When is anti-money-laundering customer due diligence required?

Anti-money-laundering customer due diligence is required at legally prescribed points in a regulated customer relationship, not only after a suspicious transaction has already occurred. Pakistani SECP-regulated reporting entities must apply the Anti-Money Laundering, Countering Financing of Terrorism and Countering Proliferation Financing Regulations, 2020 as amended through July 2026, alongside the Anti-Money Laundering Act, 2010 and relevant directions. The exact requirements vary by entity and risk, but customer identification, verification, beneficial ownership and ongoing monitoring are central elements.

Identify whether the business is a reporting entity

The first question is whether the firm falls within the AML regulatory framework and which supervisor has jurisdiction. Securities and futures brokers, NBFCs, insurers and certain other intermediaries may be subject to SECP's requirements. Banks and some payment service providers fall under SBP rules. Ordinary incorporation does not automatically make every small business subject to the same regulated intermediary programme. The correct legal category should be documented.

Before establishing a customer relationship

Customer due diligence generally forms part of onboarding before a qualifying business relationship or transaction under the applicable rules. The firm should identify the customer, verify identity through reliable sources and determine who is authorised to act. A trader's promise to provide CNIC and documents after funding an account may not meet applicable pre-onboarding duties. The law should be checked for any permitted timing exception.

Occasional transactions

Regulations can impose customer checks for specified occasional transactions, depending on type, thresholds and risk circumstances. A company should consult the operative provisions rather than quote a universal rupee amount from an unrelated banking rule. Transactions artificially split into smaller payments may raise specific concerns. Staff should be trained to recognise the relevant trigger without assuming every tiny routine payment requires exactly the same enhanced process.

Identity of an individual

For natural persons, the firm should obtain prescribed information and verify it against authentic identification. The customer record may include name, CNIC or passport, contact information and other required details. The exact source and method should comply with current rules. Staff should not retain unnecessary copies or disclose identity details casually. A completed form without effective verification is not automatically sufficient due diligence.

Corporate customers

A company account requires checking legal existence, registered address, relevant directors or authorised signatories, the purpose of business and beneficial ownership as required. Obtain current SECP incorporation information and authorised resolution. A company can act through a representative, but the intermediary should establish that person's powers. Merely receiving a certificate of incorporation does not necessarily identify the human persons exercising ultimate control.

Beneficial ownership

The purpose is to identify relevant natural persons who ultimately own or control the customer within regulatory definitions and thresholds. An intermediary should not stop at a chain of nominee or holding companies where the rules require looking through the structure. The applicable percentage threshold and alternative control criteria must be checked in the current regulation. A complex ownership chart may justify enhanced investigation rather than automatic rejection.

Politically exposed persons

PEPs and their relevant relationships may trigger enhanced due diligence and approval requirements under the risk-based framework. Being politically exposed is not itself proof of wrongdoing. The firm should assess source of wealth, source of funds and monitoring requirements as prescribed. A customer should not automatically be excluded merely because a family member holds public office, but the institution cannot ignore the specific additional controls mandated by law.

High-risk geography and business

Transactions involving jurisdictions, industries or structures associated with heightened risks may require enhanced due diligence. The firm should apply current official risk information and its documented assessment, not rely solely on stereotypes. High-risk status can affect approval level, verification and monitoring. A regulator may ask how the business actually determined the risk rating and whether its controls were proportionate.

Ongoing monitoring

CDD does not end once the account opens. The firm should scrutinise transactions for consistency with its understanding of the customer and update records when risk or identifying information changes. A significant shift in volumes, beneficial ownership or business purpose can trigger review. A client who initially passed screening may later require updated due diligence. Monitoring should be documented and linked to relevant risk triggers.

Suspicious activity

Where the institution identifies circumstances requiring suspicious transaction reporting, it must apply the relevant legal reporting and confidentiality obligations. A suspicion may arise independently of a monetary threshold. Staff should escalate internally to the legally designated officer rather than confront the customer improperly or disclose protected reporting details. The statutory treatment of tipping-off and record preservation requires particular care.

Sanctions and terrorism financing

Screening may include applicable terrorism financing and proliferation financing controls and official sanctions requirements. The regulated institution should maintain procedures for updated lists and potential matches. Name similarity alone does not establish that a customer is a designated person; false positives should be investigated through lawful verification. The firm must nevertheless act promptly when an actual applicable restriction is established.

Simplified due diligence

Certain customers or circumstances may qualify for simplified measures if law and documented risk permit them. Simplified does not mean no identification or no continuing responsibility. An institution should not treat every salaried customer as automatically risk-free. If new information indicates higher risk, additional measures may become necessary. The regulator may question blanket exemptions unsupported by the current rule.

Record retention

CDD information and transaction records must be retained for the period and in the manner prescribed by law. A regulated firm should build systems permitting retrieval during lawful inspection or investigation. Records stored only on a departing employee's laptop create operational and regulatory risk. Privacy and cybersecurity obligations should govern access and disposal. An internal retention policy must not undercut mandatory statutory periods.

Outsourcing CDD

A third-party vendor can sometimes help collect documents or screen names, subject to law, but the reporting entity should not assume it has transferred regulatory responsibility. Outsourcing agreements should provide data security, quality control, audit access and correction of errors. Staff must be able to explain why an account was accepted and what checks occurred. A software "pass" indication is not a substitute for the complete required risk assessment.

A corporate brokerage example

A company wishes to open a futures trading account through a Pakistani intermediary. The broker must identify the company, authorised persons and relevant beneficial owners, assess risk and fulfil applicable checks before activating the relationship. A board resolution is important but may not disclose ultimate control. Where shareholders are overseas entities, the broker may need further supporting ownership information.

A sudden transaction example

An established customer with historically small trades suddenly transfers a substantially larger amount from an unrelated source. The firm should compare the activity with the customer's known profile and apply appropriate monitoring or enhanced steps. This does not conclusively prove money laundering. The relevant question is whether the risk indicators trigger legally required inquiry, restrictions or reporting.

Opinion and recommended course

Customer due diligence is required at onboarding, relevant occasional transactions, material changes and ongoing risk-based monitoring as prescribed. The firm should identify customers and beneficial owners, assess risk, use enhanced controls where needed and maintain retrievable records. A risk-based programme must meet actual regulatory duties rather than treat identity collection as a one-time formality.

Principal authorities: Anti-Money Laundering Act, 2010; SECP AML/CFT/CPF Regulations, 2020, amended through July 3, 2026; applicable sanctions and supervisory guidelines; relevant SBP AML requirements for SBP-regulated entities.