• AML-1 AML-1 Customer Due Diligence Requirements

    • AML-1.1 AML-1.1 General Requirements

      • Verification of Identity and Source of Funds

        • AML-1.1.1

          Capital Market Licensees must establish effective systematic internal procedures for establishing and verifying the identity of their customers and the source of their funds. Such procedures must be set out in writing and approved by the Capital Market Licensees senior management and must be strictly adhered to.

          Amended: January 2022
          Amended: January 2020
          Amended: July 2016
          Added: October 2010

        • AML-1.1.2

          Capital Market Licensees must implement the customer due diligence measures outlined in Chapter AML-1 when:

          (a) [This Sub-paragraph was deleted in July 2018];
          (b) Establishing business relations with a new or existing customer;
          (c) A change to the signatory or beneficiary of an existing account or business relationship is made;
          (d) Customer documentation standards change substantially;
          (e) The Capital Market Licensees has doubts about the veracity or adequacy of previously obtained customer due diligence information;
          (f) A significant transaction takes place (as per rule AML-2.2.3);
          (g) There is a material change in the way that an account is operated or in the manner in which the business relationship is conducted;
          (h) There is a suspicion of Money Laundering or terrorist financing; or
          (i) Carrying out accepted crypto-assets transfers and/or wire transfers irrespective of value and/or amount.
          Amended: January 2022
          Amended: January 2020
          Amended: July 2018
          Added: October 2010

        • AML-1.1.2A

          Capital Market Licensees must understand, and as appropriate, obtain information on the purpose and intended nature of the business relationship.

          Amended: January 2022
          Added: October 2017

        • AML-1.1.2B

          Capital Market Licensees must conduct ongoing due diligence on the business relationship, including:

          (a) Scrutinizing transactions undertaken throughout the course of that relationship to ensure that the transactions being conducted are consistent with the institution's knowledge of the customer, their business and risk profile, including, where necessary, the source of funds; and
          (b) Ensuring that documents, data or information collected under the CDD process is kept up-to-date and relevant, by undertaking reviews of existing records, particularly for higher risk categories of customers.
          Amended: January 2022
          Added: October 2017

        • AML-1.1.2C

          A capital market licensee must also review and update the customers’ risk profile based on their level of ML/TF/PF risk upon onboarding and regularly throughout the life of the relationship. The risk management and mitigation measures implemented by a capital market licensee must be commensurate with the risk profile of the customer or type of customer.

           

          Added: January 2022

        • AML-1.1.3

          For the purposes of this Module, 'customer' includes counterparties such as financial markets counterparties, except where Capital Market Licensees are acting as principals where simplified due diligence measures may apply. These simplified measures are set out in section AML-1.10.

          Amended: January 2022
          October 2010

        • AML-1.1.4

          The CBB's specific minimum standards to be followed with respect to verifying customer identity and source of funds are contained in section AML-1.2. Enhanced requirements apply under certain high-risk situations: these requirements are contained in sections AML-1.3 to AML-1.7 inclusive. Additional requirements apply where a Capital Market Licensee is relying on a professional intermediary to perform certain parts of the customer due diligence process: these are detailed in section AML-1.8. Simplified customer due diligence measures may apply in defined circumstances: these are set out in section AML-1.10.

          Amended: January 2022
          October 2010

      • Verification of Third Parties

        • AML-1.1.5

          Capital Market Licensees must obtain a signed statement, in hard copy or through digital means from all new customers confirming whether or not the customer is acting on his own behalf or not. This undertaking must be obtained prior to conducting any transactions with the customer concerned.

          Amended: January 2022
          Added: October 2010

        • AML-1.1.6

          Where a customer is acting on behalf of a third party, the Capital Market Licensees must also obtain a signed statement from the third party, confirming they have given authority to the customer to act on their behalf. Where the third party is a legal person, the Capital Market Licensees must have sight of the original Board resolution (or other applicable document) authorising the customer to act on the third party's behalf and retain a certified copy.

          Amended: January 2022
          Added: October 2010

        • AML-1.1.7

          Capital Market Licensees must establish and verify the identity of the customer and (where applicable) the party/parties on whose behalf the customer is acting, including the Beneficial Owner of the funds. Verification must take place in accordance with the requirements specified in this Chapter.

          Amended: January 2022
          Added: October 2010

        • AML-1.1.8

          Where capital market services are provided to a minor or other person lacking full legal capacity, the normal identification procedures as set out in this Chapter must be followed. In the case of minors, Capital Market Licensees must additionally verify the identity of the parent(s) or legal guardian(s). Where a third party on behalf of a person lacking full legal capacity wishes to open business relations, the Capital Market Licensee must establish the identity of that third party, as well as the person conducting the business.

          Amended: January 2022
          Added: October 2010

      • Anonymous and Nominee Accounts

        • AML-1.1.9

          Capital Market Licensees must not establish or keep anonymous accounts or accounts in fictitious names. Where Capital Market Licensees maintain a nominee account, which is controlled by or held for the benefit of another person, the identity of that person must be disclosed to the Capital Market Licensees and verified by it in accordance with the requirements specified in this Chapter.

          Amended: January 2022
          Added: October 2010

      • Timing of Verification

        • AML-1.1.10

          Capital Market Licensees must not commence a business relationship or undertake a transaction with a customer before completion of the relevant customer due diligence (‘CDD’) measures specified in Chapter AML-1. Capital Market Licensees must also adopt risk management procedures with respect to the conditions under which a customer may utilise the business relationship prior to verification. However, verification may be completed after receipt of funds in the case of non face-to-face business, or the subsequent submission of CDD documents by the customer after undertaking initial customer due diligence provided that no disbursement of funds takes place until after the requirements of this Chapter have been fully met.

          Amended: January 2022
          Added: October 2010

      • Incomplete Customer Due Diligence

        • AML-1.1.11

          Where a Capital Market Licensee is unable to comply with the requirements specified in Chapter AML-1, it must consider whether to terminate the relationship or not proceed with the transaction. If it proceeds with the transaction (to avoid tipping off the customer), it should additionally consider whether it should file a Suspicious Transaction Report.

          Amended: January 2022
          Added: October 2010

        • AML-1.1.12

          See also Chapter AML-4, which covers the filing of Suspicious Transaction Reports.

          October 2010

        • AML-1.1.13

          The CBB will monitor the application of these requirements to Capital Market Licensees existing customer base.

          Amended: January 2022
          Added: October 2010

      • Suspicious Wallet Addresses

        • AML-1.1.14

          A crypto-asset licensee must establish and implement policies for identification of wallet addresses that are suspected of ML/TF (suspicious wallet addresses).

          Added: January 2020

        • AML-1.1.15

          A crypto-asset licensee must not establish or continue business relationship with or transact with suspicious wallet addresses referred to in Paragraph-1.1.14.

          Added: January 2020

        • AML-1.1.16

          Where a crypto-asset licensee identifies or becomes aware of a suspicious wallet address, it must immediately file a Suspicious Transaction Report (STR) and also notify the CBB.

          Added: January 2020

      • Non-Resident Accounts

        • AML-1.1.17

          Capital Market Licensees that establish a business relationship or transact or deal with non-resident customers must have documented criteria for acceptance of business with such persons. For non-resident customers, assessed as high risk, licensees must ensure the following:

          (a) Ensure there is a viable economic reason for the business relationship;
          (b) Perform enhanced due diligence where required in accordance with Paragraph AML-1.1.24;
          (c) Obtain and document the country of residence for tax purposes where relevant;
          (d) Obtain evidence of banking relationships in the country of residence;
          (e) Obtain the reasons for dealing with licensee in Bahrain;
          (f) Obtain an indicative transaction volume and/or value of incoming funds; and
          (g) Test that the persons are contactable without unreasonable delays.
          Amended: October 2023
          Added: January 2022

        • AML-1.1.18

          Capital Market Licensees must not accept non-residents customers from high risk jurisdictions subject to a call for action by FATF.

           

          Added: January 2022

        • AML-1.1.19

          Capital Market Licensees must take adequate precautions and risk mitigation measures before onboarding non-resident customers from high risk jurisdictions. The licensees must establish detailed assessments and criteria that take into consideration FATF mutual evaluations, FATF guidance, the country national risk assessments (NRAs) and other available guidance on onboarding and retaining non-resident customers from the following high-risk jurisdictions:

          (a) Jurisdictions under increased monitoring by FATF;
          (b) Countries upon which United Nations sanctions have been imposed except those referred to in Paragraph AML-1.1.18; and
          (c) Countries that are the subject of any other sanctions.

           

          Added: January 2022

        • AML-1.1.20

          Capital Market Licensees must establish systems and measures that are proportional to the risk relevant to each jurisdiction and this must be documented. Such a document must show the risks, mitigation measures for each jurisdiction and for each non-resident customer.

           

          Added: January 2022

        • AML-1.1.21

          Capital Market Licensees must establish a comprehensive documented policy and procedures describing also the tools, methodology and systems that support the licensee’s processes for:

          (a) The application of RBA;
          (b) Customer due diligence;
          (c) Ongoing transaction monitoring; and
          (d) Reporting in relation to their transactions or dealings with non-resident customers.

           

          Added: January 2022

        • AML-1.1.22

          Capital Market Licensees must ensure that only the official/government documents are accepted for the purpose of information in Subparagraphs AML-1.2.1 (a) to (f) in the case of non-resident customers.

           

          Added: January 2022

        • AML-1.1.23

          [This Paragraph has been deleted in October 2023].

          Deleted: October 2023
          Added: January 2022

        • AML-1.1.24

          Capital Market Licensees must follow the below CDD and customer onboarding requirements:

            Enhanced Due Diligence Digital Onboarding
          Bahrainis and GCC nationals (wherever they reside) and expatriates resident in Bahrain No Yes
          Others Yes Yes
          Added: October 2023

    • AML-1.2 AML-1.2 Face-to-Face Business

      • Natural Persons

        • AML-1.2.1

          If the customer is a natural PersonCapital Market Licensees must identify the person’s identity and obtain the following information before providing capital market services, as described in paragraph AML-1.1.2:

          (a) Full legal name and any other names used;
          (b) Full permanent address (i.e. the residential address of the customer; a post office box is insufficient);
          (c) Date of birth;
          (d) Nationality;
          (e) Passport number (if the customer is a passport holder);
          (f) Current CPR or Iqama number (for residents of Bahrain or GCC states) or government issued national identification proof;
          (g) Telephone/fax number and email address (where applicable);
          (h) Occupation or public position held (where applicable);
          (i) Employer's name and address (if self-employed, the nature of the self-employment);
          (j) Type of account, and nature and volume of anticipated business dealings with the Capital Market Licensees;
          (k) Signature of the customer(s);
          (l) Source of funds;
          (m) Source of Securities;
          (n) Reason for opening the account; and
          (o) Place of birth.
          Amended: January 2024
          Amended: January 2022
          Amended: January 2020
          Added: October 2010

        • AML-1.2.1A

          Capital Market Licensees obtaining the information and customer signature electronically using digital applications must comply with the applicable laws governing the onboarding/business relationship including but not limited to the Electronic Transactions Law (Law No. 54 of 2018) for the purposes of obtaining signatures as required in Subparagraph AML-1.2.1 (k) above.

           

          Added: January 2022

        • AML-1.2.2

          See the Guidance Notes (filed under Supplementary Information in Part B of Volume 6) for further information on source of funds (rule AML-1.2.1 (l)) and CDD requirements for Bahrain residents (rule AML-1.2.1 (c) & (f)).

          October 2010

        • AML-1.2.3

          Capital market licensees must verify the information in Paragraph AML-1.2.1 (a) to (f), by the following methods below; at least one of the copies of the identification documents mentioned in (a) and (b) below must include a clear photograph of the customer:

          (a) Confirmation of the date of birth and legal name, by use of the national E-KYC application and if this is not practical, obtaining a copy of a current valid official original identification document (e.g. birth certificate, passport, national identity card, CPR or Iqama);
          (b) Confirmation of the permanent residential address by use of the national E-KYC application and if this is not practical, obtaining a copy of a recent utility bill, bank statement or similar statement from another licensee or financial institution, or some form of official correspondence or official documentation card, such as national identity card or CPR, from a public/governmental authority, or a tenancy agreement or record of home visit by an official of the licensee; and
          (c) Where appropriate, direct contact with the customer by phone, letter or email to confirm relevant information, such as residential address information.
          Amended: January 2022
          Added: October 2010

        • AML-1.2.4

          Any document copied or obtained for the purpose of identification verification in a face-to-face customer due diligence process must be an original. An authorised official of the Capital Market Licensees must certify the copy, by writing on it the words 'original sighted', together with the date and his name and signature. Equivalent measures must be taken for electronic copies.

          Amended: January 2022
          Added: October 2010

        • AML-1.2.5

          Identity documents which are not obtained by an authorised official of the Capital Market Licensees in original form (e.g. due to a customer sending a copy by post following an initial meeting) must instead be certified (as per rule AML-1.2.4) by one of the following from a GCC or FATF member state:

          (a) A lawyer;
          (b) A notary;
          (c) A chartered/certified accountant;
          (d) An official of a government ministry;
          (e) An official of an embassy or consulate;
          (f) An official of another licensed financial institution or of an associate company of the licensee.
          Amended: January 2022
          Amended: January 2020
          Added: October 2010

        • AML-1.2.6

          The individual making the certification under rule AML-1.2.5 must give clear contact details (e.g. by attaching a business card or company stamp). The Capital Market Licensee must verify the identity of the Person providing the certification through checking membership of a professional organisation (for lawyers or accountants), or through checking against databases/websites, or by direct phone or email contact.

          Amended: January 2022
          Added: October 2010

      • Legal Entities or Legal Arrangements (such as trusts)

        • AML-1.2.7

          If the customer is a legal entity or a legal arrangement such as a company or trust, the Capital Market Licensee must obtain and record the following information from original identification documents, databases, or websites, in hard copy or electronic form, identify the customer and to take reasonable measures to verify its identity;

          (a) The entity's full name and other trading names used;
          (b) Registration number (or equivalent);
          (c) Legal form and status and proof of existence;
          (d) Registered address and trading address (including a branch where applicable);
          (e) Objectives and type of business activity;
          (f) Date and place of incorporation or establishment;
          (g) Telephone, fax number and email address;
          (h) Regulatory body or listing body (for regulated activities such as financial services and listed companies);
          (hh) The names of the relevant persons having a senior management position in the legal entity or legal arrangement;
          (i) Name of external auditor (where applicable);
          (j) Type of account, and nature and volume of anticipated business dealings with the Capital Market Licensee;
          (k) Source of funds; and
          (l) Legal representative, such as Trustees or trusts.
          Amended: January 2022
          Amended: October 2017
          Added: October 2010

        • AML-1.2.8

          The information provided under rule AML-1.2.7 must be verified by obtaining certified copies of the following documents, as applicable (depending on the legal form of the entity):

          (a) Certificate of incorporation and/or certificate of commercial registration or trust deed;
          (b) Partnership agreement;
          (c) Board resolution seeking the capital market services (only necessary in the case of private or unlisted companies);
          (d) Identification documentation of the authorised signatories of the account (certification not necessary for companies listed in a GCC/FATF state);
          (e) Copy of the latest financial report and accounts, audited where possible (audited copies do not need to be certified);
          (f) List of Persons authorised to do business on behalf of the company and in the case of the opening of an account, a Board resolution (or other applicable document) authorising the named Persons to operate the account (resolution only necessary for private or unlisted companies); and
          (g) Memorandum and Articles of Association.
          Amended: July 2016
          Amended: April 2016
          October 2010

        • AML-1.2.8A

          For customers that are legal persons, Capital Market Licensees must identify and take reasonable measures to verify the identity of beneficial owners through the following information:

          (a) The identity of the natural person(s) who ultimately have a controlling ownership interest in a legal person, and
          (b) To the extent that there is doubt under (a) as to whether the person(s) with the controlling ownership interest is the beneficial owner(s), or where no natural person exerts control of the legal person or arrangement through other means; and
          (c) Where no natural person is identified under (a) or (b) above, the identity of the relevant natural person who holds the position of senior managing official.
          Amended: January 2022
          Added: October 2017

        • AML-1.2.9

          Documents obtained to satisfy the requirements in rule AML-1.2.8 above must be certified in the manner specified in rules AML-1.2.4 to AML-1.2.6.

          October 2010

        • AML-1.2.9A

          For the purpose of Subparagraph AML-1.2.8(a), the requirement to obtain a certified copy of the commercial registration, may be satisfied by obtaining a commercial registration abstract printed directly from the Ministry of Industry, Commerce and Tourism's website, through "SIJILAT Commercial Registration Portal".

          Amended: October 2019
          Added: January 2017

        • AML-1.2.10

          The documentary requirements in rule AML-1.2.8 above do not apply in the case of listed companies from countries which are members of FATF/GCC: see section AML-1.8 below. Also, the documents listed in rule AML-1.2.8 above are not exhaustive: for customers from overseas jurisdictions, documents of an equivalent nature may be produced as satisfactory evidence of a customer's identity.

          October 2010

        • AML-1.2.11

          Capital Market Licensees must also obtain and document the following due diligence information. These due diligence requirements must be incorporated in the Capital Market Licensees new business procedures:

          (a) Enquire as to the structure of the legal entity or trust sufficient to determine and verify the identity of the ultimate beneficial owner of the funds or Securities, the ultimate provider of funds or Securities (if different), and the ultimate controller of the funds or Securities (if different);
          (b) Ascertain whether the legal entity has been or is in the process of being wound up, dissolved, struck off or terminated;
          (c) Obtain the names, country of residence and nationality of Directors or partners (only necessary for private or unlisted companies);
          (d) Require, through new customer documentation or other transparent means, updates on significant changes to corporate ownership and/or legal structure;
          (e) Obtain and verify the identity of shareholders holding 20% or more of the issued capital (where applicable). The requirement to verify the identity of these shareholders does not apply in the case of FATF/GCC listed companies;
          (f) In the case of trusts or similar arrangements, establish the identity of the settlor(s), trustee(s), and beneficiaries (including making such reasonable enquiries as to ascertain the identity of any other potential beneficiary, in addition to the named beneficiaries of the trust); and
          (g) Where a Capital Market Licensee has reasonable grounds for questioning the authenticity of the information supplied by a customer, conduct additional due diligence to confirm the above information.
          Amended: January 2022
          Added: October 2010

        • AML-1.2.12

          For the purposes of rule AML-1.2.11, acceptable means of undertaking such due diligence might include taking bank references; visiting or contacting the company by telephone; undertaking a company search or other commercial enquiries; accessing public and private databases (such as stock exchange lists, if they are listed); making enquiries through a business information service or credit bureau; confirming a company's status with an appropriate legal or accounting firm; or undertaking other enquiries that are commercially reasonable.

          October 2010

        • AML-1.2.13

          In cases where a Capital Market Licensee is providing investment management services to a regulated mutual fund, and is not responsible for receiving investors' funds (being paid into the fund), it may limit its CDD to confirming that the administrator of the fund is subject to FATF-equivalent customer due diligence measures (see section AML-1.7 for applicable measures). Where there are reasonable grounds for believing that investors' funds being paid into the fund are not being adequately verified by the administrator, then the Capital Market Licensee should consider terminating its relationship with the fund.

          Amended: January 2022
          Added: October 2010

    • AML-1.3 AML-1.3 Enhanced Customer Due Diligence: General Requirements

      • AML-1.3.1

        Enhanced customer due diligence must be performed on those customers identified as having a higher risk profile, and additional inquiries made or information obtained in respect of those customers.

        October 2010

      • AML-1.3.2

        Capital Market licensees should examine, as far as reasonably possible, the background and purpose of all complex, unusual large transactions, and all unusual patterns of transactions, which have no apparent economic or lawful purpose. Where the risks of money laundering or terrorist financing are higher, capital Market licensees should conduct enhanced CDD measures, consistent with the risks identified. In particular, they should increase the degree and nature of monitoring of the business relationship, in order to determine whether those transactions or activities appear unusual or suspicious. The additional inquiries or information referred to in Paragraph AML-1.3.1 include:

        (a) Obtaining additional information on the customer (e.g. occupation, volume of assets, information available through public databases, internet, etc.), and updating more regularly the identification data of customer and beneficial owner;
        (b) Obtaining additional information on the intended nature of the business relationship;
        (c) Obtaining information on the source of funds or source of wealth of the customer;
        (d) Obtaining information on the reasons for intended or performed transactions;
        (e) Obtaining the approval of senior management to commence or continue the business relationship;
        (f) Conducting enhanced monitoring of the business relationship, by increasing the number and timing of controls applied, and selecting patterns of transactions that need further examination;
        (g) Taking specific measures to identify the source of the first payment in this account and applying RBA to ensure that there is a plausible explanation in any case where the first payment was not received from the same customer’s account;
        (h) Obtaining evidence of a person's permanent address through the use of a credit reference agency search, or through independent governmental database or by home visit;
        (i) Obtaining a personal reference (e.g. by an existing customer of the Capital Market Licensee);
        (j) Obtaining another licensed entity’s reference and contact with the concerned licensee regarding the customer;
        (k) Obtaining documentation outlining the customer’s source of wealth;
        (l) Obtaining additional documentation outlining the customer’s source of income; and
        (m) Obtaining additional independent verification of employment or public position held.
        Amended: January 2022
        Added: October 2010

      • AML-1.3.3

        In addition to the general rule contained in rule AML-1.3.1 above, special care is required in the circumstances specified in sections AML-1.4 to AML-1.8 inclusive.

        October 2010

      • AML-1.3.4

        Additional enhanced due diligence measures for non-resident account holders may include the following:

        (a) References provided by a regulated bank from a FATF country;
        (b) Certified copies of bank statements for a recent 3-month period; or
        (c) References provided by a known customer of the bank licensee.
        Added: January 2020

    • AML-1.4 AML-1.4 Enhanced Customer Due Diligence: Non Face-to-Face Business and New Technologies

      • AML-1.4.1

        Capital Market Licensees must establish specific procedures for verifying customer identity where no face-to-face contact takes place.

        Amended: January 2022
        Added: October 2010

      • AML-1.4.2

        Where no face-to-face contact takes place, Capital Market Licensees must take additional measures (to those specified in section AML-1.2), in order to mitigate the potentially higher risk associated with such business. In particular, Capital Market Licensees must take measures:

        (a) To ensure that the customer is the Person they claim to be; and
        (b) To ensure that the address provided is genuinely the customer's.
        Amended: January 2022
        Added: October 2010

      • AML-1.4.3

        There are a number of checks that can provide a Capital Market Licensees with a reasonable degree of assurance as to the authenticity of the applicant. They include:

        (a) Telephone contact with the applicant on an independently verified home or business number;
        (b) With the customer's consent, contacting an employer to confirm employment via phone through a listed number or in writing;
        (c) Salary details appearing on recent bank statements.
        (d) Independent verification of employment (e.g.: through the use of a national E-KYC application, or public position held;
        (e) Carrying out additional searches (e.g. internet searches using independent and open sources) to better inform the customer risk profile;
        (f) Carrying out additional searches focused on financial crime risk indicator (i.e. negative news);
        (g) Evaluating the information provided with regard to the destination of fund and the reasons for the transaction;
        (h) Seeking and verifying additional information from the customer about the purpose and intended nature of the transaction or the business relationship; and
        (i) Increasing the frequency and intensity of transaction monitoring.
        Amended: January 2022
        Added: October 2010

      • AML-1.4.4

        Capital market services provided using digital channels or internet pose greater challenges for customer identification and AML/CFT purposes. Capital Market Licensees must identify and assess the money laundering or terrorist financing risks relevant to any new technology or channel and establish procedures to prevent the misuse of technological developments in Money Laundering or terrorist financing schemes. The risk assessments must be consistent with the requirements in Section AML-C.2. Capital Market Licensees which provide screen based trading or online services to their customers must set-up programmes or systems to highlight unusual transactions to enable the Capital Market Licensees to report all such transactions.

        Amended: January 2022
        Added: October 2010

      • New Products, Practices and Technologies

        • AML-1.4.5

          Capital Market Licensees must identify and assess the money laundering or terrorist financing risks that may arise in relation to:

          (a) The development of new products and new business practices, including new delivery mechanisms; and
          (b) The use of new or developing technologies for both new and pre-existing products.
          Amended: January 2022
          Added: April 2016

        • AML-1.4.6

          For purposes of Paragraph AML-1.4.5, such a risk assessment must take place prior to the launch of the new products, business practices or the use of new or developing technologies. Capital Market Licensees must take appropriate measures to manage and mitigate those risks.

          Amended: January 2022
          Added: April 2016

        • AML-1.4.7

          Capital Market Licensees, while complying with the requirements of Paragraphs AML-1.4.5 and AML-1.4.6, must pay special attention to new products, new business practices, new delivery mechanisms and new or developing technologies that favor anonymity.

          Amended: January 2022
          Added: January 2020

      • Enhanced Monitoring

        • AML-1.4.8

          Customers on boarded digitally must be subject to enhanced on-going account monitoring measures.

           

          Added: January 2022

        • AML-1.4.9

          The CBB may require a licensee to share the details of the enhanced monitoring and the on-going monitoring process for non face-to-face customer relationships.

           

          Added: January 2022

      • Licensee’s digital ID applications

        • AML-1.4.10

          Capital Market Licensees may use its digital ID applications that use secure audio-visual real time (live video conferencing/live photo selfies) communication means to identify the natural person.

           

          Added: January 2022

        • AML-1.4.11

          Capital Market Licensees must maintain a document available upon request for the use of its digital ID applications that includes all the following information:

          (a) A description of the nature of products and services for which the proprietary digital ID application is planned to be used with specific references to the rules in this Module for which it will be used;
          (b) A description of the systems and IT infrastructure that are planned to be used;
          (c) A description of the technology and applications that have the features for facial recognition or biometric recognition to authenticate independently and match the face and the customer identification information available with the licensee. The process and the features used in conjunction with video conferencing include, among others, face recognition, three-dimensional face matching techniques etc;
          (d) “Liveness” checks created in the course of the identification process;
          (e) A description of the governance arrangements related to this activity including the availability of specially trained personnel with sufficient level of seniority; and
          (f) Record keeping arrangements for electronic records to be maintained and the relative audit.

           

          Added: January 2022

        • AML-1.4.12

          Capital Market Licensees that intends to use its digital ID application to identify the customer and verify identity information must meet the following additional requirements:

          (a) The digital ID application must make use of secure audio visual real time (live video conferencing/ live photo selfies) technology to (i) identify the customer, (ii) verify his/her identity, and also (iii) ensure the data and documents provided are authentic;
          (b) The picture/sound quality must be adequate to facilitate unambiguous identification;
          (c) The digital ID application must include or be combined with capability to read and decrypt the information stored in the identification document’s machine readable zone (MRZ) for authenticity checks from independent and reliable sources;
          (d) Where the MRZ reader is with an outsourced provider, the licensee must ensure that such party is authorized to carry out such services and the information is current and up to date and readily available such that the licensee can check that the decrypted information matches the other information in the identification document;
          (e) The digital ID application has the features for allowing facial recognition or biometric recognition that can authenticate and match the face and the customer identification documents independently;
          (f) The digital ID solution has been tested by an independent expert covering the governance and control processes to ensure the integrity of the solution and underlying methodologies, technology and processes and risk mitigation. The report of the expert’s findings must be retained and available upon request;
          (g) The digital ID application must enable an ongoing process of retrieving and updating the digital files, identity attributes, or data fields which are subject to documented access rights and authorities for updating and changes; and
          (h) The digital ID application must have the geo-location features which must be used by the licensee to ensure that it is able to identify any suspicious locations and to make additional inquiries if the location from which a customer is completing the onboarding process does not match the location of the customer based on the information and documentation submitted.

           

          Added: January 2022

        • AML-1.4.13

          Capital Market Licensees using its digital ID application must establish and implement an approved policy which lays down the governance, control mechanisms, systems and procedures for the CDD which include:

          (a) A description of the nature of products and services for which customer due diligence may be conducted through video conferencing or equivalent electronic means;
          (b) A description of the systems, controls and IT infrastructure planned to be used;
          (c) Governance mechanism related to this activity;
          (d) Specially trained personnel with sufficient level of seniority; and
          (e) Record keeping arrangements for electronic records to be maintained and the relative audit trail.

           

          Added: January 2022

        • AML-1.4.14

          [This Paragraph has been deleted in October 2023]

          Deleted: October 2023
          Added: January 2022

        • AML-1.4.15

          Capital Market Licensees must ensure that the information referred to in Paragraph AML-1.2.1 is collected in adherence to privacy laws and other applicable laws of the country of residence of the customer.

           

          Added: January 2022

        • AML-1.4.16

          Capital Market Licensees must ensure that the information referred to in Subparagraphs AML-1.2.1 (a) to (f) is obtained prior to commencing the digital verification such that:

          (a) The licensee can perform its due diligence prior to the digital interaction/communication and can raise targeted questions at such interaction/communication session; and
          (b) The licensee can verify the authenticity, validity and accuracy of such information through digital means (See Paragraph AML-1.4.18 below) or by use of the methods mentioned in Paragraph AML-1.2.3 and /or AML-1.4.3 as appropriate.

           

          Added: January 2022

        • AML-1.4.17

          Capital Market Licensees must also obtain the customer’s explicit consent to record the session and capture images as may be needed.

           

          Added: January 2022

        • AML-1.4.18

          Capital Market Licensees must verify the information in Paragraph AML-1.2.1 (a) to (f) by the following methods below:

          (a) Confirmation of the date of birth and legal name by digital reading and authenticating current valid passport or other official original identification using machine readable zone (MRZ) or other technology which has been approved under paragraph FC-1.4.10, unless the information was verified using national E-KYC application;
          (b) Performing real time video calls with the applicant to identify the person and match the person’s face and /other features through facial recognition or bio-metric means with the office documentation, (e.g. passport, CPR);
          (c) Matching the official identification document, (e.g. passport, CPR) and related information provided with the document captured/displayed on the live video call; and
          (d) Confirmation of the permanent residential address by, unless the information was verified using national E-KYC application capturing live, the recent utility bill, bank statement or similar statement from another licensee or financial institution, or some form of official correspondence or official documentation card, such as national identity card or CPR, from a public/governmental authority, or a tenancy agreement or record of home visit by an official of the licensee.

           

          Added: January 2022

        • AML-1.4.19

          For the purposes of Paragraph AML-1.4.18, actions taken for obtaining and verifying customer identity could include:

          (a) Collection: Present and collect identity attributes and evidence, either in person and/or online (e.g., by filling out an online form, sending a selfie photo, uploading photos of documents such as passport or driver’s license, etc.);
          (b) Certification: Digital or physical inspection to ensure the document is authentic and its data or information is accurate (for example, checking physical security features, expiration dates, and verifying attributes via other services);
          (c) De-duplication: Establish that the identity attributes and evidence relate to a unique person in the ID system (e.g., via duplicate record searches, biometric recognition and/or deduplication algorithms);
          (d) Verification: Link the individual to the identity evidence provided (e.g., using biometric solutions like facial recognition and liveness detection); and
          (e) Enrolment in identity account and binding: Create the identity account and issue and link one or more authenticators with the identity account (e.g., passwords, one-time code (OTC) generator on a smartphone, etc.). This process enables authentication.

           

          Added: January 2022

        • AML-1.4.20

          Not all elements of a digital ID system are necessarily digital. Some elements of identity proofing and enrolment can be either digital or physical (documentary), or a combination, but binding and authentication must be digital.

           

          Added: January 2022

        • AML-1.4.21

          Sufficient controls must be put in place to safeguard the data relating to customer information collected through the video conference and due regard must be paid to the requirements of the Personal Data Protection Law (PDPL). Additionally, controls must be put in place to minimize the increased impersonation fraud risk in such non face-to-face relationship where there is a chance that customer may not be who he claims he is.

           

          Added: January 2022

      • Overseas branches

        • AML-1.4.22

          Where Capital Market Licensees intend to use a digital ID application in a foreign jurisdiction in which it operates, it must ensure that the digital ID application meets with the requirements under Paragraph AML-B.2.1.

           

          Added: January 2022

    • AML-1.5 AML-1.5 Enhanced Customer Due Diligence: Politically Exposed Persons ('PEPs')

      • AML-1.5.1

        Capital Market Licensees must have appropriate risk management systems to determine whether a customer or beneficial owner is a Politically Exposed Person ('PEP'), both at the time of establishing business relations and thereafter on a periodic basis. Capital Market Licensees must utilise publicly available databases and information to establish whether a customer is a PEP.

        Amended: January 2022
        Amended: July 2016
        Added: October 2010

      • AML-1.5.2

        Capital Market Licensees must establish a client acceptance policy with regard to PEPs, taking into account the reputational and other risks involved. Senior management approval must be obtained before a PEP is accepted as a customer. Capital Market Licensees must not accept a non-Bahraini PEP as a customer based on customer due diligence undertaken using digital ID applications.

        Amended: January 2022
        Added: October 2010

      • AML-1.5.3

        Where an existing customer is a PEP, or subsequently becomes a PEP, enhanced monitoring and customer due diligence measures must include:

        (a) Analysis of complex financial structures, including trusts, foundations or international business corporations;
        (b) A written record in the customer file to establish that reasonable measures have been taken to establish both the source of wealth and the source of funds;
        (c) Development of a profile of anticipated customer activity, to be used in on-going monitoring;
        (d) Approval of senior management for allowing the customer relationship to continue; and
        (e) On-going account monitoring of the PEP's account by senior management (such as the MLRO).
        October 2010

      • AML-1.5.3A

        In cases of higher risk business relationships with such persons, mentioned in Paragraph AML-1.5.1, Capital Market Licensees must apply, at a minimum, the measures referred to in (b), (d) and (e) of Paragraph AML-1.5.3.

        Amended: January 2022
        Added: July 2016

      • AML-1.5.3B

        The requirements for all types of PEP must also apply to family or close associates of such PEPs.

        Added: July 2016

      • AML-1.5.3C

        For the purpose of Paragraph AML-1.5.3B, 'family' means spouse, father, mother, sons, daughters, sisters and brothers. 'Associates' are persons associated with a PEP whether such association is due to the person being an employee or partner of the PEP or of a firm represented or owned by the PEP, or family links or otherwise.

        Added: July 2016

      • AML-1.5.4

        [This Paragraph was deleted in January 2020].

        Deleted: January 2020
        Amended: July 2016
        October 2010

    • AML-1.6 AML-1.6 Enhanced Due Diligence: Charities, Clubs and Other Societies

      • AML-1.6.1

        Capital market services must not be provided to charitable funds and religious, sporting, social, cooperative and professional and other societies, until an original certificate authenticated by the relevant Ministry confirming the identities of those purporting to act on their behalf (and authorising them to obtain the said service) has been obtained. For clubs and societies registered with the General Organisation for Youth and Sports (GOYS), Capital Market Licensees must contact GOYS to clarify whether the account may be opened in accordance with the rules of GOYS.

        Amended: January 2022
        Amended: July 2016
        Added: October 2010

      • AML-1.6.2

        Capital Market Licensees are reminded that clubs and societies registered with GOYS may only have one account with banks in Bahrain.

        Amended: January 2022
        Added: October 2010

      • AML-1.6.3

        Charities should be subject to enhanced transaction monitoring by Capital Market Licensees. Capital Market Licensees should develop a profile of anticipated account activity (in terms of payee countries and recipient organizations in particular).

        Amended: January 2022
        Added: October 2010

      • AML-1.6.4

        Capital Market Licensees must provide a monthly report of all payments and transfers of BD3,000 (or equivalent in foreign currencies) and above, from accounts held by charities registered in Bahrain. The report must be submitted to the CBB's Compliance Unit (see section AML-4.4 for contact address), giving details of the amount transferred, account name, number and beneficiary name account and bank details. Capital Market Licensees must ensure that such transfers are in accordance with the spending plans of the charity (in terms of amount, recipient and country).

        Amended: January 2022
        Added: October 2010

      • AML-1.6.5

        Article 20 of Decree Law No. 21 of 1989 (issuing the Law of Social and Cultural Societies and Clubs and Private Organisations Operating in the Area of Youth and Sport and Private Institutions) provides that Capital Market Licensees may not accept or process any incoming or outgoing wire transfers from or to any foreign country on behalf of charity and non-profit organisations licensed by the Ministry of Social Development, until an official letter by the Ministry authorising the receipt or remittance of the funds has been obtained by the concerned Capital Market Licensees.

        Amended: January 2022
        Added: October 2010

      • AML-1.6.6

        The receipt of a Ministry letter mentioned in rule AML-1.6.5 above does not exempt the concerned Capital Market Licensees from conducting normal CDD measures as outlined in other parts of this Module.

        Amended: January 2022
        Added: October 2010

    • AML-1.7 AML-1.7 Enhanced Due Diligence: 'Pooled Funds'

      • AML-1.7.1

        Where Capital Market Licensees receive pooled funds managed by professional intermediaries (such as investment and pension fund managers, stockbrokers and lawyers or authorized money transferors), they must apply CDD measures contained in section AML-1.8 to the professional intermediary. In addition, Capital Market Licensees must verify the identity of the beneficial owners of the funds where required as shown in rules AML-1.7.2 and AML-1.7.3 below.

        Amended: January 2022
        Added: October 2010

      • AML-1.7.2

        Where funds pooled in an account are not co-mingled (i.e. where there are 'sub-accounts' attributable to each beneficiary), all beneficial owners must be identified by the Capital Market Licensees and their identity verified in accordance with the requirements in section AML-1.2.

        Amended: January 2022
        Added: October 2010

      • AML-1.7.3

        For accounts held by intermediaries, where such funds are co-mingled, the Capital Market Licensees must make a reasonable effort (in the context of the nature and amount of the funds received) to look beyond the intermediary and determine the identity of the beneficial owners or underlying clients, particularly where funds are banked and then transferred onward to other financial institutions (e.g. in the case of accounts held on behalf of authorized money transferors). Where, however, the intermediary is subject to equivalent regulatory and Money Laundering regulation and procedures (and, in particular, is subject to the same due diligence standards in respect of its client base) the CBB will not insist upon all beneficial owners being identified, provided the bank has undertaken reasonable measures to determine that the intermediary has engaged in a sound customer due diligence process, consistent with the requirements in section AML-1.8.

        Amended: January 2022
        Added: October 2010

      • AML-1.7.4

        For accounts held by intermediaries from foreign jurisdictions, the intermediary must be subject to requirements to combat Money Laundering and terrorist financing consistent with the FATF Recommendations and the intermediary must be supervised for compliance with those requirements. The Capital Market Licensees must obtain documentary evidence to support the case for not carrying out customer due diligence measures beyond identifying the intermediary. The Capital Market Licensees must satisfy itself that the intermediary has identified the underlying beneficiaries and has the systems and controls to allocate the assets in the pooled accounts to the relevant beneficiaries.

        Amended: January 2022
        Amended: July 2016
        Added: October 2010

      • AML-1.7.5

        Where the intermediary is not empowered to provide the required information on beneficial owners (e.g. lawyers bound by professional confidentiality rules) or where the intermediary is not subject to the same due diligence standards referred to above, a Capital Market Licensees must not permit the intermediary to open an account or allow the account to continue to operate, unless specific permission has been obtained in writing from the CBB.

        Amended: January 2022
        Added: October 2010

    • AML-1.8 AML-1.8 Introduced Business from Professional Intermediaries

      • AML-1.8.1

        A Capital Market Licensees must only accept customers introduced to it by other Capital Market Licensees, financial institutions or intermediaries, if it has satisfied itself that the introducer concerned is subject to FATF-equivalent measures and customer due diligence measures. Where Capital Market Licensees delegate part of the customer due diligence measures to an introducer, the responsibility for meeting the requirements of Chapters 1 and 2 remains with the Capital Market Licensee, not the introducer.

        Amended: January 2022
        Amended: January 2018
        Added: October 2010

      • AML-1.8.2

        Capital Market Licensees may only accept introduced business if all of the following conditions are satisfied:

        (a) The customer due diligence measures applied by the introducer are consistent with those required by the FATF Recommendations;
        (b) A formal agreement is in place defining the respective roles of the Capital Market Licensees and the introducer in relation to customer due diligence measures. The agreement must specify that the customer due diligence measures of the introducer will comply with the FATF Recommendations;
        (c) The introducer is able to provide all relevant data pertaining to the identity of the customer and beneficial owner of the funds and, where applicable, the party/parties on whose behalf the customer is acting; also, the introducer has confirmed that the Capital Market Licensee will be allowed to verify the customer due diligence measures undertaken by the introducer at any stage; and
        (d) Written confirmation is provided by the introducer confirming that all customer due diligence measures required by the FATF Recommendations have been followed and the customer's identity established and verified. In addition, the confirmation must state that any identification documents or other customer due diligence material can be accessed by the Capital Market Licensee and that these documents will be kept for at least five years after the business relationship has ended.
        Amended: January 2022
        Amended: July 2016
        Added: October 2010

      • AML-1.8.3

        The Capital Market Licensees must perform periodic reviews ensuring that any introducer on which it relies is in compliance with the FATF Recommendations. Where the introducer is resident in another jurisdiction, the Capital Market Licensees must also perform periodic reviews to verify whether the jurisdiction is in compliance with the FATF Recommendations.

        Amended: January 2022
        Amended: July 2016
        Added: October 2010

      • AML-1.8.4

        Should the Capital Market Licensees not be satisfied that the introducer is in compliance with the requirements of the FATF Recommendations, the Capital Market Licensees must not accept further introductions or discontinue the business relationship with the introducer.

        Amended: January 2022
        Amended: July 2016
        Added: October 2010

    • AML-1.9 AML-1.9 Shell Financial Institutions

      • Accounts with Shell Financial Institutions

        • AML-1.9.1

          Capital Market Licensees must not establish business relations with shell financial institutions which have no physical presence or 'mind and management' in the jurisdiction in which they are licensed and which are unaffiliated with a regulated financial group. Capital Market Licensees must not knowingly establish relations with other Capital Market Licensees or financial institutions that have relations with shell financial institutions.

          Amended: January 2022
          Amended: January 2020
          Amended: July 2016
          Added: October 2010

        • AML-1.9.2

          Capital Market Licensees must make a Suspicious Transaction Report to the Financial Intelligence Directorate, Ministry of Interior and the Compliance Directorate of the CBB if they are approached by a shell financial institutions or an institution they suspect of being a shell financial institutions.

          Amended: January 2022
          Amended: January 2020
          Amended: October 2019
          Added: October 2010

    • AML-1.10 AML-1.10 Simplified Customer Due Diligence

      • AML-1.10.1

        Capital Market Licensees may apply simplified customer due diligence measures, as described in paragraphs AML-1.10.2 to AML-1.10.8, if:

        (a) [This Subparagraph was deleted in January 2018];
        (b) The transaction concerns the sale of a Security listed on a licensed exchange, issued as a result of an initial public offering after January 2006, and the customer already holds an investor number and an allotment letter. Furthermore, the licensed exchange should have advised the broker (by circular) that all necessary customer due diligence information and copies of all original identification documents will be made available upon request without delay;
        (c) The customer is a company listed on a GCC or FATF member state stock exchange with equivalent disclosure standards to those of a licensed exchange;
        (d) The customer is a financial institution whose entire operations are subject to AML/CFT requirements consistent with the FATF Recommendations and it is supervised by a financial services supervisor in a FATF or GCC member state for compliance with those requirements;
        (e) The customer is a financial institution which is a subsidiary of a financial institution located in a FATF or GCC member state, and the AML/CFT requirements applied to its parent also apply to the subsidiary;
        (f) The customer is the Central Bank of Bahrain ('CBB'), a licensed exchange, or a licensee of the CBB; or
        (g) The customer is a Ministry of a GCC or FATF member state government, a company in which a GCC government is a majority shareholder, or a company established by decree in the GCC.
        Amended: January 2022
        Amended: January 2019
        Amended: January 2018
        Amended: July 2016
        Added: October 2010

      • AML-1.10.2

        For customers falling under category (b) in rule AML-1.10.1, the customer's name and contact information must be recorded. However, the verification, certification and due diligence requirements (contained in rules AML-1.2.3, AML-1.2.5, AML-1.2.6, AML-1.2.8, AML-1.2.9 and AML-1.2.11), may be dispensed with.

        Amended: July 2018
        October 2010

      • AML-1.10.3

        [This Paragraph was deleted in July 2018].

        Deleted: July 2018
        October 2010

      • AML-1.10.5

        Capital Market Licensees wishing to apply simplified due diligence measures as allowed for under categories (c) to (g) of rule AML-1.10.1 must retain documentary evidence supporting their categorization of the customer.

        Amended: January 2022
        Added: October 2010

      • AML-1.10.6

        Examples of such documentary evidence may include a printout from a regulator's website, confirming the licensed status of an institution, and internal papers attesting to a review of the AML/CFT measures applied in a jurisdiction.

        October 2010

      • AML-1.10.7

        Capital Market Licensees may use authenticated SWIFT messages as a basis for confirmation of the identity of a financial institution under rule AML-1.10.1 (d) and (e) where it is dealing as principal. For customers coming under rule AML-1.10.1 (d) and (e), Capital Market Licensees must also obtain and retain a written statement from the parent institution of the subsidiary concerned, confirming that the subsidiary is subject to the same AML/CFT measures as its parent.

        Amended: January 2022
        Added: October 2010

      • AML-1.10.8

        Simplified customer due diligence measures must not be applied where a Capital Market Licensee knows, suspects, or has reason to suspect, that the applicant is engaged in Money Laundering or terrorism financing or that the transaction is carried out on behalf of another Person engaged in Money Laundering or terrorism financing.

        Amended: January 2022
        Added: October 2010

      • AML-1.10.8A

        Simplified customer due diligence measures must not be applied in situations where the licensee has identified high ML/TF/PF risks.

         

        Added: January 2022

      • AML-1.10.9

        [This Paragraph was deleted in July 2018].

        Deleted: July 2018
        October 2010

    • AML-1.11 AML-1.11 Enhanced Due Diligence for Correspondent Accounts

      • AML-1.11.1

        This Section, AML1.11, applies to a Capital Market Licensee when it provides correspondent account services or characteristic similar to correspondent account services.

        Amended: January 2022
        Added: January 2020

      • AML-1.11.2

        When providing correspondent account services, Capital Market Licensee, must gather sufficient information (e.g. through a questionnaire) about their respondent financial institution to understand the nature of the respondent's business. Factors to consider to provide assurance that satisfactory measures are in place at the respondent financial institution includes:

        (a) Information about the respondent financial institution’s ownership structure and management;
        (b) Major business activities of the respondent financial institution and its location (i.e. whether it is located in a FATF compliant jurisdiction) as well as the location of its parent (where applicable);
        (c) Where the customers of the respondent financial institution are located;
        (d) The respondent financial institution AML/CFT controls;
        (e) The purpose for which the account will be opened;
        (f) Confirmation that the respondent financial institution has verified the identity of any third party entities that will have direct access to the account without reference to the respondent financial institution (payable through account);
        (g) The extent to which the respondent financial institution performs on-going due diligence on customers with direct access to the account (payable through account), and the condition of regulation and supervision in the respondent financial institution’s country (e.g. from published FATF reports). Capital Market Licensees must take into account the country where the respondent financial institution is located and whether that country abides by the FATF Recommendations when establishing correspondent relationships with foreign entities. Capital Market Licensees must obtain where possible copies of the relevant laws and regulations concerning AML/CFT and satisfy themselves that the respondent financial institution have effective customer due diligence measures consistent with the FATF Recommendations;
        (h) Confirmation that the respondent financial institution is able to provide relevant customer identification data on request to the Capital Market Licensees; and
        (i) Whether the respondent financial institution has been subject to a money laundering or terrorist financing investigation.
        Amended: January 2022
        Added: January 2020

      • AML-1.11.3

        Capital Market Licensees must implement the following additional measures, prior to opening a correspondent account:

        (a) Complete a signed statement that outlines the respective responsibilities of each institution in relation to money laundering detection and monitoring responsibilities; and
        (b) Ensure that the correspondent relationship has the approval of senior management.
        Amended: January 2022
        Added: January 2020

      • AML-1.11.4

        Where the correspondent account services involve a payable through account, Capital Market Licensees must be satisfied that:

        (a) The respondent financial institution has performed appropriate measures at least equivalent to those specified in Sections AML-1.1 to AML-1.8 (Customer Due Diligence) on the third party having direct access to the payable-through account; and
        (b) The respondent financial institution is able to perform ongoing monitoring of its business relations with that third party and is willing and able to provide CDD information to the Capital Market Licensees upon request.
        Amended: January 2022
        Added: January 2020

      • AML-1.11.5

        Capital Market Licensees must document the basis for their satisfaction that the requirements in Paragraphs AML-1.11.2, AML-1.11.3 and AML-1.11.4 are met.

        Amended: January 2022
        Added: January 2020

      • AML-1.11.6

        Capital Market Licensees must not enter into or continue correspondent account services relationship with another financial institution that does not have adequate controls against money laundering or terrorism financing activities, is not effectively supervised by the relevant authorities or is a shell financial institution. Capital Market Licensees must pay particular attention when entering into or continuing relationships with respondents located in jurisdictions that have poor KYC standards or have been identified by the FATF as being ‘non-cooperative’ in the fight against money laundering/terrorist financing.

        Amended: January 2022
        Added: January 2020

      • AML-1.11.7

        Capital Market Licensees must also take appropriate measures when establishing a correspondent account services relationship, to satisfy themselves that their respondent financial institutions do not permit their accounts to be used by shell financial institutions.

        Amended: January 2022
        Added: January 2020

      • AML-1.11.8

        In the case of correspondent account services relationships, the Capital Market Licensee generally does not have direct relationships with the customers of the respondent financial institution. Therefore, there is no expectation or requirement for the Capital Market Licensee to apply CDD on a respondent financial institution’s customer, which is, instead the responsibility of the respondent financial institution. Nonetheless, it is consistent with the risk-based approach for the Capital Market Licensee to have some general sense of the respondent financial institution’s customer base as part of ascertaining the risks associated with the respondent financial institution itself.

        Amended: January 2022
        Added: January 2020

    • AML-1.12 Reliance on Third Parties for Consumer Due Diligence

      • AML-1.12.1

        Licensees are permitted to rely on third parties to perform elements of CDD measures and recordkeeping requirements stipulated in Chapter AML-1 related to customer and beneficial owner identity, verification of their identity and information on the purpose and intended nature of the business relationship with the licensee, subject to complying with the below:

        (a) Licensees remain ultimately responsible for CDD measures;
        (b) Licensees immediately obtain the relevant CDD information from the third party upon onboarding clients;
        (c) There is an agreement with the third party for the arrangement with clear contractual terms on the obligations of the third party;
        (d) The third party without delay makes available the relevant documentation relating to the CDD requirements upon request;
        (e) Licensees ensure that the third party is a financial institution that is regulated and supervised for, and has measures in place for compliance with, CDD and recordkeeping requirements in line with FATF Recommendations 10 and 11; and
        (f) For third parties based abroad, licensees must consider the information available on the level of country risk.
        Added: October 2023

      • AML-1.12.2

        Where a licensee relies on a third-party that is part of the same financial group, the licensee can consider that:

        (a) The requirements under Subparagraphs AML-1.12.1 (d) and (e) are complied with through its group programme, provided the group satisfies the following conditions:
        (i) The group applies CDD and record keeping requirements consistent with FATF Recommendations 10, 11 and 12 and has in place internal controls in accordance with FATF Recommendation 18; and
        (ii) The implementation of CDD, record keeping and AML/CFT measures are supervised at a group level by a financial services regulatory authority for compliance with AML/CFT requirements consistent with standards set by the FATF.
        (b) The requirement under Subparagraph AML-1.12.1 (f) is complied with if the country risk is adequately mitigated by the group’s AML/CFT policies.
        Added: October 2023

      • AML-1.12.3

        This Section does not apply to outsourcing or agency arrangements in which the outsourced entity applies the CDD measures on behalf of the delegating licensee, in accordance with its procedures.

        Added: October 2023