DNFBP AML/CFT Compliance Services

DNFBP means Designated Non-Financial Businesses and Professions. Pakistan’s AML/CFT laws place obligations on certain non-financial businesses and professional services when they carry out specified activities.

Depending on the activity and applicable law, categories can include real estate agents and related property businesses, dealers in precious metals or stones, certain accountants, and trust or company service providers. Legal professionals may also be covered when providing specified services. The exact category and supervisor must be checked for each business.

No. FBR supervises the categories assigned to it under the AML/CFT framework. Other DNFBP categories may have a different designated supervisor. Confirm the competent authority for your sector before relying on a portal or checklist.

Not automatically. FBR’s published guidance covers non-ICAP/ICMAP accountants when they provide specified services, such as managing client money or assets, forming or managing companies, or certain trust and company services. The service actually performed matters, so confirm your status with the competent supervisor.

Real estate activity can bring a business within AML/CFT requirements, but the exact applicability and registration route depend on the services, legal category and designated authority. Brokers, developers, builders and housing schemes should check the current requirements for their specific role.

They can be. FBR’s February 2023 DNFBP FAQ describes jewelers and dealers in precious metals or stones engaging in a customer cash transaction of Rs. 2 million or more as covered. Because thresholds and rules can change, verify the current AML/CFT rules and your supervisor’s guidance before acting.

No. Tax registration, company incorporation and AML/CFT registration or onboarding are separate processes. Having an NTN or SECP certificate does not by itself confirm that all DNFBP obligations have been met.

Use the official FBR DNFBP/IRIS portal and follow the current enrollment instructions for your category. Keep your entity, tax, ownership, management and contact details accurate, and respond to any verification or information request shown in the portal. The competent regulator decides registration and status.

Requirements vary by entity type and portal. Be ready with identity and tax details, business registration or licence information, address and contact details, ownership and control information, details of directors or partners, and an authorized representative’s authority letter if requested. Check the live portal checklist for the definitive list.

The FBR DNFBP portal is used for relevant supervisory registration or compliance services. goAML is the Financial Monitoring Unit’s system for reporting STRs and CTRs. A reporting entity may need to use both for their separate purposes.

Depending on the rules that apply, a compliance program can include a documented risk assessment, written policies and internal controls, customer due diligence, ongoing monitoring, record keeping, staff training, sanctions screening and reporting of suspicious or threshold-based cash transactions.

It is a documented assessment of how the business could be exposed to money-laundering or terrorist-financing risks. FBR guidance says to consider factors such as customers, products and services, delivery channels, geography, business size and complexity, and relevant new technologies. Use the assessment to set proportionate controls.

Keep it current and review it when material changes occur, such as new services, customer types, delivery channels, locations, ownership or risk information. Follow any specific timing or directions issued by your competent supervisor.

CDD means identifying and verifying the customer, identifying and taking reasonable steps to verify any beneficial owner, understanding the purpose of the relationship, and monitoring activity over time. The checks should match the applicable rules and the risk of the customer and service.

A beneficial owner is the natural person who ultimately owns or controls a customer, or on whose behalf a transaction is conducted. For a company or legal arrangement, look through the ownership and control structure and document the natural persons who ultimately exercise control, following the applicable rules.

Yes, where the AML/CFT requirements apply. FBR’s FAQ says existing relationships should be reviewed on a risk and materiality basis, including when there is a significant change in a customer’s profile or the existing information is no longer adequate.

EDD means additional checks for higher-risk customers, services, transactions or jurisdictions. Measures may include collecting more information, understanding source of funds or wealth, obtaining senior-management approval and increasing monitoring, as required by the applicable rules.

A Politically Exposed Person is someone entrusted with a prominent public function; relevant rules also address family members and close associates. PEP status is not automatically a ban on service, but it calls for enhanced checks, appropriate senior approval, source-of-funds or wealth measures and ongoing monitoring under the applicable rules.

Only where the rules permit it and a documented risk assessment supports a lower-risk conclusion. FBR’s regulations say simplified due diligence must not be applied where there is suspicion of money laundering or terrorist financing.

TFS are financial restrictions linked to designated persons or entities under applicable law. DNFBPs should maintain suitable screening and escalation procedures, and follow the legal directions for freezing assets and reporting a match. Use current official lists and regulator instructions rather than relying on an old saved copy.

FBR’s DNFBP regulations require a management-level compliance officer for a regulated person. FBR’s FAQ explains that a suitable senior-management person may be designated; confirm the rule and any sector-specific arrangements that apply to your entity.

Yes, a covered business should maintain appropriate written controls and an ongoing employee training program. FBR’s regulations also address employee screening and independent testing of the compliance system. The program should reflect the business’s documented risks.

FBR’s published FAQ states that CDD, business-relationship and EDD records should generally be retained for at least five years, while STR/CTR records should be retained for at least ten years from filing. Litigation or a competent authority’s direction may require longer retention; verify the current rule for your sector.

File promptly with FMU when activity, a transaction or an attempted transaction gives rise to the required knowledge or suspicion of money laundering or terrorist financing. An STR is not limited to completed transactions or existing customers. Follow the current FMU reporting instructions.

A CTR is a report to FMU for qualifying cash transactions under the prescribed threshold-based rules. The threshold and covered transaction details can depend on the applicable law and sector, so confirm the current FMU/FBR instructions rather than relying on an old amount.

FMU directs reporting entities to register and submit STRs/CTRs through its goAML portal. Follow the FMU registration guide and reporting procedures, and retain submission or follow-up records securely.

No. Disclosing that an STR has been filed or that related information is being reported may amount to prohibited tipping-off. Limit access to the information and follow the applicable confidentiality and escalation procedures.

Do not bypass required CDD. Follow your refusal and escalation procedures, consider whether the relationship or transaction can proceed, document the decision, and assess whether an STR is required. FBR’s FAQ says refusal to provide adequate information can be a reason to consider filing an STR.

The designated supervisor may review compliance through on-site or off-site supervision. Be prepared to provide your risk assessment, policies, compliance-officer details, customer files, monitoring and reporting records, training evidence and remediation actions, as requested by the authority.

Consequences depend on the breach, applicable law, regulator and enforcement process. They may include supervisory directions or sanctions. Review the current AML law and sanction rules, and respond promptly to any official notice; do not rely on a generic online penalty figure.

Some CDD functions may be performed by an eligible third party where the regulations permit it, but the reporting entity remains responsible for meeting its obligations and must satisfy the conditions for reliance. A service provider cannot assume away the regulated business’s legal responsibility.

No. TPMCL can provide compliance guidance and documentation support. Registration, supervisory decisions, reporting obligations and any approvals are determined by the competent government authority under current law.