Country regulation guides

Supervision is split between BaFin for financial institutions and regional authorities for designated non-financial businesses. Enforcement has concentrated on transaction monitoring quality rather than screening coverage.

1. Risk analysis documented and updated annually, with the methodology written down
2. Beneficial ownership verified against the Transparenzregister, and discrepancies reported
3. Enhanced diligence for all foreign PEPs including source of wealth
4. Group-wide policies applied to branches and majority holdings abroad

ACPR supervises credit and payment institutions; the AMF covers markets. Tracfin publishes typologies that supervisors expect to see reflected in monitoring rules.

1. Classification des risques maintained per business line and reviewed on change
2. Declaration to Tracfin without delay, with tipping-off prohibited
3. Freezing measures applied within the day of publication
4. Annual internal control report submitted to ACPR

SEPBLAC acts as both supervisor and financial intelligence unit, which shortens the distance between a filing and a follow-up question. Retention runs longer than the EU minimum.

1. External expert review of the AML programme, filed annually
2. Monthly reporting including nil returns
3. Beneficial ownership checked against the Registro de Titularidades Reales
4. Ten-year retention of documentation supporting a decision

The Dutch regime reports unusual transactions rather than suspicious ones, which sets a lower and more mechanical threshold than most of the EU. Volume expectations follow from that.

1. Report unusual transactions against objective and subjective indicators
2. Systematic Integrity Risk Analysis maintained and defensible
3. Continuous transaction monitoring with documented scenario tuning
4. Client files reviewed on a risk-based cycle, evidenced per file

A hub jurisdiction for funds and payments, so supervision leans heavily on outsourcing and group reliance arrangements. Reports go to both the FIU and Revenue.

1. Dual filing to FIU Ireland and the Revenue Commissioners
2. Outsourced functions remain the firm’s responsibility, with evidence of oversight
3. Board-approved risk assessment reviewed at least annually
4. Designated person appointed with documented authority

Removed from the FATF grey list in 2024, with supervision that has stayed intensive since. The reporting clock starts at detection rather than at internal escalation, which changes what a monthly review implies.

1. Suspicious transaction reports within ten days of detection
2. Compliance officer appointed with MASAK notification and personal accountability
3. Eight-year retention of records and supporting documentation
4. Crypto asset service providers in scope with licensing under CMB

A QA test jurisdiction row. Portugal transposes the EU AML directives through Law 83/2017.

Sanctions sit with OFSI and are separate from the FCA’s money-laundering supervision. Domestic PEPs are explicitly treated as lower risk unless other factors apply — a rare divergence.

1. Defence Against Money Laundering consent sought before proceeding with a suspicious transaction
2. OFSI reporting on frozen assets, including nil returns
3. Domestic PEPs start at lower risk; the rationale must still be recorded
4. Annual financial crime return (REP-CRIM) for in-scope firms

A trust and company services centre, so ownership structures rather than transaction volume drive the workload. The JFSC codes of practice carry the operative detail.

1. Enhanced diligence applied to all PEP categories without domestic carve-out
2. Trust and company structures verified to ultimate natural persons
3. Registered office providers subject to the same obligations as the client entity

Off the grey list since 2024, with supervision now split across the mainland regulator and the two financial free zones. A firm in DIFC or ADGM answers to a different rulebook than one on the mainland.

1. Filing through the goAML platform, with registration required before onboarding customers
2. Separate regimes for DIFC (DFSA) and ADGM (FSRA)
3. Enhanced diligence on all PEP tiers and on high-risk-jurisdiction exposure
4. Targeted financial sanctions checked against the local terrorist list in addition to UN

SAMA supervises banks, insurers and payment firms; the CMA covers capital markets. Rules are prescriptive, and implementation deadlines are enforced rather than negotiated.

1. Ten-year retention of customer and transaction records
2. Board-level AML committee with documented minutes
3. Local data residency for customer records
4. Immediate freezing on UNSC and domestic list designations

Under increased FATF monitoring, which raises the diligence expected of counterparties abroad as much as of firms inside the country. Reporting timelines are among the shortest anywhere.

1. Suspicious transaction reports within 24 hours
2. Currency transaction reports above the statutory threshold
3. Enhanced diligence on all PEPs, with no domestic carve-out
4. Special control unit against money laundering registration for DNFBPs

Sanctions reach further than the domestic perimeter: a USD-clearing transaction can bring a non-US firm into scope. There is no statutory PEP definition, but supervisors expect one in your policy anyway.

1. SAR filed within 30 days of initial detection, 60 with no identified subject
2. Currency transaction reports above USD 10,000
3. OFAC blocking and rejection reports within 10 business days
4. Beneficial ownership reporting under the Corporate Transparency Act

Reporting is highly structured and penalties attach to form errors as readily as to missed suspicions. PEP determination has statutory timelines rather than a general expectation.

1. PEP determination within 30 days of an account opening for prescribed cases
2. Large cash and virtual currency transaction reports at CAD 10,000
3. Two-year compliance effectiveness review, independently conducted
4. Ministerial directives applied to specified jurisdictions

Pix has moved most retail volume to instant settlement, which compresses the window for any pre-transaction control. Supervisors expect monitoring designed for that, not adapted to it.

1. Communication to COAF by the next business day after detection
2. Instant payment controls proportionate to settlement speed
3. Politically exposed person lists maintained for five years after leaving office
4. Annual internal AML effectiveness assessment

Obligations arrive as MAS Notices per licence type rather than one statute, so the applicable set depends on what you are licensed to do. Enforcement is public and specific.

1. Notice obligations differ by licence: banks, payment services, capital markets
2. Screening against UN and domestic designations before establishing a relationship
3. Wire transfer originator and beneficiary information at all values
4. Independent audit of the AML programme, scaled to size and risk

Tranche-two reforms bring lawyers, accountants and real estate agents into scope from 2026, roughly tripling the reporting population. Existing reporting entities face tightened programme obligations at the same time.

1. Suspicious matter reports within 3 business days, 24 hours for terrorism financing
2. AML/CTF programme in two parts, with Part A independently reviewed
3. International funds transfer instructions reported per transaction
4. Seven-year retention across customer and transaction records

The statutory PEP obligation covers foreign PEPs only, a narrower scope than most regimes. FSA guidelines carry expectations well beyond the statute, and supervision follows the guidelines.

1. Verification at transaction thresholds, with re-verification on change of circumstances
2. Foreign PEP enhanced diligence; domestic exposure handled under general risk assessment
3. Correspondent banking due diligence with documented shell-bank prohibition
4. Seven-year retention of verification records

A correspondent banking centre, so nested relationships and trade finance carry most of the supervisory attention. Virtual asset licensing has moved quickly since 2023.

1. Trade finance documentation checks against dual-use and sanctioned goods
2. Nested correspondent relationships identified and separately assessed
3. Virtual asset service providers licensed by the SFC with travel rule obligations
4. Foreign PEPs enhanced; domestic PEPs assessed on risk