Pakistan Legal and Regulatory Framework (AML Act 2010 and SBP/regulator requirements)
Domain 3 tests the Pakistani legal chain: the AML Act 2010, the FMU, SBP and SECP regulations, and the ATA 1997. Questions often ask which authority receives which report and what a reporting entity must do first.
Core rules
- The AML Act 2010 creates the Financial Monitoring Unit and the STR/CTR reporting duty for reporting entities, including financial institutions and DNFBPs.
- SBP AML/CFT Regulations apply to banks, DFIs and other regulated entities; SECP regulates securities, insurance and certain non-bank sectors.
- A CTR is for cash transactions at or above the prescribed threshold, commonly PKR 2 million; an STR is suspicion-based and has no minimum amount.
- Records must be kept for five years after the transaction or end of the relationship under the AML Act/FATF standard.
- The ATA 1997 and NACTA proscribed-persons regime sit alongside UNSC TFS; screening must cover both.
Worked example
A branch receives a PKR 3 million cash deposit from a customer whose declared business is a small grocery. The branch must file a CTR because the cash threshold is crossed. But the turnover mismatch, structuring pattern and third-party funding also create suspicion, so an STR is required as well. Filing the CTR does not discharge the STR duty, and the customer must not be told.
Traps
- Believing CTR and STR are alternatives; they can both apply.
- Treating the threshold as a safe harbour for suspicion.
- Forgetting that DNFBPs can be reporting entities.
- Tipping off the customer or delaying the STR until the branch 'confirms' the crime.