Pakistan AML for Accountants: FBR, ICAP and ICMAP Duties

Pakistan does not have one single supervisor for accountants on anti-money laundering (AML). Which body supervises you depends on whether you belong to a professional institute. This guide sets out who that is, what the Financial Monitoring Unit (FMU) expects once you are in scope, and where the published sources disagree. It is written from the regulators' own documents, and we say clearly where we could only rely on a secondary summary.

The legal frame in brief

The core law is the Anti-Money Laundering Act, 2010. A KPMG Pakistan summary published on 2 October 2020 describes the Anti-Money Laundering (Second Amendment) Act 2020, which added provisions on regulatory authorities for designated non-financial businesses and professions (DNFBPs). Accountants are one of the professions treated as DNFBPs. We have not read the amended Act itself, so section numbers below are attributed to the document we took them from.

Who supervises which accountants

According to the KPMG summary and to the Federal Board of Revenue (FBR), the split works like this:

• Members of the Institute of Chartered Accountants of Pakistan (ICAP) and the Institute of Cost and Management Accountants of Pakistan (ICMAP): the institute acts as a self-regulatory body for its own members.
• Accountants who are not members of either institute: FBR is the AML regulatory authority. FBR said in a 2021 press release that it is the authority for "accountants other than those registered with ICAP and ICMAP".

FBR describes its DNFBP directorate as keeping a register of the DNFBPs under its jurisdiction and using a risk-based approach, with onsite inspections and offsite monitoring. It also says it has carried out inspections since June 2021 and imposed penalties, but it does not give amounts in the pages we read.

How ICAP supervises its members

ICAP published an AML/CFT framework that states ICAP was designated under section 5(7)(a) of the AML Act by a Finance Division notification dated 23 December 2019. The ICAP Council approved the framework on 29 February 2020 and it took effect on 5 March 2020. The framework says the Securities and Exchange Commission of Pakistan (SECP) is designated as the AML/CFT supervisor of ICAP, and that an ICAP AML Supervisory Board of five members, including one nominated by SECP and one by the FMU, acts on its behalf.

Under the framework, a "Reporting Firm" is a practising firm that provides "Accountant" or "Trust and Company Service Provider" services. Practising firms file annual returns: Form A by 31 July for all firms and Form B by 15 August for Reporting Firms. ICAP says non-compliance can lead to a requirement to file, training, referral to its Investigation Committee, and sanctions under the Chartered Accountants Ordinance, 1961. ICMAP publishes its own framework, which we have not read, so this guide does not summarise it.

When the rules apply to your work

The FMU's guidelines for DNFBP supervisors, issued by letter dated 27 January 2020, cover lawyers, notaries, independent legal professionals and accountants when they prepare for or carry out certain client transactions. The guidelines list activity such as buying and selling real estate, managing client money, managing accounts, creating or operating companies, and buying and selling businesses. They exclude professionals who are employed in-house by other businesses and those working for government agencies. In practice, a firm that only prepares statutory accounts may be in a different position from one that forms companies or holds client funds. That is a scoping question for your supervisor, not for this guide.

Customer due diligence

The FMU guidelines expect, among other things:

• no anonymous or fictitious accounts;
• identification and verification of the customer before the relationship starts;
• identifying the natural persons who ultimately own or control a legal person;
• checking the authority of anyone acting for the client;
• ongoing scrutiny of transactions and up-to-date records, with enhanced due diligence for higher-risk clients, high-risk jurisdictions and politically exposed persons;
• declining the work, and considering a suspicious transaction report, if due diligence cannot be completed.

The ICAP framework adds that Reporting Firms must screen clients against United Nations and proscribed lists and must not establish relationships with designated or proscribed persons. For background on the global approach, see our guide to politically exposed persons.

Reporting to the FMU

Both the FMU guidelines and the ICAP framework say suspicions are reported to the FMU promptly, including attempted transactions, regardless of the amount. The FMU red flag indicators for accountants, which carry no date in the copy we read, name the AML Act section 7(1) as the basis for suspicious transaction reports (STRs) and stress that one red flag alone is not conclusive. Filing is through goAML, according to FBR's DNFBP pages.

For cash, the FMU guidelines refer to a currency transaction report (CTR) for every cash transaction of two million rupees and above, or any other notified threshold. Business Recorder reported in July 2021 that the FMU directed reporting entities, including DNFBPs, to file CTRs for cash transactions of Rs2 million or more, and that account-to-account transfers should not be reported as CTRs. The ICAP framework itself gives no figure and says the amount is set by the National Executive Committee through a Gazette notification, so check the current notification before relying on any number.

Staff must not tell the client about an STR or CTR except where the law requires it, and the FMU guidelines allow a firm to skip due diligence and file an STR instead where completing it would tip the client off.

Record keeping: the sources do not agree

The FMU guidelines say transaction records should be kept for not less than ten years from completion and identification records for at least ten years after the relationship ends. The ICAP framework says five years after the relationship or transaction ends, and ten years for STR and CTR records. KPMG's summary of the 2020 amendment refers to five years in section 7(C). We cannot tell from these documents which rule prevails for your firm.

What we have not covered

• The text of the AML Act as amended, including penalty provisions. We have therefore left out fine amounts.
• FBR's own AML/CFT regulations for DNFBPs and its registration process.
• ICMAP's framework.
• Any developments after 2021 in how the sector is inspected.

Practical steps: our suggestions

These are our suggestions, not regulatory requirements.

1. Confirm in writing which body supervises you: FBR, ICAP or ICMAP.
2. Decide whether any of your services fall in the listed activities, and record the reasoning.
3. Where sources differ, such as record retention, apply the longer period until your supervisor confirms.
4. Check the current CTR threshold notification each time you update your policy.
5. Train staff, since ICAP's framework sets refresher training at least every two years.

If you are comparing professional routes, our guide to the ICAP chartered accountancy route explains the qualification itself. For how other countries handle the same obligations, read our guides to Kenya and the FATF recommendations behind them.

Frequently asked questions

Is every Pakistani accountant covered by the same regulator?

No. According to FBR and KPMG's summary, FBR covers accountants who are not members of ICAP or ICMAP, and the institutes cover their own members.

Do I report suspicions below Rs2 million?

The FMU guidelines say suspicious transactions are reported regardless of the amount. The Rs2 million figure relates to cash transaction reports.

Where do I file reports?

FBR's DNFBP pages link to the FMU's goAML system for STRs and CTRs.

This guide is general information, not legal advice. Confirm current requirements with your supervisor.