(Bloomberg) — A Middle East operation of Pakistan’s largest bank displayed “significant irregularities” in dealings with politically exposed clients and screening some transactions, according to an inspection by the South Asian nation’s central bank that took place more than a year after the lender was shut out of the U.S. financial system.

The findings are contained in a State Bank of Pakistan report, finalized in the first half of 2019, on Habib Bank Ltd.’s operations in the United Arab Emirates. The inspection was conducted after the Financial Action Task Force, a global watchdog for illicit financial activities, put Pakistan on its monitoring list.

FATF is due to review whether to downgrade Pakistan a step further, to its blacklist, at a meeting in Paris that starts on Sunday. That would have serious consequences for the nation’s economy and its bailout program with the International Monetary Fund.

Employees in some of Habib Bank’s U.A.E. branches helped certain customers disguise transactions by issuing pay orders in their own names, while gaps in risk profiling and monitoring reflected an “ineffective compliance function and compliance culture,” the central bank said. In an earlier draft version of its inspection report, also seen by Bloomberg News, the central bank said U.A.E. staff skirted rules when opening an account for Duduzane Zuma, the son of former South African President Jacob Zuma.

The critical nature of the findings, which haven’t previously been reported, offers further evidence of the sorts of weak controls FATF has been looking at more broadly in its assessment of Pakistan, though the central bank’s final inspection report also notes some remedial measures taken by the bank. After Pakistan was put on the FATF monitoring list in June 2018, it pledged to improve observance of global anti-money laundering and counter-terrorism financing controls.

License Surrendered

The previous September, New York’s banking regulator fined the Karachi-based bank for weak anti-money-laundering controls and sanctions compliance and ordered it to surrender its license, effectively removing the lender from the U.S. financial system.

In response to questions from Bloomberg, State Bank of Pakistan said its draft and final inspection reports are confidential and as a result it’s unable to comment “on the veracity of observations purportedly related to inspection reports or inspection process.”

The draft report on the U.A.E. operations of Habib Bank was prepared soon after an on-site inspection by the central bank. It includes lists of customer accounts that were flagged for allegedly involving various violations by Habib Bank staff. The final report has the same broad conclusions but incorporates input from the bank, and omits the lists of specific accounts.

The problems in the U.A.E. have since been addressed by a sweeping overhaul that the bank started to roll out in the Middle East and other international operations in early 2019, according to Sagheer Mufti, Habib Bank’s chief operating officer. “There were process issues and those process issues pertain to legacy clients and legacy transactions and legacy processes,” Mufti said in an interview, responding to questions about the inspection report.

Habib Bank has “put in place a set of processes, controls to ensure the organization does not see a repeat of these issues,” Mufti said, adding that the program had been designed in cooperation with PricewaterhouseCoopers International Ltd. and cost roughly $100 million.

According to the State Bank inspection report, which is based on the U.A.E. operation’s results for the period ended Sept. 30, 2018, the local business failed to comply with instructions from the head office in Karachi to close the accounts of all Iranian nationals. Some accounts were still active despite the lapse of a “significant time period,” the report said. The bank was in the process of closing the remaining accounts “where possible,” it added.

In another example, a Habib Bank customer was found to have been importing goods via or from Iran. Instead of carrying out a thorough investigation, the bank only conducted a limited review of transactions during the previous six months “in which another instance of a similar nature was identified,” the central bank said.

In a statement, the central bank said it does not prohibit dealings with foreign nationals or companies, including from Iran, “as long as they are not designated or prohibited.” Mufti said Habib Bank does not deal with Iran.

The inspection report also said the U.A.E. operation provided banking services to “politically exposed persons” without marking them as PEPs, a category used by banks to highlight the risk of accepting money that results from bribery or corruption. In other cases, priority banking accounts were opened “by granting regulatory exceptions.”

Banks around the world have been tightening up on their dealings with PEPs and other wealthy people after a series of scandals following the 2008 global financial crisis. Regulators have stepped up scrutiny over the past decade and many banks have stopped doing business with clients perceived to be risky.

Zuma’s Account

In a list of PEPs given the exceptions, the preliminary report said Duduzane Zuma’s account at Habib Bank was opened in June 2016 and involved a “waiver of proof of income document.” That was around the time South Africa’s banks were closing accounts of companies owned by the Gupta brothers, who have been linked to numerous corruption cases in South Africa, citing reputational risk and regulatory concerns. The Guptas, who have moved to Dubai from Johannesburg, have denied all wrongdoing and said that the account closures were politically motivated.

Duduzane Zuma was closely associated with the Guptas, and was a director of at least 11 companies that had members of the family on the board. In 2017, he complained in an open letter to South Africa’s then finance minister Pravin Gordhan that all his local accounts had been closed because of political pressure.

Rudi Krause, a lawyer at BDK Attorneys which act for Duduzane Zuma, said he had passed questions about the Habib Bank account from Bloomberg to his client, but hadn’t heard back.

The finalized version of the inspection report didn’t mention the Duduzane Zuma account. It also said that Habib Bank identified the previously unmarked PEP accounts during the last quarter of 2017, and that they were subsequently closed. It improved its procedures for identifying PEPs in the first quarter of 2018, the report added.

In a statement, Habib Bank said it has had policies in place for sanctioned countries and for handling PEP accounts for a number of years. “In 2017 a handful of transactions were identified at HBL UAE which contravened our processes and standards. This should never have happened,” the statement said. “Following disciplinary proceedings, the staff members involved are no longer employed by” the bank, it added.

Mufti said banks are allowed to deal with PEPs provided the right processes are followed. Habib Bank “deals with PEPs and so do all other banks,” he said.

Habib Bank, majority owned by the Aga Khan Fund for Economic Development, had total assets of 3.1 trillion Pakistan rupees ($20.1 billion) at the end of September. It is currently focused on building up its operations in China to tap more business under President Xi Jinping’s Belt and Road initiative.