CMA’s Examination observations Report

§Preamble

Dear (SCA Licensed Finacial Institution (LFI)

Over the past year, Securities firms in UAE have completed the SCA’s annual and AML/CFT and sanction risk assessment returns for inherent risk factors and effectiveness controls. The SCA followed a risk-based approach and methodology by assessing the Money Laundering /Terrorist Financing (ML/TF/PF) risk profile of each financial institution in the UAE securities sector through the collection of ML/TF/PF inherent risk factors (also known as “Risk Indicators”).

The Risk Indicators are derived from the risks outlined in FATF’s 40 Recommendations, UAE’s National Risk Assessment (NRA) and Topical Risk Assessments. The controls assessment included ML/TF risk factors assessed at each institutional level to understand the financial institution’s residual risks.

Based on the results, we utilized our onsite and offsite tools to identify the below common shortcomings, across the sector.

Your Obligation

The Decree-Law No. (20) of 2018 On Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organizations (“AML/CFT Law “) and the Cabinet Decision No. (10) of 2019 Concerning the Implementing Regulation AML/CFT Law (“the Cabinet Decision”) contains numerous provisions setting out the rights and obligations of supervised institutions, as well as their senior managers and employees.

Securities firms are responsible for ensuring they understand the associated regulatory requirements. Both the AML-CFT Law and the Cabinet Decision state that financial institutions, including VASPs, are obliged to identify, assess, and understand the ML/FT/PF risks to which they are exposed.

What you need to do

We expect your entity to review its AML/CFT and sanction compliance countermeasures in light of the issues highlighted in this letter and take robust action to ensure that the AML/CFT and sanction compliance program is appropriate for your entity's ML/TF/PF risk exposure. You should discuss this letter with your entity’s board or equivalent governing body and identify what actions, if any, are needed to ensure your firm has an adequate AML/CFT compliance program in place.

Securities entities, including VASPs, should also ensure their internal and external auditors are aware of this letter and the material we have referenced; we continue to expect senior management to have appropriate oversight of their entities’ AML/CFT and sanction compliance program.

The action we may take

Failure to comply with the AML-CFT Law, the Cabinet Decision, and SCA’s guidance and notices is taken very seriously. Where it appears that LFIs, including VASPs, may be contravening or not meeting our standards, we may use our powers, including referrals to enforcement, where necessary under Article (14) for AML/CFT Law to vary an entity’s permission, impose requirements or change individuals’ approvals. These powers may be used to prevent or to stop harm from becoming serious, including:

a. Warning

b. Administrative penalties of no less than AED 50,000 (fifty thousand dirhams) and no more than AED 5,000,000 (five million dirhams) for each violation;

c. Banning the violator from working in the sector related to the violation for the period determined by the supervisory authority;

d. Constraining the powers of the Board members, supervisory or executive management members, managers or owners who are proven to be responsible for the violation, including the appointment of a temporary inspector;

e. Restriction of the activity or the profession for a period to be determined by the supervisory authority; and

f. Cancel the License.

In the past, we have taken enforcement actions against financial institutions and individuals who have failed to implement an adequate AML/CFT and sanction compliance program.

Key issues found and our expectations.

§1 — Governance Framework and management oversight

a. AML/CFT and sanction policies and procedures are not reviewed and regularly updated as necessary to reflect the AML/CFT legislation and recent SCA-issued guidance and notice;

b. Incommensurate documented overall risk policy (for example, risk appetite statement, customer acceptance policy, and others); and

c. AML/CFT and sanction compliance policy is not based on an assessment of ML/TF risks, considering the security entity’s business structure and factors such as its size, location, activities, methods of payment, and threats or vulnerabilities to ML/ CFT.

a. The LFIs, including VASPs, are obliged to assess and understand the ML/FT risks exposed and how the entity may be affected by those risks;

b. The financial institution in the securities sector including VASPs, shall adopt policies indicating its commitment to comply with AML/CFT obligations under the relevant AML/CFT law and regulations to prevent any transaction facilitating ML/TF activities; policies and procedures, including such information as organizational roles and responsibilities; process flows, timing and frequency; internal reporting requirements; and review, testing, and audit requirements.

§2 — Testing and Auditing

a. The scope of the internal audit plan does not focus on testing and reviewing

Targeted Financial Sanctions related controls.

a. The LFIs including VASPs, are obliged to have in place an independent audit function to test the effectiveness and adequacy of its internal policies, controls and procedures relating to combating the crimes of money laundering and the financing of terrorism and an illegal organization; and

b. The LFIs , including VASPs, should ensure that its independent audit function is appropriately staffed and organized and that it has the requisite competencies and experience to carry out its responsibilities effectively, commensurate with the ML/FT risks to which the company is exposed, and with the nature and size of their businesses.

§3 — ML/FT/PF Risk Assessment

a. Incomprehensive ML/TF/PF risk assessments and the risk assessment factors used are not in line with the business operations, products, type of customers, and delivery channels;

b. An incompetent risk-based approach to allocating the company's resources more efficiently and effectively; and

c. Failure to adopt and apply appropriate preventative measures commensurate with the nature of ML/TF risks the company faces.

a. The LFIsLFIs including VASPs, are obliged to assess and understand the ML/FT/PF risks exposed to and how the entity may be affected by those risks; The purpose of ML/FT business risk assessment is to improve the effectiveness of ML/FT/PF risk management by identifying the inherent ML/FT/PF risks faced by the entity as a whole. It also determines how

these risks are effectively mitigated through internal policies, procedures, and controls. It also establishes the residual ML/FT/PF risks and any gaps in the controls that should be addressed.

§4 — Customer Due Diligence, Enhanced Due Diligence, and Ongoing Monitoring

a. Failure to collect all necessary documents during the KYC or CDD process

before onboarding and providing financial services to prospective investors or clients using the risk based approach

b. Incomprehensive CDD measures and take reasonable steps to understand the ownership and control structure where a customer is legal person.

c. Failure to implement enhanced due diligence (EDD) to manage identified high risks and simplified due diligence (SDD) to manage identified low risks.

a. The LFIsLFIs including VASPs, are obliged to undertake CDD measures (including verifying the identity of customers, Beneficial Owners, beneficiaries, and controlling persons) either prior to or during the establishment of a Business Relationship; and

b. The LFIsLFIs including VASPs, are obliged to undertake ongoing supervision of customers’ activity, including auditing transactions executed throughout the course of the relationship to ensure that they are consistent with the information, types of activity, and risk profiles of the customers.

§5 — Sanctions Compliance Program

a. Lack of a robust sanction compliance program that includes the eight

components to meet their obligations to comply with laws and regulations related to targeted financial sanctions.

b. Incommensurate and incomplete documentation for screening operations, procedures of assets freezing, and escalation ladder for communicating any positive hits on the sanction list in the entity’s AML/ CFT policy.

a. The LFIs including VASPs, should take appropriate steps to develop, implement and regularly update an appropriate Sanctions Compliance Program (SCP) in order to fulfil its obligation to comply with the provisions of Cabinet Decision 74 as well as with the directives of the relevant competent authorities and supervisory authorities in regard to sanctions issued by the UNSC;

b. The LFIs including VASPs, should design and update their SCP so that its scope is proportionate to the level of their risk profile, tailored to its nature, scale, and complexity, and appropriate for the products and services they offer, the customers, clients, and partner relationships they maintain, and the geographic regions in which they operate;

c. The LFIs including VASPs, should ensure the SCP includes the eight (8) essential components of senior management commitment, risk assessment, sanctions risk appetite, internal controls, policies and procedures, training, independent audit and testing of processes and systems, and record keeping.

§6 — Suspicious Activities Report / Suspicious Transaction Report

a. An improper procedure that defines how to report suspicious transactions/

activity and the steps taken in such cases;

b. No sufficient guidance to the entity’s staff to recognize unusual patterns of information and activity, be aware and alert to situations/scenarios/typologies, and consider them in relevant circumstances to give rise to suspicion possibly; and

c. There is no specific proper training for the front lines.

a. The LFIs including VASPs, shall put in place indicators that can be used to identify the suspicion of the occurrence of the crime to report SARs/STRs;

b. The LFIs including VASPs, shall update these indicators on an ongoing basis, in accordance with the development and diversity of the methods used for committing such crimes, whilst complying with what Supervisory Authorities or FIU may issue in this regard.

Next Steps

We will continue to assess LFIs AML/CFT and sanction compliance programs according to our supervisory strategies. Where we find that LFIs including VASPs, are not meeting their obligations under our AML/CFT law, the cabinet Decision, and the SCA’s rules, we will take appropriate action, including exercising our regulatory powers.

Yours sincerely

AML/CFT Section Supervision and Compliance Department