NIBAF AML & CFT cheat sheet

Money laundering is the process of disguising the criminal origin of proceeds so they appear legitimate; it is distinct from the predicate offence that generated them.

Classic three-stage model: placement (introducing cash into the financial system), layering (obscuring the audit trail through transfers, conversions, or shell structures), and integration (reintroducing funds as apparently lawful assets).

Terrorist financing differs from money laundering: the funds may be legally sourced, the objective is financing of terrorism rather than hiding origin, and small sums can be material.

Predicate offences are the underlying crimes generating proceeds; the AML Act 2010 Schedule lists them, and a money laundering charge can stand on a foreign or domestic predicate.

AML/CFT objectives are to detect, deter, and disrupt illicit finance, protect the integrity of the financial system, and support investigation and asset recovery.

Three lines of defence: business unit (first), compliance/risk function (second), internal audit (third).

Typical red flags include structuring below reporting thresholds, rapid pass-through of funds, unexplained third-party payments, and reluctance to provide identification.

Financial inclusion and AML/CFT are balanced through risk-based simplified measures for low-risk products, not by blanket exemption from identification.

FATF is an intergovernmental policy body that issues Recommendations; it does not itself supervise institutions or impose sanctions directly.

FATF-style regional bodies (FSRBs) assess their members against the Recommendations; Pakistan's assessment is conducted through the Asia/Pacific Group on Money Laundering (APG).

Vienna Convention (1988) addresses drug trafficking proceeds; Palermo Convention (2000) addresses transnational organised crime; both underpin criminalisation and mutual legal assistance.

UN Security Council Resolutions 1267, 1373, 1988, and 2253 form the legal basis for targeted financial sanctions against terrorism and proliferation financing.

Basel Committee on Banking Supervision sets prudential expectations on customer due diligence and risk management for banks; IOSCO and IAIS cover securities and insurance respectively.

Egmont Group is the global network of financial intelligence units; it supports secure exchange of financial intelligence between FIUs.

Wolfsberg Group issues private-sector guidance on CDD, correspondent banking, and sanctions screening; it is industry guidance, not binding law.

Key terms: beneficial owner (natural person ultimately owning or controlling), PEP (prominent public function), STR (suspicious transaction report), TFS (targeted financial sanctions).

Anti-Money Laundering Act 2010 is the primary statute; it criminalises money laundering, sets out predicate offences, and establishes the Financial Monitoring Unit (FMU).

FMU is Pakistan's financial intelligence unit; it receives STRs and CTRs, analyses them, and disseminates intelligence to law enforcement and regulators.

Anti-Terrorism Act 1997 (as amended) provides the terrorism-financing offences and the legal basis for implementation of UN sanctions in Pakistan.

SBP AML/CFT Regulations (under the AML Act and BSA) require regulated entities to have a board-approved AML/CFT policy, a designated compliance officer, CDD, screening, and reporting.

Reporting thresholds: currency transaction reports are filed for cash transactions at or above the threshold set by the FMU (commonly PKR 2 million for individuals and PKR 2.5 million for entities); STRs have no monetary threshold.

STRs must be filed promptly, generally within seven working days of forming suspicion, using the FMU's goAML system.

SECP regulates non-bank financial companies, modarabas, and insurers; it issues parallel AML/CFT regulations for its regulated persons.

Record retention under the AML Act and SBP rules is generally five years after the end of the business relationship or transaction; records must be produced on request to regulators and the FMU.

The FATF Recommendations comprise 40 Recommendations across seven areas: AML/CFT policies, money laundering and confiscation, terrorist financing and proliferation financing, preventive measures, transparency and beneficial ownership, powers of authorities, and international cooperation.

Recommendation 1: risk-based approach - countries and institutions apply enhanced measures where risk is higher and may apply simplified measures where risk is lower.

Recommendation 10: customer due diligence - identify and verify the customer and beneficial owner, understand the purpose and intended nature of the relationship, and conduct ongoing monitoring.

Recommendation 11: record keeping - retain transaction and CDD records for at least five years.

Recommendation 12 and 22: PEPs - apply enhanced due diligence to foreign PEPs, and risk-based measures to domestic and international organisation PEPs.

Recommendation 13 and 16: correspondent banking and wire transfers - obtain information on the respondent institution and ensure originator and beneficiary information travels with the payment.

Recommendation 20 and 21: reporting of suspicious transactions and tipping-off protection; institutions must report without alerting the customer.

Recommendation 6 and 7: targeted financial sanctions for terrorism and proliferation financing, including freezing without delay and prohibition on making funds available.

Mutual evaluation is peer assessment by the FATF or an FSRB; it produces a Mutual Evaluation Report with ratings for technical compliance and effectiveness.

Technical compliance is rated C (compliant), LC (largely compliant), PC (partially compliant), NC (non-compliant), or NA.

Effectiveness is assessed on 11 Immediate Outcomes; each is rated high, substantial, moderate, or low.

The follow-up process requires countries to report progress; failure to improve can lead to grey-listing (increased monitoring) or black-listing (high-risk jurisdiction call for action).

Targeted financial sanctions require freezing of funds and economic resources of designated persons and entities without delay and without prior notice.

Designated lists relevant to Pakistan: the UN Consolidated List, and the National Counter Terrorism Authority (NACTA) proscribed list under the Anti-Terrorism Act.

Screening must cover customers, beneficial owners, and, where required, related parties; false positives must be resolved and documented before onboarding or continued operation.

Freezing obligations extend to funds owned or controlled, directly or indirectly, by a designated person, and prohibit dealing with or making resources available to them.

CDD measures: identify the customer and verify using reliable, independent sources; identify the beneficial owner and verify ownership or control; understand purpose and intended nature of the relationship; conduct ongoing monitoring.

Beneficial owner: a natural person who ultimately owns or controls the customer, commonly a shareholding or voting threshold (often 25% or more) or control through other means; if none identified, the senior managing official is recorded.

Simplified due diligence is permitted only for lower-risk situations, with documented risk rationale, and never for suspected ML/TF or for high-risk categories.

Enhanced due diligence applies to PEPs, high-risk jurisdictions, complex or unusual ownership structures, and correspondent relationships; measures include source of funds and source of wealth checks and senior management approval.

PEP definition covers individuals entrusted with prominent public functions, their family members, and close associates; risk continues for at least 12 months after leaving office.

Reliance on third parties for CDD is permitted only where the third party is regulated and supervised; the institution remains responsible for the CDD outcome.

If CDD cannot be completed, the institution must not open the account, must not commence the relationship, and should consider filing an STR.

Ongoing monitoring includes periodic KYC refresh, transaction monitoring, and updating customer risk profiles when circumstances change.

STRs are filed when there is reasonable suspicion of ML/TF, regardless of the amount; suspicion must be documented with facts, not conclusions.

CTRs are filed for cash transactions at or above the FMU-prescribed threshold; they are threshold-based and do not require suspicion.

Pakistan uses the FMU's goAML portal for STR and CTR submission; filings should include subject details, transaction details, and a clear narrative of the suspicion.

Tipping-off - informing the customer or a third party that an STR has been or will be filed - is prohibited and is itself an offence.

The reporting officer should escalate internally to the compliance officer, who decides on filing; the decision and rationale must be recorded even when no STR is filed.

STR quality matters more than quantity: specific facts, dates, amounts, counterparties, and the reason for suspicion support FMU analysis and dissemination.

The FMU analyses reports and disseminates intelligence to law enforcement agencies and regulators; it does not prosecute cases itself.

Cross-border wire transfers and suspicious activity linked to foreign jurisdictions may require reporting to the FMU and may also trigger obligations under foreign law where applicable.

A compliant AML/CFT programme has four pillars: designated compliance officer, internal policies and procedures, ongoing employee training, and independent testing/audit.

The board approves the AML/CFT policy, sets risk appetite, and receives periodic compliance reporting; senior management implements the programme.

Business risk assessment (institutional risk assessment) identifies inherent risks by customer, product, channel, and geography, then applies controls to derive residual risk.

Customer risk rating is typically a combination of customer type, business activity, geography, and delivery channel; the rating drives the level of CDD and monitoring.

Training should be role-based and refreshed at least annually, with attendance and testing records retained; new staff must be trained before handling customers.

Record keeping must cover CDD records, transaction records, STR/CTR filings, training logs, and risk assessments, retained for at least five years and available to regulators on request.

Independent testing should be performed by internal audit or an external party not involved in the compliance function, with findings reported to the board audit committee.

Key risk indicators include STR volumes and quality, overdue KYC reviews, sanctions screening alerts, and training completion rates.

The compliance officer must have direct access to the board or a board committee and sufficient authority and resources to act independently.

Segregation of duties: the compliance function should not report to the business line whose activities it monitors.

Escalation paths must be documented: front office to compliance, compliance to senior management, and compliance to the board for material issues.

Policies must be reviewed at least annually and whenever laws, regulations, or the institution's risk profile change.

Group-wide programmes must apply AML/CFT standards across branches and subsidiaries, including foreign operations where local law permits.

Outsourcing of compliance activities does not transfer regulatory responsibility; the institution remains accountable for outcomes.

Whistleblowing and confidentiality protections support internal reporting of control failures and suspected ML/TF.

Regulatory examination findings should be tracked to closure with owners and deadlines, and reported to the board.

Risk = likelihood × impact; in AML/CFT terms, likelihood of ML/TF occurring and the impact if it does.

National risk assessment (NRA) is conducted at country level; institutional risk assessment should be consistent with the NRA's identified higher-risk sectors and threats.

Higher-risk factors: cash-intensive businesses, complex ownership, offshore structures, PEPs, high-risk jurisdictions, and non-face-to-face onboarding.

Lower-risk factors: regulated entities with transparent ownership, low-value products, and established long-term relationships with verified sources of funds.

Risk assessment must be documented, approved by senior management, and used to allocate compliance resources and set monitoring thresholds.

Risk appetite statements should define which customer types, products, and jurisdictions the institution will not accept.

Risk assessments are refreshed when products, channels, or the regulatory environment change, and at least annually.

Transaction monitoring rules and thresholds should be calibrated to the institution's risk assessment and reviewed for effectiveness.

Training content should cover the AML Act, SBP/SECP regulations, CDD, STR/CTR filing, sanctions screening, and red flags relevant to the staff role.

New employees must complete AML/CFT training before customer-facing duties; all staff require refresher training at least annually.

Training records must show date, content, attendees, and assessment results; these are examined by supervisors.

Effectiveness testing (quizzes, case studies, spot checks) demonstrates that training changed behaviour, not just attendance.

Record retention: CDD and transaction records for at least five years after the end of the relationship or transaction, or longer if requested by authorities.

Records must be retrievable promptly and stored securely; electronic records must be legible and protected from alteration.

STR-related records, including the internal analysis and the FMU acknowledgement, must be retained and kept confidential.

Training and record keeping failures are common supervisory findings and can attract penalties and remediation directives.

Customer risk rating categories (low, medium, high) determine CDD depth, approval level, and monitoring frequency.

Source of funds refers to the origin of the specific funds in a transaction; source of wealth refers to the overall accumulated wealth of the customer.

Onboarding, periodic review, and trigger-event review are the three points at which CDD is performed or refreshed.

Shell banks and anonymous accounts are prohibited relationships; bearer share structures require enhanced scrutiny.

Sanctions screening differs from AML monitoring: sanctions are list-based and prohibition-based, while AML monitoring is behaviour-based.

A false negative in sanctions screening is a failure to match a designated person; a false positive is a match that is resolved as not designated.

Correspondent banking requires understanding the respondent's AML programme and the nature of its business, with enhanced measures for payable-through accounts.

Suspicion is objective: it exists where a reasonable person, with the same information and experience, would suspect ML/TF.

The FMU receives STRs and CTRs, analyses them, and disseminates intelligence products to law enforcement and regulators.

Financial intelligence includes tactical products (specific cases) and strategic products (trends and typologies).

Domestic information sharing between the FMU, regulators, and law enforcement is authorised under the AML Act; sharing with foreign FIUs occurs through Egmont-secured channels.

Institutions may share information within their group for AML/CFT purposes, subject to confidentiality safeguards.

Confidentiality of STRs is protected by law; disclosing an STR to the subject is an offence.

Feedback from the FMU to reporting institutions is limited but supports improving report quality.

Typologies published by the FATF, APG, and the FMU inform monitoring scenarios and training.

Public-private partnerships are increasingly used to share typologies and improve detection without compromising confidentiality.

The AML Act provides for penalties including imprisonment and fines for money laundering and for failure to comply with reporting obligations.

Supervisors (SBP, SECP) can impose monetary penalties, issue directives, restrict business, and require remediation plans.

The FMU can impose penalties for failure to file STRs/CTRs or for filing deficient reports.

Enforcement actions are published by supervisors and are used as supervisory tools to drive remediation.

Senior management accountability: the board and senior management are responsible for the adequacy of the AML/CFT programme.

Repeated or systemic failures can lead to licence restrictions or loss of authorisation.

Cooperation with investigations, including timely production of records, is a legal obligation.

Remediation should address root causes, not just individual findings, and should be verified by independent testing.

Banks: correspondent banking, trade finance, and cash-intensive branches are higher-risk areas.

Exchange companies and money service businesses: cash-intensive, remittance corridors, and agent networks require enhanced monitoring.

Insurance: life insurance products with investment features and early surrender are higher risk.

Securities: nominee accounts, complex structures, and cross-border flows require beneficial ownership scrutiny.

Real estate and dealers in precious metals: high-value cash transactions and third-party payments are red flags.

NPOs: risk-based supervision to protect legitimate charitable activity while preventing terrorist financing abuse.

Virtual assets: FATF Recommendation 15 requires licensing and supervision of virtual asset service providers, with travel-rule obligations.

Accountants and lawyers: designated non-financial businesses and professions must apply CDD and report suspicious transactions.

Every CDD decision, risk rating, and STR decision must be documented with date, decision-maker, and rationale.

Customer files should contain identification documents, beneficial ownership evidence, risk assessment, and review history.

Transaction records must be sufficient to reconstruct individual transactions and to support investigations.

Screening results, including false-positive resolutions, should be retained with the screening date and reviewer.

Audit trails should be immutable or protected from alteration, with access controls and retention schedules.

Documentation should be in a form producible to supervisors within the timeframe they specify.

Gaps in documentation are treated as control weaknesses even where no ML/TF occurred.

Version control for policies and procedures supports demonstrating that current requirements were followed.

Mutual legal assistance requests are made through central authorities under the Vienna and Palermo Conventions and bilateral treaties.

The FMU can exchange information with foreign FIUs through Egmont-secured channels, subject to reciprocity and confidentiality.

Supervisors cooperate with foreign supervisors for consolidated supervision of cross-border groups.

Extradition and asset recovery are supported by the AML Act and international conventions.

Requests should be specific, time-bound, and accompanied by the legal basis and the information sought.

Refusal grounds are limited and must be justified under the applicable treaty or law.

Informal cooperation through supervisory colleges supports group-wide risk assessment.

Pakistan's international cooperation is assessed under FATF Recommendations 36-40.

Trade-based money laundering: over- and under-invoicing, multiple invoicing, and misrepresentation of goods and services.

Shell company abuse: entities with no real operations used to layer funds and obscure beneficial ownership.

Third-party payment and funnel accounts: using accounts of unwitting or complicit individuals to receive and move funds.

Cyber-enabled fraud and mule accounts: rapid movement of stolen funds through multiple accounts.

Virtual assets and mixing services: pseudonymity and cross-border instant transfer increase layering risk.

Real estate and luxury goods: high-value purchases used to integrate proceeds.

Terrorist financing typologies: small-value transfers, cash couriers, and abuse of NPOs and informal value transfer systems.

Typologies inform monitoring scenarios, training content, and risk assessment updates.

STR: report of suspicious transaction or activity, no monetary threshold, filed with the FMU.

CTR: currency transaction report for cash transactions at or above the FMU-prescribed threshold.

PEP: individual entrusted with prominent public function, plus family members and close associates.

Beneficial owner: natural person who ultimately owns or controls the customer, commonly 25% or more ownership or voting rights, or control by other means.

Tipping-off: disclosing an STR or related information to the subject or a third party; prohibited.

Record retention: at least five years after the end of the relationship or transaction.

STR filing timeframe: promptly, generally within seven working days of forming suspicion.

Sanctions freezing: without delay and without prior notice, once a designation is confirmed.

Adequacy of the board-approved AML/CFT policy and risk appetite statement.

Effectiveness of CDD, including beneficial ownership identification and verification.

Quality and timeliness of STR and CTR filings, including narrative quality.

Sanctions screening coverage, calibration, and false-positive resolution.

Transaction monitoring scenario coverage and alert disposition documentation.

Training completion and effectiveness evidence.

Record retention and retrievability.

Remediation of prior findings and independent testing results.

Risk-based approach means allocating resources proportionate to risk, not applying identical measures to all customers.

Simplified measures are permitted only for low-risk situations and must be documented; they never apply where ML/TF is suspected.

Enhanced measures are mandatory for high-risk situations, including PEPs and high-risk jurisdictions.

Risk rating must be reviewed when a trigger event occurs, such as a change in ownership or business activity.

Monitoring thresholds should be calibrated to the institution's risk profile and reviewed periodically.

Risk assessments should be approved by senior management and used in decision-making.

Higher-risk customers require senior management approval for onboarding and periodic review.

The risk-based approach is a FATF Recommendation 1 obligation, not optional good practice.

Screen at onboarding, on a periodic basis, and on list updates; screening must cover customers and beneficial owners.

Use fuzzy matching with documented thresholds; calibrate to balance false positives and false negatives.

Resolve alerts with documented rationale; escalate true matches to compliance and freeze where required.

Maintain an audit trail of screening dates, lists used, and decisions.

Lists include the UN Consolidated List and NACTA proscribed list; commercial lists supplement these.

Sanctions screening is distinct from PEP screening, though both are part of onboarding controls.

Freeze funds and economic resources of designated persons without delay and without prior notice.

Report frozen assets and attempted transactions to the relevant authority as required.

State who, what, when, where, and how, with dates, amounts, accounts, and counterparties.

Explain why the activity is unusual for the customer, referencing the expected profile.

Avoid conclusions without facts; describe the observed behaviour and the supporting evidence.

Include the customer's explanation, if obtained, and why it was not satisfactory.

Identify related accounts, connected parties, and any prior reports.

Keep the narrative factual, chronological, and free of speculation about guilt.

Attach supporting documents where the FMU system permits.

Retain the internal analysis and the FMU acknowledgement.

Board: approves policy and risk appetite, oversees programme effectiveness.

Senior management: implements the programme and allocates resources.

Compliance officer/MLRO: owns the programme, decides on STR filing, and reports to the board.

Business units: perform CDD, identify red flags, and escalate.

Internal audit: independently tests the programme and reports findings.

HR: supports training, screening of employees, and disciplinary processes.

Legal: advises on obligations, confidentiality, and information requests.

Front-line staff: first point of detection and escalation.

Retain CDD records for at least five years after the end of the relationship.

Retain transaction records for at least five years after the transaction.

Retain STR and CTR records, including internal analysis, for at least five years.

Records must be retrievable promptly and in a form acceptable to supervisors.

Store records securely with access controls and protection from alteration.

Maintain training records with dates, content, and results.

Maintain risk assessment and policy version history.

Retention periods may be extended on request by authorities.

Role-based content: front line, operations, compliance, and board each need tailored training.

Cover legal obligations, CDD, red flags, STR/CTR filing, sanctions, and confidentiality.

Deliver at onboarding and at least annually thereafter.

Use case studies and typologies relevant to the institution's risk profile.

Test understanding with assessments and track results.

Refresh training when laws, regulations, or typologies change.

Document attendance, content, and assessment results.

Measure effectiveness through spot checks and quality of escalations.

Technical compliance ratings: C, LC, PC, NC, NA.

Effectiveness ratings: high, substantial, moderate, low across 11 Immediate Outcomes.

Follow-up requires progress reports and can lead to grey-listing or black-listing.

Grey-listing triggers enhanced due diligence by foreign institutions.

Countries must demonstrate effectiveness, not just legal frameworks.

Pakistan's mutual evaluation is conducted through the APG.

Findings inform national risk assessment and regulatory priorities.

Remediation plans address both technical and effectiveness gaps.

TF can involve legally sourced funds; the intent to finance terrorism is the key element.

Small amounts can be significant; threshold-based reporting alone is insufficient.

UNSCR 1373 requires criminalisation of TF and freezing without delay.

NPOs are risk-based supervised to prevent abuse while protecting legitimate activity.

Informal value transfer systems and cash couriers are common TF channels.

TF reporting should be treated as an STR, not a CTR.

Sanctions screening is a primary TF preventive control.

TF investigations require international cooperation and intelligence sharing.

PF involves providing funds or financial services for proliferation of weapons of mass destruction.

FATF Recommendation 7 requires targeted financial sanctions for PF.

UNSCR 1718, 2231, and related resolutions establish designation regimes.

Screening must cover PF lists in addition to terrorism lists.

Trade finance and dual-use goods are higher-risk areas.

Institutions should understand the customer's business to detect PF risk.

Freezing obligations apply without delay and without prior notice.

Reporting frozen assets to the relevant authority is required.

Obtain information on the respondent institution's AML programme and business.

Assess the respondent's reputation and supervisory status.

Document the responsibilities of each institution.

For payable-through accounts, apply enhanced measures and ensure CDD is performed.

Wire transfers must carry originator and beneficiary information (Recommendation 16).

Cross-border transfers require full originator information; domestic transfers may have simplified requirements.

Monitor for nested correspondent relationships.

Terminate relationships where the respondent cannot meet CDD requirements.

Over-invoicing and under-invoicing transfer value between parties.

Multiple invoicing of the same goods obscures the audit trail.

Misrepresentation of quantity or quality of goods moves value.

Red flags include unexplained pricing anomalies and complex trade routes.

Trade finance documents should be scrutinised for consistency.

Free trade zones and shell companies increase risk.

Monitoring should link trade flows to payment flows.

Typologies inform training and monitoring scenarios.

FATF Recommendation 15 requires licensing and supervision of VASPs.

The travel rule requires originator and beneficiary information for virtual asset transfers.

Mixers and anonymity-enhancing technologies increase layering risk.

Cross-border instant transfers complicate jurisdiction and recovery.

Institutions should assess exposure to VASPs as customers or counterparties.

Monitoring should include virtual asset-related transactions where applicable.

Typologies evolve rapidly; training should be refreshed accordingly.

Risk assessment should incorporate virtual asset exposure.

NPOs are risk-based supervised to prevent TF abuse while protecting legitimate activity.

Higher-risk NPOs include those operating in conflict zones or providing cash assistance.

Due diligence on NPO partners and beneficiaries supports risk mitigation.

Red flags include unexplained cash transfers and opaque governance.

Outreach and education support the sector's compliance.

Supervision should be proportionate and not inhibit legitimate charitable work.

Information sharing between regulators and the sector supports detection.

FATF Recommendation 8 addresses NPO risk.

Foreign PEPs require enhanced due diligence, including source of funds and wealth.

Domestic and international organisation PEPs require risk-based measures.

Senior management approval is required to establish or continue a PEP relationship.

Risk continues for at least 12 months after leaving office.

Family members and close associates are covered.

Screening must cover PEP lists and adverse media.

Document the rationale for any decision to continue a relationship.

Enhanced monitoring applies throughout the relationship.

Identify the natural person who ultimately owns or controls the customer.

Common threshold: 25% or more ownership or voting rights.

Control can be exercised through other means, including nominee arrangements.

If no beneficial owner is identified, record the senior managing official.

Verify ownership using reliable, independent sources.

Complex structures require enhanced scrutiny and documentation.

Bearer shares and nominee arrangements are higher risk.

Update beneficial ownership information on trigger events.

Front-line staff escalate suspicions to compliance promptly.

Compliance reviews the facts and decides whether to file an STR.

Document the decision and rationale even when no STR is filed.

Senior management is informed of material matters.

Tipping-off is prohibited at every stage.

Confidentiality of the STR is maintained.

Escalation paths are documented in policy.

Decisions are reviewed for consistency and quality.

STRs are filed with the FMU via goAML.

CTRs are filed for cash transactions at or above the threshold.

Sanctions freezes and attempted transactions are reported as required.

Regulatory returns and certifications are filed on time.

Records of filings are retained.

Late or deficient filings attract penalties.

Reporting obligations apply regardless of customer consent.

Confidentiality of filings is maintained.

Independent testing is performed by internal audit or an external party.

Testing covers CDD, monitoring, screening, reporting, training, and record keeping.

Findings are rated by severity and tracked to closure.

Results are reported to the board audit committee.

Testing should be risk-based and periodic.

Remediation is verified by follow-up testing.

Testing supports supervisory examinations.

Documentation of testing is retained.

The NRA identifies higher-risk sectors, threats, and vulnerabilities.

Institutional risk assessments should align with the NRA.

Higher-risk sectors require enhanced controls.

The NRA informs supervisory priorities.

Institutions should document how the NRA informed their assessment.

The NRA is updated periodically.

Sector-specific guidance supports implementation.

Public-private dialogue supports risk understanding.

STRs and related information are confidential.

Tipping-off is prohibited and is an offence.

Information sharing is permitted only under legal authority.

Data protection laws apply to customer data.

Access to records is controlled and logged.

Cross-border sharing requires legal basis and safeguards.

Employees are trained on confidentiality obligations.

Breaches are investigated and remediated.