FAQ’s

The United Nations through its Securities Council Resolution 1617 requires all UN Member States to implement FATF’s AML/CFT Recommendations. Pakistan is a member of UN and Asia Pacific Group (FATF Styled Regional Body) and therefore, is required to adopt FATF standards as per membership obligations.

Basic obligations imposed on reporting entities include: i. Assessing the money laundering and financing of terrorism risk that it may reasonably expect to face in the course of its business; ii. Establishing, implementing and maintaining an AML/CFT programme (procedures, policies and controls) to detect, manage and mitigate the risk of money laundering and the financing of terrorism; iii. Customer due diligence (CDD) (identification and verification of identity) and ongoing CDD; iv. Suspicious transaction reporting; v. Record keeping. Reporting entities have considerable flexibility within the limits prescribed by Regulations, in how they meet their obligations.

There are three stages involved in money laundering:
1. Placement: involves placing the proceeds of crime in the financial system;
2. Layering: involves converting the proceeds of crime into another form and creating complex layers of financial transactions to disguise the audit trail and the source and ownership of funds (e.g., the buying and selling of stocks, commodities or property);
3. Integration: involves placing the laundered proceeds back in the economy under a veil of legitimacy.

Financial institutions means any natural or legal person who conducts as a business one or more of the following activities or operations for or on behalf of a customer:
i. Acceptance of deposits and other repayable funds from the public;
ii. Lending;
iii. Financial leasing;
iv. Money or value transfer services;
v. Issuing and managing means of payment (e.g. credit and debit cards, cheques, traveller’s cheques, money orders and bankers’ drafts, electronic money);
vi. Financial guarantees and commitments;
vii. Trading in:
a. money market instruments (cheques, bills, certificates of deposit, derivatives etc.);
b. foreign exchange;
c. exchange, interest rate and index instruments;

d. transferable securities;
e. commodity futures trading.
viii. Participation in securities issues and the provision of financial services related to such issues;
ix. Individual and collective portfolio management;
x. Safekeeping and administration of cash or liquid securities on behalf of other persons;
xi. Otherwise investing, administering or managing funds or money on behalf of other persons;
xii. Underwriting and placement of life insurance and other investment related insurance;
xiii. Money and currency changing.
The risk of money laundering in Non-Bank Financial Institutions (NBFIs) may not lie in the placement stage but rather in the layering and integration stages of money laundering. The National Risk Assessment has highlighted the vulnerabilities and threats in terms of both money laundering and terrorist financing in these sectors. Accordingly, NBFI is obliged to comply with FATF recommendations even if money is routed thorough the banking channel.

No. The definition of Financial Institution includes lending business activity. Therefore, the Non-deposit taking financial institutions are required to comply with AML/CFT Regulations, 2018 in the same manner as applicable to the other Non-Banking Financial sector institutions.

Reporting entities are required to assess the money laundering and financing of terrorism risk that they may reasonably expect to face in the course of their business. In making this assessment, the reporting entity is required to consider:
i. Nature, size and complexity of its business;
ii. Products and services it offers;
iii. Methods by which it delivers products and services to its customers;
iv. Types of customers it deals with;
v. Countries it deals with;
vi. Institutions it deals with;
vii. Any guidance material produced by supervisors;
viii. Any other factors that are set out in regulations.
Reporting entities also need to consider whether any of their products involve new or developing technologies that may favour customer anonymity.

Risk assessment is the identification and assessment of ML/TF risk faced by the regulated person in relation to the jurisdictions or countries its customers are from or in; the jurisdictions or countries the regulated person has operations or dealings in and products, services, transactions and
delivery channels of the regulated person. Whereas KYC/CDD measures determine the risk profile of the customer only. Customers’ risk profiling is one of the facet used in the entity risk assessment.

Risk Based Approach means that financial institutions identify, assess, and understand the money laundering and terrorist financing risks to which the financial institution is exposed and implement the most appropriate mitigation measures. This approach enables financial institutions to focus their resources where the risks are higher.

An AML/CFT programme sets out a reporting entity’s internal policies, procedures and controls to detect money laundering and financing of terrorism and to manage and mitigate the risk of it occurring. The programme must be in writing and be based on its risk assessment. Certain elements of a programme are specifically required by the Regulations, including: i. Vetting senior managers and AML staff; ii. Training senior managers and AML staff; iii. Customer due diligence, including enhanced CDD and simplified CDD; iv. Reporting suspicious transactions; v. Monitoring and record keeping; vi. Monitoring and managing compliance with the AML/CFT programme. Risk-based systems and controls should be based on the nature, size and complexity of a reporting entity’s business, along with any money laundering and financing of terrorism risks it may face.

No. The regulated person should establish the three lines of defense to combat ML/TF namely Business Units, Compliance Officer and Internal Audit. Therefore, the scope of responsibilities will vary between compliance officer and internal audit functions. However, dual hatting is allowed for the role of Compliance Officer.

Customer risk rating (High, Low) is assigned based on ML/TF risk posed by each relevant factor (Customer, Geography, Product and Transaction Risk), whereas the level of due diligence (Simplified or Enhanced) is determined based on the ML/TF risk posed by the customer.