Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations – Guidelines for Designated Non-Financial Businesses and Professions (Version 6.0, April 2019)

§Preamble

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

Guidelines for Designated Non-Financial Businesses and Professions

April 1, 2019 Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

Contents Part I—Overview

1. Introduction 1.1 Purpose and Scope 1.2 Applicability 1.3 Legal Status 1.4 Organisation of the Guidelines

2. Overview of the AML/CFT Legal, Regulatory, and National Strategy Frameworks of the United Arab Emirates 2.1 National Legislative and Regulatory Framework 2.2 International Legislative and Regulatory Framework 2.3 AML/CFT National Strategy Framework

3. Highlights of Key Provisions Affecting Supervised Institutions 3.1 Summary of Minimum Statutory Obligations of Supervised Institutions 3.2 Confidentiality and Data Protection 3.3 Protection against Liability for Reporting Persons 3.4 Statutory Prohibitions 3.5 Money Laundering 3.6 Predicate Offences 3.7 Financing of Terrorism 3.8 Financing of Illegal Organisations 3.9 Sanctions against Persons Violating Obligations

Part II—Identification and Assessment of ML/FT Risks

4. Identification and Assessment of ML/FT Risks 4.1 Risk-Based Approach 4.2 The Standard ML Model and Generic ML/FT Risks 4.3 ML/FT Typologies 4.4 Risk Factors 4.4.1 Customer Risk 4.4.2 Geographic Risk 4.4.3 Product-, Service-, Transaction-Related Risk 4.4.4 Channel-Related Risk 4.4.5 Other Risk Factors

April 1, 2019, Version 6.0 Page | i Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

Contents 4.5 Risk Assessment 4.5.1 Documentation, Updating, and Analysis 4.5.2 Assessing Enterprise Risk 4.5.3 Assessing Business Relationship Risk 4.5.4 Assessing New Product and New Technologies Risks 4.5.5 Examples of Risk Assessment Operations

Part III—Mitigation of ML/FT Risks

5. Internal Policies, Controls and Procedures

6. Customer Due Diligence (CDD)

§6.1 — Risk-Based Application of CDD Measures

§6.2 — Circumstances and Timing for Undertaking CDD Measures

6.2.1 Establishment of a Business Relationship 6.2.2 Occasional Transactions 6.2.3 Exceptional Circumstances

§6.3 — Customer Due Diligence (CDD) Measures

6.3.1 Customer and Beneficial Owner Identification/Verification 6.3.2 CDD Requirements Concerning Legal Persons and Arrangements 6.3.3 Establishing a Customer Due Diligence Profile 6.3.4 Ongoing Monitoring of the Business Relationship 6.3.5 Reviewing and Updating the Customer Due Diligence Information

§6.4 — Enhanced Due Diligence (EDD) Measures

6.4.1 Requirements for Politically Exposed Persons (PEPs) 6.4.2 Requirements for High-Risk Customers or Transactions 6.4.3 Requirements for High-Risk Countries 6.4.4 Requirements for Money or Value Transfer Services 6.4.5 Requirements for Non-Profit Organisations 6.5 Simplified Due Diligence (SDD) Measures 6.6 Reliance on a Third Party

7. Suspicious Transaction Reporting 7.1 Role of the Financial Intelligence Department 7.2 Processing of STRs by the FIU 7.3 Meaning of Suspicious Transaction 7.4 Identification of Suspicious Transactions 7.5 Requirement to Report 7.6 Specific Exemption from the Reporting Requirement

April 1, 2019, Version 6.0 Page | ii Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

Contents Part IV—AML/CFT Administration and Reporting 7.7 Procedures for the Reporting of Suspicious Transactions 7.8 Timing of Suspicious Transaction Reports (STRs) 7.9 Confidentiality and Prohibition against “Tipping Off” 7.10 Protection against Liability for Reporting Persons 7.11 Handling of Transactions and Business Relationships after Filing of STRs

8. Governance 8.1 Compliance Officer 8.1.1 Appointment and Approval 8.1.2 Responsibilities 8.2 Staff Screening and Training 8.3 Group Oversight 8.4 Independent Audit Function 8.5 Responsibilities of Senior Management 8.6 Governance Issues of Small Organisations

9. Record Keeping 9.1 Obligations and Timeframe for the Retention and Availability of Records 9.2 Required Record Types 9.2.1 Financial Transactions 9.2.2 Customer Information 9.2.3 Company Information 9.2.4 Reliance on Third Parties to Undertake CDD 9.2.5 Ongoing Monitoring of Business Relationships 9.2.6 Suspicious Transaction Reports

10. International Financial Sanctions 10.1 Targeted Financial Sanctions 10.2 UAE Cabinet Decision No. (20) of 2019 10.3 Other International Sanctions 10.4 Sanction Screening, Alert Management, Reporting

Part V—Appendices

11. Appendices 11.1 Glossary of Terms 11.2 Useful Links

April 1, 2019, Version 6.0 Page | iii Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

Part I—Overview

1. Introduction 1.1 Purpose and Scope The purpose of these Anti-Money Laundering and Combating the Financing of Terrorism and the Financing of Illegal Organisations Guidelines for Designated Non- Financial Businesses and Professions (“DNFBPs”) (“Guidelines”) is to provide guidance and assistance to supervised institutions that are DNFBPs, in order to assist their better understanding and effective performance of their statutory obligations under the legal and regulatory framework in force in the United Arab Emirates (“UAE” or “State”).

These Guidelines have been prepared as a joint effort between the Supervisory Authorities of the UAE, and set out the minimum expectations of the Supervisory Authorities regarding the factors that should be taken into consideration by each of the supervised institutions which fall under their respective jurisdictions, when identifying, assessing and mitigating the risks of money-laundering, the financing of terrorism, and the financing of illegal organisations.

Nothing in these Guidelines is intended to limit or otherwise circumscribe additional or supplementary guidance, circulars, notifications, memoranda, communications, or other forms of guidance or feedback, whether direct or indirect, which may be published on occasion by any of the Supervisory Authorities in respect of the supervised institutions which fall under their respective jurisdictions, or in respect of any specific supervised institution.

Finally, it should be noted that, except for a brief high-level overview of some key facts regarding the United Nations Targeted Financial Sanctions (TFS) regime, and the related Cabinet Decision No. (20) of 2019 Regarding Terrorism Lists Regulation and Implementation of UN Security Council Resolutions On the Suppression and Combating of Terrorism, Terrorists Financing & Proliferation of Weapons of Mass Destruction, and Related Resolutions included in Section 10, International Financial Sanctions, detailed guidance on the subject of TFS and other international financial sanctions programmes and restrictive measures which affect DNFBPs is outside of the scope of these Guidelines. Due to the significance, complexity and extent of the subject matter, it is more appropriate for this material to be covered in depth in separate guidance materials.

1.2 Applicability Unless otherwise noted, these Guidelines apply to all Designated Non-Financial Businesses and Professions, and the members of their boards of directors, management and employees, established and/or operating in the territory of the UAE and their respective

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

Financial and Commercial Free Zones, whether they establish or maintain a Business Relationship with a Customer, or engage in any of the financial activities and/or transactions or the trade and/or business activities outlined in Articles (2) and (3) of Cabinet Decision No. (10) of 2019 Concerning the Implementing Regulation of Decree Law No. (20) of 2018 On Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations.

Specifically, and without prejudice to the definition of a DNFBP as provided for in the relevant legislative and regulatory framework of the State (see Section 2.1, National Legislative and Regulatory Framework), they are applicable to all such natural and legal persons in the following categories:

• Auditors and accountants;

• Lawyers, notaries and other legal professionals and practitioners;

• Company and trust service providers;

• Dealers in precious metals and stones;

• Real estate agents and brokers;

• Any other Designated Non-Financial Businesses and Professions (DNFBPs) not mentioned above.

1.3 Legal Status Article 44.11 of Cabinet Decision No. (10) of 2019 Concerning the Implementing Regulation of Decree Law No. (20) of 2018 On Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations charges Supervisory Authorities with “providing…DNFBPs with guidelines and feedback to enhance the effectiveness of implementation of the Crime-combatting measures.”

As such, these Guidelines do not constitute additional legislation or regulation, and are not intended to set legal, regulatory, or judicial precedent. They are intended rather to be read in conjunction with the relevant laws, cabinet decisions, regulations and regulatory rulings which are currently in force in the UAE and their respective Free Zones, and supervised institutions are reminded that the Guidelines do not replace or supersede any legal or regulatory requirements or statutory obligations. In the event of a discrepancy between these Guidelines and the legal or regulatory frameworks currently in force, the latter will prevail. Specifically, nothing in these Guidelines should be interpreted as providing any explicit or implicit guarantee or assurance that the Supervisory or other Competent Authorities would defer, waive, or refrain from exercising their enforcement, judicial, or punitive powers in the event of a breach of the prevailing laws, regulations, or regulatory rulings.

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

These Guidelines, and any lists and/or examples provided in them, are not exhaustive and do not set limitations on the measures to be taken by supervised institutions in order to meet their statutory obligations under the legal and regulatory framework currently in force. As such, these Guidelines should not be construed as legal advice or legal interpretation. Supervised institutions should perform their own assessments of the manner in which they should meet their statutory obligations, and they should seek legal or other professional advice if they are unsure of the application of the legal or regulatory frameworks to their particular circumstances.

1.4 Organisation of the Guidelines These Guidelines are organized into five (5) parts, roughly corresponding to the following major themes:

§6.5 — Simplified Due Diligence (SDD) Measures

(AML-CFT Decision 4.3, 5, 10)

In keeping with a risk-based approach to customer due diligence, under certain circumstances and in the absence of the suspicion of criminal activity, DNFBPs are permitted to exercise simplified customer due diligence measures (SDD) with regard to customers identified as low-risk.

SDD generally involves a more lenient application of certain aspects of customer due diligence measures, including, but not limited to, such elements as:

• A reduction in verification requirements with regard to customer or Beneficial Owner identification;

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

• Fewer and less detailed inquiries in regard to the purpose of the Business Relationship, the nature of the customer’s business, the customer’s source of funds, and the purpose of individual transactions;

• More limited supervision of the Business Relationship, including less frequent monitoring of transactions, and less frequent review/updating of customer due diligence information.

Specifically, the AML-CFT Decision permits the application of SDD in the following circumstances:

• Identified low-risk customers. When the customer or Beneficial Owner is identified as posing a low risk of ML/FT, DNFBPs are permitted to complete the verification of their identity after the establishment of a Business Relationship under the conditions specified in the relevant provisions of the AML-CFT Decision. In this regard, supervised institutions are required to implement appropriate and effective measures to control the risks of ML/FT, including the risks in regard to the customer or Beneficial Owner benefitting from the Business Relationship prior to the completion of the verification process. Examples of such measures which supervised institutions may consider taking in this regard are, among others:

‒ Holding funds in suspense or in escrow until the identification verification is completed; ‒ Making the completion of identification verification a condition precedent to the closing of a transaction.

It should be noted that the provision allowing a relaxation of the timing for the completion of the identification verification procedures does not imply that DNFBPs are permitted to establish a Business Relationship without any customer identification at all. On the contrary, in all cases, the basic identification information in relation to the customer (whether a natural or legal person or arrangement) should be obtained; however under the specified conditions, supervised institutions are permitted to establish the Business Relationship prior to the completion of the verification process, which may include (but is not limited to) such steps as: obtaining appropriate supporting documentation, certifications or attestations, when necessary (for example, as regards the corporate documents of a legal person); or obtaining all the necessary information related to the relevant parties of a legal person or Legal Arrangement, such as Beneficial Owners, settlors, trustees or executors, protectors, beneficiaries, or other controlling persons.

• Listed companies. DNFBPs are exempted from identifying and verifying the identity of any shareholder, partner or Beneficial Owner of a legal person under the conditions specified in the relevant provisions of the AML-CFT Decision. Namely:

‒ When the relevant identity information is obtained from reliable sources; and ‒ When the customer, or the owner holding the controlling interest of the customer, is a company listed on a regulated stock exchange subject to adequate disclosure and

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

transparency requirements related to Beneficial Ownership; or when the customer, or the owner holding the controlling interest of a legal entity customer, is the majority-held subsidiary of such a listed company.

Without prejudice to the above, in the case of foreign stock exchanges, DNFBPs should consider taking steps to adequately assess and document the relevant disclosure and transparency requirements related to Beneficial Ownership, and to ensure that they are at least equivalent to those of the UAE.

As part of their overall AML/CFT framework, DNFBPs should consider using a risk-based approach to determine the internal policies, procedures and controls they implement in connection with the application of SDD procedures. Examples of the some of the factors they should consider include but are not limited to:

• Procedures and methodologies they implement in analysing and assessing the ML/FT risk of Business Relationships (see Section 4.5.3, Assessing Business Relationship Risk) and in assigning appropriate risk classifications, especially with regard to low-risk categories;

• Circumstances, timing, and composition in regard to the application of SDD measures;

• Frequency of reviews and updates in relation to customer SDD information;

• Extent and frequency of ongoing supervision of the Business Relationship and monitoring of transactions in relation to customers to which SDD measures are applied.

Such policies, procedures and methodologies should be reasonable and proportionate to the risks involved, and, in formulating them, supervised institutions should consider the results of both the NRA and their own enterprise-wide ML/FT risk assessments. Commensurate with the nature and size of the DNFBPs’ businesses, the policies, procedures and methodologies should also be documented, approved by senior management, and communicated at the appropriate levels of the organisation.

§6.6 — Reliance on a Third Party

(AML-CFT Decision 19)

Under certain conditions, the AML-CFT Decision permits DNFBPs to rely on third parties to undertake the required customer due-diligence measures, including those measures specifically laid out in regard to identified high-risk countries (see Section 6.4.3, Requirements for High-Risk Countries), with the responsibility for the validity of the measures resting directly with the supervised institutions. Among the conditions set forth in the AML-CFT Decision concerning the reliance on third parties, it is stipulated that DNFBPs shall:

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

“Ensure that the third party is regulated and supervised, and adheres to the CDD measures towards Customers and record-keeping provisions of the present Decision.”

In order to fulfil this obligation, DNFBPs that rely on third parties to undertake CDD measures on their behalf should implement adequate means, in keeping with the nature and size of their businesses, to ensure the third party’s adherence to the requirements of the AML-CFT Law and the AML-CFT Decision in relation to customer due-diligence measures. Examples of such means include, but are not limited to:

• Clearly defined procedures for determining the adequacy of a third-party’s CDD measures, including the evaluation of such factors as the comprehensiveness and quality of its policies, procedures and controls; the number of personnel dedicated to customer due-diligence; and its audit and/or quality assurance policies in regard to CDD. (In this regard, supervised institutions are advised that tools such as questionnaires, scorecards, and on-site visits may be useful in evaluating the adequacy of a third party’s adherence.)

• Service-level agreements, clearly setting out the roles and responsibilities of the parties and specifying the nature of the CDD and record-keeping requirements to be fulfilled.

• Protocols for the certification by third parties of documents and other records pertaining to the CDD measures undertaken.

In addition to the above, when relying on foreign third parties for the undertaking of CDD measures, DNFBPs should take steps to ensure that the AML/CFT regulatory and supervisory framework under which the third party operates is at least equivalent to that of the State.

Whichever methods are utilized to ensure the adherence of third parties to the statutory CDD and record-keeping requirements, supervised institutions should consider documenting and periodically reviewing them for effectiveness, as part of their overall framework of internal policies, procedures and controls. Furthermore, they should consider documenting the rationale for their assignment of relevant customer risk classifications, as well as their evaluation/analysis of the CDD records obtained from the third parties on which it is based.

Reliance on a third party refers to a DNFBP’s delegation to a third party of the entire CDD process, including the identification and verification of customers and Beneficial Owners, beneficiaries or controlling persons of legal entities or arrangements, as well as the investigation and assembly on behalf of the supervised institution of other relevant customer documents, information and data, as per the statutory CDD and record-keeping requirements.

For the purpose of this guidance, it is important to note that supervised institutions are expected to use documents, data or information from reliable and independent sources in

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

carrying out their CDD obligations, which include, among other things, verifying the identity of customers and Beneficial Owners, beneficiaries or controlling persons of legal entities or arrangements. Supervised institutions are reminded that simply obtaining CDD documents and supporting information from reliable and independent sources during the course of performing their own CDD procedures is not necessarily considered as reliance on a third party.

Reliable and independent sources may include, but are not necessarily limited to, official bodies such as Competent Authorities, governmental departments or agencies, governmental or state-sponsored business registries, public utilities or similar official enterprises; as well as non-official organisations, such as publicly accessible free or subscription information aggregation services, credit reporting agencies, and others.

Without prejudice to the above, on occasion DNFBPs that do not rely entirely on a third party for undertaking CDD measures on their behalf may, during the course of carrying out their own due-diligence procedures, receive certain documents, information or data from a third-party FI or DNFBP. In such cases, supervised institutions should consider obtaining evidence of the third party’s regulatory and supervisory status and good standing, and they should also consider obtaining the third party’s certification that any CDD documents provided by them (such as, but not limited to, identification documents, proof of address, or documents corroborating a customer’s source of funds) are true copies of the originals.

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

Part IV—AML/CFT Administration and Reporting

7. Suspicious Transaction Reporting (AML-CFT Law 9.1, 15, 30; AML-CFT Decision 16-18)

Under the AML/CFT legislative and regulatory framework of the UAE, all DNFBPs, with few exceptions (see Section 7.6, Specific Exemption from the Reporting Requirement), are obliged to report to the Financial Intelligence Unit (FIU) suspicious transactions (STRs) and any additional information required in relation to them, and also to maintain up-to-date indicators that can be used to identify the suspicion of a crime involving ML/FT.

In order to fulfil these obligations, supervised institutions should implement adequate internal policies, procedures and controls in relation to the identification and reporting of suspicious transactions. The following sub-sections provide additional guidance in this regard.

§7.1 — Role of the Financial Intelligence Department

(AML-CFT Law 9-10; AML-CFT Decision 13, 16, 17.1, 21.2 and 5, 40-43, 46.1-4, 49.2-3)

The FIU of the UAE is the Financial Intelligence Department of the Central Bank of the UAE. Established within the premises of the Central Bank, the FIU operates independently by legal and regulatory mandate as the central national agency with sole responsibility for performing the following functions:

• Receiving and analysing Suspicious Transactions Reports from FIs and DNFBPs, and disseminating the results of its analysis to the Competent Authorities of the State;

• Receiving and analysing reports of suspicious cases from the Federal Customs Authority;

• Requesting additional information and documents relating to STRs, or any other data or information it deems necessary to perform its duties, from FIs, DNFBPs, and Competent Authorities, including information relating to customs disclosures;

• Cooperating and coordinating with Supervisory Authorities by disseminating the outcomes of its analysis, specifically with respect to the quality of STRs, to ensure the compliance of FIs and DNFBPs with their statutory AML/CFT obligations;

• Sending data relating to STRs and the outcomes of its analyses and other relevant data, including information obtained from foreign FIUs, to national Law Enforcement Authorities, prosecutorial authorities and judiciary authorities when actions are required by those authorities in relation to a suspected crime;

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

• Exchanging information with its counterparts in other countries, with respect to STRs or any other information to which it has access.

Under the aegis of the National Committee for Combating Money Laundering and the Financing of Terrorism and Illegal Organisations, and for the effective performance of its functions, the FIU maintains operational protocols with numerous national and international Competent Authorities. The Competent Authorities with which the FIU has information- sharing mechanisms in place include, among others, the following (in alphabetical order):

• ADGM (Abu Dhabi Global Market);

• Abu Dhabi Police General Headquarters;

• Dubai Financial Services Authority (DIFC);

• Dubai Gold and Commodities Exchange (DGCX);

• Dubai International Financial Centre;

• Dubai Multi Commodities Centre (DMCC);

• Dubai Police General Headquarters;

• Federal Customs Authority;

• Securities and Commodities Authority;

• Sharjah Police General Directorate.

Additionally, the FIU has been a member of the Egmont Group of Financial Intelligence Units since 2002, and maintains operational protocols for the international exchange of information with at least 45 other Financial Intelligence Units from around the world.

The types of information which the Financial Intelligence Department exchanges with other national and international Competent Authorities include, among others:

• Database search enquiries;

• Search and Freeze requests;

• Requests pertaining to the implementation of UN Security Council Resolutions (see Section 10.1, Targeted Financial Sanctions);

• Mutual Legal Assistance requests with international law enforcement/judicial authorities.

The Financial Intelligence Department thus links the public and private sectors in combating money laundering, the financing of terrorism and illegal organisations, as well as the proliferation of weapons of mass destruction. It also provides training, technical assistance

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

and guidance on evolving standards and best practices to all stakeholders within the UAE for the strengthening of the country’s AML/CFT framework.

§7.2 — Processing of STRs by the FIU

(AML-CFT Law 9-10; AML-CFT Decision 42, 43.1-3, 49.3)

A core function of the FIU is to conduct operational analysis on STRs and information received from FIs, DNFBPs, as well as from Competent Authorities, and to support the investigations of Law Enforcement Authorities. It does so by identifying specific targets (such as persons, funds, or criminal networks) and by following the trail of specific transactions in order to determine the linkages between those targets and the possible proceeds of crime, money laundering, predicate offences and terrorist financing.

Upon the receipt of STRs or information from reporting institutions or other sources, the FIU assess the information, prioritises the risk, and performs its own analyses using a variety of information sources and analytical techniques. Examples of sources of information the FIU utilises include, but are not limited to:

• Sanctions screening software, such as World Check;

• Exchange Houses’ Remittance Reporting System;

• Central Bank’s customer accounts and transactional systems databases;

• Databases of Competent Authorities, including the Federal Customs Authority’s Cash Declaration System;

• Information received from foreign FIUs, Competent Authorities and/or Law Enforcement Authorities;

• Internet searches, media reports and other public information.

In certain cases, the FIU may request additional information from the reporting entity, Competent Authorities, or even from other supervised institutions which also have a business relationship with the subject of its analysis or investigation, through the Integrated Enquiries Management System (IEMS). Upon concluding its analysis or investigation, the FIU may disseminate information about the case to Law Enforcement Authorities or foreign FIUs, and may, at its own discretion, also provide feedback to the reporting entity in the form of instructions regarding required actions to be taken, or recommendations and guidance.

In addition to the above, the FIU also performs strategic analysis, using data aggregated from the STRs and other information it receives, including from national and international Competent Authorities and FIUs of other countries, to identify trends and patterns relating to ML/FT. As a result of this analysis, it may from time to time disseminate enhanced due

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

diligence and fraud alerts to DNFBPs as a preventive measure, and may also disseminate information to supervised institutions about prevalent or new and emerging ML/FT typologies, or other specific risks which DNFBPs should take into consideration.

§7.3 — Meaning of Suspicious Transaction

(AML-CFT Law 16; AML-CFT Decision 17.1)

Within the meaning of the AML-CFT Law and its implementing AML-CFT Decision, a suspicious transaction refers to any transaction, attempted transaction, or funds which a DNFBP has reasonable grounds to suspect as constituting—in whole or in part, and regardless of the amount or the timing—any of the following:

• The proceeds of crime (whether designated as a misdemeanour or felony, and whether committed within the State or in another country in which it is also a crime);

• Being related to the crimes of money laundering, the financing of terrorism, or the financing of illegal organisations;

• Being intended to be used in an activity related to such crimes.

It should be noted that the only requirement for a transaction to be considered as suspicious is “reasonable grounds” in relation to the conditions referenced above. Thus, the suspicious nature of a transaction can be inferred from certain information, including indicators, behavioural patterns, or customer due-diligence information, and it is not dependent on obtaining evidence that a predicate offence has actually occurred or on proving the illicit source of the proceeds involved.

DNFBPs should also note that transactions need not be in progress or pending completion in order to be considered as suspicious. Even past transactions, regardless of their timing or completion status, which are found upon review to cause reasonable grounds for suspicion, must be reported in accordance with the relevant requirements.

§7.4 — Identification of Suspicious Transactions

(AML-CFT Decision 16)

DNFBPs are obliged to put in place indicators that can be used to identify the suspicion of a crime involving ML/FT, and to update those indicators on an ongoing basis in accordance with the instructions of the Supervisory Authorities or the FIU, as well as in keeping with relevant developments concerning ML/FT typologies. Supervised institutions should also consider the results of both the NRA and their own ML/FT risk assessments in this regard.

As part of their overall AML/CFT framework, and commensurate with the nature and size of their businesses, supervised institutions should determine the internal policies, procedures and controls they apply in connection with the identification, implementation, and updating

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

of indicators, as well as with the identification and evaluation of potentially suspicious transactions. Some factors that should be considered include, but are not limited to:

• Organisational roles and responsibilities with respect to the implementation and review/updating of the relevant indicators, especially in relation to obligatory indicators required by the Supervisory Authorities or the FIU;

• Operational and IT systems procedures and controls in connection with the application of relevant indicators to processes such as transaction handling and monitoring, customer due diligence measures and review, and alert escalation;

• Staff training in relation to the identification and reporting of suspicious transactions (including attempted transactions), the appropriate use and assessment of the relevant indicators, and the degree and extent of internal investigation that is appropriate prior to the reporting of a suspicious transaction.

When identifying suspicious transactions, DNFBPs, and their management and employees, should be aware of the facts that, in relation to ML/FT crimes, there is no minimum threshold or monetary value for reporting, and that no amount or transaction size should be considered too small for suspicion. This is of particular significance where the crimes of the financing of terrorism and of illegal organisations is concerned, since typologies related to them may often involve very small amounts of money.

Furthermore, with the exception of obligatory indicators for which reporting is required by the relevant Supervisory Authorities or the FIU, DNFBPs should also note that the presence of an indicator of suspicion does not necessarily always mean that a transaction is suspicious and needs to be reported. When determining whether a transaction is suspicious, supervised institutions should give consideration to the nature of the specific circumstances, including the products or services involved, and the details of the customer in the context of its due diligence profile. In some cases, patterns of activity or behaviour that might be considered as suspicious in relation to a specific customer or a particular product type, might not be suspicious in regard to another. For this reason, clear internal policies and procedures with regard to alert escalation and internal suspicious transaction reporting are critical to an effective ML/FT risk-mitigation programme.

While it is impossible to list all the indicators of suspicion in these Guidelines, some useful links to sources of AML/CFT suspicious transaction indicators are provided in Appendix 11.2, Useful Links. A few examples of potentially suspicious transaction types that DNFBPs should take into consideration include:

• Transactions or series of transactions that appear to be unnecessarily complex, that making it difficult to identify the Beneficial Owner, or that do not appear to have a discernible economic rationale;

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

• Numbers, sizes, or types of transactions that appear to be inconsistent with the customer’s expected activity and/or previous activity;

• Transactions that appear to be far larger than a customer’s declared income or turnover;

• Large unexplained cash deposits and/or withdrawals, especially when they are inconsistent with the nature of the customer’s business;

• Changes in ownership of legal entities, real estate, or other high-value assets without a clear economic rationale, and/or involving third parties to the transaction whose source of funds is unclear or dubious, and/or with documentation that appears to lack substance or to be fraudulent or forged;

• Transactions involving payments to or from third parties whose relationship with the customer and/or whose source of funds is unclear or dubious;

• Transactions or business structures involving high-risk countries, including those involving “own funds” transfers, particularly in circumstances in which there are no clear reasons for the involvement of such locations;

• Situations in which customers cannot or will not clearly explain the source of funds for a business activity or transaction, or in which the explanation appears to lack credibility;

• Situations in which CDD measures cannot be performed, such as when the customers or Beneficial Owners refuse to provide customer due diligence documentation, or provide documentation that is false, misleading, fraudulent or forged.

§7.5 — Requirement to Report

(AML-CFT Law 9.1, 15, 24; AML-CFT Decision 13.2, 17.1, 20.2)

DNFBPs are obliged to report transactions to the FIU when there are suspicions, or reasonable grounds to suspect, that the proceeds are related to a crime, or to the attempt or intention to use funds or proceeds for the purpose of committing, concealing or benefitting from a crime. As previously noted, there is no minimum reporting threshold, and no statute of limitations with regard to ML/FT crimes or reporting of suspicious transactions.

Under federal law and regulations, whether the DNFBP operates in the mainland UAE or in a Financial or Commercial Free Zone, the designated Competent Authority for the reporting of suspicious transactions is the FIU.

Failure to report a suspicious transaction, whether intentionally or by gross negligence, is a federal crime. With the exception of the exemption described in Section 7.4, Specific Exemption from the Reporting Requirement below, any person, whether a Designated Non- Financial Business and Profession, or its managers and employees, who fails to perform their statutory obligation to report a suspicion of money laundering, or the financing of

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

terrorism or of illegal organisations, is liable to a fine of no less than AED100,000 and no more than AED1,000,000 and/or imprisonment.

§7.6 — Specific Exemption from the Reporting Requirement

(AML-CFT Law 15; AML-CFT Decision 17.2)

DNFBPs that are lawyers, notaries, other legal professionals, and independent legal auditors are exempted by the AML-CFT Law and AML-CFT Cabinet Decision from the statutory reporting obligation on the grounds of professional secrecy only under one specific condition.

When they have obtained information concerning the transactions during the course of:

“…(assessing) their Customers’ legal position, or defending or representing them before judiciary authorities or in arbitration, or providing legal opinion with regards to legal proceedings, including providing consultation concerning the initiation or avoidance of such proceedings, whether the information was obtained before or during the legal proceedings, or after their completion, or in other circumstances where such Customers are subject to professional secrecy.”

§7.7 — Procedures for the Reporting of Suspicious Transactions

(AML-CFT Law 9; AML-CFT Decision 17.1(a), 21.2)

As the designated Competent Authority for receiving and analysing STRs from all DNFPBs, it is within the purview of the FIU to determine the procedures for the reporting of suspicious transactions. As stated in the AML-CFT Decision, supervised institutions shall report STRs “via the electronic system of the FIU or by any other means approved by the FIU.” In this regard, the Financial Intelligence Department has established an online Suspicious Transaction Reporting System, which requires DNFBPs to choose from a list of suspicious indicators when filing a STR.

Without prejudice to the above, it should be noted that the AML-CFT Decision provides for the reporting of STRs to be effected by the AML/CFT compliance officer appointed by each DNFBP. Specifically, the Cabinet Decision states that the duty of a compliance officer is to:

“Review, scrutinise and study records, receive data concerning Suspicious Transactions, and take decisions to either notify the FIU or maintain the Transaction with the reasons for maintaining while maintaining complete confidentiality.”

In this regard, as part of their overall risk-based AML/CFT framework and commensurate with the nature and size of their businesses, DNFBPs should establish appropriate policies, procedures and controls pertaining to the internal reporting by their managers and employees of suspicious transactions, including the provision of the necessary records and

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

data, to the designated AML/CFT compliance officer for further analysis and reporting decisions, as well as to the reporting of STRs by the AML/CFT compliance officer to the FIU. The relevant policies, procedures and controls should take into consideration such factors as:

• Policies and procedures for the internal investigation of potentially suspicious transactions prior to the reporting of STRs;

• Conditions, timing, and methods for filing internal STRs;

• Content requirements and format of internal STRs;

• Appropriate controls for ensuring confidentiality and the protection of data from unauthorised access (also see Section 7.7, Confidentiality and Prohibition against “Tipping Off”);

• Procedures related to the provision of additional information, follow-up actions pertaining to the transactions, and the handling of Business Relationships after the filing of STRs;

• Policies and procedures for the analysis and decision-making of suspicious transactions by the AML/CFT compliance officer in regard to reporting to the FIU;

• Other conditions deemed appropriate by the AML/CFT compliance officer.

Such policies, procedures and controls should be documented, approved by senior management, and communicated to the appropriate levels of the organisation, in keeping with the nature and size of the supervised institution’s business.

§7.8 — Timing of Suspicious Transaction Reports (STRs)

(AML-CFT Law 9; AML-CFT Decision 17.1(a), 21.2)

DNFBPs are obliged to report STRs to the FIU “without any delay.” Since it is the responsibility of the designated AML/CFT compliance officer to “review, scrutinise and study records, receive data concerning suspicious transactions, and take decisions to either notify the FIU or maintain the transaction,” (see Section 8.1, Compliance Officer) it follows that the time period for reporting STRs to the FIU begins at the moment a decision is made by the designated AML/CFT compliance officer that a transaction (whether pending, in progress, or past) is suspicious. Likewise, it also follows that the internal reporting of suspicious transactions to the AML/CFT compliance officer should be done “without any delay,” as soon as a suspicion or reasonable grounds for suspicion are established.

Without prejudice to the above, supervised institutions should note that, with the exception of any obligatory indicators for which immediate reporting to the FIU is required by the relevant Competent Authorities (for example, a positive match of a customer with regard to Targeted Financial Sanctions), some potentially suspicious transactions or indicators of

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

suspicion may require a degree of internal investigation before a suspicion or reasonable grounds for suspicion are established and an internal STR is reported to the designated AML/CFT compliance officer. In this regard, and commensurate with the nature and size of their businesses, DNFBPs should establish clear policies, procedures and staff training programmes pertaining to the identification and internal reporting of suspicious transactions (including attempted transactions), and the degree and extent of investigations that are appropriate prior to the internal reporting of a suspicious transaction (also see Section 7.2, Identification of Suspicious Transactions). These policies and procedures should be documented, approved by senior management, and communicated to the appropriate levels of the organisation.

§7.9 — Confidentiality and Prohibition against “Tipping Off”

(AML-CFT Law 25; AML-CFT Decision 17.2, 21.2, 31.3, 39)

When reporting suspicious transactions to the FIU, DNFSBs are obliged to maintain confidentiality with regard to both the information being reported and to the act of reporting itself, and to make reasonable efforts to ensure the information and data reported are protected from access by any unauthorized person.

As part of their risk-based AML/CFT framework, and in keeping with the nature and size of their businesses, DNFBPs, and their foreign branches or group affiliates where applicable, should establish adequate policies, procedures and controls to ensure the confidentiality and protection of information and data related to STRs. These policies, procedures and controls should be documented, approved by senior management, and communicated to the appropriate levels of the organisation.

It should be noted that the confidentiality requirement does not pertain to communication within the supervised institution or its affiliated group members (foreign branches, subsidiaries, or parent company) for the purpose of sharing information relevant to the identification, prevention or reporting of suspicious transactions and/or crimes related to ML/FT.

It is a federal crime for DNFBPs, or their managers, employees or representatives, to inform a customer or any other person, whether directly or indirectly, that a report has been made or will be made, or of the information or data contained in the report, or that an investigation is under way concerning the transaction. Any person violating this prohibition is liable to a penalty of no less than AED100,000 and no more than AED500,000 and imprisonment for a term of not less than six months.

§7.10 — Protection against Liability for Reporting Persons

(AML-CFT Law 27; AML-CFT Decision 17.3)

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

DNFBPs, as well as their board members, employees and authorised representatives are protected by the relevant articles of the AML-CFT Law and AML-CFT Decision from any administrative, civil or criminal liability resulting from their good-faith performance of their statutory obligation to report suspicious activity to the FIU. However, it should be noted that such protections do not extend to the unlawful disclosure to the customer or any other person, whether directly or indirectly, that they have reported or intend to report a suspicious transaction, or of the information or data the report contains, or that an investigation is being conducted in relation to the transaction.

§7.11 — Handling of Transactions and Business Relationships after Filing of STRs

Once a Suspicious Transaction or other suspicious information related to a Customer or Business Relationship has been reported to the FIU, there are two immediate consequences:

• DNFBPs are obliged to follow the instructions, if any, of the FIU in relation to both the specific transaction and to the business relationship in general.

• The Customer or Business Relationship should immediately be classified as a High Risk Customer and appropriate risk-based enhanced due diligence and ongoing monitoring procedures should be implemented in order to mitigate the associated ML/FT risks (see Sections 6.4, Enhanced Due Diligence (EDD) Measures, especially 6.4.2, EDD Measures for High-Risk Customers or Transactions, and 6.3.5 Ongoing Monitoring of the Business Relationship).

Further guidance on both of these topics is provided below.

FIU Instructions

After receiving a STR from a DNFBP, the Financial Intelligence Department may or may not revert to the reporting institution with specific instructions, requests for additional information, feedback or further guidance related to the Suspicious Transaction or to the business relationship in general. In such cases, these communications will generally be directed to the designated AML/CFT compliance officer of the supervised institution. Examples of the types of instructions or requests which the FIU may issue to a reporting institution include, but are not limited to:

• Instructions to reject the transaction;

• Instructions to allow the transaction to proceed (for example, as in cases of Controlled Delivery of Funds in order to allow them to be traced by the Competent Authorities);

• Instructions related to the seizure or freezing of Funds or other assets related to the Customer;

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

• Instructions to terminate the business relationship;

• Instructions to maintain and monitor the business relationship, and periodically or conditionally report activities related to it to the FIU and/or other Competent Authorities;

• Requests for additional information about the reported transaction, other transactions related to the customer, or about the business relationship in general.

Confidentiality of FIU’s Instructions

The responsibility for coordinating the supervised institution’s prompt compliance with the FIU’s instructions or requests lies with the designated AML/CFT compliance officer. It should be noted that, depending on the nature of the case, the FIU may require the compliance officer to maintain certain information related to its instructions or requests privileged and/or confidential within the supervised institution’s organisation. In other words, in some cases, the AML/CFT compliance officer could be restricted from divulging information about a transaction or business relationship to anyone other than certain members of senior management or the board of directors of the supervised institution. Regardless of the circumstances surrounding the FIU’s instructions or requests, including whether or not the compliance officer is permitted to provide explanations to the staff of the supervised institution, the DNFBP is obliged at all times to follow the AML/CFT compliance officer’s instructions in regard to any follow-up actions required in relation to a STR.

Timing of FIU’s Instructions

Whether or not the FIU issues instructions or requests for additional information to a reporting institution, or how quickly this may occur after the STR is initially reported, both depend on numerous factors. These may include the prioritisation of the incoming STR among all of the STRs received by the FIU, the results of the ensuing analysis, or the possible need for information to be exchanged with other Competent Authorities or international FIUs, as well as the timing and the results of such exchanges.

When a STR involves an anticipated, pending, or already in-progress transaction, DNFBPs should use their best efforts to delay the execution or completion of the transaction, in order to allow for a reasonable amount of time in which to receive feedback, instructions, or additional information requests from the FIU. In taking such measures, supervised institutions should take the necessary steps to avoid “tipping off” or arousing the customer’s suspicion that the transaction is being investigated or reported. Examples of some of the measures DNFBPs may consider taking, either singly or in combination, in order to delay the execution or completion of transactions include but are not limited to:

• Delaying processing of the transaction without explanation for as long as possible;

• Advising the customer that the transaction has been delayed due to an unspecified operational, technical, staff or other problem, and that efforts are underway to resolve it;

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

• Requesting additional information and/or supporting documentation (for example, evidence of relevant licences or authorisations, shipping or customs documents, additional identification documents, bank or other references) relating to the transaction, the customer, or the counterparty;

• Advising the customer that paperwork related to the transaction has been lost and requesting that it be resubmitted;

• Advising the customer that the transaction is pending an internal approval process;

• Any other reasonable delaying tactics, bearing in mind the obligation to avoid “tipping off” the customer.

During the time interval during which an anticipated, pending, or in-progress Suspicious Transaction that has already been reported to the FIU is being delayed by the supervised institution, any additional suspicions that may arise should also be reported to the FIU as a follow-up to the original STR. Examples of such additional suspicions may include, but are not limited to:

• New adverse information obtained in relation to the transaction, the business relationship, or the counterparty to the transaction;

• Unusual behaviour of the customer as a result of the transaction being delayed, such as but not limited to:

‒ Sudden material amendments or changes to the circumstances or details of the transaction;

‒ Excessive pressure, intimidation, displays of anger (beyond what would normally be expected) or threats of any kind, aimed at forcing the DNFBP or its employees to complete the transaction;

‒ Abrupt cancellation of the transaction, termination of the business relationship, or sudden attempts to withdraw or obtain a refund of the balance of deposits, funds or other assets held by the supervised institution;

‒ Any other indication or reasonable grounds to suspect that the customer has become aware that the transaction is being investigated or reported as suspicious.

If a reasonable amount of time has not yet elapsed before the receipt of feedback, instructions, or requests for additional information from the FIU in regard to a STR, and it becomes impossible for the DNFPB to delay the execution or completion of the reported transaction any longer without arousing the customer’s suspicion that the transaction is being investigated or reported, then the supervised institution should request specific instructions or permission from the FIU in regard to executing or rejecting the transaction.

No Instructions, Feedback or Additional Information Requests from the FIU

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

Due to the factors previously mentioned, DNFBPs may not receive instructions, additional information requests, or other feedback from the FIU in regard to STRs that have been filed; or the receipt of such communications may be delayed beyond what they consider to be a reasonable time period. In such instances, supervised institutions should determine the appropriate handling of the Suspicious Transaction and of the business relationship in general, taking into consideration all of the risk factors involved.

In particular, DNFBPs are reminded that, unless they are specifically instructed by the FIU to do so, they are under no obligation to carry out transactions they suspect, or have reasonable grounds to suspect, of being related to a Crime. Furthermore, unless they are specifically instructed by the FIU to maintain the business relationship (for example, so that the Competent Authorities may monitor the customer’s activity), supervised institutions should take appropriate steps in order to decide whether or not to maintain the business relationship. These steps may include, but are not limited to:

• Reassessing the business relationship risk;

• Initiating an enhanced customer due diligence review;

• Considering the performance of an enhanced background investigation (including, if appropriate, the use of a third-party investigation service);

• Any other reasonable steps, commensurate with the nature and size of their businesses, and bearing in mind the obligation to avoid “tipping off” the customer.

When deciding to terminate a business relationship for which a STR has been filed and no feedback has been received from the FIU after a reasonable time period, DNFBPs should consider formally advising the FIU of their intention to do so unless there is an official objection. In such cases, they should once again allow for a reasonable time period to receive feedback from the FIU, before initiating procedures to terminate the business relationship.

Reasonable Time Period for Receiving Feedback from the FIU

DNFBPs should note that there are no pre-established processing times, and no statute of limitations, in regard to the time interval during which the FIU may provide feedback, including instructions or requests for additional information in response to a STR. Furthermore, the time period that may be considered reasonable in relation to such feedback depends on numerous factors, including but not limited to the:

• Type, size and circumstances of the transaction;

• Normal average processing times for the specific transaction type;

• Type of customer or business relationship;

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

• Nature and size of the supervised institution’s business;

• Precise nature of the suspicion.

The time period considered to be reasonable could thus vary widely from one case to another.

As a general guideline, the reasonable time periods for feedback from the FIU concerning transaction types that are less complex, more routine, and have faster average processing times (such as an over-the-counter purchases of precious metals or gemstones, for example) would normally be expected to be shorter than those for more complex, less routine transaction types (such as, for example, sales or purchases of legal entities, real estate or other complex assets, or establishing a legal entity or legal arrangement). DNFBPs that require further assistance in determining reasonable time periods should consult with the FIU or the relevant Supervisory Authorities.

High-Risk Classification of Reported Business Relationships

When a transaction or other information about a business relationship is reported to the FIU as suspicious, it means that, by definition, the customer or business relationship to which it pertains should be classified as high risk. In situations in which no feedback or instructions have been received from the FIU (and, in particular, no specific instructions to terminate the business relationship have been received), DNFBPs that determine to maintain the business relationship should, commensurate with the nature and size of their businesses:

• Document the process by which the decision was made to maintain the business relationship, along with the rationale for, and any conditions related to, the decision;

• Implement adequate EDD measures to manage and mitigate the ML/FT risks associated with the business relationship.

In such cases, beyond the EDD measures described in previous sections (see Sections 6.4, Enhanced Due Diligence (EDD) Measures and 6.3.5 Ongoing Monitoring of the Business Relationship), DNFBPs should also consider implementing additional control measures such as, but not limited to:

• Requiring additional data, information or documents from the customer in order to carry out transactions (for example, evidence of relevant licences or authorisations, customs documents, additional identification documents, bank or other references);

• Restricting the customer’s use of certain products or services;

• Placing restrictions and/or additional approval requirements on the processing of the customer’s transactions (for example, transaction size and/or volume limits, or limits to

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

the number of transactions of certain types that can be executed during a given time period).

DNFBPs should also consider documenting the specific EDD, ongoing monitoring, and additional control measures to be taken in the form of an action plan. In this regard, supervised institutions should consider obtaining senior management approval for the plan, including its specific conditions, duration and any requirements for its removal, as well as the roles and responsibilities for its implementation, monitoring and reporting, commensurate with the nature and degree of the ML/FT risks associated with the business relationship.

8. Governance (AML-CFT Law 16.1(d); AML-CFT Decision 4.2(a), 20, 21, 44.4)

In order for the AML/CFT framework of any organisation to be effective, it must be based on the foundation of a sound governance structure, and held together by a strong compliance culture. These include appropriate management structures which are accountable for clear ML/FT risk management and mitigation measures, as well as appropriate independent control functions. Implicit in both the AML-CFT Law and the AML-CFT Decision are the elements of both, concerning which additional guidance is provided in the sections below.

§8.1 — Compliance Officer (CO)

(AML-CFT Decision 20.3, 21 and 44.12)

8.1.1 Appointment and Approval DNFBPs are obliged to appoint an AML/CFT compliance officer with the appropriate competencies and experience to perform the statutory duties and responsibilities associated with this role. The AML-CFT Decision stipulates that the AML/CFT compliance officer (“CO”) performs these duties “under his or her own responsibility”, referring to the independent nature of the function, and further provides that the appointment of a person to the position of compliance officer requires the prior consent of the relevant Supervisory Authority.

In determining the competencies, level of experience, and organizational reporting structures that are appropriate for their compliance officers, DNFBPs should take several factors into consideration, including but not limited to:

• The results of the NRA;

• The nature, size, complexity, and risk profile of their industries and businesses, as well as those associated with the products and services they offer and the markets and customer segments they serve;

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

• The organisation’s governance framework and management structure, with particular consideration given to the independent nature of compliance as a control function;

• The specific duties and responsibilities of the CO role (described below).

Where appropriate, DNFBPs may also consider engaging in dialogue with Supervisory Authorities, professional associations in their sectors, and industry peers, in relation to the competencies, experience, and governance structures that make for an effective AML/CFT compliance officer and an effective AML/CFT programme.

8.1.2 Responsibilities (AML-CFT Decision 21.1-5)

The specific duties of the compliance officer are detailed in the relevant provisions of the AML-CFT Decision. These duties can be grouped broadly into the following categories:

• ML/FT Reporting. The AML/CFT compliance officer is the supervised institution’s suspicious transaction reporting officer. In this capacity, the CO is ultimately responsible for the detection of transactions related to the crimes of money laundering and the financing of terrorism and of illegal organisations, for reporting suspicions to the FIU, and for cooperating with the Competent Authorities in relation to the performance of their duties in regard to AML/CFT.

• AML/CFT Programme Management. The CO should ensure the quality, strength and effectiveness of the supervised institution’s AML/CFT programme. As such, the AML/CFT compliance officer should be a stakeholder with respect to the FI’s and DNFBP’s overarching ML/FT risk policies, risk assessment procedures and controls, and ML/FT risk mitigation framework, including its customer due diligence measures.

• AML/CFT Training and Development. The CO is responsible for helping to establish and maintain a strong and effective AML/CFT compliance culture within the DNFBP. This duty includes working with senior management and other internal and external stakeholders to ensure that the organisation’s staff are well-qualified, well-trained, well- equipped, and well-aware of their responsibility to combat the threat posed by ML/FT.

§8.2 — Staff Screening and Training

(AML-CFT Decision 20.4-5, 21.4)

In order for their ML/FT risk assessment and mitigation measures to be effective, DNFBPs should ensure that their employees have a clear understanding of the risks involved and can exercise sound judgment, both when adhering to the organisation’s ML/FT risk mitigation measures and when identifying suspicious transactions. Furthermore, due to the ever-evolving nature of ML/FT risk, supervised institutions should ensure that their

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

employees are kept up to date on an ongoing basis in relation to emerging ML/FT typologies and new internal and external risks.

Thus, to ensure a high level of competence and AML/CFT programme effectiveness, DNFBPs should formulate and implement appropriate policies, procedures and controls with regard to staff screening and training. These measures should be applied across organisations and financial groups, including their foreign branches and majority-owned subsidiaries. Examples of some of the factors that should be considered when determining appropriate staff screening and training measures include, but are not limited to:

• The results of the NRA;

• The nature, size, complexity, and risk profile of DNFBPs’ industries and businesses, as well as those associated with the products and services they offer and the markets and customer segments they serve;

• Effective screening and selection methods in relation the AML/CFT cultural compatibility of their employment candidates;

• Assessment of staff AML/CFT competency in relation to training and development needs;

• The type, frequency, structure, content, and delivery channels of AML/CFT training programmes and development opportunities;

• The effective identification, deployment and management of both internal and external training resources;

• Appropriate methods and tools for assessing the effectiveness of staff hiring, training, and development programmes.

§8.3 — Group Oversight

(AML-CFT Decision 20, 31, 32)

DNFBPs are obliged to implement appropriate group-wide AML/CFT programmes, and to apply them in relation to all their branches and majority-owned subsidiaries. The specific requirements that must be met by DNFBPs with respect to their foreign branches and majority-owned subsidiaries are set out in the relevant provisions of the AML-CFT Decision, and reflect those to which supervised institutions are subject within the State.

In meeting these obligations with regard to their branches and majority-owned subsidiaries in foreign countries, supervised institutions should ensure that the measures they apply are consistent with the requirements of the AML-CFT Law and AML-CFT Decision. In this regard, DNFBPs should establish appropriate policies and procedures for the exchange of data and information, including customer CDD and transaction-related information, between the foreign branches and subsidiaries and the head office, for the purpose of combating the

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

crimes of money laundering and the financing of terrorism and of illegal organisations, and for reporting suspicious transactions.

In situations where these measures are not possible due to legislative or regulatory restrictions in the foreign countries in which their branches and majority-owned subsidiaries operate, DNFBPs should implement the necessary additional measures, commensurate with the nature and size of their businesses, that will enable them to manage and mitigate appropriately the ML/FT risks that relate to their foreign operations. Examples of some of the measures that should be considered include but are not limited to:

• Assessing the effectiveness of foreign branches and majority-owned subsidiaries’ CDD measures, including evaluating such factors as the comprehensiveness and quality of their policies, procedures and controls, and performing gap analyses in relation to the requirements of the AML-CFT Law and AML-CFT Decision;

• Establishing clear policies, procedures and controls in relation to the type and extent of access which managers and employees of foreign branches and majority-owned subsidiaries have to the supervised institutions’ IT and operational systems, including transaction processing systems;

• Establishing clear policies, procedures and controls in relation to the type and extent of access which customers and Business Relationships of foreign branches and majority- owned subsidiaries have to the supervised institutions’ products, services and transactional processing capabilities;

• Establishing clear policies, procedures and controls in relation to the type of CDD and transaction-related information, data, and analysis supervised institutions accept from their foreign branches and majority-owned subsidiaries in relation to customer or Business Relationship referrals, and the extent of their reliance on such information (see Section 6.6, Reliance on a Third Party);

• Implementing service-level agreements, clearly setting out the roles and responsibilities of the parties and specifying the nature of the CDD and record-keeping requirements to be fulfilled in relation to customer or Business Relationship referrals;

• Establishing protocols for the certification by the foreign branches and subsidiaries of documents and other records pertaining to the CDD measures undertaken in relation to customer or Business Relationship referrals.

In particular, in cases in which the minimum AML/CFT requirements of host countries in which DNFBPs maintain foreign operations are less strict than those of the State, supervised institutions should take the necessary measures to ensure that their foreign branches and/or majority-owned subsidiaries in those countries implement the requirements of the State, to the extent permitted by the laws and regulations of the host

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

countries. If such host countries do not permit the proper implementation of the AML/CFT requirements of the State, DNFBPs should apply appropriate additional measures to manage and mitigate the ML/FT risks (including but not limited to those described above). They should also inform the relevant Supervisory Authorities of the circumstances and comply with any additional supervisory actions, controls, or requirements of the Competent Authorities of the State (up to and including, if requested, terminating their operations in the host countries).

§8.4 — Independent Audit Function

(AML-CFT Decision 20.6)

A robust and independent audit function is a key component to a well-functioning governance structure and an effective AML/CFT framework. DNFBPs are obliged to have in place an independent audit function to test the effectiveness and adequacy of their internal polices, controls and procedures relating to combating the crimes of money laundering and the financing of terrorism and of illegal organisations. In this regard, DNFBPs should ensure that their independent audit function is appropriately staffed and organised, and that it has the requisite competencies and experience to carry out its responsibilities effectively, commensurate with the ML/FT risks to which the supervised institutions are exposed, and with the nature and size of their businesses.

It should be noted that, depending on the nature and size of their businesses, some DNFBPs (particularly smaller ones) may not necessarily have the resources to maintain a fully functioning and effective internal audit unit. In such cases, those supervised institutions should ensure that they take adequate measures to obtain the necessary capabilities from qualified external sources. They should also ensure that they have in place adequate internal capabilities to provide sufficient coordination with and oversight of any external resources they may utilise, and that such external resources are adequately regulated and supervised by relevant Competent Authorities.

DNFBPs should ensure that the periodic inspection and testing of all aspects of their AML/CFT compliance programmes, including ML/FT risk assessment and mitigation measures, and customer due diligence policies, procedures and controls, is incorporated into their regular audit plans. They should also ensure that all their branches and the subsidiaries in which they hold a majority interest, whether domestic or foreign, are part of an independent audit testing programme that covers the effectiveness and adequacy of their internal AML/CFT polices, controls and procedures.

Some of the factors supervised institutions should consider in determining the appropriate frequency and extent of audit testing of their AML/CFT programmes by their independent audit functions include but are not limited to:

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

• The results of the NRA;

• The nature, size, complexity, and geographic scope of the DNFBPs’ businesses, and the results of their enterprise risk assessments;

• The risk profile associated with the products and services they offer and the markets and customer segments they serve;

• The frequency of supervision and inspection by, and the nature of the feedback (including the imposition of administrative sanctions) they receive from, Supervisory Authorities, relative to enhancing the effectiveness of their AML/CFT measures;

• Internal and external developments in relation to ML/FT risks, as well as developments pertaining to the management and operations of the supervised institutions.

§8.5 — Responsibilities of Senior Management

(AML-CFT Decision 4.2(a), 4.2(b)(5), 8.1(a), 15.1(b) and 15.2, 17.3, 21.3, 25.1(d))

A cornerstone of any sound governance structure, including those related to AML/CFT compliance, is senior management involvement and accountability. The members of a DNFBP’s senior management (together with the members of the board of directors in those organisations that have one) are ultimately responsible for the quality, strength and effectiveness of the supervised institution’s AML/CFT framework, as well as for the robustness of its compliance culture. In this regard, a supervised institution’s senior management should set the so-called “tone at the top,” by demonstrating their commitment to ensuring an effective AML/CFT compliance programme is in place, and by clearly articulating their expectations with regard to the responsibilities and accountability of all staff members in relation to it.

Under the AML/CFT legal and regulatory framework of the United Arab Emirates, the senior management all DNFBPs are responsible for performing certain functions related to the assessment, management and mitigation of the ML/FT risks to which their organisations are exposed. These responsibilities can be grouped broadly into categories which include:

• Implementation of governance, control, and operating systems. These include such elements as:

‒ Appointing a qualified AML/CFT compliance officer who is approved by the relevant Supervisory Authority;

‒ Ensuring a robust and effective independent audit function is in place; ‒ Putting in place and monitoring the implementation of adequate management and information systems, internal controls, and policies, procedures to mitigate risks.

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

• Approval of internal policies, procedures and controls. These include such elements as the supervised institution’s policies on overall ML/FT risk appetite and customer acceptance, as well as the framework of AML/CFT policies, procedures and controls related to areas such as:

‒ Identification, assessment, understanding, and management/mitigation of ML/FT risks; ‒ Performance, review and updating of customer due-diligence (including enhanced and simplified due-diligence) measures;

‒ Identification and implementation of indictors to identify suspicious transactions; ‒ Record retention and data protection;

‒ Staff screening, training and development.

• Oversight of the AML/CFT compliance programme. This includes such elements as:

‒ Reviewing and providing comments in relation to the AML/CFT compliance officer’s semi-annual reports to the relevant Supervisory Authority;

‒ Approving the establishment and continuance of High Risk Customer Business Relationships and their associated transactions, including those with PEPs; ‒ Approving the establishment and continuance of Business Relationships involving high-risk countries;

‒ Approving the establishment and continuance of relationships with correspondent banks;

‒ Ensuring the adequate application of the appropriate components of the AML/CFT compliance programme to all branches and majority-owned subsidiaries, including those operating in foreign jurisdictions.

• Application of the directives of Competent Authorities. This includes such elements as:

‒ Applying the directives of Competent Authorities for implementing UN Security Council decisions under Chapter VII of the Charer of the United Nations, and other related directives (see Section 10, International Financial Sanctions);

‒ Implementing CDD measures defined by the National Committee for Combating Money Laundering and the Financing of Terrorism and Illegal Organisations, regarding High Risk Countries;

‒ Implementing all other directives of the relevant Competent Authorities of the State, including Cabinet Decision (20) of 2019 Regarding Terrorism Lists Regulation and Implementation of UN Security Council Resolutions On the Suppression and Combating of Terrorism, Terrorists Financing & Proliferation of Weapons of Mass Destruction, and Related Resolutions (see Section 10, International Financial Sanctions), which may enter into effect from time to time.

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

§8.6 — Governance Issues with respect to Small Organisations

Some DNFBPs may operate as small or mid-sized businesses, without large staff organisations or sophisticated IT infrastructures. In such cases, individual managers and employees may often be called upon to undertake multiple roles and responsibilities in the course of day-to-day business activities, and it may be difficult at times to maintain a clear separation of duties or functions. While a supervised institution’s small size does not in any way exempt it from fulfilling its obligations under the AML-CFT Law and AML-CFT Decision, and without prejudice to guidance provided in the previous sections, the following additional considerations are of particular importance to small and mid-sized DNFBPs.

• In situations in which the responsibilities of the AML/CFT compliance officer are delegated to a manager or staff member who also has other responsibilities, DNFBPs should undertake their best efforts to ensure that the designated AML/CFT compliance officer does not have day-to-day responsibility for sales and/or customer business relationship management.

• When an adequate separation of responsibilities is not possible due to the small size of a DNFBP’s organisation, supervised institutions should take the necessary steps to ensure that operational and AML/CFT policies and procedures (particularly those pertaining to Customer Due Diligence, the identification of Suspicious Transactions, and the monitoring and updating of required High Risk Country CDD measures, and Local and Sanctions Lists—see Sections 6, Customer Due Diligence (CDD), 6.4.3 Requirements for High-Risk Countries, and 10, International Financial Sanctions) are clearly formulated, documented, and adhered to during the establishment and ongoing monitoring of business relationships and the carrying out of transactions.

• In such cases, DNFBPs should ensure that they clearly document the rationale for any policy and/or procedural exceptions they make, along with any additional ML/FT risk- mitigation measures they implement, and that these records are properly retained in accordance with the statutory record-keeping requirements (see Section 9, Record Keeping). Supervised institutions should also consider referring to any significant policy or procedural exceptions, along with their rationale, associated additional ML/FT risk- mitigation measures, and senior management comments, in the AML/CFT compliance officer’s required semi-annual reports to the relevant Supervisory Authorities.

• DNFBPs that are unable to ensure a clear and effective separation of AML/CFT responsibilities from those related to the day-to-day management of their businesses, including but not limited to sales and customer business relationship management functions, due to the small size of their organisations should also consider taking additional measures to enhance the application of their independent audit controls (see Section 8.4, Independent Audit Function). Examples of such measures include but are not limited to:

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

‒ Incorporating the audit of policies, procedures (particularly those pertaining to Customer Due Diligence, the identification of Suspicious Transactions, and the monitoring and updating of required High Risk Country CDD measures, and Local and Sanctions Lists), and records related to exceptions made to them, as part of their audit plans and/or their service-level agreements with their external providers of independent audit services;

‒ Increasing the frequency of independent audits and random audit inspections; ‒ Applying stricter criteria with regard to the review of past transactions, such as increasing the number of transactions reviewed for a given time period, reducing size threshold limits for transactions to be reviewed, or taking other reasonable measures in this regard.

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

9. Record Keeping

§9.1 — Obligations and Timeframe for the Retention and Availability of Records

(AML-CFT Law 16.1(a),(f); AML-CFT Decision 7.2, 24, 36, 37.3)

DNFBPs are obliged to maintain detailed records, documents, data and statistics for all financial transaction types, as well as a variety of record types and documents associated with their ML/FT risk assessment and mitigation measures, as specified in the relevant provisions of the AML-CFT Decision (see Section 9.2, Required Record Types). Supervised institutions are required to maintain the records in an organised fashion so as to permit data analysis and the tracking of financial transactions, and to make the records available to the Competent Authorities immediately upon request.

The statutory retention period for all records is at least five (5) years, depending on the circumstances, from the date of the most recent of any of the following events:

• Termination of the Business Relationship or the closing of a customer’s account with the supervised institution;

• Completion of a casual transaction (in respect of a customer with whom no Business Relationship is established);

• Completion of an inspection of the records by the Supervisory Authorities;

• The issue date of a final judgment by the competent judicial authorities;

• Liquidation, dissolution, or other form of termination of a legal person or arrangement.

Without prejudice to the above, DNFBPs should note that it is the prerogative of the Competent Authorities to require the retention of the records of any supervised institution, whether data, statistics, or records pertaining to a specific customer or transaction or to general categories of customers or transactions which they deemed to be of interest, for a longer period of time at their own discretion.

In order to fulfil their record-keeping obligations, and commensurate with the nature and size of their businesses, DNFBPs should determine the appropriate policies, procedures and controls related to the adequate retention, organisation, and maintenance of records. The policies, procedures and controls should be documented, approved by senior management, and communicated to appropriate levels of the organisation. Examples of the factors which DNFBPs should give consideration to when formulating the relevant policies, procedures and controls, include but are not limited to:

• Organisational roles and responsibilities in regard to the risk assessment, implementation, review and updating of policies, procedures and controls related to

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

record-keeping and data protection, including appropriate business contingency and escalation procedures;

• Organisational roles and responsibilities in relation to record-keeping (including logging, cataloguing and organisation, archiving, handling and transferring of records and documents, as well as of the destruction of expired records);

• Physical and cyber security, and the protection of active and archived data and records from unauthorised access;

• Appropriate audit and quality assurance testing policies.

§9.2 — Required Record Types

(AML-CFT Law 16.1(a),(b),(f); AML-CFT Decision 7.2, 24)

The AML-CFT Law and AML-CFT Decision oblige DNFBPs to retain several types of records, which can be classified broadly into the following categories:

• Financial Transaction Records. This category relates to operational and statistical records, documents and information concerning all financial transactions executed or processed by the supervised institution, whether domestic or international in nature.

• CDD Records. This category relates to records, documents, and information about customers, their due diligence, and the investigation and analysis of their activities, and can be further divided into sub-categories such as records pertaining to:

‒ Customer Information ‒ Company Information ‒ Reliance on Third Parties to Undertake CDD ‒ Ongoing Monitoring of Business Relationships ‒ Suspicious Transaction Reports (STRs)

Additional guidance related to these record types is provided in the following sub-sections.

9.2.1 Financial Transactions (AML-CFT Law 16.1(f); AML-CFT Decision 24.1-3, 28.1-2, 29.4)

DNFBPs are obliged to retain the operational and statistical records, documents and information concerning all financial transactions executed or processed by the supervised institution, whether domestic or international in nature, and irrespective of the type of customer and whether or not a Business Relationship is maintained, for a minimum period of five (5) years. Some examples of the type of records, documents and information which must be retained include but are not limited to:

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

• Customer correspondence, requests or order forms related to the initiation and performance of all types of transactions;

• Customer payment advices, receipts, invoices, billing notifications, bills of exchange, statements of account, expense reimbursement requests or notifications;

• Credit-related correspondence and documentation, including those involving accounts receivable, cash advances or advance settlements, promissory notes, loans or guarantees and their amendments and supporting documents, disbursement or repayment records, collateral pledges, or any other form of customer credit;

• Deal tickets, trade blotters and ledgers, settlement and dividend payment records related to customer funds managed, legal structures or arrangements, or any other forms of asset trades or exchanges;

• Escrow or fiduciary account transaction records;

• Sale, purchase, lease, merger-acquisition, and similar agreements;

• Statistics and analytical data related to customers’ financial transactions, including their monetary values, volumes, currencies, interest rates, and other information.

In addition to the above, DNFBPs should compile notes on any particularly large or unusual transactions, and keep these notes as part of their records.

9.2.2 Customer Information (AML-CFT Law 16.1(b); AML-CFT Decision 24.2-4, 27.7, 28.1-2, 29.4, 37.1-3)

DNFBPs are required to retain all customer records and documents obtained through the performance of CDD measures in relation to Business Relationships, including customers, Beneficial Owners, beneficiaries, or other controlling persons. Examples of such records include but are not limited to:

• Customer account information and files;

• Customer correspondence (including email and fax correspondence), call reports or meeting minutes (including where applicable recordings, transcripts or logs of telephone or videophone calls);

• Copies of personal identification documents, KYC and CDD (including EDD and SDD) forms, profiles and supporting documentation, and results of due diligence background searches, queries and investigations;

• Customer risk assessment and classification records.

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

9.2.3 Company Information (AML-CFT Law 16.1(b); AML-CFT Decision 8.1(b), 9.1, 34-36)

The AML-CFT Decision provides that the administrators, liquidators, or any other stakeholders involved in the dissolution of a company are obliged to retain the records, documents and information specified in the relevant articles for a minimum period of five (5) years from the date of its dissolution, liquidation or termination. These records pertain to corporate documents as well as to information on Beneficial Owners, legal shareholders, and senior managers. Such records include but are not limited to documents and information concerning:

• Company formation, registration, deregistration, liquidation, dissolution or expiry, including documents such as share registers, memoranda and articles of association, deeds of settlement and foundation charters, or similar documents, along with any amendments to them (whether the organisation is for-profit or not-for-profit);

• Changes to company information, such as name, registered address, legal representatives and corporate officers (directors, company secretary), or legal form;

• Identification and identity verification documents related to Beneficial Owners, shareholders, nominee shareholders, directors, senior management officers and, in the case of Legal Arrangements, settlors or founders, protectors, beneficiaries, trustees or executors, governing council or committee members, or similar controlling persons.

In order to fulfil their statutory record-keeping obligations in this regard, and commensurate with the nature and size of their businesses, supervised institutions (and in particular, DNFBPs engaged as corporate attorneys, trustees, or company service providers, administrators, liquidators, directors, or any other form of stakeholders) should determine the appropriate policies, procedures and controls related to the adequate retention, organisation, and maintenance of records. The policies, procedures and controls should be documented, approved by senior management, and communicated to appropriate levels of the organisation (see Section 9.1, Obligations and Timeframe for the Retention and Availability of Records for additional guidance concerning policies, procedures, controls and statutory retention periods related to record-keeping and data protection).

9.2.4 Reliance on Third Parties to Undertake CDD (AML-CFT Law 16.1(b); AML-CFT Decision 24.2-4, 19.1(b)-2(a))

DNFBPs that rely on third parties, whether unaffiliated or members of their own financial groups, are obliged to ensure that copies of all the necessary documents collected through the performance of CDD measures can be obtained upon request and without delay, and that the third parties adhere to the record-keeping provisions of the AML-CFT Decision. See Section 9.2.2, Customer Information above for examples of such records.

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

In order to fulfil their statutory obligations, and commensurate with the nature and size of their businesses, DNFBPs should determine the appropriate policies, procedures and controls related to the assessment, monitoring, and testing of third parties’ record-retention frameworks. The policies, procedures and controls should be documented, approved by senior management, and communicated to appropriate levels of the organisation. Some of the factors to which DNFBPs should give consideration when formulating relevant policies, procedures and controls include but are not limited to:

• Organisational roles and responsibilities in regard to the assessment, monitoring and testing of the third party’s policies, procedures and controls related to record-keeping and data protection, including appropriate business contingency and escalation procedures;

• Organisational roles and responsibilities for the implementation of service-level agreements with third parties governing the provision of record-keeping services;

• Operational procedures related to request and transfer of records and documents, as well as their physical and cyber security, and the protection of active and archived data and records from unauthorised access;

• Appropriate audit and quality assurance testing policies related to the monitoring and testing of the third-party’s record-retention framework.

9.2.5 Ongoing Monitoring of Business Relationships (AML-CFT Law 16.1(b),(f); AML-CFT Decision 24.2-4)

DNFBPs are required to retain all customer records and documents obtained through the ongoing monitoring of Business Relationships. Examples of such records include but are not limited to:

• Transaction review, analysis, and investigation files, with their related correspondence;

• Customer correspondence (including email and fax correspondence), call reports or meeting minutes (including where applicable recordings, transcripts or logs of telephone or videophone calls) related to transactions or their analysis and investigation;

• Customer due diligence records, documents, profiles or information gathered in the course of reviewing, analysing or investigating transactions, as well as transaction- related supporting documentation, including the results of background searches on customers, Beneficial Owners, beneficiaries, controlling persons, or counterparties to transactions;

• Transaction handling decisions, including approval or rejection records, together with related analysis and correspondence.

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

9.2.6 Suspicious Transaction Reports (STRs) (AML-CFT Law 16.1(f); AML-CFT Decision 24.2-4)

DNFBPs are required to retain all records and documents pertaining to suspicious transaction reports and the results of all analysis or investigations performed. Such records relate to both internal STRs and those filed with the FIU, and include but are not limited to:

• Suspicious transaction indicator alert records, logs, investigations, recommendations and decision records, and all related correspondence;

• Competent authority request for information (RFIs), and their related investigation files and correspondence;

• Customer due diligence and Business Relationship monitoring records, documents and information obtained in the course of analysing or investigating potentially suspicious transactions, and all internal or external correspondence or communication records associated with them;

• STRs (internal and external), logs, and statistics, together with their related analysis, recommendations and decision records, and all related correspondence;

• Notes concerning feedback provided by the FIU with respect to reported Suspicious Transactions, as well as notes or records pertaining to any other actions taken by, or required by, the FIU.

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

10. International Financial Sanctions The United Arab Emirates is a member of several multinational and international organisations and governing bodies, including the United Nations. As such, the UAE is a party to many international agreements and conventions pertaining to the combating of money laundering and the financing of terrorism, as well as to the prevention and suppression of the proliferation of weapons of mass destruction. These conventions include, among others, the International Convention for the Suppression of the Financing of Terrorism and the Treaty on the Non-Proliferation of Nuclear Weapons.

DNFBPs are obliged to comply with the directives of the Competent Authorities of the State in relation to the agreements and conventions referred to above, including but not limited to Cabinet Decision No. (20) of 2019 Regarding Terrorism Lists Regulation and Implementation of UN Security Council Resolutions On the Suppression and Combating of Terrorism, Terrorists Financing & Proliferation of Weapons of Mass Destruction, and Related Resolutions. Moreover, it should be noted that many DNFBPs are also affected by unilateral international sanctions programmes and restrictive measures implemented by other countries and supranational blocs (see Section 10.2, Other International Financial Sanctions).

Due to the significance, complexity and extent of the subject matter of international financial sanctions, it is deemed appropriate that this material be covered in depth in separate guidance materials. However, while it is outside of the scope of these Guidelines to provide detailed guidance on these topics, a brief high-level overview of the key elements of TFS, Cabinet Decision No. (20) of 2019, and a few other major international financial sanctions regimes is included in the sub-sections below.

§10.1 — Targeted Financial Sanctions (TFS)

(AML-CFT Law 16.1(e), 28; AML-CFT Decision 44.7, 60)

Targeted Financial Sanctions are international sanctions rules established to comply with the United Nations Security Council resolutions under Chapter VII of the Charter of the United Nations. The UAE adheres to the decisions issued by the UN Security Council under that Chapter, as well as to the FATF recommendations concerning their implementation.

Consequently, both the AML-CFT Law and AML-CFT Decision authorise the Competent Authorities of the State, including the relevant Supervisory Authorities, to ensure the full compliance of DNFBPs in implementing these decisions and other related directives; and all DNFBPs are obliged to promptly apply the directives of the Supervisory Authorities in this regard. Specifically, the AML-CFT Law and its Implementing AML-CFT Decision provide that:

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

“Every natural or legal person shall immediately comply with the instructions issued by the Competent Authorities in the State concerning the implementation of the decisions issued by UN Security Council under Chapter VII of the Charter of the United Nations regarding the prevention and suppression of terrorism and Terrorism Financing, and the prevention and suppression of the proliferation of Weapons of Mass Destruction and its financing, and any other related Decisions.”

And further, that:

“Imprisonment or a fine of no less than AED 50,000 (fifty thousand dirham) and no more than AED 5,000,000 (five million dirham) shall be applied to any person who violates the instruction issued by the Competent authority in the UAE for the implementation of the directives of UN Security Council under Chapter (7) of UN Convention for the Suppression of the Financing of Terrorism and Proliferation of Weapons of Mass Destruction and other related decisions.”

TFS require countries to freeze, without delay, the funds or other assets of any person or entity either designated by, or under the authority of, the United Nations Security Council under Chapter VII of the Charter of the United Nations, and to ensure that no funds or other assets are made available, directly or indirectly, to or for the benefit of, such persons.

DNFBPs should ensure that they have adequate internal mechanisms, including the necessary policies, procedures and controls in place, commensurate with the nature and size of their businesses, in order to fulfil their obligations to promptly apply the directives of the relevant Supervisory Authorities in regard to the related directives.

§10.2 — UAE Cabinet Decision No. (20) of 2019

(AML-CFT Law 16.1(e), 28; AML-CFT Decision 60)

The AML-CFT Law and the AML-CFT Decision oblige DNFBPs to promptly apply directives issued by the Competent Authorities of the State for implementing the decisions issued by the UN Security Council under Chapter VII of the Charter of the United Nations. In furtherance of this requirement, Cabinet Decision No. (20) of 2019 (the “Decision”) sets out the legislative and regulatory framework in the UAE for the management of terrorism lists and the implementation of UN Security Council Resolutions relating to the combating of terrorism and its financing, and the suppression of the proliferation of weapons of mass destruction. In general, the Decision accomplishes the following:

• Defines the relevant Competent Authorities and their duties in regard to the implementation of UN Security Council Resolutions and related decisions, and sets out the mechanisms by which local and international terrorism lists are established and amended in the UAE;

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

• Establishes the legal and administrative framework for the freezing and unfreezing of assets of listed persons;

• Defines the related processes for the filing and of petitions and grievances with the relevant Competent Authorities, and their subsequent adjudication;

• Establishes the authority of the Supervisory Authorities to ensure the compliance of DNFBPs with the obligation to implement the relevant Security Council Resolutions and to impose adequate administrative penalties in cases of negligence or failure to do so;

• Defines the obligations of DNFBPs for the purpose of implementing the provisions of the Decision; and provides certain protections against administrative liability for persons acting in compliance with them, as well as administrative and penal sanctions for persons violating the same.

For convenience, the specific obligations of DNFBPs, as well as the protections and penalties, are summarised further below. These obligations derive in part from the relevant Articles (11 and 12) of the Decision, which state the following:

• Article 11 (Cabinet Decision No. (20) of 2019)

“Every natural or legal person should, without delay or prior notice, freeze Funds owned, controlled or held, in whole or in part, directly or indirectly by any of the following:

1. An individual or organization designated by the UN Security Council or any relevant Security Council committee pursuant to any relevant Security Council resolutions.

2. An individual acting, directly or indirectly, on behalf of, or as directed, controlled or dominated by, any person or organization listed in the Sanctions List.

In all cases, the rights of bona fide third parties shall be considered when implementing any of the freezing procedures.”

• Article 12 (Cabinet Decision No. (20) of 2019)

“Any natural or legal person shall be prohibited from making available any Funds in his/her possession or under his/ her control, or other financial services, whether directly or indirectly, for, or to the benefit of, any person or organization listed in the Sanctions List, unless pursuant to a permission of the Office [the Executive Office of the Committee for Goods and Materials Subject to Import and Export Control], and in coordination with the relevant Sanctions Committee [the UN Security Council Committee established as per resolution numbers 1988 (2011), 1267 (1999), 1989 (2011), 2253 (2015), 1718 (2006) and all other related resolutions], or in line with related Security Council resolutions.”

With reference to the above, the Decision defines “without delay” as meaning “within hours from issuance of the listing decision by the Sanctions Committee.” In practical terms,

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

DNFBPs should consider this to mean within hours (and usually within the same business day) of identifying a customer or transaction as being subject to the provisions of the relevant Security Council Resolutions, and certainly prior to the execution of any transactions for such persons or organisations. It is also important to note that, according to the provisions of the Decision, DNFBPs are obliged to take responsibility for freezing the Funds (including assets in any form) of listed persons and organisations, which are in their possession or under their control, or which they receive for any reason (including as payment for products or services), even without receiving specific instructions from any Competent Authority to do so.

Under certain conditions involving payments due under contracts, agreements, or obligations entered into prior to the person becoming subject to the relevant UN Security Council resolutions, DNFBPs may be permitted to accept funds from listed persons or organisations, provided that the funds thus accepted are subject to freezing and are reported to the Office, or that permission for the relevant disposition of the funds is obtained from the Office. The specific conditions are covered in detail in Articles 13 and 14 of the Decision, to which supervised institutions are referred.

Summary of the Obligations of DNFBPs under Cabinet Decision (20) of 2019

The principal obligations of DNFBPs under Cabinet Decision (20) of 2019 Regarding Terrorism Lists Regulation and Implementation of UN Security Council Resolutions On the Suppression and Combating of Terrorism, Terrorists Financing & Proliferation of Weapons of Mass Destruction, and Related Resolutions relate to the following categories of actions:

• Maintaining a continuously up-to-date awareness of the persons and organisations listed in the relevant Sanctions Committees lists and comparing these on an ongoing basis with their customer databases;

• Ensuring, prior to entering into business relationships or conducting any transactions with natural or legal persons or legal arrangements, that such persons or organisations are not included in the relevant Sanctions List;

• Freezing (or unfreezing when so instructed by the Competent Authorities) the Funds of listed persons or organisations, which the supervised institutions hold, have access to, or otherwise control;

• Immediately reporting to the Supervisory Authorities when listed persons or organisations are identified and/or when the Funds of such persons or organisations are frozen, as well as in other specific situations noted below.

In addition to the above, the Cabinet Decision prohibits persons who, by virtue of their positions in relation to supervised institutions, have access to or become aware of information provided or exchanged with a Competent Authority under the relevant

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

provisions of the Decision, from disclosing such information in any form, except for the purpose of implementing the Decision.

With respect to the reporting of listed persons and organisations, DNFBPs should note the following key points:

• They are obliged to report to the relevant Supervisory Authorities the details of any customers identified as listed persons or organisations regardless of whether they are past, current, or prospective customers; regardless of whether they maintain(ed) business relationships with such customers or interact(ed) with them only in the form of occasional or attempted transactions; and also regardless of whether they perform(ed) any transactions related to such persons or organisations.

• Supervised institutions are also required to report to the relevant Supervisory Authorities the details of any customers that are identified as potential matches with listed persons or organisations, when they cannot resolve the similarities (i.e. cannot either confirm the match as true or conclusively reject it as a false positive) based on the information available to them and therefore have not frozen the Funds of such persons or organisations, or have not undertaken other procedures in compliance with the prohibition requirements prescribed in the relevant UN Security Council Resolutions. In such cases, DNFBPs should avoid executing any transactions related to such persons or organisations, pending feedback or instructions from the relevant Supervisory Authorities.

• In the case of Suspicious Transactions (whether past, in-progress, or attempted) involving listed persons or organisations, DNFBPs should file the STRs with the FIU as per the normal procedures (see Section 7, Suspicious Transaction Reporting). At the same time, they should report the details of the listed persons or organisations to the relevant Supervisory Authorities in accordance with the provisions of the Decision.

Summary of Protections/Penalties for DNFBPs under Cabinet Decision (20) of 2019

Cabinet Decision No. (20) of 2019 Regarding Terrorism Lists Regulation and Implementation of UN Security Council Resolutions On the Suppression and Combating of Terrorism, Terrorists Financing & Proliferation of Weapons of Mass Destruction, and Related Resolutions establishes an exemption against administrative liability arising from damages or claims against persons acting in good faith in compliance with its provisions. It also establishes administrative and penal sanctions against persons violating its provisions.

In other words, the Decision protects DNFBPs, as well as their directors, management, and employees acting in good faith in compliance with its provisions, when they: freeze or deny the disposal of, or access to, Funds; refuse to provide financial services related to frozen Funds; or decline to perform or fulfil any other obligation by reason of compliance with the

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

relevant provisions of the Decision, the relevant UN Security Council Resolutions, or the related directives of the Competent Authorities.

For the purpose of enforcement, Cabinet Decision No. (20) of 2019 authorises the Supervisory Authorities to impose “adequate administrative penalties in case of negligence or failure to implement the provisions of this Decision.” Additionally, the Decision subjects any person who violates their obligations under its relevant provisions to the administrative and penal punishments stipulated in the AML-CFT Law. Specifically, Article 28 of the AML- CFT Law provides that:

“Imprisonment or a fine of no less than AED 50,000 (fifty thousand dirham) and no more than AED 5,000,000 (five million dirham) shall be applied to any person who violates the instruction issued by the Competent authority in the UAE for the implementation of the directives of UN Security Council under Chapter (7) of UN Convention for the Suppression of the Financing of Terrorism and Proliferation of Weapons of Mass Destruction and other related decisions.”

§10.3 — Other International Sanctions

In addition to TFSs and related programmes of the United Nations, many other countries and supranational blocs also maintain international economic, trade or travel sanctions programmes and restrictive measures of their own. Similar to the TFS regimes, these unilateral measures often require the freezing of funds or other assets of listed natural or legal persons and organisations. They may also require general or specific licences in order to conduct business or engage in transactions with persons or entities from certain countries. DNFBPs who engage in transactions in the currencies of those countries and supranational blocs, whether for their own account or on behalf of their customers and Business Relationships, may be affected by such international financial sanctions regimes. Some of the major international financial sanctions programmes are those of:

• The United States of America. The United States maintains a significant number of economic, trade, and other sanctions programmes in accordance with its foreign policy and national security objectives. Some of these programmes are comprehensive, affecting entire countries or jurisdictions, while others are selective, targeting specific governments, sectors, organisations and/or persons.

Many of the United States’ sanctions programmes are administered by the US Department of the Treasury’s Office of Foreign Assets Control (“OFAC”); however, some (for example, certain trade licensing and travel restriction programmes) may be administered by other departments or agencies of the US government.

The United States requires all US persons, including citizens and permanent residents (green card holders), no matter where they are located, to comply with the provisions of OFAC sanctions programmes. Additionally, all persons and entities within the United

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

States, all US incorporated entities and their foreign branches, and, in the case of certain programmes, the foreign subsidiaries of US legal entities and non-US persons in possession of US-origin goods, are also required to comply. In this regard, DNFBPs that conduct business or transactions in US dollars should note that the clearing of US dollar- denominated transactions through a US financial institution or clearing system is an activity that can place funds and their related assets under the jurisdiction of OFAC sanctions programmes.

Fines for violations of OFAC sanctions can be substantial, and may include both civil and criminal penalties. While these can vary according to the sanctions programme, depending on the case, civil and criminal penalties can often exceed several millions of US dollars.

• The European Union. In the context of its Common Foreign and Security Policy (CFSP), the European Union maintains a number of economic, trade and other sanctions programmes, or “restrictive measures”. Such restrictive measures may be imposed against third countries, entities or persons, in line with the EU’s CFSP objectives.

Certain restrictive measures of the EU, such as arms embargoes or restrictions on admission, may be implemented at the national level by each member state. Others are implemented at the EU level, such as measures relating to restrictions on economic relations with third countries or those freezing funds and economic resources. Other types of restrictive measures that have been used by the EU include, among others, embargoes on equipment that could be used for internal repression, export or import restrictions, flight bans, bans on the provision of financial services, investment bans, and sectoral bans or measures aimed at preventing the misuse of equipment, technology or software for monitoring and intercepting of the internet or other forms of communication.

Generally, the EU requires compliance with its sanctions programmes in situations where linkages exist with the EU. These may involve, among other things, persons or entities within the territory of the European Union, or onboard aircraft or marine vessels registered in EU member states; nationals of EU member states; legal persons or arrangements incorporated or constituted under the laws of any EU member state (including, in some instances, the owned or controlled non-EU subsidiaries of EU domiciled legal entities); or persons or organisations conducting any business or transactions, in whole or in part, within the European Union. In this regard, DNFBPs that conduct business or transactions in euros should note that the clearing of euro- denominated transactions through a EU financial institution or clearing system is an activity that can place funds and their related assets under the jurisdiction of EU restrictive measures.

The European Union’s regulations imposing restrictive measures also provide for penalties in the case of violations of the measures. Such penalties may vary according to

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

the specifics of the situation and the member state involved; however, the common EU approach to the imposition of penalties provides that they should be effective, proportionate and dissuasive.

• The United Kingdom. In addition to the EU-wide restrictive measures which it has applied during its tenure as a member state of the European Union, the UK also has the ability to impose its own financial sanctions and restrictive measures under domestic legislation, including:

‒ Terrorist Asset-Freezing Act 2010 (TAFA 2010) ‒ Counter Terrorism Act 2008 (CTA 2008) ‒ Anti-Terrorism, Crime and Security Act 2001 (ATCSA 2001)

Such sanctions may be imposed upon persons, organisations, or sectors, and may include measures such as the targeted freezing of assets, and restrictions on a variety of financial markets and services, including but not limited to: investment bans; restriction on access to capital markets; orders to cease banking relationships and activities, or to cease doing all business; requirements to obtain permission before making or receiving certain payments or transfers of funds; or restrictions on the provision of various types of financial, insurance, brokerage, advisory or other services.

The competent authority for the UK’s financial sanctions regime is HM Treasury’s Office of Financial Sanctions Implementation (OFSI). Other restrictive measures are administered by other departments of the UK government, such as the implementation of trade sanctions and embargoes by the Department for International Trade (Export Control Organisation) and the implementation of travel bans by the Home Office.

The UK requires compliance with its financial sanctions by all persons and organisations located within, or undertaking activities within, the territory of the UK, as well as by all UK persons wherever they are located. In addition, all UK nationals and legal entities (including their non-UK branches) established under UK law must also comply with UK financial sanctions, regardless of where their activities take place. In this regard, DNFBPs that conduct business or transactions in British pounds should note that the clearing of British pound-denominated transactions through a UK financial institution or clearing system is an activity that can place funds and their related assets under the jurisdiction of UK financial sanctions programmes.

Penalties for the violation or circumvention of UK financial sanctions can be severe, depending on the exact nature of the offence and the type of sanction. Current sentencing guidelines may include monetary fines of up to one (1) million pounds sterling, and criminal prosecution with maximum prison terms of up to seven (7) years.

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

§10.4 — Sanction Screening, Alert Management, Reporting

In order to fulfil their obligation to comply with the provisions of Cabinet Decision No. (20) of 2019, as well as with the directives of the relevant Competent Authorities and Supervisory Authorities in regard to TFS and other decisions issued by the UN Security Council, and to manage their exposure to the risks associated with unilateral international financial sanctions programmes and restrictive measures implemented by other countries, DNFBPs should take steps to ensure that they have adequate internal policies, procedures and controls in place, commensurate with the nature and size of their businesses. Some of the factors to which supervised institutions should give consideration in this regard include, but are not limited to:

• Organisational roles and responsibilities related to the identification, understanding, assessment, monitoring and management of the risks associated with TFS and other international financial sanctions regimes and restrictive measures;

• Information and operating systems, procedures and controls pertaining to customer and Business Relationship screening, alert management, escalation, and reporting related to TFS and other international financial sanctions regimes and restrictive measures;

• Information and operating systems, policies, procedures and controls related to the implementation of the requirements of TFS and other international financial sanctions regimes and restrictive measures;

• Staff training and awareness-building requirements pertaining to TFS and other international financial sanctions regimes and restrictive measures;

• Appropriate independent audit policies and testing procedures with respect to the operational and control framework for TFS and other international financial sanctions regimes and restrictive measures.

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

Part V—Appendices 11 Appendices

§11.1 — Glossary of Terms

Beneficial Owner: Natural person who owns or exercises effective ultimate control, directly or indirectly, over a customer or the natural person on whose behalf a transaction is being conducted or, the natural person who exercises effective ultimate control over a legal person or Legal Arrangement.

Beneficiary Financial Institution The Financial Institution that receives a wire transfer from an Ordering Financial Institution directly or indirectly via an Intermediary Financial Institution and makes funds available to the beneficiary.

Business Relationship Any ongoing commercial or financial relationship established between Financial Institutions, Designated Non-Financial Businesses and Professions, and their customers in relation to activities or services provided by them.

CBUAE: Central Bank of United Arab Emirates Client: Any person involved in or attempts to carry out any of the activities specified in the Implementing Regulations of this Decree Law with one of the Financial Institutions or designated nonfinancial businesses and professions.

Committee: National Committee for Combating Money Laundering and the Financing of Terrorism and Illegal Organisations.

Competent Authorities: The competent government authorities in the State entrusted with the implementation of any provision of the Decree-Law and the present Decision.

Confiscation: Permanent expropriation of private funds or proceeds or instrumentalities by an injunction issued by a competent court.

Controlled Delivery: Process by which a Competent Authority allows the entering or transferring of illegal or suspicious funds or crime revenues to and from the UAE for the purpose of investigating a crime or identifying the identity of its perpetrators.

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

Core Principles for Financial Basel Committee on Banking Supervision (BCBS) Supervision: Principles 1-3, 5-9, 11-15, 26, and 29; International Association of Insurance Supervisors (IAIS) Principles 1, 3-11, 18, 21-23, and 25; and International Organisation of Securities Commission (IOSCO) Principles 24, 28, 29 and 31; and Responsibilities A, B, C and D.

Correspondent Banking Relationship between a correspondent financial Relationship: institution and a respondent one through a current account or any other type of account or through a service related to such an account and includes a corresponding relationship established for the purpose of securities transactions or transfer of funds.

Crime: Money laundering crime and related Predicate Offences, or Financing of Terrorism or Illegal Organisations.

Customer Due Diligence Process of identifying or verifying the information of a (CDD): Customer or Beneficial owner, whether a natural or legal person or a Legal Arrangement, and the nature of its activity and the purpose of the Business Relationship and the ownership structure and control over it for the purposes of the Decree-Law and this Decision.

Customer: Anyone who performs or attempts to perform any of the acts defined in Article 2 and 3 of the present Decision with any Designated Non-financial business or profession.

Decree-Law (or “AML-CFT Federal Decree-Law No. (20) of 2018 On Anti-Money Law”): Laundering and Combating the Financing of Terrorism and Financing of Illegal Organisations.

Decision (or “AML-CFT Cabinet Decision No. (10) of 2019 Concerning the Decision” or “Cabinet Implementing Regulation of Decree Law No. (20) of Decision”): 2018 On Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations.

Designated Nonfinancial Anyone who conducts one or several of the commercial Businesses and Professions or professional activities defined in Article 3 of the (DNFBPs): present Decision.

Egmont Group: The Egmont Group is an intergovernmental body of 159 Financial Intelligence Units (FIUs), which provides a platform for the secure exchange of expertise and financial intelligence to combat money laundering and the financing of terrorism (ML/FT).

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

FATF: The Financial Action Task Force is an inter- governmental body that sets international standards and promotes effective implementation of legal, regulatory and operational measures for combating money laundering, terrorist financing and other related threats to the integrity of the international financial system.

FSRBs: FATF-Style Regional Bodies are regional intergovernmental organisations which promote and assess the implementation of internationally accepted AML/CFT policies and regulations.

Financial Group: A group of financial institutions that consists of holding companies or other legal persons exercising the control over the rest of the group and coordinating functions for the application of supervision on the group, branch, and subsidiary level, in accordance with the international core principles for financial supervision, and AML/CFT policies and procedures.

Financial Institutions: Anyone who conducts one or several of the financial activities or operations of /or on behalf of a Customer.

Financial Transactions or Any activity or transaction defined in Article (2) of the Activities: present Decision.

Financing of Illegal Any physical or legal action aiming at providing funding Organisations: to an illegal organisation, or any of its activities or members.

Financing of Terrorism: Any of the acts mentioned in Articles (29, 30) of Federal Law no. (7) of 2014 on combating terrorism offences.

FIU: Financial Intelligence Unit.

Freezing or Seizure: Temporary attachment over the moving, conversion, transfer, replacement or disposition of funds in any form, by an order issued by a Competent Authority.

Funds: Assets in whatever form, whether tangible, intangible, movable or immovable including national currency, foreign currencies, documents or notes evidencing the ownership of those assets or associated rights in any forms including electronic or digital forms or any interests, profits or income originating or earned from these assets.

Governor: Governor of the Central Bank

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

High Risk Customer: A customer who represents a risk either in person, activity, Business Relationship, nature or geographical area, such as a customer from a high-risk country or non-resident in a country that does not hold an identity card, or a costumer having a complex structure, performing complex operations or having unclear economic objective, or who conducts cash-intensive operations, or operations with an unknown third party, or operations without directly confronting any other high risk operations identified by Financial Institutions, or Designated Non-Financial Businesses and Professions, or the Supervisory Authority.

Illegal Organisations: Organisations whose establishment is criminalised or which exercise a criminalised activity.

Intermediary Account: Corresponding account used directly by a third party to conduct a transaction on its own behalf.

Intermediary Financial The Financial Institution that receives and sends wire Institution: transfer between the Ordering Financial Institution and the Beneficiary Financial institution or another Intermediary Financial Institution.

Law Enforcement Authorities: Federal and local authorities which are entrusted under applicable legislation to combat, search, investigate and collect evidences on the crimes including AML/CFT crimes and financing illegal organisations.

Legal Arrangement: A relationship established by means of a contract between two or more parties which does not result in the creation of a legal personality such as Trusts or other similar arrangements.

Local List: The List issued by the Cabinet pursuant to Article (3) of Cabinet Decision No. (20) of 2019 Regarding Terrorism Lists Regulation and Implementation of UN Security Council Resolutions On the Suppression and Combating of Terrorism, Terrorists Financing & Proliferation of Weapons of Mass Destruction, and Related Resolutions.

MENAFATF: MENAFATF is a FATF-Style Regional Body (FSRB), for the purpose of fostering co-operation and co-ordination between the countries of the MENA region in establishing an effective system of compliance with international AML/CFT standards. The UAE is one of the founding members of MENAFATF.

Means: Any means used or intended to be used for the commitment of an offence or felony.

Minister: Minister of Finance Money Laundering: Any of the acts mentioned in Clause (1) of Article (2) of the Decree-Law.

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

Non-Profit Organisations Any organised group, of a continuing nature set for a (NPOs): temporary or permanent time period, comprising natural or legal persons or not for profit Legal Arrangements for the purpose of collecting, receiving or disbursing funds for charitable, religious, cultural, educational, social, communal or any other charitable activities.

Politically Exposed Persons Natural persons who are or have been entrusted with (PEPs): prominent public functions in the State or any other foreign country such as Heads of States or Governments, senior politicians, senior government officials, judicial or military officials, senior executive managers of state-owned corporations, and senior officials of political parties and persons who are, or have previously been, entrusted with the management of an international organisation or any prominent function within such an organisation; and the definition also includes the following:

1. Direct family members (Of the PEP, who are spouses, children, spouses of children, parents).

2. Associates known to be close to the PEP, which include:

a- Individuals having joint ownership rights in a legal person or arrangement or any other close Business Relationship with the PEP.

b- Individuals having individual ownership rights in a legal person or arrangement established in favour of the PEP.

Predicate Offense: Any act constituting an offense or misdemeanour under the applicable laws of the State whether this act is committed inside or outside the State when such act is punishable in both countries.

Proceeds: Funds generated directly or indirectly from the commitment of any crime or felony including profits, privileges, and economic interests, or any similar funds converted wholly or partly into other funds.

RBA: A Risk-Based Approach is a method for allocating resources to the management and mitigation of ML/FT risk in accordance with the nature and degree of the risk.

Registrar: Entity in charge of supervising the register of commercial names for all types of establishments registered in the State.

Sanctions Committee: The UN Security Council Committee established as per resolution nos. 1988 (2011), 1267 (1999), 1989 (2011), 2253 (2015), 1718 (2006) and all other related resolutions.

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

Sanctions List: A list wherein individuals and terrorist organizations, which are subject to the Sanctions imposed as per the Security Council Sanctions Committee are listed, along with their personal data and the reasons for Listing.

Settlor: A natural or legal person who transfers the control of his funds to a Trustee under a document.

Shell Bank Bank that has no physical presence in the country in which it is incorporated and licensed, and is unaffiliated with a regulated financial group that is subject to effective consolidated supervision.

State: United Arab Emirates Supervised institutions: Financial institutions (FIs) and Designated Non- Financial Businesses and Professions (DNFBPs) which fall under the scope of Federal Decree-Law No. (20) of 2018 on Facing Money Laundering and Combating the Financing of Terrorism and Illegal Organisations, and of Cabinet Decision No. (10) of 2019 Concerning the Implementing Regulation of Decree Law No. (20) of 2018 On Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations.

Supervisory Authority: Federal and local authorities, which are entrusted by legislation to supervise Financial Institutions, Designated Non-Financial Businesses and Professions and non-profit organisations or the Competent Authority in charge of approving the pursuit of an activity or a profession in case a supervisory authority is not assigned by legislations.

Suspicious Transactions: Transactions related to funds for which there are reasonable grounds to believe that they are earned from any misdemeanour or felony or related to the Financing of Terrorism or of illegal organisations, whether committed or attempted.

TFS: Targeted Financial Sanctions are part of an international sanctions regime issued by the UN Security Council under Chapter (7) of the United Nations Convention for the Prohibition and Suppression of the Financing of Terrorism and Proliferation of Weapons of Mass Destruction.

Transaction: All disposal or use of Funds or proceeds including for example: deposit, withdrawal, conversion, sale, purchase, lending, swap, mortgage, and donation.

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

Trust: A legal relationship in which a settlor places funds under the control of a trustee for the interest of a beneficiary or for a specified purpose. These assets constitute funds that are independent of the trustee's own estate, and the rights to the trust assets remain in the name of the settlor or in the name of another person on behalf of the settlor.

Trustee: A natural or legal person who has the rights and powers conferred to him by the Settlor or the Trust, under which he administers, uses, and acts with the funds of the Settlor in accordance with the conditions imposed on him by either the Settlor or the Trust.

UNODC: United Nations Office on Drugs and Crime

Undercover Operation: Process of search and investigation conducted by one of the judicial impoundment officers by impersonating or playing a disguised or false role in order to obtain evidence or information related to the Crime.

Wire Transfer: Financial transaction conducted by a Financial Institution or through an intermediary institution on behalf of a transferor whose funds are received by a beneficiary in another financial institution, whether or not the transferor and the beneficiary are the same person.

Anti-Money Laundering and Combating the Financing of Terrorism and Illegal Organisations

§11.2 — Useful Links

Institution URL Abu Dhabi Global Market https://www.adgm.com/ Abu Dhabi Securities Exchange http://www.adx.ae/ Basel Committee on Banking Supervision http://www.bis.org/bcbs/index.htm (BCBS) Central Bank of the UAE https://www.centralbank.ae Dubai Financial Market http://www.dfm.ae/ Dubai Financial Services Authority (DFSA) http://www.dfsa.ae/ Egmont Group https://egmontgroup.org FATF http://www.fatf-gafi.org Gulf Cooperation Council For The Arab http://www.gcc-sg.org/ States (GCC) International Organisation of Securities http://www.iosco.org/ Commissions (IOSCO) Interpol/Money Laundering http://www.interpol.int/Public/FinancialCrim e/MoneyLaundering/default.asp MENAFATF http://www.menafatf.org/ Securities and Commodities Authority http://www.sca.ae/ United Nations http://www.un.org/ United Nations Office on Drugs & Crime – http://www.unodc.org/unodc/money- Global Programme Against Money laundering/index.html Laundering Wolfsberg Group https://www.wolfsberg-principles.com/