Pakistan

Section 10 of the Public Interest Disclosures Act, 2017 bars dismissal, demotion, harassment and other adverse action against a person who makes a disclosure, and places the burden on the organisation to show its action was not victimisation. Section 12 requires concealment of the complainant's identity. Covers federal public bodies and private bodies the Government notifies.

Regulation 13 (Internal Controls) gives compliance officers timely access to customer records, requires an annual training programme built on a needs assessment and an independent audit function to test AML/CFT/CPF controls. AML Act section 7G requires reporting entities to appoint a compliance officer at management level and run training programmes scaled to their risk and size.

Regulation 2 requires identity to be verified before a business relationship is established or an occasional transaction is conducted, and CDD information to be kept current, with the updating frequency set by a policy tied to customer risk profiling. The legal basis is AML Act section 7A; section 7D bars opening the account where CDD cannot be completed and requires the entity to consider filing an STR.

Section 7(1) of the AML Act requires STRs to be filed with the FMU 'promptly'; a footnote to the text shows the earlier wording was 'immediately, but not later than seven working days after forming that suspicion'. Section 7(3) requires currency transaction reports 'immediately, but not later than seven working days' after the transaction. SBP Regulation 7 repeats the duty to file STRs and CTRs under section 7.

Regulation 15 of the SECP AML/CFT Regulations 2018 requires transaction records to be kept for at least five years from completion of the transaction (15(1)) and CDD and identification records for at least five years after the business relationship ends (15(3)). The regulations also cover insurers, takaful operators, NBFCs and modarabas.

Paragraph 8 requires an SBP licence, granted under section 24 of the 2007 Act in four stages. Paragraph 16 requires funds received for e-money to be held in a trust account with a licensed bank rated at least A, without commingling with the institution's own funds.

Regulation 10(4)(xv) of the Listed Companies (Code of Corporate Governance) Regulations, 2019 has the board establish a whistle blowing policy with a mechanism to receive and handle complaints fairly and transparently and to protect the complainant against victimisation. Regulation 14(xvi) has the chief executive report to the board on issues pursued under that policy and how they were resolved. Regulations 10 and 14 are not marked mandatory, so they apply on a comply-or-explain basis (regulation 1(2)); regulation 27(4)(xiv), which has the audit committee review how staff and management report concerns to it in confidence, sits in a mandatory regulation.