CA-A.1.1

This Module lays down requirements that apply to all licensees, with respect to the minimum level of capital they must maintain.

CA-A.1.2

Principle 9 of the Principles of Business requires that licensees maintain adequate human, financial and other resources, sufficient to run their business in an orderly manner (see Section PB-1.1.9).

CA-A.1.3

This Module contains the Central Bank of Bahrain's ('CBB') Directive (as amended from time to time) relating to the capital adequacy of licensees, and is issued under the powers available to the CBB under Article 38 of the CBB Law. The Directive in this Module is applicable to all licensees. Requirements regarding Money Changer Licensees are also included in the Regulation Organising Money Changing Business, issued in 1994 and included in this Module.

CA-A.1.4

For an explanation of the CBB's rule-making powers and different regulatory instruments, see Section UG-1.1.

CA-A.2.1

This Module was first issued in October 2010 by the CBB. Any material changes that have subsequently been made to this Module are annotated with the calendar quarter date in which the change was made: Chapter UG-3 provides further details on Rulebook maintenance and version control.

CA-A.2.2

A list of recent changes made to this Module is provided below:

CA-A.2.3

This Module supersedes the following provisions contained in circulars or other regulatory instruments:

CA-1.1.1

In accordance with Principle of Business 9 (Section PB-1.1.9), licensees must maintain adequate human, financial and other resources sufficient to run their business in an orderly manner.

CA-1.1.2

Licensees are required to maintain, at all times, the minimum capital requirement specified in Section CA-1.2.

CA-1.1.3

In addition to the minimum capital requirements specified in Section CA-1.2 onwards, the CBB may, at its discretion, require licensees to hold additional capital, should this be necessary (in the CBB's view) to meet additional liquidity requirements. (refer to CA-1.5.2)

CA-1.1.4

No funds may be withdrawn by shareholders from the licensee without the necessary prior written approval of the CBB.

CA-1.1.5

In the event that a licensee fails to meet any of the requirements specified in this Module, it must, on becoming aware that it has breached these requirements, immediately notify the CBB in writing. Unless otherwise directed, the licensee must in addition submit to the CBB, within 30 calendar days of its notification, a plan demonstrating how it will achieve compliance with these requirements.

CA-1.1.6

Should a licensee fail to comply with the requirements of this Module, the CBB may impose enforcement measures, as described in Module EN.

CA-1.2.1

Licensees must ensure that, at all times, their Minimum Capital meets the requirement stipulated in Rule CA-1.2.2 below.

CA-1.2.2

Minimum Capital Requirements are:

CA-1.2.3

For those licensees authorised prior to 1st January 2011, the minimum paid-up capital noted in Subparagraph CA-1.2.2 (a) must be not less than BD200,000. In addition, such licensees must comply with Subparagraphs CA-1.2.2 (b) and (c).

BC-A.1.1

This Module contains requirements that have to be met by licensees with regards to their dealings with customers.

BC-A.1.2

The Rules contained in this Module aim to ensure that licensees deal with their customers in a fair and open manner, and address their customers' information needs.

BC-A.1.3

The Rules build upon several of the Principles of Business (see Module PB (Principles of Business)). Principle 1 (Integrity) requires licensees to observe high standards of integrity and fair dealing, and to be honest and straightforward in their dealings with customers. Principle 3 (Due skill, care and diligence) requires licensees to act with due skill, care and diligence when acting on behalf of their customers. Principle 7 (Customer Interests) requires licensees to pay due regard to the legitimate interests and information needs of their customers, and to communicate with them in a fair and transparent manner.

BC-A.1.4

The Rules contained in this Module are largely principles-based and focus on desired outputs rather than on prescribing detailed processes. This gives licensees flexibility in how to implement the basic standards prescribed in this Module.

BC-A.1.5

This Module contains the Central Bank of Bahrain's ('CBB') Directive (as amended from time to time) on business conduct by licensees, and is issued under the powers available to the CBB under Article 38 of the CBB Law. The directive in this Module is applicable to all licensees. Requirements regarding Money Changer Licensees are also included in the Regulation Organising Money Changing Business, issued in 1994 and included in this Module.

BC-A.1.6

For an explanation of the CBB's rule-making powers and different regulatory instruments, see Section UG-1.1.

BC-A.2.1

This Module was first issued in October 2010 by the CBB. Any material changes that have subsequently been made to this Module are annotated with the calendar quarter date in which the change was made: Chapter UG-3 provides further details on Rulebook maintenance and version control.

BC-A.2.2

A list of recent changes made to this Module is provided below:

BC-A.2.3

This Module supersedes the following provisions contained in circulars or other regulatory requirements:

BC-2.2.5

Before a licensee communicates any promotional material to a customer or a potential customer it must ensure the promotional material at the very least contains the information laid out in Paragraph BC-2.5.1 of the Appendix.

BC-2.2.6

Licensees must not make use of the name of the CBB in any promotion in such a way that would indicate endorsement or approval of its services.

BC-2.2.7

All documentation concerning promotional schemes must be in Arabic and English and, if relevant, any other language necessary for customers to fully understand and appreciate their terms and conditions. Such terms and conditions, including any related advertising, need to be clear, concise, truthful, unambiguous and complete so as to enable customers to make a fully informed decision.

BC-2.2.8

Customers to whom promotional schemes are directed should enjoy equal opportunity in terms of access to, and treatment within, such schemes.

BC-2.2.9

No costs (including funding costs), charges or levies associated with promotional schemes should be concealed from prospective customers.

BC-2.2.10

Any raffles/lotteries etc. held as part of promotional schemes should be independently monitored (e.g. by the institution's external auditor) and adequate systems put in place to ensure fair play and impartiality.

BC-2.2.11

An appropriate system should also exist for informing participants of the results of a raffle/lottery without delay.

BC-2.2.12

Institutions should note that raffles/lotteries etc. may be subject to rules and requirements (including prior authorisation/approval) laid down by the Ministry of Industry and Commerce.

BC-2.2.13

Licensees must maintain a record of all promotional materials issued by them or on their behalf, particularly where raffles/lotteries etc. are concerned.

BC-2.3.4

Licensees must maintain adequate records of all complaints received, and how they were dealt with, to a level of detail sufficient to demonstrate compliance with this Section and in accordance with the Rules under Section GR-1.

BC-2.3.5

In recording complaints activity, licensees should consider the types of data and reports that will enable them to demonstrate compliance with the above Rules for handling complaints, together with the overarching principles requiring fair dealings with customers.

RM-A.1.1

This Module contains requirements relating to the management of risk by licencees. It expands on certain high level requirements contained in other Modules. In particular, Section AU-2.6 of Module AU (Authorisation) specifies requirements regarding systems and controls that have to be met as a license condition; Principle 10 of the Principles of Business (ref. PB-1.10) requires licencees to have systems and controls sufficient to manage the level of risk inherent in their business; and Module HC (High-level Controls) specifies various requirements relating to the role and composition of Boards, and related high-level controls.

RM-A.1.2

This Module obliges licensees to recognise the range of risks that they face and the need to manage these effectively. Their risk management framework is expected to have the resources and tools to identify, monitor and control all material risks. The adequacy of a licensee's risk management framework is subject to the scale and complexity of its operations, however. In demonstrating compliance with certain Rules, licensees with very simple operational structures and business activities may need to implement less extensive or sophisticated risk management systems, compared to licensees with a complex and/or extensive customer base or operations.

RM-A.1.3

This Module contains the Central Bank of Bahrain's ('CBB') Directive (as amended from time to time) regarding Risk Management requirements applicable to licensees, and is issued under the powers available to the CBB under Article 38 of the Central Bank of Bahrain and Financial Institutions Law 2006 ('CBB Law'). Requirements regarding Money Changer Licensees are also included in the Regulation Organising Money Changing Business, issued in 1994 and included in this Module.

RM-A.1.4

For an explanation of the CBB's rule-making powers and different regulatory instruments, see section UG-1.1.

RM-A.2.1

This Module was first issued in October 2010. Any material changes that have subsequently been made to this Module are annotated with the calendar quarter date in which the change was made: Chapter UG-3 provides further details on Rulebook maintenance and version control.

RM-A.2.2

A list of recent changes made to this Module is provided below:

RM-A.2.3

This Module does not replace any regulations or circulars in force prior to month year.

RM-1.1.1

The Board of Directors of licensees must take responsibility for the establishment of an adequate and effective framework for identifying, monitoring and managing risks across all its operations.

RM-1.1.2

The CBB expects the Board to be able to demonstrate that it provides suitable oversight and establishes, in relation to all the risks the licencee is exposed to, a risk management framework that includes setting and monitoring policies, systems, tools and controls.

RM-1.1.3

Although authority for the management of a firm's risks is likely to be delegated, to some degree, to individuals at all levels of the organisation, the overall responsibility for this activity should not be delegated from its governing body and relevant senior managers.

RM-1.1.4

A licencees's failure to establish, in the opinion of the CBB, an adequate risk management framework will result in it being in breach of Condition 6 of the Licensing Conditions of Section AU-2.6. This failure may result in the CBB withdrawing or imposing restrictions on the licensee, or the licensee being required to inject more capital.

RM-1.1.5

The Board of Directors must also ensure that there is adequate documentation of the licensee's risk management framework.

RM-1.1.6

The risk management framework of licensees must provide for the establishment and maintenance of effective systems and controls as are appropriate to their business, so as to identify, measure, monitor and manage risks.

RM-1.1.7

An effective framework for risk management should include systems to identify, measure, monitor and control all major risks on an on-going basis. The risk management systems should be approved and periodically reviewed by the Board as outlined in HC-1.1.5.

RM-1.1.8

The systems and controls required by Paragraph RM-1.1.6 must be proportionate to the nature, scale and complexity of the firm's activities.

RM-1.1.9

The processes and systems required must enable the licensee to identify the major sources of risk to its ability to meet its liabilities as they fall due, which include but are not limited to the following:

RM-1.5.5

Licensees must implement enhanced fraud monitoring of movements in customers’ accounts to guard against electronic frauds using various tools and measures, such as limits in value, volume and velocity.

RM-1.5.6

Licensees must have in place customer awareness communications, pre and post registration process, using video calls, short videos or pop-up messages, to alert and warn natural persons using online channels or applications about the risk of electronic frauds, and emphasise the need to secure their personal credentials and not share them with anyone, online or offline.

RM-1.5.7

Licensees must take appropriate measures to authenticate the identity and authorisation of customers when the customer accesses the online or digital platform or when a transaction is initiated on the platform.

Licensees must, at a minimum, establish adequate security features for customer authentication including the use of at least two different elements out of the following three elements:

RM-1.5.8

For the purpose of Paragraph RM-1.5.7, licensees must ensure that the authentication elements are independent from each other, in that the breach of one does not compromise the reliability of the others and are sufficiently complex to prevent forgery.

RM-1.5.9

For the purposes of Subparagraph RM-1.5.7 (b), where a customer’s mobile device is registered/marked as ‘trusted’ using knowledge, biometric or other authentication methods through the licensee’s application, the use of such mobile device would be considered as meeting the ‘possession’ element for authentication of future access or transactions using that device.

RM-3.1.1

The Board of money changer licensees must ensure that the licensee has a robust cyber security risk management framework to comprehensively manage the licensee’s cyber security risk and vulnerabilities. The Board must establish clear ownership, decision-making and management accountability for risks associated with cyber-attacks and related risk management and recovery processes.

RM-3.1.2

Licensees must ensure that the cyber security risk management framework encompasses, at a minimum, the following components:

RM-3.1.3

The cyber security risk management framework must be developed in accordance with the National Institute of Standards and Technology (NIST) Cyber security framework which is summarized in Appendix A – Cyber security Control Guidelines. At the broader level, the Cyber security framework should be consistent with the licensee’s risk management framework.

RM-3.1.4

Senior management, and where appropriate, the boards, should receive comprehensive reports covering cyber security issues such as the following:

RM-3.1.5

The Board must ensure that the cyber security risk management framework is evaluated for scope of coverage, adequacy and effectiveness every three years or when there are significant changes to the risk environment, taking into account emerging cyber threats and cyber security controls.

RM-3.1.6

Licensees must have in place arrangements to handle cyber security risk management responsibilities. Licensees may, commensurate with their size and risk profile, assign the responsibilities to a qualified Chief Information Security Officer (CISO) reporting to an independent risk management function or incorporate the responsibilities of cyber security risk into the risk management function. Overseas licensees must be governed under a framework of cyber security risk management policies which ensure that an adequate level of oversight is exercised by the regional office or head office.

RM-3.1.7

Licensees should ensure that appropriate resources are allocated to the cyber security risk management function for implementing the cyber security framework.

RM-3.1.8

Licensees must ensure that the cyber security risk management function is headed by suitably qualified Chief Information Security Officer (CISO), with appropriate authority to implement the Cyber Security strategy.

RM-3.1.9

Licensees may establish a cyber security committee that is headed by an independent senior manager from a control function (like CFO / CRO), with appropriate authority to approve policies and frameworks needed to implement the cyber security strategy, and act as a governance committee for the cyber security function. Membership of this committee should include senior management members from business functions, IT, Risk and Compliance.

RM-3.1.10

The senior management must be responsible for the following activities:

RM-3.1.11

The senior management must ensure that:

RM-3.1.12

With respect to Subparagraph RM-3.1.11(a), data classification entails analyzing the data the licensee retains, determining its importance and value, and then assigning it to a category. When classifying data, the following aspects of the policy should be determined:

The general guideline for data classification is that the definition of the classification should be clear enough so that it is easy to determine how to classify the data. In other words, there should be little (if any) overlap in the classification definitions. The owner of data (i.e. the relevant business function) should be involved in such classification.

RM-3.1.13

An organisation-wide cyber security strategy must be defined and documented to include:

RM-3.1.14

The cyber security strategy should be communicated to the relevant stakeholders and it should be revised as necessary and, at least, once every three years. Appendix A provides cyber security control guidelines that can be used as reference to support the licensee’s cyber security strategy and cyber security policy.

RM-3.1.15

Licensees must implement a written cyber security policy setting forth its policies for the protection of its electronic systems and client data stored on those systems, which must be reviewed and approved by the licensee’s senior management, as appropriate, at least annually. The cyber security policy areas including but not limited to the following must be addressed:

RM-3.1.16

Licensees must ensure that the cyber security policy is effectively implemented through a consistent risk-based approach using tools and methodologies that are commensurate with the size and risk profile of the licensee. The approach, tools and methodologies must cover all cyber security functions and controls defined in the cyber security policy.

RM-3.1.17

Licensees should establish and maintain plans, policies, procedures, process and tools (“playbooks”) that provide well-defined, organised approaches for cyber incident response and recovery activities, including criteria for activating the measures set out in the plans and playbooks to expedite the licensee’s response time. Plans and playbooks should be developed in consultation with business lines to ensure business recovery objectives are met and are approved by senior management before broadly shared across the licensee. They should be reviewed and updated regularly to incorporate improvements and/or changes in the licensee. Licensees may enlist external subject matter experts to review complex and technical content in the playbook, where appropriate. A number of plans and playbooks should be developed for specific purposes (e.g. response, recovery, contingency, communication) that align with the overall cyber security strategy.

RM-3.1.18

A Licensee must develop and implement preventive measures across all relevant technologies to minimise the licensee’s exposure to cyber security risk. Such preventive measures must include, at a minimum, the following:

RM-3.1.19

Licensees should also implement the following prevention controls in the following areas:

RM-3.1.20

Licensees must set up anti-spam and anti-spoofing measures to authenticate the licensee’s mail server and to prove to ISPs, mail services and other receiving mail servers that senders are truly authorized to send the email. Examples of such measures include:

RM-3.1.21

Licensees should subscribe to one of the Cyber Threat Intelligence services in order to stay abreast of emerging cyber threats, cybercrime actors and state of the art tools and security measures.

RM-3.1.22

Licensees must use a single unified private email domain or its subdomains for communication with customers to prevent abuse by third parties. Licensees must not utilise third-party email provider domains for communication with customers. The email domains must comply with the requirements with respect to SPF, DKIM and DMARC in this Module. With respect to URLs or other clickable links in communications with customers, licensees must comply with the following requirements:

RM-3.1.22A

For the purpose of Paragraph RM-3.1.22, subject to CBB’s approval, licensees may be allowed to use additional domains for email communications with customers under certain circumstances. Examples of such circumstances include emails sent to customers by:

RM-3.1.23

Licensees must conduct periodic assessments of cyber threats. For the purpose of analysing and assessing current cyber threats relevant to the licensee, it should take into account the factors detailed below:

RM-3.1.24

Licensees must conduct periodic assessments of the maturity, coverage, and effectiveness of all cyber security controls. Cyber security control assessment must include an analysis of the controls’ effectiveness in reducing the likelihood and probability of a successful attack.

RM-3.1.25

Licensees should ensure that the periodic assessments of cyber threats and cyber security controls cover all critical technology systems. A risk treatment plan should be developed for all residual risks which are considered to be above the licensee’s risk tolerance levels.

RM-3.1.26

Licensees must conduct regular technical assessments to identify potential security vulnerabilities for systems, applications, and network devices. The vulnerability assessments must be comprehensive and cover internal technology, external technology, and connections with third parties. Assessments for external public facing services and systems must be more frequent.

RM-3.1.27

With respect to Paragraph RM-3.1.25, external technology refers to the licensee’s public facing technology such as websites, apps and external servers. Connections with third parties includes any API or other connections with fintech companies, technology providers, outsourcing service providers etc.

RM-3.1.28

Licensees must have in place vulnerability and patch management processes which include remediation processes to ensure that the vulnerabilities identified are addressed and that security patches are applied where relevant within a timeframe that is commensurate with the risks posed by each vulnerability.

RM-3.1.29

All licensees must perform penetration testing of their systems, applications, and network devices to verify the robustness of the security controls in place at least once a year. However, licensees that provide services through digital channels must perform penetrating testing at least twice a year. These tests must be used to simulate real world cyber-attacks on the technology environment and must:

RM-3.1.30

CBB may require additional third-party security reviews to be performed as needed.

RM-3.1.31

The tests referred to in Paragraph RM-3.1.59 must be conducted each year in June and December. Reports on penetration testing must be submitted to CBB before 30th September for the tests as at 30th June and 31st March for the tests as at 31st December. The penetration testing reports must include the vulnerabilities identified and a full list of ‘passed’ tests and ‘failed’ tests together with the steps taken to mitigate the risks identified.

RM-3.1.32

Licensees must implement cyber security incident management processes to ensure timely detection, response and recovery for cyber security incidents. This includes implementing a monitoring system for log correlation and anomaly detection.

RM-3.1.33

Licensees should receive data on a real time basis from all relevant systems, applications, and network devices including operational and business systems. The monitoring system should be capable of identifying indicators of cyber incidents and initiate alerts, reports, and response activities based on the defined cyber security incident management process.

RM-3.1.34

Licensees should retain the logs and other information from the monitoring system for detecting cyber incidents, including "low-and-slow" attacks, in order to facilitate incident investigations, for 12 months or longer.

RM-3.1.35

Once a cyber incident is detected, licensees should activate their containment measures, processes and technologies best suited to each type of cyber incident to prevent a cyber incident from inflicting further damage. This may involve, after considering the costs, business impact and operational risks, shutting down or isolating all or affected parts of their systems and networks as deemed necessary for containment and diagnosis.

RM-3.1.36

Licensees must define roles and responsibilities and assign adequate resources to detect, identify, investigate and respond to cyber incidents that could impact the licensee’s infrastructure, services and customers. Such responsibilities must include log correlation, anomaly detection and maintaining the licensee’s asset inventory and network diagrams.

RM-3.1.37

Licensees must regularly identify, test, review and update current cyber security risk scenarios and the corresponding response plan. This is to ensure that the scenarios and response plan remain relevant and effective, taking into account changes in the operating environment, systems or the emergence of new cyber security threats. If any gaps are identified, the monitoring system must be updated with new use cases and rule sets which are capable of detecting the current cyber incident scenarios.

RM-3.1.38

The cyber incident scenario tests should include high-impact-low-probability events and scenarios that may result in failure. Common cyber incident scenarios include distributed denial of service (DDoS) attacks, system intrusion, data exfiltration and system disruption. Licensees should regularly use threat intelligence to update the scenarios so that they remain current and relevant. Licensees should periodically review current cyber incident scenarios for the purpose of assessing the licensee’s ability to detect and respond to these scenarios if they were to occur.

RM-3.1.39

Licensees must ensure that critical cyber security incidents detected are escalated to an incident response team, management and the Board, in accordance with the licensee’s business continuity plan and crisis management plan, and that an appropriate response is implemented promptly. See also Paragraph RM-3.1.58 for the requirement to report to CBB.

RM-3.1.40

Licensees should clearly define the roles, responsibilities and accountabilities for cyber incident detection and response activities to one or more named individuals that meet the pre-requisite role requirements. Potential conflicts of interest are minimised by ensuring a separation of implementation and oversight roles where possible. The roles should include:

RM-3.1.41

For the purpose of managing a critical cyber incident, the licensee should operate a situation room, and should include in the incident management procedure a definition of the authorities and responsibilities of staff members, internal and external reporting lines, communication channels, tools and detailed working procedures. The situation room or a war room is a physical room or a virtual room where relevant members of the management gather to handle a crisis in the most efficient manner possible.

RM-3.1.42

Licensees should record and document in an orderly manner the incidents that have been handled and the actions that were taken by the relevant functions. In particular, the licensee should maintain an "incident log" in which all the notifications, decisions and actions taken, in relation to cyber incidents, are documented, as close as possible to the time of their occurrence. It should also include the status of the issue whether it is open or has been resolved and person in charge of resolving the issue/incident. The logs should be stored and preserved in a secure and legally admissible manner.

RM-3.1.43

Licensees should utilise pre-defined taxonomy for classifying cyber incidents according to, for example, the type of incident, threat actors, threat vectors and repercussions; and a pre-established severity assessment framework to help gauge the severity of the cyber incident. For example, taxonomies that can be used when describing cyber incidents:

The cyber incident severity may be classified as:

RM-3.1.44

Licensees should determine the effects of the cyber incident on customers and to the wider financial system as a whole and report the results of such an assessment to CBB if it is determined that the cyber incident may have a systemic impact.

RM-3.1.45

Licensees should establish metrics to measure the impact of a cyber incident and to report to management the performance of response activities. Examples include:

RM-3.1.46

Licensees must identify the critical systems and services within its operating environment that must be recovered on a priority basis in order to provide certain minimum level of services during the downtime and determine how much time the licensee will require to return to full service and operations.

RM-3.1.47 RM-3.1.47

Critical incidents are defined as incidents that trigger the BCP and the crisis management plan. Critical systems and services are those whose failure can have material impact on any of the following elements:

Training and Awareness

Reporting to CBB

TC-A.1.1

This Module presents requirements that have to be met by licensees with respect to training and competency of individuals undertaking controlled functions (i.e. approved persons).

TC-A.1.2

Module TC provides Rules and Guidance to licensees to ensure satisfactory levels of competence, in terms of an individual's knowledge, skills, experience, and professional qualifications. Licensees are required to demonstrate that individuals undertaking controlled functions are sufficiently competent, and are able to undertake their respective roles and responsibilities.

TC-A.1.3

The Rules build upon Principles 3 and 10 of the Principles of Business (see Module PB (Principles of Business)). Principle 3 (Due Skill, Care and Diligence) requires licensees to observe high standards of integrity and fair dealing, and to be honest and straightforward in its dealings with customers. Principle 9 (Adequate Resources) requires licensees to maintain adequate human, financial and other resources sufficient to run its business in an orderly manner.

TC-A.1.4

Condition 4 of the Central Bank of Bahrain's ('CBB') Licensing Conditions (Chapter AU-2.4) and Condition 1 of the Approved Persons regime (Chapter AU-3.1) impose further requirements. To satisfy Condition 4 of the CBB's Licensing Conditions, a licensees' staff, taken together, must collectively provide a sufficient range of skills and experience to manage the affairs of the licensee in a sound and prudent manner (AU-2.4). This condition specifies that licensees must ensure their employees meet any training and competency requirements specified by the CBB. Condition 1 of the Approved Persons Conditions (AU-3.1) sets forth the 'fit and proper' requirements in relation to competence, experience and expertise required by approved persons.

TC-A.1.5

This Module contains the CBB's Directive (as amended from time to time) relating to Training and Competency and is issued under the powers available to the CBB under Articles 38 and 65 of the Central Bank of Bahrain and Financial Institutions Law 2006 ('CBB Law'). The Directive in this Module is applicable to all licensees (including their approved persons). Requirements regarding Money Changer Licensees are also included in the Regulation Organising Money Changing Business, issued in 1994 and included in this Module.

TC-A.1.6

For an explanation of the CBB's rule-making powers and different regulatory instruments, see Section UG-1.1.

TC-A.2.1

This Module was first issued in October 2010. Any material changes that are subsequently made to this Module are annotated with the calendar quarter date in which the change is made; Chapter UG-3 provides further details on Rulebook maintenance and version control.

TC-A.2.2

A list of recent changes made to this Module is provided below:

TC-A.2.3

This Module does not replace any regulations or circulars in force prior to October 2010.

TC-1.1.5

As individuals, directors of a licensee must hold professional qualifications and/or have relevant experience outlined in Appendix TC-1 as a minimum.

TC-1.1.6

The role of the director is to be accountable and responsible for the management and performance of the licensee, and is outlined in more details in Section HC-1.1.

TC-1.1.7

When taken as a whole, the board of directors of a licencee must be able to demonstrate that it has the necessary expertise, as outlined in Paragraphs HC-1.2.4 and HC-1.2.5.

TC-1.1.8

Individuals holding the position of chief executive officer or equivalent at a licensee must hold relevant qualifications and relevant experience as outlined in Appendix TC-1 as a minimum.

TC-1.1.9

The chief executive officer or general manager (as appropriate) is responsible for the executive management and performance of the licensee within the framework or delegated authorities set by the Board.

TC-1.1.10

Individuals holding the position of head of function at a licensee must hold relevant professional qualifications and experience as outlined in Appendix TC-1 as a minimum.

TC-1.1.11

Heads of functions are responsible for tracking specific functional performance goals in addition to identifying, managing, and reporting critical organisational issues upstream.

TC-1.1.12

Individuals holding the position of compliance officer at a licensee must hold relevant experience and qualifications as outlined in Appendix TC-1 as a minimum.

TC-1.1.13

In accordance with Paragraph HC-2.4.3, an employee of appropriate standing must be designated by licensees for the position of compliance officer. The duties of the compliance officer include:

TC-1.1.14

Individuals holding the position of MLRO at a licensee, whose attributes and responsibilities are described more fully in Paragraphs FC-4.1.7 and FC-4.2.1, must hold relevant qualifications as outlined in Appendix TC-1 as a minimum.