GOVERNMENT OF PAKISTAN
SECURITIES AND EXCHANGE COMMISSION OF PAKISTAN

Islamabad, Dated 28 th September 2020

NOTIFICATION DIRECTIVE

S.R.O. 920 (I)/2020.- Whereas the Anti-Money Laundering Act, 2020 (VII of 2010) (“the AML Act”) through the Anti-Money Laundering (Second Amendment) Act, 2020 under section 6A(1) and Schedule IV of the AML Act has designated Securities and Exchange Commission of Pakistan (“SECP” or the “Commission”) as an AML/CFT Regulatory Authority for any reporting entity licensed or regulated by SECP under relevant laws administered by SECP. Accordingly, under section 6A of the AML Act, the SECP is now empowered to issue regulations, directions and guidelines under the AML Act, 2010. The AML Act require all Reporting Entities to ensure implementation of Targeted Financial Sanctions (TFS) of freezing and prohibition obligations in relation to the money, assets or property of the designated or proscribed persons under the United Nations (Security Council) Act, 1948 (XLV of 1948) and under the Anti-Terrorism Act, 1997(XXVII of 1997).

AND WHEREAS the term Regulated Entity (“RP”) means securities brokers, futures brokers, Insurers, Takaful Operators, NBFCs and Modarabas regulated by SECP under the administered legislation.

AND WHEREAS the Commission has issued Guidelines for implementation of Anti-Money Laundering/Counter Financing of Terrorism (“AML /CFT”) framework (updated April, 2020) as contained in the Regulations for assistance and guidance of Regulated Entities. These Guidelines supplement the Regulations and the AML/CFT regime by clarifying and explaining the general requirements of the AML Law to help R P in applying AML/CFT measures, developing an effective AML/CFT risk assessment and compliance framework suitable/compatible to their business, and in particular, in detecting and reporting suspicious activities. The Guidelines also contain four (4) detailed Annexures, which provide guidance for preparing AML/CFT Risk Assessment; AML/CFT Compliance Assessment Checklist; ML/TF warning signs/red flags; proliferation financing warning signs/red alerts.

NOW THEREFORE, in exercise of the powers conferred under section 6A of the AML Act and in supersession of Commission’s earlier notification S.R.O 55 (I)/2020 dated January 28, 2020 and SRO 881(I)/2020, dated September 9, 2020, the Commission hereby directs all the Regulated Entities to comply with following reporting requirements and submit information in the manner prescribed below to the respective supervisory departments of the Commission, in consonance with the requirements of the Regulations and Guidelines namely:-

A. Annual risk assessment and control/compliance assessment framework based on data and information as on 30 June, to be filed by 31 st July of each financial year (“FY”), starting from the date of notification of this directive, and as instructed from time to time by the Commission.

a) Risk Assessment Framework: Regulated Entities should undertake and submit their internal annual risk assessment which should be aligned with the risks identified in the latest National Risk Assessment of the country and cover the process adopted for risk identification. The risk assessment methodology should cover the risk emanating from customers, products, geography and delivery channels, elaborate risk tolerance level and assess residual risk after implementation of mitigation measures. Regulated Entities are encouraged to use the template given in Annex 1 to the Guidelines for reference, but may choose their own risk assessment methodology that best suits or represents their business covering the aforementioned risks, in light of the AML Act, 2010 and the Regulations. The risk assessment report should be reviewed and approved by the board of

directors of the Regulated Entities and shall be signed by the chief executive officer/ company secretary.

b) Compliance Assessment Checklist: Regulated Entities should submit their annual compliance assessment checklist to demonstrate adequacy and effectiveness of AML/CFT compliance framework in light of the Regulations, and are encouraged to use the checklist provided in Annex 2 to the Guidelines for this purpose.

B. Quarterly information/ data on 30th of the subsequent month of every quarter, containing the following information:

a) Extracts of the discussion / deliberations on ML/TF risks and issues, by board of directors and/or management committees;

b) Number of new customer accounts opened during the period according to risk categorizations i.e. high, medium and low and their respective investment amount;

c) Total number of foreign and domestic politically exposed persons (“PEP”) and their total value of investments/deposits/financing etc. during the period;

d) Number of accounts/transactions closed and rejected for non-compliance of Customer Due Diligence (“CDD”) process and due to identification in proscribed person/Targeted Financial Sanction (“TFS”);

e) Documentation of any activity for which a Suspicious Transaction Report (“STR”) was considered but not filed along with rationale, during the period;

f) Copies of reports/mechanism to identify unusual transactions warranting further review;

g) Number of suspicious transactions, attempted transactions and currency transaction reports submitted to Financial Monitoring Unit (“FMU”);

h) Detail of complaints received on account of Know Your Customer (“KYC”) / AML, including its status i.e. in process/ resolved / closed, during the period;

i) Details of trainings conducted on AML/CFT for new and existing staff including number of participants and topics covered;

j) Number of customers transferred from one risk category to another and their amount of investments;

k) Confirmation of having an automatic Transaction Monitoring System (“TMS”) or otherwise? If yes, the name of TMS used;

l) Do you have automatic name screening solution? If yes, then what is the name of screening solution? If not, what are your future plans w.r.t.to automation;

m) Upgradation in AML CFT policies/manuals during the reporting period;

n) How much human resource is deployed for AML CFT and Compliance Function? Details of increase in number of employees during the period.

C. Each RP is required to immediately scan its customer data bases and their Beneficial Owners /associates for any matches with the stated designated/proscribed person(s)/entity(ies) on the receipt of notifications issued by the Ministry of Foreign Affairs under United Nations (Security Council) Act 1948 or intimation from National Counter Terrorism Authority/Law Enforcement Agencies/ Home Departments of Provinces/Ministry of Interior regarding additions, deletions and updates in list/SRO under the Anti- Terrorism Act, 1997 and. In case of a true match or suspicion of a proscribed/designated person following actions shall be taken by the RP immediately;

(a) Freeze without delay the customer’s fund/ policy or block the transaction, without prior notice if it is an existing customer;

(b) Reject the transaction or attempted transaction or the customer, if the relationship has not commenced;

(c) Lodge a STR with the FMU, and simultaneously

(d) Notify SECP and the Ministry of Foreign Affairs in case that person is designated under

United Nations Security Council Resolutions or the National Counter Terrorism Authority (“NACTA”) in case that person is designated under the Anti-Terrorism Act, 1997.

D. Compliance report on Statutory Regulatory Orders issued by the Ministry of Foreign Affairs under United Nations (Security Council) Act, 1948 or intimation from National Counter Terrorism Authority/Law Enforcement Agencies/Home Departments of Provinces/Ministry of Interior regarding updates in the list of proscribed person(s)/entity(ies) under the Anti-Terrorism Act, 1997, shall be submitted to the Commission within forty eight (48) hours of receiving the same in the manner as may be instructed from time to time by the Commission.

E. the Commission hereby directs all the Regulated Entities to comply with following requirements of Red Flags/ indicators for identification of persons or entities suspected to be acting on behalf of or at the direction of designated/proscribed individuals or entities:-

I. Red Flags Applicable to all SECP Sectors:

The following indicators should be used to identify suspected persons:

a) A customer appears to have conducted transactions on behalf of or at the direction of a designated/proscribed individual.

b) A customer is an office bearer (trustee/ member/ director/ authorized signatory etc.) of a designated/proscribed entity.

c) A customer is a business partner of an office bearer (trustee/ member/ director etc.) of a designated/proscribed entity.

d) A customer is a close family member of a designated/ proscribed individual who is also suspected to be associated with the business of the designated/ proscribed individual by way of financial or other assistance.

e) An entity has a designated/ proscribed individual on its board or management.

f) Unilateral sanctions listing identifies linkage/ association of a customer with a designated/proscribed individual or entity.

g) Media (Broadcast/ Print/ Social) news highlights customer’s involvement in providing financial or other assistance to designated/ proscribed individual or entity.

h) Inquiry from law enforcement agency/ intelligence agency indicating linkage of a customer with designated/ proscribed individual or entity.

II. Red Flags that specifically relate to Non-banking financial institutions (NBFIs)

i) The customer declares a proscribed person as a guarantor of loan or nominee of the customer.

j) Customer has obtained a loan from an NBFC, but the loan shall be utilized by a proscribed person.

k) Repayment of a loan to the customer is made by a proscribed person.

l) In case of Mutual Funds account to account transfer involving transfer to a proscribed individual or entity.

m) A customer who is refused financial services/ loan due to association with a proscribed person approaches another financial institution for securing a loan.

III. Red Flags based on behavior of an Account Holder associated with proscribed individuals or entities:

a) A customer has provided the same residential/ office address that matches the known residential/office address of a designated/ proscribed individual or entity.

b) A customer has provided the same personal contact number that matches the contact number provided earlier by a proscribed/ designated customer.

c) A customer depositing funds in the account of a person or entity listed in an international or foreign jurisdiction’s sanctions lists maintained in accordance with UNSC resolution 1373.

d) A customer listed in an international or foreign jurisdiction’s sanctions list maintained in accordance with UNSC resolution 1373, is depositing funds in another customer’s account.

Any person to whom this directive applies and who contravenes or fails to comply with the requirements of this directive or submits a return which is false in material respect or where under a misstatement is made shall be subject to sanction in accordance with AML/CFT Sanctions Rules, 2020 issued under the AML Act, 2010 and imposed by the Commission according to section 6A of the AML Act.

This directive shall not affect anything done, order made, show cause issued, proceeding commenced, penalty imposed, investigation, inspection or inquiry conducted or any other action taken or done under or in pursuance of above referred superseded directive shall be valid and under lawful authority.

[File No.SY/SECP/8/13]