Comores KYC, KYB & AML compliance checklist
Une checklist pratique et sourcée pour mettre en œuvre les exigences KYC, KYB et AML en Comores.
- Dernière revue
- Dernière revue:
- Version
- Version 1.0
Réponse directe
Que couvre la checklist de conformité pour Comores ?
La checklist pour Comores traduit les principales règles KYC, KYB et AML en 11 domaines de contrôle et 32 contrôles d’implémentation, avec les autorités, obligations de déclaration et preuves à conserver.
Faits réglementaires clés
- FIU
- Service de Renseignements Financiers (SRF)
- Primary AML rule
- Law No. 12-008/AU of 28 June 2012
- Suspicion reporting
- Immediately to the SRF, including attempted suspicious transactions
- Occasional CDD
- Above KMF 5,000,000; also below the threshold where suspicion or linked activity applies
- Core retention
- At least 5 years under Law No. 12-008/AU
- FATF status
- Not named on FATF public lists as at 19 June 2026
Détail d’implémentation
Exigences et actions de conformité pour Comores
Ouvrez chaque domaine pour consulter l’exigence, l’action recommandée, les preuves à conserver et la source primaire utilisée.
01Scope, authorities, and licensingResolve the entity, activity and competent authority before launch.3 éléments+
Determine whether each activity is subject to the AML/CFT law.
- Action d’implémentation
- Map every entity, product and channel to the financial-institution or designated non-financial categories and document the SRF and sector supervisor.
- Preuves à conserver
- Applicability memo, product map and accountable-owner register.
- Source primaire
- Law No. 12-008/AU, Article 3
Treat the SRF as the financial intelligence unit.
- Action d’implémentation
- Appoint the required correspondent and obtain the current reporting format and secure filing instructions directly from the SRF before operations begin.
- Preuves à conserver
- Appointment, authority guidance, tested procedure and access approvals.
- Source primaire
- Law No. 12-008/AU, Articles 18-23 and 25
Obtain authorisation before regulated financial or payment activity.
- Action d’implémentation
- Classify banking, microfinance, payment, remittance, foreign-exchange, insurance and other regulated services and obtain every required approval before launch.
- Preuves à conserver
- Perimeter analysis, BCC or sector correspondence and licence register.
- Source primaire
- Law No. 13-003/AU; Law No. 20-005/AU; applicable sector rules
02Governance and risk assessmentThe programme must be documented, risk-based and independently tested.3 éléments+
Maintain a documented ML/TF risk assessment.
- Action d’implémentation
- Assess customers, products, channels, geography, cash, agents and technology and update the assessment on material change.
- Preuves à conserver
- Approved methodology, risk map, controls and version history.
- Source primaire
- Decision No. 12-2023/BCC/DSBR, Articles 1-5
Maintain written controls, training and independent audit.
- Action d’implémentation
- Assign senior accountability and an SRF correspondent, screen staff, train relevant personnel and independently test the programme.
- Preuves à conserver
- Appointments, policies, training, audit and remediation log.
- Source primaire
- Law No. 12-008/AU, Article 14
Assess new products and technology before launch.
- Action d’implémentation
- Document ML/TF risks and mitigating controls and, where Article 6 applies, send the assessment to the BCC before effective launch.
- Preuves à conserver
- Pre-launch assessment, governing-body approval and BCC transmission.
- Source primaire
- Decision No. 12-2023/BCC/DSBR, Article 6
03Natural-person identificationCDD uses reliable, independent evidence and continues throughout the relationship.3 éléments+
Identify and verify customers and representatives.
- Action d’implémentation
- Verify identity and address using current official evidence and verify every representative's authority and identity.
- Preuves à conserver
- Identity file, address evidence, mandate and verification result.
- Source primaire
- Law No. 12-008/AU, Article 8
Apply occasional-transaction CDD at the statutory trigger.
- Action d’implémentation
- Identify occasional customers above KMF 5,000,000 and also where linked transactions reach the threshold, lawful provenance is uncertain or suspicion exists.
- Preuves à conserver
- Aggregation test, identity record and escalation decision.
- Source primaire
- Law No. 12-008/AU, Article 9
Do not proceed where mandatory CDD fails.
- Action d’implémentation
- Do not open, transact or continue the relationship when required CDD cannot be completed and file an STR in the circumstances required by the law.
- Preuves à conserver
- Decline or exit decision, investigation and restricted STR record.
- Source primaire
- Law No. 12-008/AU, Article 8
04KYB, registries, and beneficial ownershipCorporate evidence does not replace natural-person ownership and control analysis.3 éléments+
Verify legal existence, governance and authority.
- Action d’implémentation
- Obtain a current registration extract, constitutional documents, address, directors and signatory powers and reconcile inconsistencies.
- Preuves à conserver
- Registry extract, statutes, powers and reconciliation.
- Source primaire
- Law No. 12-008/AU, Article 8; OHADA Uniform Acts
Identify and verify natural-person beneficial owners.
- Action d’implémentation
- Understand the ownership and control structure, identify the natural persons who ultimately own or effectively control the customer, and verify them using reliable independent evidence.
- Preuves à conserver
- Ownership chart, source records, control analysis and verified identities.
- Source primaire
- Law No. 12-008/AU, Articles 1 and 8
Do not assume a complete central beneficial-owner register.
- Action d’implémentation
- Obtain current registry and authority evidence, reconcile it to customer-supplied ownership and control records, and document any information gap.
- Preuves à conserver
- Registry search, customer declaration and discrepancy log.
- Source primaire
- GIABA 2024 Mutual Evaluation, Immediate Outcome 5 and Recommendation 24 analysis
05PEPs, EDD, and remote onboardingHigher-risk and remote relationships require enhanced controls.3 éléments+
Detect PEP exposure in customers and beneficial owners.
- Action d’implémentation
- Use risk-sensitive systems to identify domestic, foreign and international-organisation PEPs, family members and close associates.
- Preuves à conserver
- Screening, relationship map, match decision and refresh log.
- Source primaire
- Decision No. 12-2023/BCC/DSBR, Articles 7-12
Apply PEP approval, source and monitoring measures.
- Action d’implémentation
- Obtain senior approval, establish source of wealth and source of funds, and conduct enhanced ongoing monitoring.
- Preuves à conserver
- Approval, provenance analysis and monitoring plan.
- Source primaire
- Decision No. 12-2023/BCC/DSBR, Articles 7-8
Control remote-onboarding risk.
- Action d’implémentation
- Apply identity, fraud, device, liveness and exception controls proportionate to the channel and do not lower CDD where suspicion exists.
- Preuves à conserver
- Channel assessment, vendor review, tests and exceptions.
- Source primaire
- Law No. 12-008/AU, Article 8; Decision No. 12-2023/BCC/DSBR, Article 3
06Monitoring and suspicious reportingSRF reporting is immediate, traceable and confidential.3 éléments+
Monitor activity against the current customer profile.
- Action d’implémentation
- Examine unusual, complex or apparently unjustified activity and preserve a reasoned conclusion.
- Preuves à conserver
- Alerts, investigation, disposition and rule governance.
- Source primaire
- Law No. 12-008/AU, Articles 8 and 12
Report suspicious and attempted transactions immediately to the SRF.
- Action d’implémentation
- File when funds are suspected or reasonably suspected to be criminal proceeds or connected to terrorism or terrorist financing, including attempts regardless of amount.
- Preuves à conserver
- Decision chronology, report, receipt and supplemental-information log.
- Source primaire
- Law No. 12-008/AU, Article 25
Prevent tipping off.
- Action d’implémentation
- Restrict access and do not disclose an STR, its contents or a related inquiry to the customer or an unauthorised third party.
- Preuves à conserver
- Access logs, confidentiality procedure and training.
- Source primaire
- Law No. 12-008/AU, Article 28
07Payments, wires, thresholds, and agentsPayment controls preserve required data and separate CDD thresholds from reporting duties.3 éléments+
Do not treat the KMF 5,000,000 CDD trigger as a universal cash-report threshold.
- Action d’implémentation
- Apply Article 9 identification and aggregation while confirming any current objective-reporting rule or sector threshold directly with the SRF and supervisor.
- Preuves à conserver
- CDD trigger logic, authority confirmation and filing matrix.
- Source primaire
- Law No. 12-008/AU, Article 9
Preserve required wire-transfer information.
- Action d’implémentation
- Collect and retain accurate originator and beneficiary information; refuse a transfer lacking required information and inform the SRF.
- Preuves à conserver
- Message sample, exception workflow, refusal and SRF notice.
- Source primaire
- Law No. 12-008/AU, Article 11
Retain accountability for third parties and agents.
- Action d’implémentation
- Perform due diligence, obtain required CDD information immediately, secure supporting documents on request and monitor performance; ultimate responsibility remains with the institution.
- Preuves à conserver
- Due diligence, contract, retrieval test and monitoring.
- Source primaire
- Decision No. 12-2023/BCC/DSBR, Articles 13-15
08Targeted financial sanctionsUse current UN and national instruments and controlled escalation procedures.3 éléments+
Screen applicable designations.
- Action d’implémentation
- Screen customers, beneficial owners, controllers, representatives and transactions at onboarding, list updates and before relevant execution.
- Preuves à conserver
- List inventory, update logs, screening configuration and dispositions.
- Source primaire
- Law No. 12-008/AU, Article 11; Law No. 21-004/AU
Freeze prohibited property and prevent dealing.
- Action d’implémentation
- Immediately escalate a potential designation match, prevent prohibited movement or availability, and act under current competent-authority instructions.
- Preuves à conserver
- Freeze procedure, timestamps, legal basis and authority communication.
- Source primaire
- Law No. 21-004/AU; applicable UN Security Council resolutions
Control false positives and release.
- Action d’implémentation
- Document match analysis and obtain current authority instructions for reporting, false-positive resolution and lawful release; do not invent a national portal or deadline.
- Preuves à conserver
- Match rationale, authority instruction, report and reconciliation.
- Source primaire
- Law No. 21-004/AU; GIABA 2024 Mutual Evaluation, Recommendations 6-7
09Records and regulator accessRecords must reconstruct the customer, ownership, transaction and decision.3 éléments+
Retain transaction records for at least five years.
- Action d’implémentation
- Preserve sufficient domestic and international transaction records for at least five years from the transaction and longer where a legal hold applies.
- Preuves à conserver
- Schedule, transaction reconstruction and legal-hold log.
- Source primaire
- Law No. 12-008/AU, Article 12
Retain CDD and analysis records for at least five years.
- Action d’implémentation
- Preserve identity, account, correspondence and analysis records for at least five years after the relationship ends or the occasional transaction, as applicable.
- Preuves à conserver
- Archive sample, configuration and retrieval test.
- Source primaire
- Law No. 12-008/AU, Article 12
Respond securely to competent-authority requests.
- Action d’implémentation
- Authenticate requests, protect STR confidentiality, produce reproducibly and log scope, timing and receipt.
- Preuves à conserver
- Request, approval, production index and acknowledgement.
- Source primaire
- Law No. 12-008/AU, Articles 13 and 22
10Privacy, biometrics, and transfersIdentity data requires proportionate safeguards even where AML duties mandate collection.3 éléments+
Map the legal basis and necessity for identity processing.
- Action d’implémentation
- Document purpose, data, access, recipients, security and retention under current Comorian law and AML confidentiality duties.
- Preuves à conserver
- Data inventory, legal assessment, notices and access matrix.
- Source primaire
- Law No. 12-008/AU, Articles 13, 21 and 28; applicable Comorian law
Apply enhanced safeguards to biometric and sensitive data.
- Action d’implémentation
- Minimise collection, restrict access, test security and document necessity before biometric or sensitive-data use.
- Preuves à conserver
- Impact assessment, security tests, access controls and approval.
- Source primaire
- Risk-based control; confirm current Comorian data-protection requirements
Confirm transfer and incident requirements before production use.
- Action d’implémentation
- Obtain a dated local-law analysis and current authority guidance before configuring international transfers, breach notices or biometric processing.
- Preuves à conserver
- Legal update, authority guidance and implemented procedure.
- Source primaire
- Controlled legal uncertainty; no unsupported deadline asserted
11Practical evidence packsMaintain concise packs that reproduce decisions and support supervisory access.2 éléments+
Maintain a reconstructable onboarding pack.
- Action d’implémentation
- Bundle identity, KYB, beneficial ownership, screening, risk, approvals and exceptions under stable identifiers.
- Preuves à conserver
- Complete sampled onboarding pack.
- Source primaire
- Operational control supporting Law No. 12-008/AU, Articles 8 and 12
Maintain a reconstructable monitoring and reporting pack.
- Action d’implémentation
- Link transactions, alerts, analysis, approvals, reports and post-filing controls while protecting confidentiality.
- Preuves à conserver
- Complete sampled case pack and access log.
- Source primaire
- Operational control supporting Law No. 12-008/AU, Articles 25-29
Registre des sources primaires
11 sources utilisées pour cette checklist
Utilisez ces liens pour vérifier la législation, les lignes directrices, les procédures de déclaration et les statuts internationaux.
- Law No. 12-008/AU - AML/CFTMinistry of Justice, Comoros · Primary legislation
- Law No. 21-004/AU - terrorism, financing and money launderingBanque Centrale des Comores · Primary legislation
- Decision No. 12-2023/BCC/DSBR - AML/CFT measuresBanque Centrale des Comores · Primary regulation
- Law No. 13-003/AU - banking lawBanque Centrale des Comores · Primary legislation
- Law No. 20-005/AU - payment services and providersBanque Centrale des Comores · Primary legislation
- Comoros Mutual Evaluation Report 2024FATF / GIABA · Authoritative country assessment
- Comoros Follow-up Report 2026FATF / GIABA · Authoritative follow-up assessment
- Comoros country pageFATF · Authoritative country status
- FATF black and grey listsFATF · Authoritative current status
- OHADA legal frameworkOHADA · Official company-law materials
- United Nations Security Council consolidated sanctions listUnited Nations · Authoritative sanctions list
Réponses directes
Questions KYC, KYB et AML pour Comores
Who receives suspicious transaction reports?+
The Service de Renseignements Financiers (SRF) of Comoros.
When is an STR filed?+
Immediately when an obliged person suspects or has reasonable grounds to suspect covered criminal proceeds or a terrorism-financing connection. Attempted suspicious transactions are covered regardless of amount.
Is KMF 5,000,000 a universal cash-report threshold?+
No. Article 9 states an occasional-customer identification trigger. Confirm any current objective-reporting duty or sector threshold directly with the SRF and supervisor.
How is beneficial ownership determined?+
Identify and verify the natural persons who ultimately own or effectively control the customer and understand the legal person's ownership and control structure.
How long are AML records retained?+
The core rule is at least five years, with the trigger depending on whether the record concerns a transaction, an occasional transaction or the end of a business relationship.
Is Comoros on a FATF public list?+
It was not named on the FATF high-risk or increased-monitoring lists current at 19 June 2026. The 2024 mutual evaluation and 2026 follow-up still identify material gaps.
Does privacy law affect KYC data?+
Yes, confidentiality, necessity, security and access controls remain relevant. Obtain current local advice before configuring biometrics, international transfers or incident deadlines.
Can a payment product launch without approval?+
No. Classify the product under current banking, payment and sector rules and obtain every required approval before launch.
Méthode de recherche et de revue
VOVE ID Compliance Research cartographie le périmètre réglementaire, traduit les obligations en contrôles opérationnels, relie les affirmations importantes aux sources et date chaque revue.
General regulatory information, not legal advice or a licence determination. Reviewed as applicable on 20 August 2026. Confirm reporting-entity status, current SRF filing specifications, sector thresholds, sanctions procedures, company and beneficial-owner information, privacy requirements and product licensing with the competent authority and qualified Comorian counsel before launch.