Securities Industry (Anti Money Laundering and Countering the Financing of Terrorism) Rules, 2015

SECURITIES INDUSTRY (ANTI MONEY LAUNDERING AND COUNTERING THE FINANCING OF TERRORISM) RULES, 2015

Arrangement of Sections

Section

PART I – PRELIMINARY	3

1. | Citation..........................................................................................................................3
2. | Interpretation..................................................................................................................3
3. | Internal control requirement..........................................................................................4
4. | Money Laundering Reporting Officer............................................................................4

PART II – RISK RATING	5

5. | Requirement for risk rating framework..........................................................................5

PART III – VERIFICATION OF CUSTOMER IDENTITY	6

6. | Standard..........................................................................................................................6
7. | Nature and scope of activity..........................................................................................6
8. | Time frames for verification of customer identity.........................................................7
9. | Natural persons..............................................................................................................8
10. | Corporate customers......................................................................................................9
11. | Partnerships and unincorporated businesses..................................................................9
12. | Financial and corporate service providers....................................................................10
13. | Other legal structures and fiduciary arrangements.......................................................10
14. | Foundations..................................................................................................................11
15. | Personal representatives of an estate............................................................................11
16. | Non-profit associations................................................................................................12
17. | Powers of attorney........................................................................................................12
18. | Special considerations..................................................................................................12
19. | Verification to be conducted according to nature and structure..................................13
20. | Re-verification..............................................................................................................13
21. | Form of documents......................................................................................................13
22. | Reliance on third party Know Your Customer procedures..........................................13
23. | Introduction from group companies or intermediaries................................................14
24. | Exemption from verification of identity......................................................................16
25. | Enhanced due diligence................................................................................................17
26. | Politically exposed persons..........................................................................................17
27. | Bearer shares................................................................................................................18
28. | Ongoing monitoring......................................................................................................19

PART IV – RECORD KEEPING	19

29. | Scope and retention period of records.........................................................................19
30. | Verification records......................................................................................................20
31. | Transaction records......................................................................................................20

PART V – MISCELLANEOUS	21

32. | Education and training.................................................................................................21
33. | Consideration of guidelines.........................................................................................22

---

SECURITIES INDUSTRY (ANTI MONEY LAUNDERING AND COUNTERING THE FINANCING OF TERRORISM) RULES, 2015

SECURITIES INDUSTRY ACT

(NO. 10 OF 2011)

SECURITIES INDUSTRY (ANTI MONEY LAUNDERING AND COUNTERING THE FINANCING OF TERRORISM) RULES, 2015

The Securities Commission of The Bahamas, in exercise of the powers conferred by section 149 of the Securities Industry Act, 2011 makes the following Rules —

PART I – PRELIMINARY

1. Citation. These Rules may be cited as the Securities Industry (Anti Money Laundering and Countering the Financing of Terrorism) Rules, 2015.

2. Interpretation. In these Rules — "Act" means the Securities Industry Act (No. 10 of 2011); "Financial Intelligence Unit" means the body established under section 3 of the Financial Intelligence Unit Act¹; "Money Laundering Reporting Officer" means a person appointed pursuant to regulation 5 of the Financial Intelligence (Transactions Reporting) Regulations²; "non-profit association" means an association or organisation that primarily engages in raising or disbursing funds for purposes such as religious, charitable, educational, scientific, historical, fraternal, literary, sporting, artistic, or athletic, purposes not for profit; "occasional transaction" has the same meaning as defined in the Financial Transactions Reporting Act³;

¹Vol. VIII, (Ch. 367) ²Sub. Leg., Vol. VI, (Ch. 367) ³Vol. VIII, (Ch. 368)

Page - 3

---

"regulated person" means a registrant or a person registered under Part V of the Act but for the purposes of rules 3 and 4 excludes an investment fund.

3. Internal control requirement. (1) A regulated person shall appoint senior personnel responsible for establishing, implementing and maintaining policies, procedures and controls — (a) to deter the use of a facility for money laundering or the financing of terrorism; (b) to ensure the timely detection and reporting of suspicious activity; and (c) for the prompt investigation of suspicious activity. (2) A regulated person shall on a regular basis verify compliance with internal policies, procedures and controls relating to money laundering and terrorist financing activities.

4. Money Laundering Reporting Officer. (1) Save where the function is outsourced, a regulated person shall appoint a person to act as its Money Laundering Reporting Officer who, where that person is an individual, must be sufficiently senior in the structure of the entity to command the necessary authority to carry out the functions and duties. (2) A regulated person shall, where the function of the Money Laundering Reporting Officer is outsourced, satisfy itself that the outsourced Money Laundering Reporting Officer has sufficient authority to enable it to carry out the necessary functions and duties. (3) A Money Laundering Reporting Officer has responsibility for overseeing and managing the making of suspicious transaction reports regarding money laundering or terrorist financing. (4) A regulated person shall — (a) register the Money Laundering Reporting Officer with the Financial Intelligence Unit; (b) ensure that the Money Laundering Reporting Officer, as well as any person appointed to assist the Money Laundering Reporting Officer, has timely access to systems, customer records and all relevant information required to discharge their duties; (c) notify the Commission of the name of the Money Laundering Reporting Officer and any change thereto; and

Page - 4

---

(d) include in the notification required by sub-paragraph (c) a statement that the Money Laundering Reporting Officer is a fit and proper person. (5) An employee of a regulated person must report their knowledge or suspicion of customers who are engaged in money laundering or the financing of terrorism to the appointed Money Laundering Reporting Officer. (6) When assessing a report received from an employee under paragraph (5), a Money Laundering Reporting Officer shall determine whether information or other matters contained in the report give rise to knowledge or a suspicion that a customer is engaged in money laundering or the financing of terrorism.

PART II – RISK RATING

5. Requirement for risk rating framework. (1) A regulated person shall assess the risk profile of each new customer relationship or product prior to establishing a business relationship with the customer or issuing the product. (2) A regulated person's risk rating framework shall — (a) categorize customer relationships and products so that the level of risk associated with each customer relationship or product is identifiable; (b) categorize customer relationships and products to take account of risk factors related to the particular customer relationship or product including — (i) customer type/profession; (ii) country of domicile; (iii) complexity of ownership; (iv) complexity of legal structure; (v) source of business; (vi) type of assets; (vii) type, size and volume of transactions; (viii) level of cash transactions; (ix) adherence to customer activity profile;

Page - 5

---

(c) establish the level of management able to approve the regulated person entering into customer relationships at the various levels of risk rating categories; (d) establish Know Your Customer and due diligence information requirements appropriate for the risk profile of the customer relationship or product; (e) require the periodic review of the customer relationship or product to — (i) ensure that the categorizations are current and appropriate; (ii) enable the regulated person to determine whether any adjustment should be made to the risk rating; (f) require the re-categorization of a customer relationship or product offered by the regulated person in the event of a change in the risk profile of a customer relationship or product; and (g) require the documentation of the basis for the risk rating applied to a customer relationship or product and of any changes in the risk rating of a particular customer relationship or product.

PART III – VERIFICATION OF CUSTOMER IDENTITY

6. Standard. A regulated person shall, when verifying customer identity — (a) satisfy itself that the prospective customer is who the customer claims to be; and (b) ensure that sufficient information is obtained — (i) on the nature of the business that the customer expects to undertake; and (ii) concerning any expected or predictable pattern of transactions.

7. Nature and scope of activity. (1) A regulated person shall, when commencing a business relationship — (a) record the purpose and reason for establishing the business relationship and the anticipated level and nature of activity to be undertaken; and

Page - 6

---

(b) adopt risk management procedures concerning the conditions under which a customer may utilize the business relationship prior to verification. (2) A regulated person shall not, where satisfactory evidence of identity is outstanding in relation to a prospective or existing customer — (a) issue documents of title; (b) remit income to the customer, but may reinvest such income; and (c) conduct any other transaction over the relevant facility except by an order of the court. (3) A regulated person shall, once a business relationship has been established, take reasonable steps to ensure that due diligence information is kept up to date. (4) A regulated person shall, where the regulated person considers a customer to be high risk, confirm the customer's source of wealth. (5) A regulated person shall, where a customer provides a document with which the regulated person is not familiar, take reasonable steps to verify that the document is authentic. (6) Where a prospective or an existing customer fails or is unable to provide adequate evidence of identity, or a regulated person is not satisfied that a transaction in which it is or may be involved is legitimate, the regulated person shall — (a) determine whether — (i) other steps should be taken to verify the customer's identity; (ii) it is appropriate to proceed or continue with the business relationship; and (b) file a suspicious transaction report to the Financial Intelligence Unit. (7) A regulated person shall, where a business is discontinued, return funds held to the order of the prospective customer to the source from which the funds came, and not to a third party, unless directed to do otherwise by an order of the court.

8. Time frames for verification of customer identity. A regulated person shall verify the identity of customers or persons conducting transactions — (a) before a prospective customer becomes a facility holder; (b) before any occasional transaction involving an amount of cash that exceeds fifteen thousand dollars ($15,000);

Page - 7

---

(c) before a transaction is conducted involving an amount of cash that exceeds fifteen thousand dollars ($15,000) where it appears to the regulated person that the person conducting the transaction is doing so on behalf of any other person or persons; (d) as soon as practicable after the regulated person — (i) becomes aware that two or more occasional transactions are or have been structured to avoid lawful verification procedures in respect of the person or persons conducting the transactions and the aggregate amount of cash involved exceeds fifteen thousand dollars ($15,000); (ii) has knowledge or a reasonable suspicion that a customer is conducting or proposes to conduct a transaction which involves the proceeds of criminal conduct as defined in section 3 of the Proceeds of Crime Act⁴ or is an attempt to avoid the enforcement of the Proceeds of Crime Act; or (iii) has knowledge or a reasonable suspicion that funds as defined in section 2 of the Anti Terrorism Act⁵, or financial services, are related to or are to be used to facilitate an offence under the Anti-Terrorism Act.

9. Natural persons. (1) A regulated person shall, when verifying the identity of a natural person, obtain and document — (a) the person's — (i) full and correct name; (ii) correct permanent address; (iii) date and place of birth; and (b) the purpose of the account and nature of the business relationship. (2) A regulated person may, when verifying the identity of a natural person, seek the following additional information — (a) nationality; (b) occupation and name of employer and, where the customer is self-employed, the nature of the self-employment; (c) estimated level of account activity including — (i) size of account, in the case of investment and custody accounts;

⁴Vol. II, (Ch. 93) ⁵Vol. III, (Ch. 107)

Page - 8

---

(ii) balance ranges, in the case of current and deposit accounts; (iii) an indication of the expected transaction volume of the account; and (iv) source of funds.

10. Corporate customers. (1) A regulated person shall, when verifying the identity of corporate customers, obtain — (a) the original or a certified copy of the certificate of incorporation, registration or the equivalent; (b) a copy of the board resolution authorizing the opening of the account or the facility and the signatories authorized to sign on the account; (c) satisfactory evidence of identity of all account signatories, details of their relationship with the company and, where they are not employees, an explanation of the relationship; (d) satisfactory evidence of identification of each natural person — (i) with a beneficial interest of 10% or more in the company, except where the company is a public company; (ii) with principal control over the company's assets; (iii) who otherwise exercises control over the management of the company; and (e) confirmation that the company has not been or is not in the process of being dissolved, struck off the register, wound up or terminated. (2) A regulated person shall, when opening an account for a company, take all reasonable steps to verify the legal existence of the company and to ensure that any person purporting to act on behalf of the company is authorized to do so. (3) A regulated person shall review its records when an authorized signatory is changed to ensure that all current signatories have been verified.

11. Partnerships and unincorporated businesses. (1) A regulated person shall, when verifying the identity of partnerships and unincorporated businesses, obtain — (a) a copy of the partnership agreement or document establishing the partnership or unincorporated business;

Page - 9

---

(b) a mandate authorizing the opening of the account, or the use of some other facility, and conferring permission on any person authorized to undertake transactions; (c) satisfactory evidence of the identity of all partners and controllers of the firm or business; and (d) satisfactory evidence of the identity of all authorized signatories. (2) A regulated person shall review its records when partners, controllers or authorized signatories change to ensure that the new signatories have been verified.

12. Financial and corporate service providers. Where a financial and corporate service provider licensed under the Financial and Corporate Service Providers Act⁶ operates a facility with a regulated person, the regulated person must verify the identity of the financial and corporate service provider and any person on whose behalf the financial corporate service provider operates the facility.

13. Other legal structures and fiduciary arrangements. (1) A regulated person shall, when verifying the identity of a trust, fiduciary or nominee structure, make appropriate enquiries into the general nature and purpose of the trust, fiduciary or nominee structure, the source of its funds and obtain evidence of identification for — (a) all persons providing funds or assets to the structure; (b) all identifiable or known beneficiaries in the trust; (c) all beneficiaries of a fiduciary or nominee structure; (d) any person with signatory powers in relation to the structure; (e) all persons exercising effective control over the trust, fiduciary or nominee structure including an individual who has power, whether exercisable alone, jointly or with another person, to — (i) dispose of, advance, lend, invest, pay or apply property to the trust, fiduciary of nominee structure; (ii) vary the terms of the trust, fiduciary or nominee structure; (iii) add or remove a person as a beneficiary; (iv) add or remove a person as a beneficiary to or from a class of beneficiaries; (v) appoint or remove trustees, fiduciaries or nominees; or

⁶Vol. VIII, (Ch. 369)

Page - 10

---

(vi) direct, withhold, consent to or veto the exercise of any of the powers referred to in sub-paragraphs (i) – (v). (2) A regulated person shall, where a trustee, fiduciary or nominee whose identity has been verified is replaced, verify the identity of the new trustee, fiduciary or nominee before the new trustee, fiduciary or nominee is allowed to exercise control over the funds. (3) A financial institution that introduces a transaction to a regulated person on behalf of a settlor and beneficiary shall verify in accordance with rule 23 the identity of the settlor and the beneficiary.

14. Foundations. A regulated person shall, when verifying the identity of a foundation, obtain — (a) the foundation's Charter; (b) the Registrar General's certificate of registration or, where applicable, a document of equivalent standing in a foreign jurisdiction; (c) the source of funds and, where a person other than the founder provides funds for the foundation, verification of the identity of the third party providing the funds or for whom the founder may be acting; (d) identification evidence of the founder(s) and for such officers and council members of a foundation as may be signatories for the accounts of the foundation; and (e) identification evidence of beneficiaries that hold a vested interest in the foundation.

15. Personal representatives of an estate. (1) A regulated person that enters into a business relationship as a part of the winding up of an estate of a deceased person shall verify the identity of the personal representative of the estate. (2) Notwithstanding paragraph (1), the identity of the personal representative of the estate need not be verified where securities will be issued — (a) from an investment account established with the regulated person in the deceased's name; and (b) to the personal representative in accordance with the Grant of Probate or Letters of Administration solely for the purpose of winding up the estate.

Page - 11

---

(3) Securities referred to in paragraph (2) may be issued, on the instruction of the personal representative, to the underlying beneficiaries without verification of their identity.

16. Non-profit associations. A regulated person shall, when verifying the identity of a non-profit association obtain — (a) the nature of the proposed entity's purpose and operations; and (b) identification evidence of at least two signatories and or anyone authorized to give instructions on behalf of the entity.

17. Powers of attorney. A regulated person conducting transactions in accordance with a power of attorney shall verify, where appropriate — (a) the identity of each donee of the power of attorney; (b) the identity of the donor of the power of attorney; and (c) third party mandates.

18. Special considerations. (1) A regulated person shall exercise additional care in relation to the provision of the following services — (a) safe custody; (b) intermediaries; (c) technological developments; and (d) occasional transactions. (2) A regulated person shall, when providing a service referred to in paragraph (1), verify the identity of the facility holder or person carrying out the relevant transaction. (3) A regulated person offering internet based or telephone products and services shall have secure and reliable methods, appropriate to the risks associated with the particular product or service, of verifying the identity of the customer. (4) A regulated person shall verify the underlying customers of a financial institution where a facility holder — (a) is an intermediary that is not a financial institution within the meaning of paragraph (6) of rule 23; or

Page - 12

---

(b) is not from a country that is listed in the First Schedule to the Financial Transactions Reporting Act. (5) A regulated person need not verify underlying customers where a facility holder is an intermediary that is a financial institution within the meaning of paragraph (6) of rule 23. (6) A regulated person shall monitor facilities and services maintained by or provided to a facility holder or customer under this rule for transactions over fifteen thousand dollars ($15,000) and for any series of transactions which in total exceed fifteen thousand dollars ($15,000).

19. Verification to be conducted according to nature and structure. A regulated person required to verify underlying customers or persons related to a facility holder shall adhere to the standards for verification of identification provided in this Part as may be appropriate to the nature and structure of the person or entity being verified.

20. Re-verification. A regulated person shall re-verify the identity of a customer where — (a) during the course of the business relationship the regulated person has reason to doubt the identity of the customer; (b) there is a material change in the way a facility is operated; or (c) sub-paragraph (d)(ii) or (iii) of rule 8 applies.

21. Form of documents. A regulated person shall, where the submission of original documents and information by a customer is impractical or impossible, accept only certified copies of documents and information submitted by the customer in support of verification of identity.

22. Reliance on third party Know Your Customer procedures. (1) A regulated person shall maintain adequate documentation to demonstrate that Know Your Customer procedures have been properly implemented and have been carried out by the regulated person. (2) Notwithstanding paragraph (1) of rule 23, a regulated person may rely on the Know Your Customer procedures carried out by another financial institution where — (a) the regulated person is unable to readily determine whether or not an occasional transaction involves cash because a customer

Page - 13

---

deposited funds into a facility held for and on behalf of the regulated person by another financial institution; and (b) the financial institution is a facility holder of the regulated person and conducts a transaction on behalf of its customer using the facilities of the regulated person. (3) A regulated person relying on the Know Your Customer procedures of another financial institution shall — (a) obtain written confirmation from the financial institution that it has verified the identity of the customer concerned; and (b) confirm the existence of the facility provided by the financial institution. (4) A regulated person may rely on the Know Your Customer procedures of other financial institutions only in relation to transactions conducted by such financial institutions which are facility holders of the regulated person. (5) Subject to rule 23, a regulated person shall carry out appropriate due diligence and obtain the necessary evidence of identity where a person on whose behalf a transaction is being conducted is introduced to the regulated person for the purpose of forming a business relationship.

23. Introduction from group companies or intermediaries. (1) A regulated person entering a business relationship shall conduct Know Your Customer procedures on any customer introduced to it by another financial institution unless the financial institution is an eligible introducer able to provide the regulated person with copies of all required documentation. (2) A regulated person relying on the Know Your Customer procedures of an eligible introducer shall obtain — (a) written confirmation that the eligible introducer has verified the customer's identity in accordance with the national laws of the eligible introducer; (b) certification from the eligible introducer that any photocopies forwarded are identical to the corresponding originals; and (c) clear and legible copies of all documentation within thirty days of receipt of the written confirmation referred to in sub-paragraph (a) from the eligible introducer. (3) Notwithstanding any reliance on an eligible introducer's Know Your Customer procedures, a regulated person shall —

Page - 14

---

(a) ensure that adequate Know Your Customer procedures are followed and that the documentary evidence of the eligible introducer to be relied on is satisfactory; and (b) as soon as is reasonably possible, obtain from the eligible introducer all the relevant information pertaining to the customer's identity. (4) A regulated person that does not obtain from an eligible introducer the relevant information and documentation within thirty days of receipt of the eligible introducer's written confirmation shall — (a) firstly, attempt to verify the customer's identity directly with the customer or suspend the customer's account; and (b) where after a further reasonable period the regulated person is unable to verify the customer's identity and does not receive the relevant documents, terminate the business relationship. (5) An eligible introducer is, in relation to a domestic financial institution — (a) a person licensed pursuant to Part VI of the Securities Industry Act⁷; (b) an investment fund administrator licensed pursuant to section 34 of the Investment Funds Act⁸; (c) a bank or trust company licensed by the Central Bank of The Bahamas; or (d) a company carrying on life assurance business pursuant to section 2 of the Insurance Act⁹. (6) An eligible introducer is, in relation to a foreign financial institution, an institution that — (a) exercises functions similar to those of a financial institution — (i) licensed pursuant to Part VI of the Securities Industry Act; (ii) licensed as an investment fund administrator pursuant to section 34 of the Investment Funds Act; (iii) licensed as a bank or trust company by the Central Bank of The Bahamas; (iv) carrying on life assurance business pursuant to section 2 of the Insurance Act; and (b) is based in a country listed in the First Schedule of the Financial Transactions Reporting Act and —

⁷No. 10 of 2011 ⁸Vol. VIII, (Ch. 369A) ⁹Vol. VII, (Ch. 347)

Page - 15

---

(i) is subject, in accordance with the laws of The Bahamas, to equivalent or higher anti money laundering and countering of financing of terrorism standards of regulation; and (ii) has no obstacles which would prevent the regulated person from obtaining the original documentation.

24. Exemption from verification of identity. (1) Rules 6 to 21 do not apply to a regulated person where — (a) the facility holder is a financial institution referred to in paragraphs (5) and (6) of rule 23; and (b) a single occasional transaction is conducted in an amount not exceeding fifteen thousand dollars ($15,000). (2) Subject to paragraph (3), a regulated person is not required to obtain documents and information for verification of a customer where the customer is — (a) a superannuation scheme; (b) an occupational retirement or pension plan which does not allow non-employee participation; (c) a financial institution regulated by the Securities Commission, the Central Bank of The Bahamas, the Insurance Commission of The Bahamas, or the Gaming Board; (d) a foreign financial institution located in a jurisdiction specified in the First Schedule to the Financial Transactions Reporting Act which is regulated by a body having equivalent regulatory and supervisory responsibilities as the Securities Commission, the Central Bank of The Bahamas, the Insurance Commission, or the Gaming Board; (e) a central or local government agency or statutory body; (f) a publicly traded company or investment fund listed on The Bahamas International Securities Exchange or any other stock exchange specified in the Schedule to the Financial Transactions Reporting Regulations and approved by the Securities Commission; (g) a regulated investment fund as defined in section 2 of the Investment Funds Act or a regulated investment fund located in a country specified in the First Schedule to the Financial Transactions Reporting Act and regulated by a body having equivalent regulatory and supervisory responsibilities as the Securities Commission;

Page - 16

---

(h) an applicant for insurance consisting of a policy of insurance in connection with a pension scheme taken out by virtue of a person's contract of employment or occupation; (i) an applicant for insurance in respect of which a premium is payable in one instalment of an amount not exceeding two thousand five hundred dollars ($2,500); (j) an applicant for insurance in respect of which a periodic premium is payable and where the total payable in respect of any one calendar year does not exceed two thousand five hundred dollars ($2,500); and (k) a Bahamian dollar facility of or below fifteen thousand dollars ($15,000). (3) Notwithstanding paragraphs (1) and (2), a regulated person shall verify the identity of a customer in all cases where the regulated person knows of or suspects money laundering or terrorist financing and makes a report to — (a) the Financial Intelligence Unit, in the case of money laundering; or (b) the Commissioner of Police, in the case of terrorist financing.

25. Enhanced due diligence. (1) A regulated person shall apply enhanced customer due diligence measures for categories of customers, business relationships, or transactions that the regulated person considers to present a higher risk for money laundering or terrorist financing. (2) A regulated person shall, where the regulated person concludes as a part of its risk assessment of a facility holder that the standard identity verification process is insufficient, take additional verification measures with respect to the facility holder.

26. Politically exposed persons. (1) For the purposes of this rule, a politically exposed person — (a) means an individual who holds or has held, within the preceding twelve month period of a proposed business relationship, an important public position including, but not limited to, the position of a — (i) head of state; (ii) head of government;

Page - 17

---

(iii) senior official in the executive, legislative, administrative, military, or judicial branches of government, whether elected or not; (iv) senior official in a major political party; (v) senior executive in a major statutory or government owned corporation; (b) includes any parent, sibling, spouse or child of an individual referred to in paragraph (a); and (c) includes any corporation, business or other entity formed by or for the benefit of a person referred to in sub-paragraph (a)(i). (2) A regulated person shall use in relation to politically exposed persons a risk sensitive approach to — (a) approving the commencement of business relationships with customers; (b) continuing relationships with customers who are or who have subsequently become politically exposed persons; and (c) develop clear policies, internal guidelines, procedures and controls regarding such business relationships.

27. Bearer shares. A regulated person shall, where a customer of the regulated person has issued or has the potential to issue bearer shares, conduct in addition to the verification of identity measures required under this Part, enhanced due diligence measures including but not limited to — (a) opening accounts for companies capable of issuing bearer shares only where the holders and beneficial owners of such shares are verified in accordance with this Part; (b) establishing procedures to ensure that the regulated person is notified whenever there is a change of holder or beneficial owner, or both, of such shares including but not limited to — (i) obtaining an undertaking in writing from the beneficial owner which states that immediate notification will be given to the regulated person if the shares are transferred to another party; (ii) ensuring that where the regulated person does not physically hold the bearer shares they are held in secure custody by a named custodian which has undertaken to inform the regulated person of any proposed change in ownership of the

Page - 18

---

company or the bearer shares, or of any changes to records relating to such shares and the custodian; and (iii) depending on its risk assessment of the customer, having the undertakings referred to in sub-paragraphs (i) and (ii) certified by a public accountant, counsel and attorney, or such other person as may be recognised by the Commission.

28. Ongoing monitoring. (1) A regulated person that has completed the identification procedures and established a business relationship with a customer shall monitor the conduct of the relationship to ensure that it is consistent with the nature of the business stated when the relationship was established. (2) A regulated person that has accepted 'hold mail' instructions in relation to a facility, notwithstanding the source of the 'hold mail' business, shall obtain evidence of the identity of the facility holder.

PART IV – RECORD KEEPING

29. Scope and retention period of records. (1) A regulated person shall, in compliance with all relevant laws of The Bahamas, prepare and maintain records of its business relationships and transactions that enable — (a) competent third parties to assess the regulated person's observance of anti money laundering and countering of the financing of terrorism policies and procedures; (b) transactions effected through the regulated person to be reconstructed; and (c) the regulated person to satisfy court orders or enquiries from the appropriate authorities. (2) A regulated person shall keep all records required to be maintained by these Rules for a period of seven years from the date that the customer of the regulated person ceases to be a facility holder. (3) A customer ceases to be a facility holder of a regulated person from the date of — (a) the carrying out of a one-off transaction or the last transaction in a series of transactions; (b) the closing of the account or accounts or the ending otherwise of the business relationship;

Page - 19

---

(c) the commencement of proceedings to recover debts payable on insolvency. (4) The seven year period referred to in paragraph (2) commences, where formalities to end a business relationship have not been undertaken but a period of seven years has elapsed since the date of the last transaction, on the date of the completion of the last transaction. (5) Where a regulated person is a company that is being liquidated, the liquidator shall retain the relevant records of the regulated person for the balance of the prescribed period remaining at the date of dissolution. (6) A regulated person shall maintain records in such form as would enable the relevant facility holder to be identified and to establish the customer's identity as verified by the financial institution. (7) Records may be maintained in the form of — (a) original documents; (b) microfiche; or (c) other electronic media.

30. Verification records. A regulated person shall — (a) where a facility holder conducts a transaction through a facility provided by the regulated person; and (b) where the regulated person in accordance with section 9 of the Financial Transactions Reporting Act verifies the identity of the facility holder and of any non-facility holder in relation to the facility, maintain the records generated by such verification in accordance with paragraph (2) of rule 29.

31. Transaction records. (1) A regulated person shall maintain transaction records containing information on the — (a) nature of the transaction; (b) details of the transaction, including the amount of the transaction and the denomination of the currency; (c) date on which which the transaction was conducted; (d) identification verification details of the parties to the transaction;

Page - 20

---

(e) where applicable, facility through which the transaction was conducted and any other facility directly involved in the transaction; and (f) the files, business correspondence and records connected to the facility. (2) A regulated person shall maintain records of — (a) suspicions raised internally by the Money Laundering Reporting Officer but not disclosed to the authorities; (b) suspicions which the Financial Intelligence Unit, the Commissioner of Police, or it supervisory authority have advised are of no interest; (c) findings of inquiries conducted by the regulated person into unusual activity.

PART V – MISCELLANEOUS

32. Education and training. (1) A regulated person shall take appropriate measures to make employees aware of — (a) policies and procedures put in place to detect and prevent money laundering and to counter the financing of terrorism including those for the identification, record keeping, detection of unusual and suspicious transactions and internal reporting; and (b) all legislation pertaining to anti money laundering and countering the financing of terrorism. (2) A regulated person shall provide relevant employees with training in the recognition and handling of suspicious transactions.

Page - 21

---

33. Consideration of guidelines. A regulated person shall, when developing policies and procedures related to anti money laundering and countering the financing of terrorism, pay due regard to the provisions of any guidelines, best practices and policy statements issued by the Securities Commission in relation to anti money laundering and countering the financing of terrorism.

Dated this 26th day of November, 2015

[Signature]

The Securities Commission of The Bahamas

Page - 22