Foundations of Anti-Money Laundering

Module 1: The financial-crime system in Pakistan

1.1 What AML/CFT/CPF covers

Money laundering concerns property connected to criminal proceeds. Terrorist financing concerns funds collected, provided or used for terrorism; those funds can come from lawful or unlawful sources. Proliferation financing concerns financing the spread of weapons of mass destruction. Controls overlap, but the analyst should name the risk being assessed. FATF sets international standards, while Pakistan implements obligations through its own laws, rules, regulations and directions.

1.2 The lead law

The Anti-Money Laundering Act, 2010 (AMLA) is the starting point. Section 3 defines the money-laundering offence; Schedule I lists predicate offences. Section 7 covers suspicious and currency transaction reporting. Sections 7A–7H address customer due diligence, records, risk understanding and controls. Section 6 establishes the Financial Monitoring Unit (FMU) and section 6A addresses AML/CFT regulatory authorities. A reporting entity need not wait for a predicate-offence conviction before escalating a concern.

1.3 Who does what

FMU receives and analyses STRs and CTRs and disseminates financial intelligence. SBP supervises its regulated financial entities; SECP supervises its regulated entities; FBR supervises specified designated non-financial businesses and professions (DNFBPs). Some lawyers and accountants are covered through self-regulatory arrangements. FIA, NAB, ANF, FBR investigation directorates and provincial Counter Terrorism Departments have investigative roles within their mandates. NACTA coordinates counter-terrorism work and publishes information on proscribed persons and organizations.

1.4 Choose the rule before the control

One property purchase may involve a bank, broker, builder and lawyer, each with a different supervisory rule set. Identify the reporting entity, regulated activity and supervisor first. Then consult current AMLA provisions, sector rules and FMU instructions. Do not assume that a threshold, onboarding document or exemption from one sector applies to another.

Pakistan scenario

A Karachi estate agency sells a plot to a company. The buyer pays through a bank and a lawyer prepares the transfer. Identify at least three participants with potentially different AML obligations.

Practical tool

Write an applicability note: entity and service; supervisor; rule and version; internal policy owner.

Module 2: How ML, TF and PF work in local settings

2.1 The three stages are a teaching model

Placement introduces criminal proceeds into a financial channel, layering obscures the trail, and integration presents the value as legitimate. Real cases need not follow this sequence. A property transfer or company payment may combine stages. Focus on the observed movement, people and purpose instead of forcing every case into a rigid stage.

2.2 Pakistan risk picture

Pakistan’s summarized 2023 National Risk Assessment rated corruption and bribery, illegal money or value transfer including hawala and hundi, tax crimes, smuggling and cash smuggling as very high money-laundering threats. Narcotics trafficking, trafficking in people and migrant smuggling, fraud and forgery, and cybercrime were assessed as high threats. These national findings inform risk assessment; they do not make every customer in a related sector suspicious.

2.3 Terrorist financing and nonprofits

A payment to a nonprofit is not suspicious merely because it is charitable, small or cross-border. Understand who controls the organization, who receives funds, the planned activity and its credible history. Check relevant designated or proscribed-person links. Controls should be proportionate so legitimate aid is not blocked without a basis.

2.4 Proliferation financing and trade

PF concerns may arise when goods, end users, freight routes and payments do not align, especially with dual-use goods or a sanctions nexus. Preserve invoices, shipping records and counterparty information, ask precise questions and follow the escalation route. Do not label an unfamiliar product prohibited without checking applicable lists and specialist advice.

Pakistan scenario

A Lahore electronics trader is paid by an unrelated overseas company for goods sent to a third country. The invoice, buyer and freight papers name different parties. Investigate each party’s role, goods, end use, route and payment rationale; do not infer PF from a three-country trade alone.

Practical tool

Map funds → parties → goods or assets → destination → stated purpose → independent evidence.

Module 3: Risk-based decisions

3.1 Risk is a reasoned judgment

Assess risk at business and customer level. Consider customer type and ownership, product, delivery channel, geographic links, transaction pattern and the quality of available information. Inherent risk is exposure before controls; residual risk is exposure after controls. A red flag is a reason to examine context, not a conclusion. AMLA section 7F requires reporting entities to identify, assess and understand their risks.

3.2 Proportionate measures

Higher risk can call for stronger verification, more information, senior review or closer monitoring under the applicable sector rule. Lower risk may permit simplified measures where law and regulator allow, but it never means no CDD or disregard for suspicion. FATF’s risk-based approach emphasises proportionality and financial inclusion.

3.3 PEPs and ownership

Politically exposed person status is a risk factor with specific sector requirements, not an allegation. Assess position, associates, source of funds and wealth, ownership and expected activity; apply required approval and monitoring. Trace a nominee or layered company to the natural person who ultimately owns or controls it. Record verification and unresolved gaps.

3.4 Review when facts change

Reassess risk after a new beneficial owner, unexplained funding source, new geographic route, sanctions exposure or unexpected behavior. The review should state what changed, evidence considered, revised risk, resulting control and approving person.

Pakistan scenario

A Faisalabad exporter starts receiving funds from unrelated senders, followed by rapid payments to newly added suppliers. Compare the pattern with the expected export cycle, inspect invoices and shipping evidence, update risk and escalate unresolved issues.

Practical tool

Risk note columns: factor; observed fact; evidence; control response; reviewer and date.

Module 4: Customer due diligence and beneficial ownership

4.1 When CDD is required

AMLA section 7A requires CDD when entering a business relationship, for prescribed occasional transactions, when ML or TF is suspected, and when previously obtained information is doubtful. Identify and verify the customer through reliable independent sources, understand the relationship’s purpose, identify beneficial ownership and monitor ongoing activity. SBP-regulated entities should also follow SBP’s Consolidated Customer Onboarding Framework.

4.2 A file is more than a CNIC

A CNIC or other identity document helps verify a person but does not explain purpose or source of funds. For a company, examine incorporation and authority documents, the ownership chain, controllers, business purpose and relevant records. NADRA and SECP information can assist when lawfully available, but a database match alone does not establish the relationship’s economic purpose.

4.3 Find the natural-person owner

Trace each ownership or control layer rather than stopping at a corporate shareholder. Clarify nominees and discrepancies between declarations and independent evidence. Under AMLA, a beneficial owner includes the natural person who ultimately owns or controls a customer or on whose behalf a transaction is conducted.

4.4 If CDD cannot be completed

AMLA section 7D requires a reporting entity that cannot complete required CDD to avoid opening or performing the transaction, or to end an existing relationship, and promptly consider an STR. If continuing CDD after forming suspicion would tip off the customer, follow the statutory and internal escalation route. Do not invent an explanation for missing evidence.

Pakistan scenario

A company buying commercial property will not identify the natural person behind its corporate owner, while a third party funds the deposit. Pause under the applicable process; seek ownership, authority and funding evidence; record the refusal; escalate and consider an STR.

Practical tool

CDD sheet: identity; beneficial owner; authority; purpose; source of funds; sanctions; gaps; decision.

Module 5: Monitoring and local warning signs

5.1 Compare behavior with profile

Monitoring compares actual activity with the expected customer profile. Review counterparties, timing, value, channels, history and purpose. An alert begins a review; it becomes a concern when available facts and explanations do not resolve it. Record why alerts were closed as well as why they were escalated.

5.2 Cash and informal transfer

Potential indicators include repeated cash deposits without a credible business reason, deposits in several locations followed by rapid outward movement, or flows suggesting unlicensed hawala or hundi. A large cash payment is not automatically laundering; small linked transactions can also matter. Compare with lawful business needs and the current reporting rules.

5.3 Property, precious metals and trade

Property indicators can include unexplained third-party payment, quick resale, inconsistent stated value or opaque ownership. Precious-metals cases may involve cash and unclear onward movement. Trade reviews compare invoice, shipment, customs and payment documents. FBR publishes DNFBP guidance; FMU publishes local red flags and typologies.

5.4 Digital and remote channels

Remote onboarding, wallets and instant transfers can speed movement and complicate identification, while also producing useful records. Verify identity and channel information under the relevant framework. Link related transactions and preserve the audit trail. A digital channel alone is not evidence of wrongdoing.

Pakistan scenario

A Rawalpindi jeweller receives payments from people unrelated to the purchaser, who then asks for a different name on the invoice. Identify payer, buyer and beneficial owner; obtain the business rationale; preserve payment and invoice records; escalate unresolved inconsistencies.

Practical tool

Alert note: trigger; expected activity; actual activity; records; explanation; remaining concern; disposition.

Module 6: STRs, CTRs and FMU goAML

6.1 Recognise reportable suspicion

AMLA section 7 covers a conducted or attempted transaction or pattern when the reporting entity knows, suspects or has reason to suspect unlawful proceeds, evasion of AMLA, no apparent lawful purpose after examining facts, or TF links. Suspicion is based on facts, not proof of an offence. Staff should escalate promptly through the internal process so the reporting entity can decide on formal filing.

6.2 Write a useful STR narrative

Identify who was involved, what happened, when, where and how much. Explain how the activity differs from the expected profile, documents reviewed, explanations sought and why concern remains. Separate fact from inference, identify linked transactions and preserve supporting evidence under FMU instructions. Avoid generic claims of suspiciousness without reasons.

6.3 CTR is a separate obligation

A CTR is based on the prescribed cash-transaction threshold and any applicable exemptions, whether or not suspicion exists. FMU’s March 2025 circular cites PKR 2 million for a qualifying cash transaction. The 2025 STR/CTR Regulations provide for filing immediately and no later than seven working days after a qualifying cash transaction, while STRs are due promptly once suspicion forms. One transaction can require both reports. Check the current threshold notification and sector instructions before operational use.

6.4 goAML and confidentiality

goAML is FMU’s reporting application. Use authorized access and current FMU guidance. FMU may request supporting information. AMLA section 7(4) requires records related to filed STRs and CTRs for at least ten years after reporting. Section 34 restricts disclosing that a report was made. Never tell the customer an STR was filed.

Pakistan scenario

A branch receives cash into a trader’s account followed by rapid outward movement. Invoices conflict with the stated business. Investigate and document the conflict, escalate a possible STR, and separately assess whether the cash meets CTR rules.

Practical tool

STR headings: subject; timeline; expected profile; anomalies; checks; unresolved suspicion; supporting records; approval.

Module 7: Sanctions, TF and PF controls

7.1 Two legal tracks

Pakistan implements relevant UN Security Council measures under the United Nations (Security Council) Act, 1948, with Ministry of Foreign Affairs notifications. Domestic proscription is under the Anti-Terrorism Act, 1997; NACTA publishes information on proscribed persons and organizations, including Fourth Schedule persons. AMLA describes targeted financial sanctions as freezing and prohibition duties involving designated or proscribed persons.

7.2 Screening is more than a name search

Screen relevant customers, beneficial owners and other parties when the applicable rule requires. Compare aliases, identifiers, date of birth, address and ownership. Similar names can produce false positives. An unresolved possible match calls for urgent internal escalation, evidence preservation and action under the relevant legal direction. Staff should not release funds or impose a freeze outside their authority.

7.3 Sanctions and STRs are distinct

A sanctions match can require a prohibition or freezing process even if other activity looks normal. An STR decision is separate. Filing an STR does not replace legally required sanctions action, and a false-positive sanctions decision does not resolve unrelated suspicious transactions.

7.4 Humanitarian context

For nonprofits and relief, distinguish a genuine sanctions nexus from simple geographic or sector association. Check the exact measure, available authorization or exemption process and current regulator direction. FATF updated Recommendation 6 in 2026 in relation to humanitarian exemptions, but operational decisions depend on Pakistani implementation and the applicable order.

Pakistan scenario

A screening tool flags a beneficiary with a common name similar to a listed person. Compare reliable identifiers and ownership details, document the match review and escalate promptly if unresolved. A name-only hit does not prove a true match.

Practical tool

Match record: list and date; matching and conflicting identifiers; source; reviewer; disposition; escalation and legal action.

Module 8: Governance, sector rules and accountability

8.1 A working AML programme

A sound programme includes a documented risk assessment, policies, CDD, monitoring, sanctions controls, reporting, an accountable compliance function, training, independent review and management information. Senior management must see material unresolved risk, fund remediation and test whether controls actually operate. A policy by itself is not evidence of performance.

8.2 SBP-regulated entities

SBP’s AML/CFT/CPF regulations apply to its regulated entities. Additional instructions include the July 2025 Consolidated Customer Onboarding Framework. Banks, microfinance banks, exchange companies and other SBP entities should check the exact activity and current instruments. Islamic banking must apply relevant AML requirements too.

8.3 SECP-regulated entities

SECP publishes AML/CFT/CPF Regulations, 2020, consolidated as amended to 3 July 2026. These cover applicable SECP-regulated businesses such as specified securities, non-bank finance and insurance entities according to licences and activities. Corporate registration records may support verification, but the firm still needs to understand ownership and purpose.

8.4 DNFBPs and professions

FBR supervises specified real estate, precious-metals-and-stones and FBR-supervised accounting activities. AMLA and applicable regulations address covered lawyers, notaries, other accountants and trust or company service providers through their designated supervisors or self-regulatory bodies. Scope depends on the service being provided, not merely the firm’s profession.

Pakistan scenario

A real estate broker copies a bank’s CDD checklist and assumes SBP supervises it. The broker must determine its DNFBP scope, FBR obligations and the property-specific evidence needed for its risk assessment and decisions.

Practical tool

Control register: obligation; legal source and version; procedure; owner; evidence; test date; open gap.

Module 9: Ethics, escalation and record keeping

9.1 Escalate facts without accusation

Raise an unexplained pattern even when it involves a valuable customer or senior colleague. Describe facts, checks and what remains unanswered. Avoid speculation based on ethnicity, religion, occupation or nationality alone. Use specific legal, geographic and transactional factors.

9.2 Defensible decision trail

A reviewer should be able to reconstruct the initial alert, evidence, questions, customer response, risk assessment, escalation, approval, filing decision and later action. Record reasons for closing an alert as carefully as reasons for filing. Restrict access to people who need it and protect confidential information.

9.3 Retention periods

AMLA section 7C generally requires transaction records for at least five years after completion and CDD, account, correspondence and analysis records for at least five years after the relationship ends. Records relating to a filed STR or CTR have a separate at-least-ten-year period under section 7(4). Check sector rules and legal holds before disposal.

9.4 Inspection readiness

An inspector may ask why a customer received a risk grade, how ownership was verified, why an alert was closed, whether a report was prompt and whether training worked. A sound file links source rule, action and evidence. Log a gap and fix its cause rather than reconstructing a missing record later.

Pakistan scenario

A manager asks an analyst to clear an unresolved sanctions alert because the customer is important. Preserve the alert and audit trail, follow escalation policy, obtain independent review and record the disposition. Commercial value does not decide match status.

Practical tool

Decision log: date and time; actor; fact and source; action; rationale; approval; next review.

Module 10: Integrated Pakistan case and final practice

10.1 Case facts

All names and amounts are fictional. Crescent Estates, a Lahore property broker, arranges a commercial-unit sale to Meridian Trading (Pvt.) Ltd. Meridian’s director provides company papers but cannot identify the natural persons behind its corporate shareholder. The deposit arrives in transfers from three unrelated individuals, one through an exchange-house channel. Meridian says it imports textiles, yet plans to assign the unit quickly to a newly formed company. A screening tool shows a partial-name hit for one payer. The manager asks staff to complete the sale now and review later.

10.2 Your task

Identify the broker’s possible reporting-entity status and supervisor; missing CDD and beneficial-ownership information; transactions needing inquiry; what the screening hit does and does not establish; whether the sale may proceed; what to escalate and potentially report; and the record to preserve.

10.4 Personal action plan

Write one step to improve a risk assessment, one to improve escalation records and one to check official sources for updates. Give each an owner and target date.

Pakistan scenario

Complete the integrated worksheet before reading the model analysis. Explain your decision on whether activity can proceed and which further facts would change that decision.

Practical tool

Integrated worksheet: sector rule; parties; ownership; funds; screening; monitoring; reporting; records; reviewer.