with any provision of these
regulation made shall, in addition to any penalty provided under AML Act, be liable to pay by way of penalty a sum which may extend to ten million rupees and where the contravention is a continuing one, with a further penalty which may extend to one hundred thousand rupees for every day after the first during which such contravention continues.
21.2 A penalty under sub-regulation (1) shall be imposed by the Commission after providing a
reasonable opportunity of being heard to the party.
Annex I
S No. Type of Customer Information/Documents to be Obtained

1. Individuals A photocopy of any one of the following valid identity documents;
   (i) Computerized National Identity Card (CNIC) issued by NADRA.
   (ii) National Identity Card for Overseas Pakistani (NICOP) issued by NADRA.

(iii) Pakistan Origin Card (POC) issued by NADRA.
(iv) Alien Registration Card (ARC) issued by National Aliens Registration Authority (NARA), Ministry of Interior (local currency account only). (v) Passport; having valid visa on it or any other proof of legal stay along with passport (foreign national individuals only).
2. Sole proprietorship (i) Photocopy of identity document as per Sr. No. 1 above of the
proprietor.
(ii) Registration certificate for registered concerns.
(iii) Certificate or proof of membership of trade bodies etc, wherever applicable. (iv) Declaration of sole proprietorship on business letter head. (v) Account opening requisition on business letter head. (vi) Registered/ Business address.
3. Partnership (i) Photocopies of identity documents as per Sr. No. 1 above of all the
partners and authorized signatories.
(ii) Attested copy of ‘Partnership Deed’ duly signed by all partners of the firm. (iii) Attested copy of Registration Certificate with Registrar of Firms. In case the partnership is unregistered, this fact shall be clearly mentioned on the Account Opening Form. (iv) Authority letter from all partners, in original, authorizing the person(s) to operate firm’s account. (v) Registered/ Business address.
4. Limited Companies/
Corporations
(i) Certified copies of:
(a) Resolution of Board of Directors for opening of account specifying the person(s) authorized to open and operate the account; (b) Memorandum and Articles of Association; (c) Certificate of Incorporation; (d) Certificate of Commencement of Business, wherever applicable; (e) List of Directors on ‘Form-A/Form-B’ issued under Companies Act, 2017, as applicable; and (f) Form-29, wherever applicable. (ii) Photocopies of identity documents as per Sr. No. 1 above of all the directors and persons authorized to open and operate the account; (iii) For individual (natural person) shareholders holding 20% or above stake (10% or above in case of EDD) in an entity, identification and verification of such natural persons; and

(iv) For legal persons holding shares equal to 20% or above in an entity, identification and verification of individual (natural person) shareholders holding shares equal to 20% or above of that legal person. (v) Registered address.
5. Branch Office or
Liaison Office of
Foreign Companies
(i) A copy of permission letter from relevant authority i-e Board of Investment. (ii) Photocopies of valid passports of all the signatories of account. (iii) List of directors on company letter head or prescribed format under relevant laws/regulations. (iv) A Letter from Principal Office of the entity authorizing the person(s) to open and operate the account. (v) Registered address.
6. Trust, Clubs,
Societies and
Associations etc.
(i) Certified copies of:
(a) Certificate of Registration/Instrument of Trust (b) By-laws/Rules & Regulations (ii) Resolution of the Governing Body/Board of Trustees/Executive Committee, if it is ultimate governing body, for opening of account authorizing the person(s) to operate the account. (iii) Photocopy of identity document as per Sr. No. 1 above of the authorized person(s) and of the members of Governing Body/Board of Trustees /Executive Committee, if it is ultimate governing body. (iv) Registered address/ Business address where applicable.
7. NGOs/NPOs/Charities
(i) Certified copies of:
(a) Registration documents/certificate
(b) By-laws/Rules & Regulations
(ii) Resolution of the Governing Body/Board of Trustees/Executive Committee, if it is ultimate governing body, for opening of account authorizing the person(s) to operate the account. (iii) Photocopy of identity document as per Sr. No. 1 above of the authorized person(s) and of the members of Governing Body/Board of Trustees /Executive Committee, if it is ultimate governing body. (iv) Any other documents as deemed necessary including its annual accounts/ financial statements or disclosures in any form which may help to ascertain the detail of its activities, sources and usage of funds in order to assess the risk profile of the prospective customer. (v) Registered address/ Business address.

8. Agents
   (i) Certified copy of ‘Power of Attorney’ or ‘Agency Agreement’.
   (ii) Photocopy of identity document as per Sr. No. 1 above of the agent and principal. (iii) The relevant documents/papers from Sr. No. 2 to 7, if agent or the principal is not a natural person. (iv) Registered/ Business address.
9. Executors and
   Administrators
   (i) Photocopy of identity document as per Sr. No. 1 above of the Executor/Administrator. (ii) A certified copy of Letter of Administration or Probate. (iii) Registered address/ Business address.
10. Minor Accounts (i) Photocopy of Form-B, Birth Certificate or Student ID card (as
    appropriate) shall be obtained from minor.
    (ii) Photocopy of identity document as per Sr. No. 1 above of the guardian of the minor. Note:
    (i) The photocopies of identity documents shall invariably be attested by Gazetted officer/ Nazim/Administrator or an officer of a Financial Institution after original seen. (ii) In case of a salaried person, in addition to CNIC, an attested copy of his service card, or any other acceptable evidence of service, including, but not limited to a certificate from the employer will be obtained. (iii) In case of an individual with shaky/immature signatures, in addition to CNIC, a passport size photograph of the new account holder will be obtained. (iv) In case of expired CNIC, account may be opened on the basis of attested copies of NADRA receipt/token and expired CNIC subject to condition that Financial Institution shall obtain copy of renewed CNIC of such customer within 03 months of the opening of account. For CNICs which expire during the course of the customer’s relationship, Financial Institutions shall design/ update their systems which can generate alerts about the expiry of CNICs at least 01 month before actual date of expiry and shall continue to take reasonable measures to immediately obtain copies of renewed CNICs, whenever expired. In this regard, Financial Institutions are also permitted to utilize NADRA Verisys reports of renewed CNICs and retain copies in lieu of valid copy of CNICs. However, obtaining copy of renewed CNIC as per existing instructions will continue to be permissible. (v) In case the CNIC does not contain a photograph, Financial Institutions shall obtain following:
    a) a duly attested copy of either driving license, service card, nikkah nama, birth certificate, educational degree/certificate, pension book, insurance certificate. b) a photograph duly attested by gazetted officer/Nazim/Administrator/ officer of the Financial Institution.

c) a copy of CNIC without photograph duly attested by the same person who attested the photograph. (vi) Financial Institutions shall obtain copies of CNICs of all the members of Governing and Executive Bodies of DHA or ask for delegation of power to Administrator under section (7) & (8) of the Pakistan Defence Housing Authority Order, 1980 and accept copy of CNIC of Administrator as well as authorized signatories for the purpose of opening accounts of DHA or similar other authorities subject to compliance of other requirements. (vii) The condition of obtaining Board Resolution is not necessary for foreign companies/entities belonging to countries where said requirements are not enforced under their laws/regulations. However, such foreign companies will have to furnish Power of Attorney from the competent authority for establishing Business Relationship to the satisfaction of the Financial Institution. (viii) The condition of obtaining photocopies of identity documents of directors of Limited Companies/Corporations is relaxed in case of Government/Semi Government entities, where Financial Institutions should obtain photocopies of identity documents of only those directors and persons who are authorized to establish and maintain Business Relationship. However, Financial Institutions shall validate identity information including CNIC numbers of other directors from certified copies of ‘Form-A/Form-B’ and ‘Form 29’ and verify their particulars through NADRA Verisys. The Verisys reports should be retained on record in lieu of photocopies of identity documents. No.SY/SECP/8/13