Rules for the Implementation of Targeted Financial Sanctions

The Financial Institution shall screen the names and information of customers, beneficial owners, directors, and authorized signatories on behalf of customers, and other related parties, based on the latest decisions issued by the United Nations Security Council and national sanctions lists. The Financial Institution shall also review the transactions it has carried out in the previous twelve months to identify any previous dealings with persons newly listed in the sanctions lists. This process shall be documented and auditable, clarifying the scope of the screening, its results, and the actions taken in response. Depending on the level of risk of the Financial Institution and its transactions, the review shall cover a period longer than twelve months, if available resources permit. In all cases, the screening process shall include, at a minimum, the following: a. Customers and transactions. b. Beneficial owners c. Directors and authorized signatories on behalf of customers. d. Other relevant parties (including, but not limited to: correspondent banks, remittance beneficiaries, and intermediaries). 3.5 The Financial Institution's screening mechanism shall include documenting the manner and time of screening, its procedures and results, and identifying the administrative unit responsible therefor. The Financial Institution shall conduct screening in accordance with the following: a. Before initiating a new business relationship, opening a bank account, opening an electronic wallet, or opening a remittance membership with a customer or related party. b. ‌Before executing any transaction and financial transactions, whether local or international. c. Immediately upon any update to the sanctions lists. d. When the Financial Institution updates or reviews customer data. e. On a quarterly basis (comprehensive screening). f. Based on specific events that warrant additional screening. 3.6 The Financial Institution shall adopt and implement a clear schedule for screening procedures in accordance with the cases specified in paragraph (3.5), provided that the specified timeframes comply with the following: a. Outgoing and incoming transactions: Screen all outgoing transactions before they are executed and incoming transactions as soon as they are received (without waiting for the end of the day or the specified period). b. Comprehensive Screening: Comprehensive screening of customer databases and information, transactions, beneficial owners, directors, and authorized signatories, and related parties shall be conducted at least once every three months. c. Post-update Screening: When an update to the sanctions lists is issued, all customer and transaction data and information, beneficial owners, directors, and authorized signatories, and related parties shall be screened against the updated list, with a record kept documenting the update, the screening process, and any actions taken as a result. d. Additional screening based on specific events: The systems and tools used for screening shall be activated based on any material changes or events that occur, including a change in ownership or control structure, the emergence of a new high-risk country in the customer's transactions or business relationships, or a change in transaction patterns that may indicate increased risk, or alerts from regulators or competent authorities indicating increased risk in a sector, country, or group of customers; an increase in a customer's risk rating following a periodic assessment; a customer's association with suspicious behavior prior to or following an update to sanctions lists; or the presence of adverse media associated with a specific customer, country, or sector. The Financial Institution shall identify and document these events in its internal policies and procedures, taking into account that these events are updated periodically and continuously to reflect the most prominent emerging risks or threats.